{"action":"created","issue":{"url":"https://api.github.com/repos/servicemesher/istio-official-translation/issues/980","repository_url":"https://api.github.com/repos/servicemesher/istio-official-translation","labels_url":"https://api.github.com/repos/servicemesher/istio-official-translation/issues/980/labels{/name}","comments_url":"https://api.github.com/repos/servicemesher/istio-official-translation/issues/980/comments","events_url":"https://api.github.com/repos/servicemesher/istio-official-translation/issues/980/events","html_url":"https://github.com/servicemesher/istio-official-translation/issues/980","id":435773563,"node_id":"MDU6SXNzdWU0MzU3NzM1NjM=","number":980,"title":"/blog/2018/egress-mongo/index.md","user":{"login":"fleeto","id":6958477,"node_id":"MDQ6VXNlcjY5NTg0Nzc=","avatar_url":"https://avatars3.githubusercontent.com/u/6958477?v=4","gravatar_id":"","url":"https://api.github.com/users/fleeto","html_url":"https://github.com/fleeto","followers_url":"https://api.github.com/users/fleeto/followers","following_url":"https://api.github.com/users/fleeto/following{/other_user}","gists_url":"https://api.github.com/users/fleeto/gists{/gist_id}","starred_url":"https://api.github.com/users/fleeto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fleeto/subscriptions","organizations_url":"https://api.github.com/users/fleeto/orgs","repos_url":"https://api.github.com/users/fleeto/repos","events_url":"https://api.github.com/users/fleeto/events{/privacy}","received_events_url":"https://api.github.com/users/fleeto/received_events","type":"User","site_admin":false},"labels":[{"id":1231737768,"node_id":"MDU6TGFiZWwxMjMxNzM3NzY4","url":"https://api.github.com/repos/servicemesher/istio-official-translation/labels/lang/zh","name":"lang/zh","color":"0a737f","default":false},{"id":1231736334,"node_id":"MDU6TGFiZWwxMjMxNzM2MzM0","url":"https://api.github.com/repos/servicemesher/istio-official-translation/labels/priority/P0","name":"priority/P0","color":"4c97c9","default":false},{"id":1011676806,"node_id":"MDU6TGFiZWwxMDExNjc2ODA2","url":"https://api.github.com/repos/servicemesher/istio-official-translation/labels/sync/update","name":"sync/update","color":"d4c5f9","default":false},{"id":1231736049,"node_id":"MDU6TGFiZWwxMjMxNzM2MDQ5","url":"https://api.github.com/repos/servicemesher/istio-official-translation/labels/version/1.1","name":"version/1.1","color":"1d76db","default":false},{"id":1011331131,"node_id":"MDU6TGFiZWwxMDExMzMxMTMx","url":"https://api.github.com/repos/servicemesher/istio-official-translation/labels/welcome","name":"welcome","color":"a8ef1a","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-04-22T15:41:28Z","updated_at":"2019-04-22T15:53:33Z","closed_at":null,"author_association":"MEMBER","body":"Source File: [/blog/2018/egress-mongo/index.md](https://github.com/istio/istio.io/tree/release-1.1/content/blog/2018/egress-mongo/index.md)\nDiff:\n~~~diff\n diff --git a/content/blog/2018/egress-mongo/index.md b/content/blog/2018/egress-mongo/index.md\nindex c3987083..3159a90a 100644\n--- a/content/blog/2018/egress-mongo/index.md\n+++ b/content/blog/2018/egress-mongo/index.md\n@@ -93,8 +93,7 @@ For this task you set up an instance of [MongoDB](https://www.mongodb.com). You\n ### Initial setting of Bookinfo application\n \n To demonstrate the scenario of using an external database, you start with a Kubernetes cluster with [Istio installed](/docs/setup/kubernetes/install/kubernetes/#installation-steps). Then you deploy the\n-[Istio Bookinfo sample application](/docs/examples/bookinfo/), [apply the default destination rules](/docs/examples/bookinfo/#apply-default-destination-rules), and\n-[change Istio to the blocking-egress-by-default policy](/docs/tasks/traffic-management/egress/#change-to-the-blocking-by-default-policy).\n+[Istio Bookinfo sample application](/docs/examples/bookinfo/) and [apply the default destination rules](/docs/examples/bookinfo/#apply-default-destination-rules).\n \n This application uses the `ratings` microservice to fetch book ratings, a number between 1 and 5. The ratings are\n displayed as stars for each review. There are several versions of the `ratings` microservice. You will deploy the\n@@ -193,7 +192,7 @@ instructions in this section. Alternatively, if you do want to direct your traff\n       name: mongo\n     spec:\n       hosts:\n-      - my-mongo.tcp.svc\n+      - $MONGODB_HOST\n       addresses:\n       - $MONGODB_IP/32\n       ports:\n@@ -201,9 +200,6 @@ instructions in this section. Alternatively, if you do want to direct your traff\n         name: tcp\n         protocol: TCP\n       location: MESH_EXTERNAL\n-      resolution: STATIC\n-      endpoints:\n-      - address: $MONGODB_IP\n     EOF\n     {{< /text >}}\n \n@@ -217,17 +213,18 @@ instructions in this section. Alternatively, if you do want to direct your traff\n     Also note that when the protocol `TCP` is specified, the configuration is not specific for MongoDB, but is the same\n     for any other database with the protocol on top of TCP.\n \n-    Note that the host of your MongoDB is not used in TCP routing, so you can use any host, for example `my-mongo.tcp.svc`. Notice the `STATIC` resolution and the endpoint with the IP of your MongoDB service. Once you define such an endpoint, you can access MongoDB services that do not have a domain name.\n-\n 1.  Refresh the web page of the application. Now the application should display the ratings without error:\n \n-    {{< image width=\"80%\" link=\"./externalDBRatings.png\" caption=\"Book Ratings Displayed Correctly\" >}}\n+{{< image width=\"80%\" link=\"./externalDBRatings.png\" caption=\"Book Ratings Displayed Correctly\" >}}\n \n-    Note that you see a one-star rating for both displayed reviews, as expected. You set the ratings to be one star to\n-    provide yourself with a visual clue that your external database is indeed being used.\n+Note that you see a one-star rating for both displayed reviews, as expected. You set the ratings to be one star to\n+provide yourself with a visual clue that your external database is indeed being used.\n \n-1.  If you want to direct the traffic through an egress gateway, proceed to the next section. Otherwise, perform\n-    [cleanup](#cleanup-of-tcp-egress-traffic-control).\n+#### Cleanup of the egress configuration for TCP without a gateway\n+\n+{{< text bash >}}\n+$ kubectl delete serviceentry mongo\n+{{< /text >}}\n \n ### Direct TCP Egress traffic through an egress gateway\n \n@@ -236,9 +233,33 @@ In this section you handle the case when you need to direct the traffic through\n connections from the MongoDB client to the egress gateway, by matching the IP of the MongoDB host (a CIDR block of\n   length 32). The egress gateway forwards the traffic to the MongoDB host, by its hostname.\n \n-1.  [Deploy Istio egress gateway](/docs/examples/advanced-gateways/egress-gateway/#deploy-istio-egress-gateway).\n+1.  Create a `ServiceEntry` for the MongoDB service, this time with `resolution` `DNS`. Specifying the resolution as\n+    `DNS` instructs the egress gateway to perform a DNS query to get the IP address of the MongoDB host. Note that the\n+    IP of the MongoDB host used by the MongoDB client (the `ratings` service) is not known to the egress gateway.\n+    The sidecar proxy of the `ratings` service forwards the connection from the `ratings` service to the egress gateway,\n+    so the IP of the egress gateway is used as the destination IP.\n+\n+    {{< text bash >}}\n+    $ kubectl apply -f - <<EOF\n+    apiVersion: networking.istio.io/v1alpha3\n+    kind: ServiceEntry\n+    metadata:\n+      name: mongo\n+    spec:\n+      hosts:\n+      - $MONGODB_HOST\n+      addresses:\n+      - $MONGODB_IP/32\n+      ports:\n+      - number: $MONGODB_PORT\n+        name: tcp\n+        protocol: TCP\n+      resolution: DNS\n+      location: MESH_EXTERNAL\n+    EOF\n+    {{< /text >}}\n \n-1.  If you did not perform the steps in [the previous section](#control-tcp-egress-traffic-without-a-gateway), perform them now.\n+1.  Refresh the web page of the application and verify that the ratings are displayed correctly.\n \n 1.  Proceed to the following section.\n \n@@ -256,7 +277,7 @@ connections from the MongoDB client to the egress gateway, by matching the IP of\n     configured.\n \n     {{< text bash >}}\n-    $ helm template install/kubernetes/helm/istio/ --name istio-egressgateway --namespace istio-system -x charts/gateways/templates/service.yaml --set gateways.istio-ingressgateway.enabled=false --set gateways.istio-egressgateway.enabled=true --set gateways.istio-egressgateway.ports[0].port=80 --set gateways.istio-egressgateway.ports[0].name=http --set gateways.istio-egressgateway.ports[1].port=443 --set gateways.istio-egressgateway.ports[1].name=https --set gateways.istio-egressgateway.ports[2].port=$EGRESS_GATEWAY_MONGODB_PORT --set gateways.istio-egressgateway.ports[2].name=mongo | kubectl apply -f -\n+    $ helm template install/kubernetes/helm/istio/ --name istio-egressgateway --namespace istio-system -x charts/gateways/templates/service.yaml --set gateways.istio-ingressgateway.enabled=false --set gateways.istio-egressgateway.ports[0].port=80 --set gateways.istio-egressgateway.ports[0].name=http --set gateways.istio-egressgateway.ports[1].port=443 --set gateways.istio-egressgateway.ports[1].name=https --set gateways.istio-egressgateway.ports[2].port=$EGRESS_GATEWAY_MONGODB_PORT --set gateways.istio-egressgateway.ports[2].name=mongo | kubectl apply -f -\n     {{< /text >}}\n \n 1.  Check that the `istio-egressgateway` service indeed has the selected port:\n@@ -267,7 +288,7 @@ connections from the MongoDB client to the egress gateway, by matching the IP of\n     istio-egressgateway   ClusterIP   172.21.202.204   <none>        80/TCP,443/TCP,7777/TCP   34d\n     {{< /text >}}\n \n-1.  Create an egress `Gateway` for your MongoDB service, and destination rules and a virtual service to direct the\n+1.  Create an egress `Gateway` for your MongoDB service, and destination rules and virtual services to direct the\n     traffic through the egress gateway and from the egress gateway to the external service.\n \n     {{< text bash >}}\n@@ -285,7 +306,7 @@ connections from the MongoDB client to the egress gateway, by matching the IP of\n           name: tcp\n           protocol: TCP\n         hosts:\n-        - my-mongo.tcp.svc\n+        - $MONGODB_HOST\n     ---\n     apiVersion: networking.istio.io/v1alpha3\n     kind: DestinationRule\n@@ -297,19 +318,12 @@ connections from the MongoDB client to the egress gateway, by matching the IP of\n       - name: mongo\n     ---\n     apiVersion: networking.istio.io/v1alpha3\n-    kind: DestinationRule\n-    metadata:\n-      name: mongo\n-    spec:\n-      host: my-mongo.tcp.svc\n-    ---\n-    apiVersion: networking.istio.io/v1alpha3\n     kind: VirtualService\n     metadata:\n       name: direct-mongo-through-egress-gateway\n     spec:\n       hosts:\n-      - my-mongo.tcp.svc\n+      - $MONGODB_HOST\n       gateways:\n       - mesh\n       - istio-egressgateway\n@@ -332,14 +346,14 @@ connections from the MongoDB client to the egress gateway, by matching the IP of\n           port: $EGRESS_GATEWAY_MONGODB_PORT\n         route:\n         - destination:\n-            host: my-mongo.tcp.svc\n+            host: $MONGODB_HOST\n             port:\n               number: $MONGODB_PORT\n           weight: 100\n     EOF\n     {{< /text >}}\n \n-1.  [Verify that egress traffic is directed through the egress gateway](#verify-that-egress-traffic-is-directed-through-the-egress-gateway).\n+1.  Proceed to [Verify that TCP egress traffic is directed through the egress gateway](#verify-that-tcp-egress-traffic-is-directed-through-the-egress-gateway).\n \n #### Mutual TLS between the sidecar proxies and the egress gateway\n \n@@ -350,12 +364,12 @@ enable Mixer policy enforcement based on that identity. By enabling mutual TLS y\n 1.  Delete the configuration from the previous section:\n \n     {{< text bash >}}\n-    $ kubectl delete gateway istio-egressgateway --ignore-not-found=true\n-    $ kubectl delete virtualservice direct-mongo-through-egress-gateway --ignore-not-found=true\n-    $ kubectl delete destinationrule egressgateway-for-mongo mongo --ignore-not-found=true\n+    $ kubectl delete gateway istio-egressgateway\n+    $ kubectl delete virtualservice direct-mongo-through-egress-gateway\n+    $ kubectl delete destinationrule egressgateway-for-mongo\n     {{< /text >}}\n \n-1.  Create an egress `Gateway` for your MongoDB service, and destination rules and a virtual service\n+1.  Create an egress `Gateway` for your MongoDB service, and destination rules and virtual services\n     to direct the traffic through the egress gateway and from the egress gateway to the external service.\n \n     {{< text bash >}}\n@@ -373,7 +387,7 @@ enable Mixer policy enforcement based on that identity. By enabling mutual TLS y\n           name: tls\n           protocol: TLS\n         hosts:\n-        - my-mongo.tcp.svc\n+        - $MONGODB_HOST\n         tls:\n           mode: MUTUAL\n           serverCertificate: /etc/certs/cert-chain.pem\n@@ -396,14 +410,7 @@ enable Mixer policy enforcement based on that identity. By enabling mutual TLS y\n               number: 443\n             tls:\n               mode: ISTIO_MUTUAL\n-              sni: my-mongo.tcp.svc\n-    ---\n-    apiVersion: networking.istio.io/v1alpha3\n-    kind: DestinationRule\n-    metadata:\n-      name: mongo\n-    spec:\n-      host: my-mongo.tcp.svc\n+              sni: $MONGODB_HOST\n     ---\n     apiVersion: networking.istio.io/v1alpha3\n     kind: VirtualService\n@@ -411,7 +418,7 @@ enable Mixer policy enforcement based on that identity. By enabling mutual TLS y\n       name: direct-mongo-through-egress-gateway\n     spec:\n       hosts:\n-      - my-mongo.tcp.svc\n+      - $MONGODB_HOST\n       gateways:\n       - mesh\n       - istio-egressgateway\n@@ -434,7 +441,7 @@ enable Mixer policy enforcement based on that identity. By enabling mutual TLS y\n           port: 443\n         route:\n         - destination:\n-            host: my-mongo.tcp.svc\n+            host: $MONGODB_HOST\n             port:\n               number: $MONGODB_PORT\n           weight: 100\n@@ -443,28 +450,26 @@ enable Mixer policy enforcement based on that identity. By enabling mutual TLS y\n \n 1.  Proceed to the next section.\n \n-#### Verify that egress traffic is directed through the egress gateway\n+#### Verify that TCP egress traffic is directed through the egress gateway\n \n 1.  Refresh the web page of the application again and verify that the ratings are still displayed correctly.\n \n-1.  [Enable Envoy’s access logging](/docs/tasks/telemetry/logs/access-log/#enable-envoy-s-access-logging)\n-\n-1.  Check the log of the egress gateway's Envoy and see a line that corresponds to your\n+1.  Check the statistics of the egress gateway's Envoy and see a counter that corresponds to your\n     requests to the MongoDB service. If Istio is deployed in the `istio-system` namespace, the command to print the\n-    log is:\n+    counter is:\n \n     {{< text bash >}}\n-    $ kubectl logs -l istio=egressgateway -n istio-system\n-    [2019-04-14T06:12:07.636Z] \"- - -\" 0 - \"-\" 1591 4393 94 - \"-\" \"-\" \"-\" \"-\" \"<Your MongoDB IP>:<your MongoDB port>\" outbound|<your MongoDB port>||my-mongo.tcp.svc 172.30.146.119:59924 172.30.146.119:443 172.30.230.1:59206 -\n+    $ kubectl exec -it $(kubectl get pod -l istio=egressgateway -n istio-system -o jsonpath='{.items[0].metadata.name}') -c istio-proxy -n istio-system -- curl -s localhost:15000/stats | grep $MONGODB_PORT | grep ${MONGODB_HOST}.upstream_cx_total\n+    cluster.outbound|<your MongoDB port>||<your MongoDB host>.upstream_cx_total: 1\n     {{< /text >}}\n \n-### Cleanup of TCP egress traffic control\n+#### Cleanup directing TCP egress traffic through an egress gateway\n \n {{< text bash >}}\n $ kubectl delete serviceentry mongo\n-$ kubectl delete gateway istio-egressgateway --ignore-not-found=true\n-$ kubectl delete virtualservice direct-mongo-through-egress-gateway --ignore-not-found=true\n-$ kubectl delete destinationrule egressgateway-for-mongo mongo --ignore-not-found=true\n+$ kubectl delete gateway istio-egressgateway\n+$ kubectl delete virtualservice direct-mongo-through-egress-gateway\n+$ kubectl delete destinationrule egressgateway-for-mongo\n {{< /text >}}\n \n ## Egress control for TLS\n@@ -494,7 +499,7 @@ In case you [do not need an egress gateway](/docs/examples/advanced-gateways/egr\n instructions in this section. If you want to direct your traffic through an egress gateway, proceed to\n [Direct TCP Egress traffic through an egress gateway](#direct-tcp-egress-traffic-through-an-egress-gateway).\n \n-1.  Create a `ServiceEntry` for the MongoDB service:\n+1.  Create a `ServiceEntry` and a `VirtualService` for the MongoDB service:\n \n     {{< text bash >}}\n     $ kubectl apply -f - <<EOF\n@@ -510,6 +515,26 @@ instructions in this section. If you want to direct your traffic through an egre\n         name: tls\n         protocol: TLS\n       resolution: DNS\n+    ---\n+    apiVersion: networking.istio.io/v1alpha3\n+    kind: VirtualService\n+    metadata:\n+      name: mongo\n+    spec:\n+      hosts:\n+      - $MONGODB_HOST\n+      tls:\n+      - match:\n+        - port: $MONGODB_PORT\n+          sni_hosts:\n+          - $MONGODB_HOST\n+        route:\n+        - destination:\n+            host: $MONGODB_HOST\n+            port:\n+              number: $MONGODB_PORT\n+          weight: 100\n+      location: MESH_EXTERNAL\n     EOF\n     {{< /text >}}\n \n@@ -519,6 +544,7 @@ instructions in this section. If you want to direct your traffic through an egre\n \n {{< text bash >}}\n $ kubectl delete serviceentry mongo\n+$ kubectl delete virtualservice mongo\n {{< /text >}}\n \n ### Direct TLS Egress traffic through an egress gateway\n@@ -530,8 +556,6 @@ The egress gateway forwards the traffic to the MongoDB host. Note that the sidec\n to be 443. The egress gateway accepts the MongoDB traffic on the port 443, matches the MongoDB host by SNI, and rewrites\n  the port again to be the port of the MongoDB server.\n \n-1.  [Deploy Istio egress gateway](/docs/examples/advanced-gateways/egress-gateway/#deploy-istio-egress-gateway).\n-\n 1.  Create a `ServiceEntry` for the MongoDB service:\n \n     {{< text bash >}}\n@@ -567,9 +591,9 @@ to be 443. The egress gateway accepts the MongoDB traffic on the port 443, match\n \n     {{< tabset cookie-name=\"mtls\" >}}\n \n-    {{< tab name=\"mutual TLS enabled\" cookie-value=\"enabled\" >}}\n+    {{% tab name=\"mTLS enabled\" cookie-value=\"enabled\" %}}\n \n-    {{< text_hack bash >}}\n+{{< text bash >}}\n     $ kubectl apply -f - <<EOF\n     apiVersion: networking.istio.io/v1alpha3\n     kind: Gateway\n@@ -644,13 +668,13 @@ to be 443. The egress gateway accepts the MongoDB traffic on the port 443, match\n               number: $MONGODB_PORT\n           weight: 100\n     EOF\n-    {{< /text_hack >}}\n+{{< /text >}}\n \n-    {{< /tab >}}\n+    {{% /tab %}}\n \n-    {{< tab name=\"mutual TLS disabled\" cookie-value=\"disabled\" >}}\n+    {{% tab name=\"mTLS disabled\" cookie-value=\"disabled\" %}}\n \n-    {{< text_hack bash >}}\n+{{< text bash >}}\n     $ kubectl apply -f - <<EOF\n     apiVersion: networking.istio.io/v1alpha3\n     kind: Gateway\n@@ -714,13 +738,22 @@ to be 443. The egress gateway accepts the MongoDB traffic on the port 443, match\n               number: $MONGODB_PORT\n           weight: 100\n     EOF\n-    {{< /text_hack >}}\n+{{< /text >}}\n \n-    {{< /tab >}}\n+    {{% /tab %}}\n \n     {{< /tabset >}}\n \n-1. [Verify that the traffic is directed though the egress gateway](#verify-that-egress-traffic-is-directed-through-the-egress-gateway)\n+1.  Refresh the web page of the application again and verify that the ratings are still displayed correctly.\n+\n+1.  Check the statistics of the egress gateway's Envoy and see a counter that corresponds to your\n+    requests to the MongoDB service. If Istio is deployed in the `istio-system` namespace, the command to print the\n+    counter is:\n+\n+    {{< text bash >}}\n+    $ kubectl exec -it $(kubectl get pod -l istio=egressgateway -n istio-system -o jsonpath='{.items[0].metadata.name}') -c istio-proxy -n istio-system -- curl -s localhost:15000/stats | grep $MONGODB_PORT | grep ${MONGODB_HOST}.upstream_cx_total\n+    cluster.outbound|<your MongoDB port>||<your MongoDB host>.upstream_cx_total: 1\n+    {{< /text >}}\n \n #### Cleanup directing TLS Egress traffic through an egress gateway\n \n@@ -1037,8 +1070,6 @@ to hold the configuration of the Nginx SNI proxy:\n \n 1.  Refresh the web page of the application again and verify that the ratings are still displayed correctly.\n \n-1.  [Enable Envoy’s access logging](/docs/tasks/telemetry/logs/access-log/#enable-envoy-s-access-logging)\n-\n 1.  Check the log of the egress gateway's Envoy proxy. If Istio is deployed in the `istio-system` namespace, the command\n     to print the log is:\n~~~"},"comment":{"url":"https://api.github.com/repos/servicemesher/istio-official-translation/issues/comments/485457179","html_url":"https://github.com/servicemesher/istio-official-translation/issues/980#issuecomment-485457179","issue_url":"https://api.github.com/repos/servicemesher/istio-official-translation/issues/980","id":485457179,"node_id":"MDEyOklzc3VlQ29tbWVudDQ4NTQ1NzE3OQ==","user":{"login":"fleeto","id":6958477,"node_id":"MDQ6VXNlcjY5NTg0Nzc=","avatar_url":"https://avatars3.githubusercontent.com/u/6958477?v=4","gravatar_id":"","url":"https://api.github.com/users/fleeto","html_url":"https://github.com/fleeto","followers_url":"https://api.github.com/users/fleeto/followers","following_url":"https://api.github.com/users/fleeto/following{/other_user}","gists_url":"https://api.github.com/users/fleeto/gists{/gist_id}","starred_url":"https://api.github.com/users/fleeto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fleeto/subscriptions","organizations_url":"https://api.github.com/users/fleeto/orgs","repos_url":"https://api.github.com/users/fleeto/repos","events_url":"https://api.github.com/users/fleeto/events{/privacy}","received_events_url":"https://api.github.com/users/fleeto/received_events","type":"User","site_admin":false},"created_at":"2019-04-22T15:53:33Z","updated_at":"2019-04-22T15:53:33Z","author_association":"MEMBER","body":"/confirm"}}
{"actor":{"display_login":"fleeto"}}