<p>Currently I am using Cloud proxy to connect to a Postgres Cloud SQL database as a sidecar. When using Istio, however it introduces its own sidecar, which lead to the result that there are two proxies in the pod. So I thougth, can the encrypted connection not also established using Istio?</p>
<p>Basically, <a href="https://stackoverflow.com/questions/56094753/istio-connect-to-an-external-ip">it is possible to connect to an external IP using Istio</a>.</p>
<p><a href="https://stackoverflow.com/questions/57343583/how-can-i-use-custom-client-certificate-for-external-service-with-istio">It should also be possible to configure a DestinationRule which configures TLS.</a></p>
<p><a href="https://cloud.google.com/sql/docs/postgres/configure-ssl-instance#client-certs" rel="nofollow noreferrer">And it also be possible to create Client certificates for Cloud SQL</a>.</p>
<p>EDIT: might be the same problem: <a href="https://stackoverflow.com/questions/45542830/nginx-tls-termination-for-postgresql">NGINX TLS termination for PostgreSQL</a></p>
<p>So I ended up with something like</p>
<pre><code>apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-db
spec:
  hosts:
    - external-db
  ports:
    - number: 5432
      name: postgres
      protocol: TLS
  location: MESH_EXTERNAL
  resolution: STATIC
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: external-db
spec:
  host: external-db
  trafficPolicy:
    tls:
      mode: MUTUAL
      clientCertificate: /etc/certs/client-cert.pem
      privateKey: /etc/certs/client-key.pem
      caCertificates: /etc/certs/server-ca.pem

---
apiVersion: v1
kind: Service
metadata:
  name: external-db
spec:
  clusterIP: None
  ports:
    - protocol: TCP
      port: 5432
---
apiVersion: v1
kind: Endpoints
metadata:
  name: external-db
subsets:
  - addresses:
      - ip: 10.171.48.3
    ports:
      - port: 5432
</code></pre>
<p>and in the pod with</p>
<pre><code>sidecar.istio.io/userVolumeMount: '[{&quot;name&quot;:&quot;cert&quot;, &quot;mountPath&quot;:&quot;/etc/certs&quot;, &quot;readonly&quot;:true}]'
sidecar.istio.io/userVolume: '[{&quot;name&quot;:&quot;cert&quot;, &quot;secret&quot;:{&quot;secretName&quot;:&quot;cert&quot;}}]'
</code></pre>
<p><strong>However, the server rejects the connection. So the question is, can this setup possibly work? And does it even make any sense?</strong></p>

<p>It seems that Postgres uses application-level protocol negotation, so Istio/Envoy cannot be used in that case:</p>
<p><a href="https://github.com/envoyproxy/envoy/issues/10942" rel="nofollow noreferrer">https://github.com/envoyproxy/envoy/issues/10942</a>
<a href="https://github.com/envoyproxy/envoy/issues/9577#issuecomment-606943362" rel="nofollow noreferrer">https://github.com/envoyproxy/envoy/issues/9577#issuecomment-606943362</a></p>
