<p>i'm trying to reverse proxy using istio virtual service</p>

<p>it is possible forward request in virtual service? (like nginx's proxy_pass)</p>

<p>in result, </p>

<ul>
<li><a href="http://myservice.com/about/" rel="nofollow noreferrer">http://myservice.com/about/</a>* -> forward request to CDN (external service outside k8s system - aws s3, etc....)</li>
<li><a href="http://myservice.com/" rel="nofollow noreferrer">http://myservice.com/</a>* -> my-service-web (internal service includes in istio mesh)</li>
</ul>

<p>defined serviceentry, but it just "redirect", not forward reqeust.</p>

<p>here is my serviceentry.yaml and virtualservice.yaml</p>

<ol>
<li>serviceentry.yaml</li>
</ol>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: my-service-proxy
  namespace: my-service
spec:
  hosts:
   - CDN_URL
  location: MESH_EXTERNAL
  ports:
    - number: 80
      name: http
      protocol: HTTP
    - number: 443
      name: https
      protocol: TLS
  resolution: DNS

</code></pre>

<ol start="2">
<li>virtualservice.yaml</li>
</ol>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-service
  namespace: my-service
spec:
  hosts:
   - myservice.com
  gateways:
   - myservice
  http:
  - match:
    - uri:
        prefix: /about
    rewrite:
      authority: CDN_URL
      uri: /
    route:
    - destination:
        host: CDN_URL
  - route:
    - destination:
        host: my-service-web.svc.cluster.local
        port:
          number: 80

</code></pre>

<p>virtualservice can acts like nginx-igress?</p>

<p>Based on that <a href="https://discuss.istio.io/t/istio-egress-breaking-apache-httpd-reverse-proxy/3542/9" rel="nofollow noreferrer">istio discuss</a></p>

<p>User @palic asked same question here </p>

<blockquote>
  <p>Shouldn’t it be possible to let ISTIO do the reverse proxy
  thing, so that no one needs a webserver (httpd/nginx/
  lighthttpd/…) to do the reverse proxy job?</p>
</blockquote>

<p>And the answer provided by @Daniel_Watrous</p>

<blockquote>
  <p>The job of the Istio control plane is to configure a fleet of reverse proxies. The purpose of the webserver is to serve content, not reverse proxy. The reverse proxy technology at the heart of Istio is Envoy, and Envoy can be use as a replacement for HAProxy, nginx, Apache, F5, or any other component that is being used as a reverse proxy.</p>
</blockquote>

<hr>

<blockquote>
  <p>it is possible forward request in virtual service</p>
</blockquote>

<p>Based on that I would say it's not possible to do in virtual service, it's just rewrite(redirect), which I assume is working for you.</p>

<hr>

<blockquote>
  <p>when i need function of reverse proxy, then i have to using nginx ingresscontroller (or other things) instead of istio igress gateway? </p>
</blockquote>

<p>If we talk about reverse proxy, then yes, you need to use other technology than istio itself.</p>

<p>As far as I'm concerned, you could use some nginx pod, which would be configured as reverse proxy to the external service, and it will be the host for your virtual service.</p>

<p>So it would look like in below example.</p>

<p><strong>EXAMPLE</strong></p>

<p>ingress gateway -> Virtual Service -> nginx pod ( reverse proxy configured on nginx)<br>
Service entry -> accessibility of URLs outside of the cluster</p>

<p>Let me know if you have any more questions.</p>
