<p>I am trying to run a nginx forward proxy in kubernetes but I'm facing some issues.</p>
<p>My configuration:</p>
<ul>
<li>nginx configured as forward proxy with http connect module, running on docker: <a href="https://pastebin.com/Chm11vGb" rel="nofollow noreferrer">Dockerfile</a> - listens to 8888</li>
<li>K8S with istio 1.4 <a href="https://pastebin.com/VX7M9mRM" rel="nofollow noreferrer">Deployment, service, gateway and virtual service configuration</a>, host exposed to 36088</li>
<li>Firefox for testing</li>
</ul>
<p>My steps:</p>
<ol>
<li><p>For local testing, I'm configuring the connection settings in <a href="https://support.mozilla.org/en-US/kb/connection-settings-firefox" rel="nofollow noreferrer">Firefox</a> to point to the instance of nginx running in Docker on <code>localhost:8888</code>. With this configuration, the proxy is behaving as expected, denying and allowing traffic as per the <code>nginx.conf</code>.</p>
</li>
<li><p>For testing my pod in K8S, I can run <code>kubectl port-forward name-of-my-pod 8888:8080</code> and configure Firefox to use the proxy forwarded on <code>localhost:8080</code>. As per point 1, the proxy works as expected and I can see the traffic hitting my pod in the logs.</p>
</li>
<li><p>Finally, To test my istio/AKS configuration, I can hit <code>https://proxy.mydomain.net:36088</code> (defined in the gatwway) with a web browser. The url responds just fine and I can see the pod outputting some logs.</p>
</li>
</ol>
<p>Sadly, though, when I configure Firefox to make use of <code>proxy.mydomain.net:36088</code>, I am getting <code>connection timeout</code> and I can see that the traffic is not actually hitting my pod and I am not getting any logs.</p>
<p>In other words, the proxy doesn't seem to be working when I use it as a proxy, but it responds fine when I access its URL a normal website.</p>
<p>Based on the fact that the traffic doesn't seem to hit my pod, I guess that I need to configure something else in istio/aks to ensure that my service/pod works as a proxy, but I don't know if my guess is right. Is anything obvious that am I missing?</p>

<p>After a lot of digging, we managed to make this work.</p>
<p>This is how our templates look like: <a href="https://pastebin.com/xUE4msF5" rel="nofollow noreferrer">deployment, gateway, service and virtualservice</a></p>
<p>The crucial point was:</p>
<ul>
<li>Adding the <code>.Values.istio.port.number</code> to the istio-ingressgateway</li>
<li>configuring <code>.Values.istio.port.protocol</code> to TCP</li>
<li>configuring the gateway as <code>PASSTHROUGH</code></li>
</ul>
