<p>I have a fairly simple setup in my kubernetes cluster, with two zones:</p>
<ul>
<li>Low trust (public facing)</li>
<li>Medium trust (non public)</li>
</ul>
<p>Both zones have Istio enabled, with:</p>
<ul>
<li>Ingress gateway with SSL enabled. For testing within my local docker desktop, I use port 443 for the public facing, and port 443 for medium trust</li>
<li>Virtual service</li>
<li>Destination rule</li>
</ul>
<p>I am deploying apache HTTPD - acting as a reverse proxy within the low trust. The plan is for the HTTPD to then forward the traffic to istio ingress gateway in the medium trust.
Within the medium trust is a Spring boot application.</p>
<p>So, lets say, user is accessing <a href="https://lowtrust.avengers.local/avengers" rel="nofollow noreferrer">https://lowtrust.avengers.local/avengers</a>. This request will be serviced by the ingress gateway in the lowtrust, and will end up in the HTTPD, which then forward the request to ingress gateway in mediumtrust.</p>
<pre><code>LOWTRUST                      MEDIUMTRUST
| GW--&gt; VS--&gt;HTTPD Pod|======&gt;| GW --&gt; VS --&gt;Java Pod|
</code></pre>
<p>I have created a github repo to demonstrate this:
<a href="https://github.com/alexwibowo/avengersKubernetes" rel="nofollow noreferrer">https://github.com/alexwibowo/avengersKubernetes</a></p>
<p>The HTTP proxy configuration is here: <a href="https://github.com/alexwibowo/avengersKubernetes/blob/main/httpd/conf/proxy.conf" rel="nofollow noreferrer">https://github.com/alexwibowo/avengersKubernetes/blob/main/httpd/conf/proxy.conf</a>.</p>
<p>The Istio ingress gateway for lowtrust:
<a href="https://github.com/alexwibowo/avengersKubernetes/blob/main/kubernetes/avengers/charts/avengers-istio/templates/istio-httpd.yaml" rel="nofollow noreferrer">https://github.com/alexwibowo/avengersKubernetes/blob/main/kubernetes/avengers/charts/avengers-istio/templates/istio-httpd.yaml</a></p>
<p>and istio ingress gateway for mediumtrust:
<a href="https://github.com/alexwibowo/avengersKubernetes/blob/main/kubernetes/avengers/charts/avengers-istio/templates/istio-app.yaml" rel="nofollow noreferrer">https://github.com/alexwibowo/avengersKubernetes/blob/main/kubernetes/avengers/charts/avengers-istio/templates/istio-app.yaml</a></p>
<p>As you can see, both gateways have their own certs configured. At the moment, I kind of 'cheat' by modifying my /etc/host file to have the following:</p>
<pre><code>127.0.0.1            lowtrust.avengers.local
&lt;CLUSTER_IP_ADDRESS&gt; mediumtrust.avengers.local
</code></pre>
<p>By doing this, when HTTPD pod making request to 'mediumtrust.avengers.local', it will get directed to the istio ingress gateway (thats my understanding anyway).</p>
<p>I've heard that you can actually set up a mutual TLS for the scenario I've described above. With this approach, I wont need to setup the certificate in my mediumtrust ingress gateway - and just use 'ISTIO_MUTUAL'. I think for this, I will also need to set up a 'proxy' service &amp; virtual service in the lowtrust namespace. The virtual service will then manage the communication between lowtrust &amp; mediumtrust. But I'm not 100% how to do this.</p>
<p>Any help / advice is much appreciated!</p>
<p>Edit 1 (2021/07/01)
I've been reading more about this topic. So another option, is to have Service of type 'ExternalName' within the 'lowtrust' namespace.
Which, if I might use the analogy, will act like a 'proxy' for connecting to the service on the other namespace.
e.g.:</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: cr1-avengers-app
  namespace: &quot;lowtrust&quot;
spec:
  type: ExternalName
  externalName: &quot;cr1-avengers-app.mediumtrust.svc.cluster.local
  ports:
    - port: 8081
      targetPort: 8080
      protocol: TCP
      name: http
</code></pre>
<p>But by using this, I will effectively bypass the Istio VirtualService, DestinationRule that I've defined on the mediumtrust namespace.</p>

caffeine_inquisitor
<p>The way I've managed to solve this locally is by having an entry in my windows hostfile.
E.g.:</p>
<pre><code>127.0.0.1 lowtrust.avengers.local
10.109.161.243 mediumtrust.avengers.local
</code></pre>
<p><code>10.109.161.243</code> is the Cluster IP address for my istio-ingressgateway. I got this by running <code>kubectl get svc -n istio-system</code> from command line.</p>
<pre><code>NAME                   TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                                    AGE
istio-ingressgateway   LoadBalancer   10.109.161.243   localhost     15021:30564/TCP,80:31834/TCP,443:31828/TCP,445:32700/TCP,15012:30459/TCP,15443:30397/TCP   21d
</code></pre>
<p>I was also missing 'SSLProxyEngine' flag in my reverse proxy configuration. So in the end my VirtualHost configuration looks like below:
E.g.:</p>
<pre><code>&lt;VirtualHost *:7000&gt;
    ProxyRequests Off
    &lt;Proxy *&gt;
        Order deny,allow
        Allow from all
    &lt;/Proxy&gt;

    SSLProxyEngine on
    ProxyPass          /avengers        https://mediumtrust.avengers.local/avengers
    ProxyPassReverse   /avengers        https://mediumtrust.avengers.local/avengers

    CustomLog &quot;/tmp/access.log&quot; common
    ErrorLog /tmp/error.log
&lt;/VirtualHost&gt;

</code></pre>
