<p>I've been looking at terminating TLS in Istio between the redis client and server running in the Kubernetes cluster.</p>
<p>Essentially we have an Istio ingress gateway which handles all traffic to the cluster and I figured it might be able to terminate the TLS and send the traffic unencrypted to the server in the cluster.</p>
<p>However, after trying a TLS route I get a 404 (&quot;response_code_details&quot;:&quot;route_not_found&quot;). The ingress gateway logs the correct domain (redis.cluster.company.com) though.</p>
<p>Read somewhere that PASSTHROUGH would make it work, but we want Istio to terminate the TLS.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - '*'
    port:
      name: http
      number: 80
      protocol: HTTP
    tls:
      httpsRedirect: true
  - hosts:
    - '*'
    port:
      name: https
      number: 443
      protocol: HTTPS
    tls:
      credentialName: domain-cert
      mode: SIMPLE
---
apiVersion: v1
kind: Service
metadata:
  name: redis
  namespace: infra-redis-poc
spec:
  type: ClusterIP
  ports:
  - protocol: TCP
    port: 6379
    targetPort: 6379
    name: tcp-redis
  selector:
    name: redis-primary
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: primary-deployment
  namespace: infra-redis-poc
  labels:
    name: redis-primary
spec:
  replicas: 1
  selector:
    matchLabels:
      name: redis-primary
  template:
    metadata:
      labels:
        name: redis-primary
    spec:
      subdomain: primary
      containers:
      - name: redis
        image: redis:7.0.11-alpine3.18
        command:
          - &quot;redis-server&quot;
        args:
          - &quot;--protected-mode&quot;
          - &quot;no&quot;
        ports:
        - containerPort: 6379
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: redis-vs
  namespace: infra-redis-poc
spec:
  gateways:
    - istio-system/gateway
  hosts:
  - redis.cluster.company.com
  tls:
  - match:
    - sniHosts:
      - redis.cluster.company.com
    route:
    - destination:
        host: redis.infra-redis-poc.svc.cluster.local
</code></pre>
<p>Any ideas welcome!</p>
<p>Kind regards,</p>
<p>Patrik</p>

PatrikJ
<p>The issue might be related to the <code>tls</code> configuration in the <code>VirtualService</code>. Since you want to terminate TLS at the ingress gateway, you should use the <code>http</code> configuration instead of <code>tls</code>. Here's how you can modify the <code>VirtualService</code> to achieve this:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: redis-vs
  namespace: infra-redis-poc
spec:
  gateways:
  - istio-system/gateway
  hosts:
  - redis.cluster.company.com
  http:
  - match:
    - uri:
        prefix: &quot;/&quot;
    route:
    - destination:
        host: redis.infra-redis-poc.svc.cluster.local
</code></pre>
<p>In this configuration, we replaced the <code>tls</code> section with an <code>http</code> section. The <code>match</code> block is configured to match any URI with a prefix of &quot;/&quot;, which means it will match all incoming requests. The <code>route</code> block remains the same, directing traffic to the <code>redis</code> service in the <code>infra-redis-poc</code> namespace.</p>
<p>By using the <code>http</code> configuration, the ingress gateway will terminate TLS and forward unencrypted traffic to the Redis server as desired <a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/" rel="nofollow noreferrer">istio.io</a>.</p>
