update egress example

scripts/istio-egress/connect-example.yaml

@@ -0,0 +1,147 @@
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: direct-cnn-through-egress-gateway
+  namespace: tunneltest
+spec:
+  hosts:
+  - edition.cnn.com
+  gateways:
+  - mesh
+  http:
+    - match:
+        - headers:
+            x-zeta-inhouse-required:
+              exact: "true"
+      rewrite:
+        uri: "/"
+        authority: httpbin.org
+      route:
+        - destination:
+            host: httpbin.org
+            port:
+              number: 80
+    - match:
+        - headers:
+            x-zeta-inhouse-required:
+              exact: "false"
+      route:
+        - destination:
+            host: istio-egressgateway.istio-system.svc.cluster.local
+            subset: cnn
+            port:
+              number: 443
+    - name: default
+      route:
+      - destination:
+            host: istio-egressgateway.istio-system.svc.cluster.local
+            subset: cnn
+            port:
+              number: 443
+  exportTo:
+    - "*"
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: egressgateway-for-cnn
+  namespace: tunneltest
+spec:
+  host: istio-egressgateway.istio-system.svc.cluster.local
+  subsets:
+  - name: cnn
+    trafficPolicy:
+      portLevelSettings:
+      - port:
+          number: 443
+        tls:
+          mode: SIMPLE
+          sni: edition.cnn.com
+  exportTo:
+    - "*"
+---
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: force-tunneling-mesh
+  namespace: tunneltest
+spec:
+  hosts:
+  - edition.cnn.com
+  gateways:
+  - istio-egressgateway
+  tls:
+  - match:
+    - sniHosts:
+        - edition.cnn.com
+    route:
+    - destination:
+        host: external-forward-proxy.tunneltest.svc.cluster.local
+        subset: tunnel-traffic-to-cnn
+        port:
+          number: 8888
+  exportTo:
+    - "*"
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: originate-tls-to-connect-proxy-and-tunnel-traffic-to-google-com
+  namespace: tunneltest
+spec:
+  host: external-forward-proxy.tunneltest.svc.cluster.local
+  subsets:
+  - name: tunnel-traffic-to-cnn
+    trafficPolicy:
+      tunnel:
+        targetHost: edition.cnn.com
+        targetPort: 443
+        protocol: CONNECT
+  exportTo:
+    - "*"
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: Gateway
+metadata:
+  name: istio-egressgateway
+  namespace: tunneltest
+spec:
+  selector:
+    istio: egressgateway
+  servers:
+  - port:
+      number: 80
+      name: http-port-for-tls-origination
+      protocol: HTTPS
+    hosts:
+    - edition.cnn.com
+    tls:
+      mode: PASSTHROUGH
+  - port:
+      number: 443
+      name: https-port-for-tls-origination
+      protocol: TLS
+    hosts:
+    - edition.cnn.com
+    tls:
+      mode: PASSTHROUGH
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: ServiceEntry
+metadata:
+  name: cnn
+  namespace: tunneltest
+spec:
+  hosts:
+  - edition.cnn.com
+  ports:
+  - number: 80
+    name: http
+    protocol: HTTP
+    # targetPort: 443
+  - number: 443
+    name: http-port
+    protocol: TLS
+  resolution: DNS
+  exportTo:
+    - "*"

scripts/istio-egress/proxy-svc.yaml

@@ -0,0 +1,62 @@
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tinyproxy
+  namespace: tunneltest
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tinyproxy
+  template:
+    metadata:
+      labels:
+        app: tinyproxy
+    spec:
+      containers:
+      # - image: 678258727640.dkr.ecr.ap-south-1.amazonaws.com/tunneltest:latest
+      - image: vimagick/tinyproxy
+        imagePullPolicy: IfNotPresent
+        name: tinyproxy
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: external-forward-proxy
+  namespace: tunneltest
+  annotations:
+    "networking.istio.io/exportTo": '*'
+    # "ingress.kubernetes.io/service-upstream": "true"
+    # "konghq.com/preserve-host": "false"
+spec:
+  type: ClusterIP
+  ports:
+  - protocol: TCP
+    port: 8888
+    name: tcp
+  selector:
+      app: tinyproxy
+  exportTo:
+    - ""
+    - "istio-system"
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: ServiceEntry
+metadata:
+  name: external-forward-proxy.tunneltest.svc.cluster.local
+  namespace: tunneltest
+spec:
+  hosts:
+    - external-forward-proxy.tunneltest.svc.cluster.local
+  # addresses:
+  # - 172.20.80.166/32
+  location: MESH_EXTERNAL
+  ports:
+    - number: 8888
+      name: https
+      protocol: HTTPS
+  resolution: DNS
+  exportTo:
+    - "*"
+---