bitvector2 / frontdoor Goto Github PK

Combined Istio / Nginx / Spring Cloud Gateway Front Door Layer

• Istio Ingress Gateway terminates inbound TLS requests from internet and routes to either Nginx or Spring Cloud Gateway
• Static content is served from Nginx
• API calls are served from Spring Cloud Gateway
• Traffic pathway appears entirely inline to avoid use of CORS
• Istio provides mTLS between all Envoy:Envoy connections automatically
• Istio provides client side load balancing, retry and circuit breaker logic
• Istio Egress Gateway provides retry and circuit breaker logic to outside world

Background Info

• https://istio.io/docs/tasks/traffic-management/ingress/
• https://istio.io/docs/tasks/traffic-management/secure-ingress/
• https://istio.io/docs/tasks/traffic-management/egress/
• https://istio.io/blog/2018/egress-tcp/
• https://www.nginx.com/resources/wiki/start/topics/examples/full/
• http://nginx.org/en/docs/
• https://cloud.spring.io/spring-cloud-gateway/
• https://spring.io/guides/gs/gateway/

Testing Notes

• export INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].nodePort}')
• export SECURE_INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="https")].nodePort}')
• export INGRESS_HOST=$(kubectl get po -l istio=ingressgateway -n istio-system -o 'jsonpath={.items[0].status.hostIP}')
• curl --include --header host:frontdoor.bitvector.org http://$INGRESS_HOST:$INGRESS_PORT/
• curl --include --header host:frontdoor.bitvector.org --resolve frontdoor.bitvector.org:$SECURE_INGRESS_PORT:$INGRESS_HOST --cacert 2_intermediate/certs/ca-chain.cert.pem https://frontdoor.bitvector.org:$SECURE_INGRESS_PORT/r/httpbin/get