Istio gateways? about kedge HOT 2 OPEN

Thanks for this! You are welcome to join improbable-eng slack to discuss this (:

Link: https://join.slack.com/t/improbable-eng/shared_invite/enQtMzQ1ODcyMzQ5MjM4LWY5ZWZmNGM2ODc5MmViNmQ3ZTA3ZTY3NzQwOTBlMTkzZmIxZTIxODk0OWU3YjZhNWVlNDU3MDlkZGViZjhkMjc and @bplotka slack user.

From an initial look, it looks simple enough but I wonder about certain features:

• Does it support something else than mTLS? What about human -> service traffic? Some OAuth2 vs OIDC auth would be very nice here.
• How are routes configured? Automatically by Istio, right?
• The gateway is implemented by what? Did you implement something custom? Because it sounds like the same thing can be done by pure envoy. (in the same way -> by kedge)

Rest logic seems to be kind of similar to winch -> kedge and actually envoy egress -> envoy ingress flow as well. TBH we are slowly moving towards pure envoy right now. 😉

from kedge.

Gateway is just a config spec. All proxies in istio (sidecar or gateway) run Envoy.
You can expose the gateway to end users (see istio docs on gateway ingress, where users access bookinfo via gateway). It doesn’t have fancy stuff like oauth and oidc yet. But it supports the full gamut of Envoy features.

The routing rules you configure in istio get translated into Envoy configs by istio pilot. Pilot then updates envoys dynamically via Envoy xDS protocol.

from kedge.