egressgwy-proxy-https2https.yaml

# nonk8s
# ServiceEntry规范：https://istio.io/latest/docs/reference/config/networking/service-entry/
# 1. 首先使用ServiceEntry对象定义外部域名：istio.io（定义后才能在VirtualService中作为dst）
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: istio-io-https
spec:
  hosts:
    - istio.io
  ports:
    #    - number: 80
    #      name: http
    #      protocol: HTTP
    - number: 443
      name: tls
      protocol: TLS
  resolution: DNS
  location: MESH_EXTERNAL

---
# 2. 为 Host：istio.io 定义一个 egressGateway
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: egress-istio-io-https
spec:
  selector:
    istio: egressgateway
  servers:
    - port:
        # 定义此网关要用于监听 去往 host：istio.io 流量的端口号（必须是egress网关Service已经暴露的端口号之一）
        # 端口号错误会导致应用访问404/503
        number: 443
        name: tls
        protocol: TLS
      hosts:
        - istio.io
      tls:
        mode: PASSTHROUGH # 透传tls流量
---
# 3. 定义VS将 istio.io 流量转发到 egressGateway，再从 egressGateway 转发到 istio.io
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: egressgateway-proxy-https-istio-io
spec:
  hosts:
    - istio.io
  gateways:
    - mesh
    - egress-istio-io-https
  tls: # 匹配HTTPS或TLS流量
    - match:
        - gateways:
            - mesh
          port: 443
          sniHosts:
            - istio.io
      route:
        - destination:
            host: istio-egressgateway.istio-system.svc.cluster.local
            port: # 可省略（因为目标svc定义的ports[0].name是可读的“https”）
              number: 443
    - match:
        - gateways:
            - egress-istio-io-https
          port: 443
          sniHosts:
            - istio.io
      route:
        - destination:
            host: istio.io
            port:
              number: 443