Hi there!!!
I've been trying for a little while to make Istio mTLS and Traefik to work but without any luck.
Essentially I've got Traefik to manage the ingress and Istio for the Mesh, but once I enable the mTLS I'm getting 404 Gateway.
Any help is so much appreciated!
Hi, Were you able to figure out how to make mTLS work for Traefik and Istio?
In permissive mode all works fine for me, When in strict mode I get NR filter_chain_not_found in istio logs... I believe this is because traefik is sending traffic on IP:port instead of service:port and istio couldn't find any routes to route the traffic. Any suggestions on what can be done to make this work?
I am facing same problem.
Any updates?
Were you able to figure out?
Unfortunately I don't think it's possible, @putharekulu correctly pointed the limitation.
I ended up using the Traefik Mesh which obviously is not near as good.
Sad. I'll move on to linkerd.
I tried this Using Traefik Ingress Controller with Istio Service Mesh and worked for me to route traffic from traefik to Istio. But I have some other limitations with this approach so we are planning to move on to use Istio Gateway instead of traefik for routing external requests.
You can use Traefik ingress & Istio mesh in permissive mode, but you can't have that working with mTLS Enforced
Hello there,
@putharekulu @Aur0nd do you know that since Traefik v2.10, you can set the option nativeLB on your Services? It allows Traefik to target the service instead of the pods.
Moreover, the next Traefik version v3.2 brings a global option to enable this behavior.
From my understanding of the limitation you've described, these options should solve the issue.
WDYT?
Hey there,
We are testing traefik with istio currently, and will eventually run into the above issue.
It sounds like the preferred approach would be once on Traefik 3.2 to set the global option so as traffic goes to the k8s cluster IP versus straight to the backends?
Are there any examples for configuring traefik for L7 & using istio for services on the mesh?
Thank you
Hello @krobbo,
You can find a recent tutorial to start with Istio and Traefik here.
It sounds like the preferred approach would be once on Traefik 3.2 to set the global option so as traffic goes to the k8s cluster IP versus straight to the backends?
Indeed, setting the option to the provider level is relevant in this context.
Thats fantastic, thank you @nicomengin