Hi, Were you able to figure out how to make mTLS work for Traefik and Istio?
In permissive mode all works fine for me, When in strict mode I get NR filter_chain_not_found in istio logs... I believe this is because traefik is sending traffic on IP:port instead of service:port and istio couldn't find any routes to route the traffic. Any suggestions on what can be done to make this work?
I tried this Using Traefik Ingress Controller with Istio Service Mesh and worked for me to route traffic from traefik to Istio. But I have some other limitations with this approach so we are planning to move on to use Istio Gateway instead of traefik for routing external requests.
@putharekulu@Aur0nd do you know that since Traefik v2.10, you can set the option nativeLB on your Services? It allows Traefik to target the service instead of the pods.
Moreover, the next Traefik version v3.2 brings a global option to enable this behavior.
From my understanding of the limitation you've described, these options should solve the issue.
WDYT?
We are testing traefik with istio currently, and will eventually run into the above issue.
It sounds like the preferred approach would be once on Traefik 3.2 to set the global option so as traffic goes to the k8s cluster IP versus straight to the backends?
Are there any examples for configuring traefik for L7 & using istio for services on the mesh?
You can find a recent tutorial to start with Istio and Traefik here.
It sounds like the preferred approach would be once on Traefik 3.2 to set the global option so as traffic goes to the k8s cluster IP versus straight to the backends?
Indeed, setting the option to the provider level is relevant in this context.