Add X-Forwarded-Proto: https header via VirtualService

[brendangadd]

Trino won't support authentication unless TLS is configured. However, it allows (and recommends) terminating TLS at the load balancer, so it will trust that the connection was secured if it sees an X-Forwarded-Proto: https header.

Istio is automatically encrypting all cluster traffic on the service mesh, but it does so completely transparently. Thus, we need to explicitly set the proxy header to let Trino know our traffic is indeed encrypted – even though clients will be using standard HTTP protocol when they connect.

[rohank07]

Breaking this task down into:

1. Setting up a virutal service/ingress and connect using https service to the pod level (trino coordinator)
2. Once verified 1. works, add x-forwarded proto header

[rohank07]

Step 1 ✔️
Created Gateway and Virtual Service. Gateway has both http and https ports. httpsRedirect is enabled on the Gateway. The http traffic is directed to https (80 to 443). Deployed MetalLb on local cluster to resolve host via browser (temporarily using https://trino.example.com/ui/) configured to use the istio-ingressgateway's external-IP. Virtual service resolves to host: trino.example.com

[rohank07]

Step 2:
Added X-forwarded proto header in the virtual service (no need for EnvoyFilter). Unable to verify using request headers via httpbin. This will be verified when jwt auth is set up.
Breakdown: Browser gets request -> istio adds request header -> passes request to Trino

[rohank07]

Got the X-Forwarded-Proto: https header to show when using httpbin api. curl -s -HHost:httpbin.example.com "http://$INGRESS_HOST:$INGRESS_PORT/headers?show_env