Blog post for egress SNI routing.

[libesz]

Description

Blog post for #14126

Reviewers

TBD

• Ambient
• Docs
• Installation
• Networking
• Performance and Scalability
• Extensions and Telemetry
• Security
• Test and Release
• User Experience
• Developer Infrastructure
• Localization/Translation

[istio-policy-bot]

😊 Welcome! This is either your first contribution to the Istio documentation repo, or
it's been a while since you've been here. A few things you should know:

• You can learn about how we write and maintain documentation, our style guidelines,
  and the available web site features by visiting Contributing to the Docs.

• In the next few minutes, an automatic preview of your change will be built with
  a full copy of the istio.io website. You can find this preview by clicking on
  the Details link next to the deploy/netlify entry in the status section of this
  page.

• We care about quality, so we've put in place a number of checks to ensure our documentation
  is top-notch. We do spell checking, sanitize the Markdown, ensure all hyperlinks point to a
  valid location, and more. If your PR doesn't pass one of these checks, you'll see a red X in the
  lint_istio.io entry in the status section. Click on the Details link to get a list of the
  problems with your PR. Fix those problems and push an update; this will automatically re-run the
  tests. Hopefully this time everything will be perfect!

• Once your changes are accepted and merged into the repository, they will initially show up
  on https://preliminary.istio.io. The changes will be published to https://istio.io
  the next time we do a major release (which typically happens every 3 months or so).
  To publish them sooner, add a cherrypick/release-x.xx label, where x.xx is the current
  release of Istio.

Thanks for contributing!

Courtesy of your friendly welcome wagon.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: libesz / name: Gergo Huszty (331eef1, d73f109, 582164a, f0847b0, 437b494, 8a9ed35, 92d16a2, b57aa9a, 7eb7c8b, 0ca2dbf, 2988fb4, a71dbc4, 831e8b1, b2ee21c, 75d4246, dafe90e)
• ✅ login: windsonsea / name: Michael (831e8b1)

[istio-testing]

Hi @libesz. Thanks for your PR.

I'm waiting for a istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[Arhell]

/ok-to-test

[frankbu]

Suggested change

	title: "[WIP] Routing HTTPS/TLS traffic to arbitrary remote destinations"
	description: "A generic approach to set up egress gateways and use them to route traffic to a restricted set of target remote hosts dynamically, supporting wildcard domains."
	title: "Routing egress gateway traffic to wildcard destinations"
	description: "A generic approach to set up egress gateways that can route traffic to a restricted set of target remote hosts dynamically, including wildcard domains."

[libesz]

Shouldn't Routing egress gateway traffic be just Routing egress traffic?

[frankbu]

Technically, the article is just showing how to make an egress gateway route to wildcard hosts, there's no problem if routing direct. But the description says that clearly enough, so if you think leaving gateway out of the title, that's fine.

[frankbu]

Another listener with SNI forwarder performs a new TLS header
inspection for the original TLS session. If the inner SNI
hostname matches the allowed domain names (including
wildcards), it TCP proxies the traffic to the destination, read
from the header per connection. This listener is internal to
Envoy (allowing it to restart traffic processing to see
the innner SNI value), so that no pods (inside or outside the
mesh) can connect to it directly. This listener is 100% manually
configured through EnvoyFilter.

[frankbu]

Suggested change

	publishdate: 2023-12-10
	publishdate: 2023-12-01

[frankbu]

Nice article, LGTM. Thanks @libesz!

[frankbu]

/cherrypick release-1.20

[istio-testing]

@frankbu: new pull request created: #14211

In response to this:

/cherrypick release-1.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.