如何在使用 ISTIO 服务网格时为 ldap/opendj 配置 ssl

Question

I have a couple of microservices and our backend is opendj/ldap. It has been configured to use SSL. Now we are trying to use ISTIO as our k8s service mesh. Every other service works fine but the ldap server - opendj - is not. My gues is it's because of the ssl configuration. It's meant to use self-signed cert.

I have a script that creates a self-signed cert in istio namespace and I have tried to use it like this on the gateway.yaml

  - port:
      number: 4444
      name: tcp-admin
      protocol: TCP
    hosts:
    - "*"
    tls:
      mode: SIMPLE # enable https on this port
      credentialName: tls-certificate # fetch cert from k8s secret

I also have tried to use

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: opendj-istio-mtls
spec:
  host: opendj.{{.Release.Namespace }}.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
      credentialName: tls-certificate

---

apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: opendj-receive-tls
spec:
  targets:
  - name: opendj
  peers:
  - mtls: {}

For the ldap server but it's not connecting. While trying to use the tls spec in gateway.yaml I am getting this error

Error: admission webhook "pilot.validation.istio.io" denied the request: configuration is invalid: server cannot have TLS settings for non HTTPS/TLS ports

And the logs from opendj server

INFO - entrypoint - 2020-06-17 12:49:44,768 - Configuring OpenDJ.
WARNING - entrypoint - 2020-06-17 12:49:48,987 - 
Unable to connect to the server at
"oj-opendj-0.opendj.default.svc.cluster.local" on port 4444


WARNING - entrypoint - 2020-06-17 12:49:53,293 - 
Unable to connect to the server at
"oj-opendj-0.opendj.default.svc.cluster.local" on port 4444

Can someone please help me out how I should approach this.

Answer 1

To Enable non-https traffic over TLS connections you have to use Protocol TLS. TLS implies the connection will be routed based on the SNI header to the destination without terminating the TLS connection. You can check this .

  - port:
      number: 4444
      name: tls
      protocol: TLS
    hosts:
    - "*"
    tls:
      mode: SIMPLE # enable https on this port
      credentialName: tls-certificate # fetch cert from k8s secret

Please check this istio documentation also.