15.1-mtls-settings.yaml

##################################################
# Test Name: Enable TLS to an external endpoint
# Test Number: 15.1
# Test Description:
#   - Turn on TLS to an external endpoint
##################################################
apiVersion: networking.mesh.gloo.solo.io/v1
kind: VirtualMesh
metadata:
  name: virtual-mesh
  namespace: gloo-mesh
spec:
  federation:                            # Enable automatic federation of all services to all clusters
    selectors:
      - {}
  meshes:
    - name: istiod-istio-system-cluster1
      namespace: gloo-mesh
    - name: istiod-istio-system-cluster2
      namespace: gloo-mesh
---
apiVersion: discovery.mesh.gloo.solo.io/v1
kind: Destination                        # Representaion of a non-mesh service for routing
metadata:
  name: httpbin
  namespace: gloo-mesh
spec:
  externalService:                       # httpbin.org external service
    endpoints:
    - address: httpbin.org
      ports:
        https: 443
    hosts:
    - httpbin.org                        # match on internal requests for httpbin.org
    name: httpbin
    ports:
    - name: http
      number: 80                         # internal port match, requires requests be to http://httpbin.org:80 and will be upgraded to HTTPS
      protocol: HTTP
---
apiVersion: networking.enterprise.mesh.gloo.solo.io/v1beta1
kind: VirtualGateway
metadata:
  name: ingress
  namespace: gloo-mesh
spec:
  ingressGatewaySelectors:
  - portName: http2                      # match on port name http2
    destinationSelectors:
    - kubeServiceMatcher:
        labels:
          istio: ingressgateway          # select all gateways with istio=ingressgateway label
        namespaces:
        - istio-system                   # only include istio-system namespace
  connectionHandlers:
  - http:
      routeConfig:
      - virtualHost:
          domains:
          - "frontend.solo.io"           # listen on frontend.solo.io
          routes:
          - name: httpbin
            routeAction:
              destinations:
              - staticDestination:       # route to httpbin destination
                  name: httpbin
                  namespace: gloo-mesh
            options:
              trafficPolicy:
                mtls:
                  istio:
                    tlsMode: SIMPLE      # enable tls to external endpoint