Istio Ingress Gateway, VirtualService, and DestinationRule

Inbound 5G traffic requires either a standard Kubernetes Ingress or an Istio Ingress Gateway. Definitions for an Istio VirtualService and DestinationRule are also required.

Istio Ingress Gateway

It is possible to use a standard Kubernetes Ingress for 5G network traffic, or you can use an Istio Ingress Gateway instead. Istio Ingress Gateways can be configured in several ways. In the following example, the Istio Ingress Gateway offloads traffic from the HTTPS TLS connection addressed to chf.acme.com and validates using the certificate held in the chf-acme-credential secret in the istio-system namespace. 

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: matrixx-chf-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
 
    # HTTP/2 Traffic secured
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
      - "chf.acme.com"
    tls:
      mode: SIMPLE
      credentialName: chf-acme-credential

VirtualService

To route inbound traffic from the Istio ingress Gateway, create a VirtualService that accepts traffic from the Istio Ingress Gateway and sends it to the Kubernetes service for the CHF network function. Create the VirtualService in the istio-system namespace.

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: chf
spec:
  hosts:
  - "chf.acme.com"
  gateways:
  - matrixx-chf-gateway
  http:
 
  # Match HTTPS (HTTP2) Traffic
  - match:
    - uri:
        prefix: "/"
      port: 443
    route:
 
      # CHF (with Engine)
    - destination:
        port:
          number: 80
        host: sba-5gc-chf-ag1.matrixx-chf.svc.cluster.local
      weight: 100

DestinationRule

In addition to the VirtualService, you must create a DestinationRule to ensure that communication between the Istio Ingress Gateway and the CHF service is always upgraded to HTTP/2. Create the DestinationRule in the istio-system namespace.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: chf
spec:
  host: sba-5gc-chf-ag1.matrixx-chf.svc.cluster.local
  trafficPolicy:
    connectionPool:
      http:
        h2UpgradePolicy: UPGRADE