Is this compatible with cluster-local-domain-tls: Enabled ?

[Resousse]

I'm trying to make my knative setup (using istio + API Gateway) e2e encrypted, however I'm having trouble making it.
My external APIGateway is supporting a letsencrypt certificate with success.
However the flow redirection from the external to the local gateway seems to not been encrypted.
I'm trying lot of stuff using PeerAuthentication & DestinationRule, but no success as of now...

Has anyone configured a knative setup with API Gateway using full flow encryption successfully?

[dprotaso]

I see you mention - cluster-local-domain-tls: Enabled and PeerAuthentication & DestinationRule

If you're using Istio then you should be using mesh and not enabling cluster-local-domain. It's not expected that you try to use the two together since mesh will provide you encryption over each hop.

Note - mesh support via net-gateway-api plugin is not yet supported (it hasn't been implemented) you'll want to use https://github.com/knative-extensions/net-istio. Though I'm not clear if enabling ambient just works out of the box (it might but we don't test it)

[Resousse]

ohh ok, I see. Thanks!
But my API gateway runs on a istio, so why native istio mesh couldn't work ? (sorry just a naive question)

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.