Pass SNI to origin + Istio ingress gateway

[BojanZelic]

I'm trying to configure the cloudflared tunnel to work with Istio. Istio Ingress Gateway uses SNI to match the request on where it routes traffic to. I can't seem to figure out a way that I could pass SNI information from cloudflared tunnel -> the origin automatically.

I can see that Host headers come through without issue. Is there a way to automatically get the SNI information from the original user request and pass it through?

I can manually hardcode it for every entry as a workaround for now.

What I'm trying to achieve:

credentials-file: "/var/run/cloudflared/<id>.json"
ingress:
- hostname: "*.mydomain.io"
  service: https://istio-ingressgateway.istio-system.svc.cluster.local
- service: http_status:404
tunnel: <id>

But this doesn't work and it's essentially the equivalent of this:

curl -v -HHost:host1.mydomain.io https://istio-ingressgateway.istio-system.svc.cluster.local

My current workaround:

credentials-file: "/var/run/cloudflared/<id>.json"
ingress:
- hostname: "host1.mydomain.io"
  originRequest:
    originServerName: host1.mydomain.io
  service: https://istio-ingressgateway.istio-system.svc.cluster.local
- hostname: "host2.mydomain.io"
  originRequest:
    originServerName: host2.mydomain.io
  service: https://istio-ingressgateway.istio-system.svc.cluster.local
- service: http_status:404
tunnel: <id>

Now this works and is the equivalent of:

 ISTIO_IP=$(dig +short istio-ingressgateway.istio-system.svc.cluster.local)
 curl -v -HHost:host1.mydomain.io--resolve "host1.mydomain.io:443:$ISTIO_IP" https://host1.mydomain.io -k

But I have to manually set every entry. Is there way to configure the cloudflared to pass SNI to the backend?

[patrickli]

This is not just limited to istio. Essentially any HTTPS host requires explicit configuration so the correct SNI can be passed to the backend.
If the SNI from the client can be passed on (unless overwritten via the originServerName option) then we can use a wildcard host config instead of explicit configuration.

[linuxgemini]

I am experiencing the same issue with Traefik as ingress, where Traefik will respond with the correct certificate per SNI with a default fallback to the self-signed TRAEFIK DEFAULT CERT. Setting noTLSVerify would fix the host selection issue, but with wildcard records things get a lot messier.

[buroa]

@sudarshan-reddy Any update on this?

[Hazmi35]

@sudarshan-reddy Any update on this?

Sorry to bump. But why do you close your PR? What happened?

[buroa]

@Hazmi35 Sorry, but that other implementation was not working. I went and dove into it again and got it working.

[jcsf]

This has been released on version 2024.4.0

[linuxgemini]

That's great news! AFAICT the dashboard at Cloudflare One is not updated yet to reflect the option; but you can update via the API endpoint for tunnel configurations (/accounts/:account_id/cfd_tunnel/:tunnel_id/configurations) to add "matchSNItoHost": true on originRequest for config.ingress[] and get it working.

[owenhaynes]

Has anyone experienced any issues with this? Can not tell if keep alive are causing some issues get a lot of flip flopping between 200 status and 404 because my downstream envoy keeps getting different requested_server_name that do not match the :authority

[hmoffatt]

This parameter (matchSNItoHost) is still missing from the documentation at https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/configure-tunnels/origin-configuration/

[huyz]

@hmoffatt matchSNIToHost is now documented: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/#matchsnitohost