Requests being sent to Nginx reverse proxy in-pod receiving 502 error from Istio proxy

[brendonts]

Hey, I have an application pod in my Istio mesh that is utilizing nginx to forward requests to an endpoint like /auth/login/ to a backend server for authentication. A couple notes about my mesh:

• mTLS is enabled
• meshConfig.outboundTrafficPolicy.mode is set to REGISTRY_ONLY, service entries are configured
• I am routing all outbound traffic to egress gateways utilizing VirtualServices

The Nginx config is similar to below:

server {
    listen 5200;
    }

    location /auth/login/ {
        proxy_pass    http://my-server.my.domain;
        proxy_redirect          default;
        proxy_set_header     X-Forwarded-For $some_host;
        ....(removed for brevity and because I'm not allowed to post exact configs for my org)
}

As a side note, nginx does not seem to be setting the :authority header to proxy_pass and instead using the original application URL. I've tried using:

proxy_set_header Host http://my-server.my.domain;

to no avail.

Within the pod, I can successfully send/curl requests to http://my-server.my.domain and I have a service entry in place allowing the traffic. However the proxy functions as expected sending requests to /auth/login to http://my-server.my.domain in another namespace without Istio.

I enabled debug level component logging on my istio-proxy container logs and see the successful curl request to http://my-server.my.domain. However I see a 502 for the proxied requests initiated by application through nginx. I get an output similar to:

'status', '502'
'server', 'istio-envoy'
....

This brings up a few questions:

1. Why does Istio seemingly have a problem with requests from an nginx reverse proxy
2. Is there any documentation on what headers Istio/envoy uses or needs for routing requests?
3. Does anyone recommend anything further I can do to troubleshoot this?

I think I could work-around this utilizing a VirtualService to proxy requests to /auth/login instead of nginx but I'm trying to preserve the application design because it needs to run in different environments that may or may not have Istio.

[leesa123]

I'm having the same problem too. Has this issue been resolved?

[leesa123]

I think that the cause is nginx sends the proxy url converted from FQDN to IP address to envoy proxy