Istio: Retrieving certificate details of another pod - istio

Question

I'm trying to understand how mTLS is implemented in Istio and came up with the below scenario.
In my setup I have a namespace foo with two pods as below:
NAME READY STATUS RESTARTS AGE
httpbin-75b47445c9-gscrn 2/2 Running 0 1d
sleep-6777b55c98-tlqb6 2/2 Running 0 1d
My requirement is to retrieve the public certificate of httpbin from sleep.(Just for testing purposes)
So I get an interactive shell inside sleep and execute the below command.
curl --insecure -v http://httpbin.foo:8000/ip 2>&1 | awk 'BEGIN { cert=0 } /^\* SSL connection/ { cert=1 } /^\*/ { if (cert) print }'
But I'm not getting any output from it.
However, if I replace http://httpbin.foo:8000/ip with http://google.com I can get the certificate details correctly.
Can you please explain what is happening here.

Answer 1

Note that when you run curl http://httpbin.foo:8000 from an Istio-injected pod, the following happens:
Your HTTP request arrives to the Istio sidecar proxy of your pod (sleep)
The sidecar proxy encapsulates your request into mTLS connection to httpbin.foo:8000
The sidecar proxy of httpbin.foo performs TLS termination (decapsulates the original HTTP request) and forwards it to the httpbin.foo service
The httpbin.foo service receives the original, plain HTTP request
The httpbin.foo service sends a plain HTTP response
The sidecar proxy of httpbin.foo encapsulates the response and returns the response to your sidecar proxy
Your sidecar proxy returns the response back to your curl
Note that your curl will get plain HTTP response of the httpbin.foo service, which is unaware of Istio mTLS. Istio mTLS is like a tunnel for the communication between your curl and httpbin.foo, the certificate from the tunnel will not be returned to your curl.
To get the certificate of the sidecar proxy of httpbin.foo, you need to send a request to httbin.foo service directly (it will arrive to the sidecar proxy of httpbin.foo), bypassing the Istio sidecar proxy of your source pod (sleep).
For that you can deploy the sleep pod to some namespace without Istio injection, and then use openssl to retrieve the certificate:
kubectl create namespace without-istio
kubectl apply -f samples/sleep/sleep.yaml -n without-istio
kubectl exec -it $(kubectl get pod -l app=sleep -n without-istio -o jsonpath={.items..metadata.name}) -n without-istio -c sleep -- openssl s_client -connect httpbin.foo:8000