Questions tagged [istio]

Use this tag if a question is about Istio, which can be used to connect, secure, control, and observe services.

Filter by
Sorted by
Tagged with
0 votes
0 answers
20 views

Any good pattern to deploy and maintain multiple helm-released API version routes along with Istio Virtual Service routing?

I am deploying multiple API versions (helm chart) from automated pipeline and I want to deploy an Istio virtual service to establish routing to those version (/v1, /v2, etc.). Each of these API helm ...
user avatar
0 votes
0 answers
14 views

Istio WorkloadEntry is not using DestinationRule

Is it possible to make WorkloadEntry to use DestinationRule? I am unable to make this configuration to work: apiVersion: networking.istio.io/v1alpha3 kind: WorkloadEntry metadata: name: we spec: ...
user avatar
  • 101
0 votes
0 answers
13 views

Making Istio Gateway accessible from another machine

I have a minikube cluster with Istio and I have configured an Istio Gateway as described here. If I curl from the machine, where the cluster is, to the gateway everything works fine. However I want to ...
user avatar
  • 13
0 votes
0 answers
258 views

Istio Virtual Service Routing for RabbitMQ amqp protocol

I have setup my services using Istio Virtual Services. The URLs that applications external to the Kubernetes cluster use are controlled by a set of Gateway and Virtual Service resources that allow me ...
user avatar
  • 172
0 votes
1 answer
55 views

How to setup custom authentication and authorization in Istio/K8?

As I am new to istio world. I am having difficulty understanding how that technology's auth system work. Let's say, I have a project that has 8 pods(services). I understand that authentication and ...
user avatar
2 votes
1 answer
36 views

Istio Keeps On Showing TcpProxyValidationError Errors

I initially created an EnvoyFilter to apply idle_timeout of 5s to outbound requests originating from workloads with label app: mecha-dev. apiVersion: networking.istio.io/v1alpha3 kind: EnvoyFilter ...
user avatar
1 vote
1 answer
86 views

TLS handshake failure

We have an ODBC Driver trying to connect through TLS , but fails. We tested using openssl with the following command and worked fine: openssl s_client -connect xxx.com:31020 the server accepts TLS 1....
user avatar
  • 121
0 votes
1 answer
53 views

Istio Virtual service - enforce specific api version

I am having troubles creating an object within specific api group it gets switced from alpha to beta, why? networking.istio.io/v1beta1 vs networking.istio.io/v1alpha3 Note: I can control in the crd ...
user avatar
3 votes
0 answers
774 views

Istio - corsPolicy allowOrigin from virtualService not blocking curl requests from different origins

Bug description 1.2.2/1.2.10/1.4.0/1.5.1/1.5.2/1.5.3/1.5.4/1.6.0 - allowOrigins not blocking curl requests from different origins. Security vulnerability scan has detected this. When I curl if a ...
user avatar
1 vote
1 answer
22 views

Istio: envoy proxy to https container in same pod

I've got a container that runs a https service on port 9999. The service is as follows: apiVersion: v1 kind: Service metadata: labels: role: pingfederate2 name: pingfederate2 spec: ports: ...
user avatar
-1 votes
1 answer
1k views

upstream connect error or disconnect/reset before headers. reset reason: connection failure

I am deploying a virtual service and gateway but when I run it on browser get the below error: upstream connect error or disconnect/reset before headers. reset reason: connection failure I deployed ...
user avatar
0 votes
1 answer
265 views

Replace/Consume Istio's Prometheus/Grafana by existing Prometheus-operator

I have multiple K8S clusters that have Prometheus-operator Helm chart installed in monitoring namespace. Each operator consists of Prometheus/Alertmanager/Grafana. Aside from it I have Istio Helm ...
user avatar
0 votes
1 answer
61 views

How to scale the control plane of a service mesh?

Scalability in the data plane is easy to achieve by simply having more replicas. The configuration the proxies receive from the control plane makes that possible . However, if the number of services (...
user avatar
11 votes
5 answers
122k views

How to solve 'upstream connect error or disconnect/reset before headers. reset reason: connection termination' in Istio?

I try to setup an aws load balancer (ELB) with SSL follow the instruction at #6566 Certificate was attached on ELB. However, I got the issue "upstream connect error or disconnect/reset before ...
user avatar
  • 251
2 votes
0 answers
89 views

What security loopholes does Istio tackle?

My application consists of four microservices. (hr, salary, stock and employee). Users of the application access the "hr" service using http. To fulfill this request the hr microservice communicates ...
user avatar
  • 203
0 votes
1 answer
135 views

Kubernetes - Internal only API Endpoints

Hypothetical question. Say we have a Java application running in a Kubernetes pod (single docker container) that has 'public' endpoints and 'internal' endpoints. The /public endpoints should be ...
user avatar