Questions tagged [istio]

Use this tag if a question is about Istio, which can be used to connect, secure, control, and observe services.

Filter by
Sorted by
Tagged with
0 votes
1 answer
251 views

How to use uriRegexRewrite in Istio VirtualService?

I was waiting on the Regex Rewrite based on Capture Groups for a long time and it was finally merged in 1.19.4. I cannot find much documentation regarding how to use the uriRegexRewrite and my ...
Sinux's user avatar
  • 1
0 votes
0 answers
7 views

Canarydeployment of AKS based applications using istio

We were trying to enable canary based deployment for our aks based applications using istio feature and HELM templates. By referring the documents provided in medium , intex we tried the solution as ...
Vowneee's user avatar
  • 101
0 votes
0 answers
12 views

istioctl manifest apply with custom parameters

I want to apply the default manifest with some custom parameters such as namespace and tolerations but I have no idea how to pass tolerations parameters into the manifest. and I used the command and ...
alice chan's user avatar
0 votes
0 answers
37 views

How do I expose a GRPC service with Istio on Kubernetes?

Trying to setup grpc service via istio ingress controller I can access istio http, but not grpc. Service grpc is working. Ingress is here: apiVersion: networking.k8s.io/v1 kind: Ingress metadata: ...
Alex Anonym's user avatar
0 votes
0 answers
40 views

Kubernetes Gateway API - Using HTTPRoute rules to rewrite URI paths

My goal is to have a single Gateway that can be used to host multiple applications at different paths. The URLRewrite filter exists, however, when it does not seem to be working as expected. Using ...
TJ Zimmerman's user avatar
0 votes
0 answers
35 views

istio - whitelist particular ip/range for a virtualservice endpoint

With istio is it possible to whitelist particular ip/range for a virtualservice endpoint. The use case I have endpoint that I want to expose through internal loadbalancer but only available for ...
anVzdGFub3RoZXJodW1hbg's user avatar
1 vote
1 answer
50 views

In Istio, what controls throughput to a service?

I have a load testing application (jMeter) that is calling my service that is hosted in Kubernetes. Summary I have a service hosted in Kubernetes that seems to have limits placed on how many calls it ...
Vaccano's user avatar
  • 206
0 votes
0 answers
29 views

Can istio provide the caller identity to the application when using mTLS

In our istio cluster we are using mTLS for authentication/authorization. This is nice but it would be great to pass on this identification to the target application so it could provide fine grained ...
MarkJ's user avatar
  • 1
0 votes
0 answers
32 views

Istio circuit breaker sending traffic to unhealthy Services

I'm quite new to istio and experimenting Istio circuit breaker concepts, for that I have configured the istio virtual service, destination rules and nginx pods. My virtual service have two different ...
Debugger's user avatar
  • 101
0 votes
1 answer
198 views

K8S: How to manage incoming traffic for multiple instances of the same app with isolated namespaces and unique subdomains using an Ingress Controller?

I am new to K8S and need help deploying multiple instances of the same app. Each instance needs to be isolated in its own namespace and must have two exposed services (backend and frontend) accessible ...
Kardier's user avatar
1 vote
0 answers
13 views

How to manage Service Meshes via Infrastructure as Code?

In our environment we have found infrastructure as code with YAMLs to be a relatively painless great experience using GIT and source control to commit YAMLs that then get deployed to various ...
Joshua Enfield's user avatar
2 votes
0 answers
466 views

Recommended way to uninstall Istio?

I installed Istio with istioctl and our cluster has multiple Istio control planes. So as part of upgrading to a new Istio version, I want to delete the older version. What is the recommended approach? ...
Rocky Hai's user avatar
  • 287
0 votes
1 answer
63 views

Gather kubectl logs data to an external service

When I run kubectl logs MyPodNameHere I get back the standard-out of that pod. My company has a central logging service for all our applications and I would like to send the logs output to that ...
Vaccano's user avatar
  • 206
0 votes
0 answers
75 views

How to deploy sidecarless envoy in Istio using eBPF?

I read this very interesting article that shows how to use sidecarless envoy: Sidecarless with eBPF or sidecar with Envoy proxy? But it does not show any hands on as to how to deploy sidecarless envoy ...
Biju's user avatar
  • 255
0 votes
1 answer
81 views

Is there a "tracing" service that comes with Istio?

This page: https://istio.io/latest/docs/tasks/observability/gateways/#option-2-insecure-access-http Shows how to setup external visibility to the telemetry addons for Istio. One of those is shown to ...
Vaccano's user avatar
  • 206
0 votes
0 answers
190 views

Any good pattern to deploy and maintain multiple helm-released API version routes along with Istio Virtual Service routing?

I am deploying multiple API versions (helm chart) from automated pipeline and I want to deploy an Istio virtual service to establish routing to those version (/v1, /v2, etc.). Each of these API helm ...
ThatChrisGuy's user avatar
0 votes
1 answer
176 views

How to setup custom authentication and authorization in Istio/K8?

As I am new to istio world. I am having difficulty understanding how that technology's auth system work. Let's say, I have a project that has 8 pods(services). I understand that authentication and ...
coolisuz's user avatar
2 votes
1 answer
54 views

Istio Keeps On Showing TcpProxyValidationError Errors

I initially created an EnvoyFilter to apply idle_timeout of 5s to outbound requests originating from workloads with label app: mecha-dev. apiVersion: networking.istio.io/v1alpha3 kind: EnvoyFilter ...
bakadevops's user avatar
1 vote
1 answer
214 views

TLS handshake failure

We have an ODBC Driver trying to connect through TLS , but fails. We tested using openssl with the following command and worked fine: openssl s_client -connect xxx.com:31020 the server accepts TLS 1....
Abba's user avatar
  • 121
0 votes
1 answer
169 views

Istio Virtual service - enforce specific api version

I am having troubles creating an object within specific api group it gets switced from alpha to beta, why? networking.istio.io/v1beta1 vs networking.istio.io/v1alpha3 Note: I can control in the crd ...
anVzdGFub3RoZXJodW1hbg's user avatar
3 votes
0 answers
2k views

Istio - corsPolicy allowOrigin from virtualService not blocking curl requests from different origins

Bug description 1.2.2/1.2.10/1.4.0/1.5.1/1.5.2/1.5.3/1.5.4/1.6.0 - allowOrigins not blocking curl requests from different origins. Security vulnerability scan has detected this. When I curl if a ...
anVzdGFub3RoZXJodW1hbg's user avatar
1 vote
1 answer
97 views

Istio: envoy proxy to https container in same pod

I've got a container that runs a https service on port 9999. The service is as follows: apiVersion: v1 kind: Service metadata: labels: role: pingfederate2 name: pingfederate2 spec: ports: ...
James Elliott's user avatar
-1 votes
1 answer
2k views

upstream connect error or disconnect/reset before headers. reset reason: connection failure

I am deploying a virtual service and gateway but when I run it on browser get the below error: upstream connect error or disconnect/reset before headers. reset reason: connection failure I deployed ...
kapil gupta's user avatar
0 votes
1 answer
323 views

Replace/Consume Istio's Prometheus/Grafana by existing Prometheus-operator

I have multiple K8S clusters that have Prometheus-operator Helm chart installed in monitoring namespace. Each operator consists of Prometheus/Alertmanager/Grafana. Aside from it I have Istio Helm ...
anVzdGFub3RoZXJodW1hbg's user avatar
0 votes
1 answer
67 views

How to scale the control plane of a service mesh?

Scalability in the data plane is easy to achieve by simply having more replicas. The configuration the proxies receive from the control plane makes that possible . However, if the number of services (...
jhamfler's user avatar
12 votes
5 answers
202k views

How to solve 'upstream connect error or disconnect/reset before headers. reset reason: connection termination' in Istio?

I try to setup an aws load balancer (ELB) with SSL follow the instruction at #6566 Certificate was attached on ELB. However, I got the issue "upstream connect error or disconnect/reset before ...
pcuong's user avatar
  • 261
2 votes
0 answers
97 views

What security loopholes does Istio tackle?

My application consists of four microservices. (hr, salary, stock and employee). Users of the application access the "hr" service using http. To fulfill this request the hr microservice communicates ...
Pasan W.'s user avatar
  • 203
0 votes
1 answer
151 views

Kubernetes - Internal only API Endpoints

Hypothetical question. Say we have a Java application running in a Kubernetes pod (single docker container) that has 'public' endpoints and 'internal' endpoints. The /public endpoints should be ...
Caledonia91's user avatar