Questions tagged [istio]

Use this tag if a question is about Istio, which can be used to connect, secure, control, and observe services.

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

How to check Istio Gateway and Virtual Service logs (on AWS EKS)?

I tried Istio for one micro service (on AWS EKS) in one of my applications at work. It works fine. However when I tried for another microservice, the curl request is sending 404. I would like to check ...
0
votes
0answers
12 views

With Istio, how can I ensure that traffic is coming from my proxy?

I would like to add a check to Istio to ensure that the source IP address is my load balancer. While not fool proof, I think it would make it more difficult for a attacker to spoof my proxy (where my ...
0
votes
1answer
14 views

How to setup custom authentication and authorization in Istio/K8?

As I am new to istio world. I am having difficulty understanding how that technology's auth system work. Let's say, I have a project that has 8 pods(services). I understand that authentication and ...
0
votes
0answers
9 views

Does Istio installation apply the service mesh on all clusters inside an AWS account?

Suppose I have the following 4 EKS clusters on my AWS account: my-cluster-1 my-cluster-2 my-cluster-3 my-cluster-4 Suppose I run the following commands: aws eks update-kubeconfig --region us-east-1 --...
0
votes
0answers
6 views

tls-origination: Invalid path istio when importing tls

I am intercepting a service at port 389 and applying tls-origination, so my destination rules is as follows: apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: ldap spec: ...
2
votes
1answer
23 views

Istio Keeps On Showing TcpProxyValidationError Errors

I initially created an EnvoyFilter to apply idle_timeout of 5s to outbound requests originating from workloads with label app: mecha-dev. apiVersion: networking.istio.io/v1alpha3 kind: EnvoyFilter ...
-1
votes
0answers
58 views

istiod reports “pilot_conflict_inbound_listener”

Every so often we see push status messages from istiod that report a pilot_conflict_inbound_listener. The conflicts appear to be reported for pods with more than one ClusterIP service pointing at them....
1
vote
1answer
62 views

TLS handshake failure

We have an ODBC Driver trying to connect through TLS , but fails. We tested using openssl with the following command and worked fine: openssl s_client -connect xxx.com:31020 the server accepts TLS 1....
0
votes
1answer
22 views

Istio Virtual service - enforce specific api version

I am having troubles creating an object within specific api group it gets switced from alpha to beta, why? networking.istio.io/v1beta1 vs networking.istio.io/v1alpha3 Note: I can control in the crd ...
2
votes
0answers
349 views

Istio - corsPolicy allowOrigin from virtualService not blocking curl requests from different origins

Bug description 1.2.2/1.2.10/1.4.0/1.5.1/1.5.2/1.5.3/1.5.4/1.6.0 - allowOrigins not blocking curl requests from different origins. Security vulnerability scan has detected this. When I curl if a ...
1
vote
1answer
16 views

Istio: envoy proxy to https container in same pod

I've got a container that runs a https service on port 9999. The service is as follows: apiVersion: v1 kind: Service metadata: labels: role: pingfederate2 name: pingfederate2 spec: ports: ...
-1
votes
1answer
987 views

upstream connect error or disconnect/reset before headers. reset reason: connection failure

I am deploying a virtual service and gateway but when I run it on browser get the below error: upstream connect error or disconnect/reset before headers. reset reason: connection failure I deployed ...
0
votes
1answer
225 views

Replace/Consume Istio's Prometheus/Grafana by existing Prometheus-operator

I have multiple K8S clusters that have Prometheus-operator Helm chart installed in monitoring namespace. Each operator consists of Prometheus/Alertmanager/Grafana. Aside from it I have Istio Helm ...
0
votes
1answer
56 views

How to scale the control plane of a service mesh?

Scalability in the data plane is easy to achieve by simply having more replicas. The configuration the proxies receive from the control plane makes that possible . However, if the number of services (...
9
votes
5answers
73k views

How to solve 'upstream connect error or disconnect/reset before headers. reset reason: connection termination' in Istio?

I try to setup an aws load balancer (ELB) with SSL follow the instruction at #6566 Certificate was attached on ELB. However, I got the issue "upstream connect error or disconnect/reset before ...
2
votes
0answers
84 views

What security loopholes does Istio tackle?

My application consists of four microservices. (hr, salary, stock and employee). Users of the application access the "hr" service using http. To fulfill this request the hr microservice communicates ...
0
votes
1answer
119 views

Kubernetes - Internal only API Endpoints

Hypothetical question. Say we have a Java application running in a Kubernetes pod (single docker container) that has 'public' endpoints and 'internal' endpoints. The /public endpoints should be ...