Questions tagged [istio]
Use this tag if a question is about Istio, which can be used to connect, secure, control, and observe services.
23
questions
0
votes
0
answers
17
views
istio - whitelist particular ip/range for a virtualservice endpoint
With istio is it possible to whitelist particular ip/range for a virtualservice endpoint.
The use case I have endpoint that I want to expose through internal loadbalancer but only available for ...
1
vote
1
answer
23
views
In Istio, what controls throughput to a service?
I have a load testing application (jMeter) that is calling my service that is hosted in Kubernetes.
Summary
I have a service hosted in Kubernetes that seems to have limits placed on how many calls it ...
- 206
0
votes
0
answers
13
views
Can istio provide the caller identity to the application when using mTLS
In our istio cluster we are using mTLS for authentication/authorization.
This is nice but it would be great to pass on this identification to the target application so it could provide fine grained ...
- 1
0
votes
0
answers
17
views
Istio circuit breaker sending traffic to unhealthy Services
I'm quite new to istio and experimenting Istio circuit breaker concepts, for that I have configured the istio virtual service, destination rules and nginx pods.
My virtual service have two different ...
- 101
0
votes
1
answer
120
views
K8S: How to manage incoming traffic for multiple instances of the same app with isolated namespaces and unique subdomains using an Ingress Controller?
I am new to K8S and need help deploying multiple instances of the same app. Each instance needs to be isolated in its own namespace and must have two exposed services (backend and frontend) accessible ...
- 1
1
vote
0
answers
12
views
How to manage Service Meshes via Infrastructure as Code?
In our environment we have found infrastructure as code with YAMLs to be a relatively painless great experience using GIT and source control to commit YAMLs that then get deployed to various ...
- 111
2
votes
0
answers
293
views
Recommended way to uninstall Istio?
I installed Istio with istioctl and our cluster has multiple Istio control planes. So as part of upgrading to a new Istio version, I want to delete the older version. What is the recommended approach?
...
- 287
0
votes
1
answer
44
views
Gather kubectl logs data to an external service
When I run kubectl logs MyPodNameHere I get back the standard-out of that pod.
My company has a central logging service for all our applications and I would like to send the logs output to that ...
- 206
0
votes
0
answers
72
views
How to deploy sidecarless envoy in Istio using eBPF?
I read this very interesting article that shows how to use sidecarless envoy:
Sidecarless with eBPF or sidecar with Envoy proxy?
But it does not show any hands on as to how to deploy sidecarless envoy ...
- 255
0
votes
1
answer
70
views
Is there a "tracing" service that comes with Istio?
This page: https://istio.io/latest/docs/tasks/observability/gateways/#option-2-insecure-access-http
Shows how to setup external visibility to the telemetry addons for Istio. One of those is shown to ...
- 206
0
votes
0
answers
169
views
Any good pattern to deploy and maintain multiple helm-released API version routes along with Istio Virtual Service routing?
I am deploying multiple API versions (helm chart) from automated pipeline and I want to deploy an Istio virtual service to establish routing to those version (/v1, /v2, etc.). Each of these API helm ...
- 101
0
votes
1
answer
162
views
How to setup custom authentication and authorization in Istio/K8?
As I am new to istio world. I am having difficulty understanding how that technology's auth system work.
Let's say, I have a project that has 8 pods(services). I understand that authentication and ...
- 1
2
votes
1
answer
52
views
Istio Keeps On Showing TcpProxyValidationError Errors
I initially created an EnvoyFilter to apply idle_timeout of 5s to outbound requests originating from workloads with label app: mecha-dev.
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
...
- 23
1
vote
1
answer
166
views
TLS handshake failure
We have an ODBC Driver trying to connect through TLS , but fails.
We tested using openssl with the following command and worked fine:
openssl s_client -connect xxx.com:31020
the server accepts TLS 1....
- 121
0
votes
1
answer
144
views
Istio Virtual service - enforce specific api version
I am having troubles creating an object within specific api group it gets switced from alpha to beta, why? networking.istio.io/v1beta1 vs networking.istio.io/v1alpha3
Note: I can control in the crd ...
3
votes
0
answers
1k
views
Istio - corsPolicy allowOrigin from virtualService not blocking curl requests from different origins
Bug description
1.2.2/1.2.10/1.4.0/1.5.1/1.5.2/1.5.3/1.5.4/1.6.0 - allowOrigins not blocking curl requests from different origins. Security vulnerability scan has detected this. When I curl if a ...
1
vote
1
answer
80
views
Istio: envoy proxy to https container in same pod
I've got a container that runs a https service on port 9999.
The service is as follows:
apiVersion: v1
kind: Service
metadata:
labels:
role: pingfederate2
name: pingfederate2
spec:
ports:
...
- 121
-1
votes
1
answer
2k
views
upstream connect error or disconnect/reset before headers. reset reason: connection failure
I am deploying a virtual service and gateway but when I run it on browser get the below error:
upstream connect error or disconnect/reset before headers. reset reason: connection failure
I deployed ...
- 101
0
votes
1
answer
305
views
Replace/Consume Istio's Prometheus/Grafana by existing Prometheus-operator
I have multiple K8S clusters that have Prometheus-operator Helm chart installed in monitoring namespace. Each operator consists of Prometheus/Alertmanager/Grafana.
Aside from it I have Istio Helm ...
0
votes
1
answer
65
views
How to scale the control plane of a service mesh?
Scalability in the data plane is easy to achieve by simply having more replicas. The configuration the proxies receive from the control plane makes that possible . However, if the number of services (...
- 76
12
votes
5
answers
187k
views
How to solve 'upstream connect error or disconnect/reset before headers. reset reason: connection termination' in Istio?
I try to setup an aws load balancer (ELB) with SSL follow the instruction at #6566
Certificate was attached on ELB.
However, I got the issue "upstream connect error or disconnect/reset before ...
- 261
2
votes
0
answers
97
views
What security loopholes does Istio tackle?
My application consists of four microservices. (hr, salary, stock and employee). Users of the application access the "hr" service using http. To fulfill this request the hr microservice communicates ...
- 203
0
votes
1
answer
145
views
Kubernetes - Internal only API Endpoints
Hypothetical question.
Say we have a Java application running in a Kubernetes pod (single docker container) that has 'public' endpoints and 'internal' endpoints.
The /public endpoints should be ...
- 383