1

I'm Trying to understand how Istio envoy proxy works when outboundTrafficPolicy mode is set to REGISTRY_ONLY. With the setup defined below I would expect that the inside pod would be blocked from accessing the outside pod since the sidecar.istio.inject label is set to "false" for the outside pod and "true" for the inside pod. However when I exec into the inside pod and issue a curl command I get a success .

kubectl -n istio-test exec -it inside-85f794ff76-7x44s -c sleep -- curl  http://outside
<html><body><h1>It works!</h1></body></html>

Configuration Setup

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: outside
  name: outside
  namespace: istio-test
spec:
  ports:
  - name: 80-80
    port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: outside
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: inside
  name: inside
  namespace: istio-test
spec:
  ports:
  - name: 80-80
    port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: inside
  clusterIP: None
  type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: outside
  name: outside
  namespace: istio-test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: outside
  template:
    metadata:
      labels:
        app: outside
        version: v1
        sidecar.istio.io/inject: "false"
    spec:
      containers:
      - image: httpd
        name: httpd
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: inside
  name: inside
  namespace: istio-test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: inside
  template:
    metadata:
      labels:
        app: inside
        version: v1
        sidecar.istio.io/inject: "true"
    spec:
      containers:
      - image: curlimages/curl
        name: sleep
        command:
        - /bin/sleep
        - infinity
---
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: default
  namespace: istio-test
spec:
  workloadSelector:
    labels:
      app: inside
  outboundTrafficPolicy:
    mode: REGISTRY_ONLY

I was expecting to need a ServiceEntry to register the external pod. Why does this not appear to be the case?

How can I block traffic from the inside pod to the outside pod?

Improve this question

2 Answers 2

Reset to default
1

I've installed Istio in a fresh cluster:

alias k=kubectl
alias i=istioctl

curl -L https://istio.io/downloadIstio | sh -
export PATH="$PATH:/path/to/istio-1.20.1/bin"

i install --set profile=minimal
k create ns istio-test
k label ns/istio-test istio-injection=enabled
k apply -f question.yaml  # your YAML manifest

You are right saying inside can call outside:

k -n istio-test exec -it inside-6bcff479d-c5dfp -c sleep -- curl outside
<html><body><h1>It works!</h1></body></html>

This is because using your sidecar object config together with the default mesh settings, Istio agents running alongside your pods within the mesh are going to get the details of all services in all namespaces within your cluster:

i pc c inside-6bcff479d-c5dfp -n istio-test
SERVICE FQDN                                 PORT      SUBSET     DIRECTION     TYPE             DESTINATION RULE
                                             80        -          inbound       ORIGINAL_DST     
BlackHoleCluster                             -         -          -             STATIC           
InboundPassthroughClusterIpv4                -         -          -             ORIGINAL_DST     
PassthroughCluster                           -         -          -             ORIGINAL_DST     
agent                                        -         -          -             STATIC           
inside.istio-test.svc.cluster.local          80        -          outbound      ORIGINAL_DST     
istiod.istio-system.svc.cluster.local        443       -          outbound      EDS              
istiod.istio-system.svc.cluster.local        15010     -          outbound      EDS              
istiod.istio-system.svc.cluster.local        15012     -          outbound      EDS              
istiod.istio-system.svc.cluster.local        15014     -          outbound      EDS              
kube-dns.kube-system.svc.cluster.local       53        -          outbound      EDS              
kube-dns.kube-system.svc.cluster.local       9153      -          outbound      EDS              
kubernetes.default.svc.cluster.local         443       -          outbound      EDS              
metrics-server.default.svc.cluster.local     443       -          outbound      EDS              
outside.istio-test.svc.cluster.local         80        -          outbound      EDS              
prometheus_stats                             -         -          -             STATIC           
sds-grpc                                     -         -          -             STATIC           
xds-grpc                                     -         -          -             STATIC           
zipkin                                       -         -          -             STRICT_DNS

Just see EDS entries above. If you want this to change, you can configure your Sidecar object with egress settings:

apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: default
  namespace: istio-test
spec:
  workloadSelector:
    labels:
      app: inside
  outboundTrafficPolicy:
    mode: REGISTRY_ONLY
  egress:
    - hosts:
        - ~/*

This makes Sidecar to be configured with no services from no namespaces:

i pc c -n istio-test inside-6bcff479d-c5dfp
SERVICE FQDN                      PORT     SUBSET     DIRECTION     TYPE             DESTINATION RULE
                                  80       -          inbound       ORIGINAL_DST     
BlackHoleCluster                  -        -          -             STATIC           
InboundPassthroughClusterIpv4     -        -          -             ORIGINAL_DST     
PassthroughCluster                -        -          -             ORIGINAL_DST     
agent                             -        -          -             STATIC           
prometheus_stats                  -        -          -             STATIC           
sds-grpc                          -        -          -             STATIC           
xds-grpc                          -        -          -             STATIC           
zipkin                            -        -          -             STRICT_DNS

Defining outboundTrafficPolicy as REGISTRY_ONLY means your pod won't be able to reach out to google.com:

k -n istio-test exec -it inside-6bcff479d-c5dfp -c sleep -- curl google.com -I
curl: (56) Recv failure: Connection reset by peer
command terminated with exit code 56

Adding egress configuration will make it unable to access other pods either:

k -n istio-test exec -it inside-6bcff479d-c5dfp -c sleep -- curl outside -I
curl: (56) Recv failure: Connection reset by peer
command terminated with exit code 56

REGISTRY_ONLY allows connectivity to the services configured by the Istio agent. If the agent is configured to access all services in the cluster, it will. It doesn't matter if these services themselves have Istio agents.

It is a good practice to configure Istio Sidecar objects to be able to access only the services they need to access. This not only helps security, but also reduces the overhead associated with propagating endpoint changes across all Istio-enabled pods. In bigger clusters this might be a big deal.

Improve this answer
0

I think this one is answered on stackoverflow with the same question, you may check this link.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .