Questions tagged [istio]
The istio tag has no usage guidance.
28
questions
0
votes
1
answer
117
views
Istio ingress gateway cannot connect to more than one replica for a service
I'm setting up Istio in a new AWS EKS cluster and created a basic nginx deployment to test. When the deployment only has one replica, it works perfectly, responding in less than 100ms.
When I add one ...
- 111
0
votes
0
answers
40
views
Issues Setting Up Istio Gateway
I have an AKS cluster with 2 nodes
Node A. 10.216.6.229 Node B. 10.216.6.230
We do not have External Load Balancer, so Istio Gateway EXTERNAL-IP is . As per Get Started documentation, I used command ...
- 1
0
votes
0
answers
57
views
How do I preserve source IP with TLS PASSTHROUGH mode on an Istio ingress gateway
I have a pod that NEEDS to keep the client cert in tact and terminate TLS at the pod level. For that reason, I’ve got to use TLS passthrough mode.
However, I also need the source IP of the original ...
0
votes
0
answers
192
views
Istio - Prometheus - HPA Stack not communicating [ HPA could not calculate the number of replicas ]
I have cluster with 1 control panel and 2 nodes.
Istio is installed as Service Mesh.
I do request management via istio ingress.
I want it to automatically scale by sharing metrics between Kubernetes ...
- 1
0
votes
0
answers
135
views
Istio TCP Global Rate Limit
I am attempting to implement a global rate limit for tcp connections through the istio ingress gateway. I have followed the official docs for implementing a global http rate limiter service and ...
- 1
0
votes
0
answers
29
views
istio ingress controller fails to assign public ip because of 'Microsoft.Network/publicIPAddresses/join/action'
I'm trying to create an AKS service with static pre-defined public IP. For that I'm using terraform.
The important parts
resource "azurerm_public_ip" "public_ip" {
...
- 121
2
votes
2
answers
981
views
How can I get Egress Static IP per namespace within a EKS cluster
My current setup involves an EKS Cluster with multiple namespaces (multi-tenant) across many different EKS nodes in private subnets. I would like the egress traffic from the pods to have a dedicated ...
0
votes
0
answers
118
views
coreDNS flooded by istio (envoy)
When there are lots of external VMs which are accessible only via a firewall and there are multiple namespaces in the cluster, each with its own set of external VMs, you end up with a lot of ...
- 101
0
votes
0
answers
13
views
What should I do to deploy the Istio in a production Environment?
I want to know how can I increase the Istio components (control-plane) scale in a Kubernetes cluster?
can I use HPA for Istio components?
I think my deployment architecture is one Kubernetes cluster ...
0
votes
0
answers
60
views
How to deploy pods in aks when azure policy enabled?
With the dev account got from my employer, the azure policy is getting enabled by default.Even if I disable that, after 2 or 3 min, it is getting enabled again.
This is the policy page of kubernetes
...
- 379
0
votes
1
answer
696
views
istio gateway Not launching internal links, how to fix that?
I have deployed application in kubernetes.
It is working if we expose to a default load balancer service in azure kubernetes.
But, after setting a virtual service linked with istio ingress gateway, it ...
- 247
0
votes
1
answer
145
views
How to route all traffic to a service in Istio?
I have a virtual service yaml file with below lines.
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: nodeserver
spec:
hosts:
- "*"
gateways:
- node-...
- 247
0
votes
1
answer
366
views
istioctl kiali is not creating, how to fix that?
From the getting started link, I was able to create a gateway and the routing to bookinfo app provided in sample.
It got deployed and able to access the app from ingress gateway of istio.
The next ...
- 247
1
vote
2
answers
137
views
How do I configure routing for non-knative service in a Knative & Istio installed k8 cluster?
I have a Knative installed with Istio as networking layer (without injection)
The kubernetes cluster is using Istio ingress gateway as default ingress.
Most Knative service's routing are managed ...
- 11
1
vote
1
answer
305
views
How to setup custom authentication and authorization in Istio/K8?
Let's say, I have a project that has 8 pods(services). I understand that authentication and authorization are covered in Istio Gateway using jwt. So that every request is verified. But users with ...
- 13
1
vote
0
answers
224
views
aws-load-balancer-controller annotations not working
I'm trying to automatically start an ALB in my EKS cluster by using the aws-load-balancer-controller
This is what the logs of my deployment look like:
$ kubectl logs -n kube-system deployment.apps/aws-...
- 123
1
vote
1
answer
126
views
Istio Keeps On Showing TcpProxyValidationError Errors
I initially created an EnvoyFilter to apply idle_timeout of 5s to outbound requests originating from workloads with label app: mecha-dev.
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
...
- 23
1
vote
1
answer
605
views
Why is My Istio EnvoyFilter with TCP Idle Timeout Setting not working?
I have created an EnvoyFilter to apply TCP idle timeout to outbound requests. Here's my filter configuration:
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: tcp-idle-...
- 23
0
votes
1
answer
77
views
Istio Multi-master Multi-network Locality Failover Woes
I can't get "multi-primary multi-network" to play nice with locality failover (or locality load balancing for that matter). The endpoints are registered fine. The istio-system is labeled ...
- 260
0
votes
0
answers
90
views
Openshift Route - Cookie specification - Istio Routing
I have requirement to pass cookie or headers in openshift route to istio virtual service and decide the traffic routing based on cookie or header passed from route to virtualservice.
Please share ...
- 101
2
votes
1
answer
192
views
Jupyter notebook on kubernetes not being able to connect to outside docker service
Im running a kubernetes (kubeflow + k8s) pod with a jupyter notebook and a docker service outside of the kubernetes server, im currently trying to connect to a sql service but it keeps getting ...
- 31
1
vote
0
answers
111
views
Istio Multicluster: Terminate mTLS at Ingress Gateway for Non-proxied Service
I am writing a service to coordinate Istio control planes in a "replicated control planes" configuration. I have managed to programmatically create ServiceEntry objects that correctly route ...
- 260
2
votes
0
answers
519
views
Istio egress gateway HANDSHAKE_FAILURE_ON_CLIENT_HELLO with custom certs
What we ware trying to achieve is point mesh traffic to an external service via an egressgateway.
We tried several iterations, and now trying with an egressgateway in between.
The external service is ...
- 121
0
votes
1
answer
37
views
Canary with istio, what happen if app backend service is down/slow
App A is a Php application, service B is elasticsearch.
A is deployed via istio, with canary pattern.
A'canary and A'current use the same B service.
If B is getting slow or down, A'canary and A'...
- 1,209
0
votes
0
answers
36
views
Can a local proxy 'improve' network reliability?
Apologies for the fairly vague question but I have been working with Envoy as part of Istio recently and was wondering about one of the benefits of sidecar proxies in general
By configuring a proxy ...
- 233
1
vote
1
answer
5k
views
istio-proxy 403 error:'upstream connect error or disconnect/reset before headers. reset reason: connection failure'
We have deployed an application behind the istio ingress gateway and is accessible at test.domain.com/jenkinscore.We have used istio 1.4.5. The domain name is created for the istio ingress gateway ...
0
votes
1
answer
942
views
istio service mesh for east-west traffic management in kubernetes cluster
I am having the confusion regarding the some of use-case in our environment. First one is we will be having api gateway of our own for north/south traffic which our api gateway will be listening to ...
0
votes
1
answer
371
views
Envoy/Istio as reverse-proxy to explicit IP
I'd like to route like this (nginx pseudo-config):
server_name fou.example.com;
location "/Forskning" {
upstream https://185.102.32.26/;
}
location "/" {
upstream http://fou-web.fou.svc.cluster....
- 386