---
title: "Istio | Speedscale Docs"
description: "Configure Istio support with the Speedscale Operator to enable traffic management and seamless integration of Speedscale sidecars in your workloads."
canonical: "https://docs.speedscale.com/getting-started/installation/install/istio/"
---

[Documentation index](https://docs.speedscale.com/getting-started/llms.txt) | [Markdown](https://docs.speedscale.com/getting-started/installation/install/istio/index.md) | [Canonical page](https://docs.speedscale.com/getting-started/installation/install/istio/)

# Istio

info

Please make sure the [Speedscale Operator](https://docs.speedscale.com/getting-started/quick-start/) is installed before configuring Istio support.

[Istio](https://istio.io/) is a service mesh offering that modifies a cluster to provide, among other things, traffic and network management.

<a id="external-networking-requirements"></a>

## External Networking Requirements

Speedscale pods in the the `speedscale` namespace, as well as the `generator` and `responder` pods that are deployed during traffic replays require external internet access. If your istio installation is configured with an outbound traffic policy of `REGISTRY_ONLY` rather than `ALLOW_ANY`, meaning that only whitelisted services can be accessed from within the cluster (see [OutboundTrafficPolicy](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/#MeshConfig-OutboundTrafficPolicy)), you will to configure [ServiceEntry](https://istio.io/latest/docs/reference/config/networking/service-entry/) resources that allow the following `MESH_EXTERNAL` access:

| Host | Protocol | Direction |
| --- | --- | --- |
| app.speedscale.com | HTTPS | Outbound |
| downloads.speedscale.com | HTTPS | Outbound |
| firehose.us-east-1.amazonaws.com | HTTPS | Outbound |
| sqs.us-east-1.amazonaws.com | HTTPS | Outbound |
| sns.us-east-1.amazonaws.com | HTTPS | Outbound |
| s3.us-east-1.amazonaws.com | HTTPS | Outbound |
| \*.s3.us-east-1.amazonaws.com | HTTPS | Outbound |
| sts.amazonaws.com | HTTPS | Outbound |
| sts.us-east-1.amazonaws.com | HTTPS | Outbound |
| monitoring.us-east-1.amazonaws.com | HTTPS | Outbound |
| gcr.io | HTTPS | Outbound |
| speedscale.github.io | HTTPS | Outbound |

caution

These hosts are subject to change and security via TLS is recommended as opposed to IP whitelisting. If you require a list of IPs, they can be programmatically accessed as shown [here for AWS](https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html) and [here for GCR](https://www.gstatic.com/ipranges/cloud.json).

For example:

```yaml
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: speedscale-external-svc-https
  namespace: speedscale
spec:
  hosts:
    - app.speedscale.com
    - downloads.speedscale.com
    - firehose.us-east-1.amazonaws.com
    - sqs.us-east-1.amazonaws.com
    - sns.us-east-1.amazonaws.com
    - s3.us-east-1.amazonaws.com
    - "*.s3.us-east-1.amazonaws.com"
    - sts.amazonaws.com
    - sts.us-east-1.amazonaws.com
  location: MESH_EXTERNAL
  ports:
    - name: https
      number: 443
      protocol: TLS
  resolution: NONE
```

<a id="speedscale-sidecar-configuration"></a>

## Speedscale Sidecar Configuration

Istio makes use of a transparent proxy known as [Envoy](https://www.envoyproxy.io/), which is added as a sidecar to workloads that reside within the mesh. This sidecar, much like Speedscale's, also modified iptables rules in order to intercept traffic without any modification to a user's application.

No additional configuration is required to add the Speedscale sidecar to workloads that reside within an Istio mesh.

The Speedscale operator intelligently determines when Istio is present and configures workloads accordingly so that both transparent proxies operate in tandem. In addition, the Speedscale operator and sidecar are configured in such a way that they preserve the ability to use Istio mesh features such as mTLS.

Important

If your Istio installation is configured to use the [Istio CNI Agent](https://istio.io/latest/docs/setup/additional-setup/cni/), you _must_ annotate your workloads with the following annotation to maintain compatibility:

```text
sidecar.speedscale.com/istio-cni: "true"
```

Please be aware that Istio installations that leverage the CNI agent come with an inherent race condition where a pod may be scheduled and started on a node prior to the CNI Daemonset pod being ready. This is outlined in the [Istio documentation](https://istio.io/latest/docs/setup/additional-setup/cni/#race-condition--mitigation).

Sidecar capture is deprecated

For new Kubernetes installations with Istio, use the [eBPF collector](https://docs.speedscale.com/reference/ebpf-traffic-collection/). Follow the [sidecar installation guide](https://docs.speedscale.com/getting-started/installation/sidecar/install/) only for an existing deployment or when your workload does not meet the eBPF requirements.

<a id="allow-egress-speedscale-traffic-optional"></a>

## Allow Egress Speedscale Traffic (Optional)

If your Istio installation and sidecar control which subset of egress traffic is allowable, you may need to add the `speedscale` namespace to the sidecar's egress configuration. This step is not necessary if you do not have custom sidecar configuration. Here is an example from the Istio [docs](https://istio.io/latest/docs/reference/config/networking/sidecar/):

```yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: default
  namespace: prod-us1
spec:
  egress:
    - hosts:
        - "speedscale/*"
```

<a id="ensure-virtualservice-contains-host-optional"></a>

### Ensure VirtualService Contains Host (Optional)

If your service is accessible both outside and inside the cluster, make sure the Istio `VirtualService` contains the same host. See the Istio [documentation](https://istio.io/latest/docs/reference/config/networking/virtual-service/) for more information.

<a id="istio-debug-logs"></a>

### Istio debug logs

Apart from taking the usual debugging steps mentioned [here](https://docs.speedscale.com/guides/troubleshooting/) you can also increase the log level on the Istio sidecar by running the following command.

```sh
kubectl -n {YOUR NAMESPACE} exec -it {POD NAME}-c istio-proxy  -- sh -c "curl -X POST  localhost:15000/logging?level=debug"
```

<a id="get-in-touch"></a>

## Get In Touch

Istio allows for numerous different networking configuration options that can become difficult to navigate. Please be sure to consult the Istio [documentation](https://istio.io/latest/docs/) or reach out to Speedscale directly for more information or assistance.