Skip to main content

Istio

info

Please make sure the Speedscale Operator is installed before configuring Istio support.

Istio is a service mesh offering that modifies a cluster to provide, among other things, traffic and network management.

External Networking Requirements

Speedscale pods in the the speedscale namespace, as well as the generator and responder pods that are deployed during traffic replays require external internet access. If your istio installation is configured with an outbound traffic policy of REGISTRY_ONLY rather than ALLOW_ANY, meaning that only whitelisted services can be accessed from within the cluster (see OutboundTrafficPolicy), you will to configure ServiceEntry resources that allow the following MESH_EXTERNAL access:

HostProtocolDirection
app.speedscale.comHTTPSOutbound
firehose.us-east-1.amazonaws.comHTTPSOutbound
sqs.us-east-1.amazonaws.comHTTPSOutbound
sns.us-east-1.amazonaws.comHTTPSOutbound
s3.us-east-1.amazonaws.comHTTPSOutbound
*.s3.us-east-1.amazonaws.comHTTPSOutbound
sts.amazonaws.comHTTPSOutbound
sts.us-east-1.amazonaws.comHTTPSOutbound
monitoring.us-east-1.amazonaws.comHTTPSOutbound
gcr.ioHTTPSOutbound
caution

These hosts are subject to change and security via TLS is recommended as opposed to IP whitelisting. If you require a list of IPs, they can be programmatically accessed as shown here for AWS and here for GCR.

For example:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: speedscale-external-svc-https
namespace: speedscale
spec:
hosts:
- app.speedscale.com
- firehose.us-east-1.amazonaws.com
- sqs.us-east-1.amazonaws.com
- sns.us-east-1.amazonaws.com
- s3.us-east-1.amazonaws.com
- "*.s3.us-east-1.amazonaws.com"
- sts.amazonaws.com
- sts.us-east-1.amazonaws.com
location: MESH_EXTERNAL
ports:
- name: https
number: 443
protocol: TLS
resolution: NONE

Speedscale Sidecar Configuration

Istio makes use of a proxy known as Envoy, which it adds as a sidecar to workloads that reside within the mesh. Both the Istio and Speedscale sidecars act as transparent proxies: each must modify iptables routing rules in order to intercept both ingress and egress traffic. Unfortunately, they cannot coexist when operating in this mode since both are attempting to intercept and manage workload traffic.

Istio is supported by Speedscale despite this conflict, but requires a few extra steps.

Within an Istio mesh, the Speedscale sidecar must operate as a non-transparent proxy; a reverse proxy for inbound traffic and a forward proxy for outbound traffic. This requires two things:

  1. Envoy must be configured to send ingress traffic to the Speedscale reverse proxy, which is done automatically by the Speedscale Operator via an Istio Sidecar resource.
  2. Your application must be configured to use an outbound proxy

Add Workload Annotations

Begin by adding the following annotations to your Kubernetes workload along with any other sidecar annotations:

sidecar.speedscale.com/inject: "true"
sidecar.speedscale.com/proxy-type: dual
sidecar.speedscale.com/proxy-protocol: tcp:http

Note: the proxy-protocol annotation shown above will operate the outbound, forward proxy as an HTTP proxy. If your application needs so use a SOCKS4 or SOCKS5 proxy, use tcp:socks. See proxy modes for more information.

Configure Outbound TLS Support

Outbound TLS support for the Speedscale sidecar can be enabled with the annotation sidecar.speedscale.com/tls-out: "true". You may be required to perform additional steps if your application and not Envoy is originating TLS requests. See Trusting TLS Certificates for more information.

Configuring Your Application Proxy Server

Every language has it's own nuances for how it works with a forward proxy server for outbound traffic. Select your language to see well-known patterns for that language.

Golang supports HTTP_PROXY and HTTPS_PROXY environment variables to configure outbound http or https requests.

spec:
template:
spec:
containers:
- env:
- name: HTTP_PROXY
value: http://127.0.0.1:4140
- name: HTTPS_PROXY
value: http://127.0.0.1:4140

Allow Egress Speedscale Traffic (Optional)

If your Istio installation and sidecar control which subset of egress traffic is allowable, you may need to add the speedscale namespace to the sidecar's egress configuration. This step is not necessary if you do not have custom sidecar configuration. Here is an example from the Istio docs:

apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
name: default
namespace: prod-us1
spec:
egress:
- hosts:
- "speedscale/*"

Ensure VirtualService Contains Host (Optional)

If your service is accessible both outside and inside the cluster, make sure the Istio VirtualService contains the same host. See the Istio documentation for more information.

Get In Touch

Istio allows for numerous different networking configuration options that can become difficult to navigate. Please be sure to consult the Istio documentation or reach out to Speedscale directly for more information or assistance.