solo.io Traffic in ambient mesh, 10 Mar 2023

Previous Meeting

⏯

youtube image

►

From YouTube: Traffic in ambient mesh - Part 1: Istio CNI and node configuration

Description

In this video we talk about how sidecar proxies in the Istio service mesh are configured and explain the importance of the Istio CNI plugin and how it works in Istio ambient mesh.

A

Hi! in this series of videos, we'll talk about how traffic gets intercepted and how it flows.

A

In the ambient mesh. in this first video,, we'll start by looking at the sidecar proxies first,.

A

Then we'll talk about istio, cni plug-in and the role it plays in istio and istio ambient mesh.

A

But let's start with how sidecar proxies get configured to intercept traffic to and from a pod.

A

I have a three note cluster running on my machine, and next I'll install istio on this cluster.

A

Note that I'm not using ambient profile yet. we'll take a look at how the sidecar proxy configuration.

A

Works first. note that I am setting the privileged variable to true, and that's just because so I can.

A

Run the iptables command within that container.. Now that I have istio installed,, let's label the.

A

Namespace for injection and deploy the sleep and http bin pods. once the pods are deployed. We.

A

Can see that there are two containers in each bot:, the application container and the sidecar.

A

Proxy container.: let's look at the pod yaml to see what other stuff is in there., so we can see the two.

A

Containers, the application container, http bin in this case, and the istio proxy container,, which runs.

A

The proxy v2 image with the proxy sidecar and a couple of other arguments. now, in addition to.

A

These two containers there's also an istio init container that runs as dnf container.. Now the init.

A

Containers are run before any app containers in the pod.. In this case, the init container runs the.

A

Same image as the istio proxy container, the proxy v2 image. However, it passes in different arguments.

A

Now, what istio iptables command does together with these other arguments? Is it configures the ip.

A

Tables within the pod so that the traffic to and from the pod gets intercepted by the sidecar proxy.

A

So let's look at these rules quickly. now, because I installed istio with the proxy privilege setting.

A

Set to true, I'm able to use sudo inside the istio proxy container and view the iptables.

A

Now I'm not going into a lot of details here, but the gist is that these rules are here to.

A

Intercept traffic from and to the pod and to direct it to specific ports on the istio proxy.

A

For example, you might see and recognize a couple of ports like port 15008,. That's the.

A

Port, where all the inbound traffic is routed, to. port 15090 is the prometheus one. 15021, health.

A

Checks and so on.. Basically, the combination of all these iptable rules ensures that inbound.

A

And outbound traffic from the pod gets routed to the sidecar proxy.. Now, if we go back to the.

A

Yaml and look at the security context, next, we'll see that the init container adds the net admin.

A

And net raw capabilities to the pod., if you're not familiar with these capabilities, net admin allows.

A

The container to perform various network related operations, such as configure network interfaces,.

A

Modify ip firewall,, routing, tables, and so on, and the net raw allows the container to use the raw.

A

And packed sockets and bind to any address for transparent proxy. now, in order to deploy.

A

Containers that have these abilities, we need to have sufficient kubernetes rbac permissions to.

A

Do so. now I didn't run into any issues deploying it to my cluster,, but that's because I have admin.

A

Access to my cluster,, but typically one doesn't have that access and shouldn't have that access to.

A

The cluster just to deploy applications. now to get around that we can install istio and enable.

A

The use of a cni plugin. cni stands for container network interface and it allows us to write.

A

Plugins for configuring network interfaces., the container runtime in kubernetes talks to these.

A

Plugins whenever a pod gets created or deleted,, and there are total of four different operations.

A

Per the cni spec. now istio has its own cni, plugin called istio cni,, and this plugin replaces the istio.

A

Init container. functionally,. It accomplishes the same things as the init container,. However,.

A

The difference is that, while the cni plugin itself still requires elevated rbac, permissions,.

A

The application pods don't require that anymore. I've set up another cluster, and this time I will.

A

Install istio using the ambient profile. you'll notice that, in addition to istiod, the z-tunnel.

A

Daemon set is also being deployed.. Now, if we look at the pods,- and I have a cluster with three nodes,.

A

You'll see that the istio cni plugin is running on each node,, as well as the z-tunnel proxy.

A

We can deploy the same workloads as earlier the http bin and sleep, but this time there's.

A

No sidecar proxy, that's being injected., there's only one app container running in the pod.

A

Since there's nothing being done in the pods anymore,, we can look at the node instead.. I'm.

A

Running a cluster using kind,, which runs the docker containers,, so I can shell inside one of the nodes.

A

From within the node,, I can run the same: iptable save command as before,, but this time you'll see.

A

There's a lot of rules that are being added to the iptables,. However, the rules that we're.

A

Interested in are the ones that are prefixed with the word z-tunnel. using iptables and geneve tunnels.

A

Is one way istio cni can set up the network for the ambient mesh.? The other way is to use ebpf,.

A

Which we'll talk about in one of the future videos. in the next video we'll go into more details and.

A

Explain how these iptables rules work and how the traffic gets routed to and from the z-tunnel proxy.