Deep Visibility and Enforcement with Istio Service Mesh
Secure workload provides comprehensive visibility and enforcement for all applications running within Kubernetes or OpenShift clusters that are enabled with Istio Service Mesh.
Following are key components and guidelines for effective segmentation of these applications:
Service Mesh Sidecars
Service Mesh uses sidecar proxies deployed with application containers to intercept and manage network traffic. Sharing the same network namespace as the application, these sidecars mediate all inbound and outbound network communication.
Traffic Enforcement
-
When implementing segmentation policies for Service Mesh enabled applications, it's essential to consider the additional ports used by sidecar proxies. These ports play a vital role in managing and securing the application's network traffic.
-
For the Service Mesh to remain intact and available, ensure your segmentation policies explicitly include rules for the ports used by sidecar proxies.
Supported Port and Protocol for Sidecar Proxy
Include the following ports while enforcing segmentation policies on Service Mesh enabled applications.
|
Port |
Protocol |
Description |
|---|---|---|
|
15000 |
TCP |
Envoy admin port (commands/diagnostics) |
|
15001 |
TCP |
Envoy outbound |
|
15004 |
HTTP |
Debug port |
|
15006 |
TCP |
Envoy inbound |
|
15008 |
HTTP2 |
HBONE mTLS tunnel port |
|
15020 |
HTTP |
Mereged Prometheus telemetry from Istio agent, Envoy, and application |
|
15021 |
HTTP |
Health Checks |
|
15053 |
DNS |
DNS port, if capture is enabled |
|
15090 |
HTTP |
Envoy Prometheus telemetry |
|
The above ports are the default ports used by Istio for Envoy sidecar proxy communication.If these ports have been updated in the Istio global Service Mesh configuration settings, use the updated ports in the applications. |
Supported Port and Protocol for Service Mesh Control Plane
Use the following port and protocol when segmenting the control plane.
|
Port |
Protocol |
Description |
|---|---|---|
|
443 |
HTTPS |
Webhook servie port |
|
8080 |
HTTP |
Debug Interface (deprecated, container port only) |
|
15010 |
GRPC |
XDS and CA services (Plaintext, only for secure networks) |
|
15012 |
GRPC |
XDS and CA services (TLS and mTLS, recommended for production use) |
|
15014 |
HTTP |
Control plane monitoring |
|
15017 |
HTTPS |
Webhook container port, forwarded from 443 |