-
Notifications
You must be signed in to change notification settings - Fork 7.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ip6tables ISTIO_OUTBOUND chain missing "catch-dport" rules #30868
Comments
istio/tools/istio-iptables/pkg/cmd/run.go Lines 502 to 509 in e282a1f
|
Looks to me like the entire istio/tools/istio-iptables/pkg/cmd/run.go Line 286 in e282a1f
By the way, is it intentional that (almost) all IPv6 rules (inbound and outbound both) are created in |
cc @jacob-delgado for keeping this in mind and making it unstale. |
Not stale..working on it. |
ip6tables now includes the rule to redirect traffic to Envoy for the outbound ports listed using the annotation traffic.sidecar.istio.io/includeOutboundPorts
ip6tables now includes the rule to redirect traffic to Envoy for the outbound ports listed using the annotation traffic.sidecar.istio.io/includeOutboundPorts
ip6tables now includes the rule to redirect traffic to Envoy for the outbound ports listed using the annotation traffic.sidecar.istio.io/includeOutboundPorts
* Fixes #30868. Added the missing ip6tables rule. ip6tables now includes the rule to redirect traffic to Envoy for the outbound ports listed using the annotation traffic.sidecar.istio.io/includeOutboundPorts * Added test case to check ipv6 rules when outbound ports are included * Added release notes * Updated releasenotes/notes/30868.yaml Co-authored-by: sharathchandra <sharath.chandra.balachandra@est.tech>
* Fixes #30868. Added the missing ip6tables rule. ip6tables now includes the rule to redirect traffic to Envoy for the outbound ports listed using the annotation traffic.sidecar.istio.io/includeOutboundPorts * Added test case to check ipv6 rules when outbound ports are included * Added release notes * Updated releasenotes/notes/30868.yaml Co-authored-by: sharathchandra <sharath.chandra.balachandra@est.tech>
…33439) * Fixes istio#30868. Added the missing ip6tables rule. ip6tables now includes the rule to redirect traffic to Envoy for the outbound ports listed using the annotation traffic.sidecar.istio.io/includeOutboundPorts * Added test case to check ipv6 rules when outbound ports are included * Added release notes * Updated releasenotes/notes/30868.yaml Co-authored-by: sharathchandra <sharath.chandra.balachandra@est.tech>
Bug description
When deploying applications into the service mesh in an IPv6 cluster with a
traffic.sidecar.istio.io/includeOutboundPorts
annotation, the respective ip6tables rule to redirect traffic on the specified destination port(s) to Envoy is missing. The corresponding IPv4 iptables rule is created correctly.[ ] Docs
[ ] Installation
[X] Networking
[ ] Performance and Scalability
[ ] Extensions and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
[ ] Upgrade
Expected behavior
Ip6tables rule is created analogously to iptables rule
Steps to reproduce the bug
Deploy sleep pod with a sidecar container and the
traffic.sidecar.istio.io/includeOutboundPorts=12345
annotation in an IPv6 clusterVersion (include the output of
istioctl version --remote
andkubectl version --short
andhelm version --short
if you used Helm)1.8.3
How was Istio installed?
Helm
Environment where the bug was observed (cloud vendor, OS, etc)
The text was updated successfully, but these errors were encountered: