{"action":"closed","issue":{"url":"https://api.github.com/repos/istio/istio/issues/1476","repository_url":"https://api.github.com/repos/istio/istio","labels_url":"https://api.github.com/repos/istio/istio/issues/1476/labels{/name}","comments_url":"https://api.github.com/repos/istio/istio/issues/1476/comments","events_url":"https://api.github.com/repos/istio/istio/issues/1476/events","html_url":"https://github.com/istio/istio/issues/1476","id":271140314,"number":1476,"title":"Egress rule must support Mongo/Redis/TCP services","user":{"login":"kyessenov","id":9537734,"avatar_url":"https://avatars2.githubusercontent.com/u/9537734?v=4","gravatar_id":"","url":"https://api.github.com/users/kyessenov","html_url":"https://github.com/kyessenov","followers_url":"https://api.github.com/users/kyessenov/followers","following_url":"https://api.github.com/users/kyessenov/following{/other_user}","gists_url":"https://api.github.com/users/kyessenov/gists{/gist_id}","starred_url":"https://api.github.com/users/kyessenov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kyessenov/subscriptions","organizations_url":"https://api.github.com/users/kyessenov/orgs","repos_url":"https://api.github.com/users/kyessenov/repos","events_url":"https://api.github.com/users/kyessenov/events{/privacy}","received_events_url":"https://api.github.com/users/kyessenov/received_events","type":"User","site_admin":false},"labels":[{"id":737750176,"url":"https://api.github.com/repos/istio/istio/labels/pilot","name":"pilot","color":"c11783","default":false}],"state":"closed","locked":false,"assignee":{"login":"vadimeisenbergibm","id":16784982,"avatar_url":"https://avatars1.githubusercontent.com/u/16784982?v=4","gravatar_id":"","url":"https://api.github.com/users/vadimeisenbergibm","html_url":"https://github.com/vadimeisenbergibm","followers_url":"https://api.github.com/users/vadimeisenbergibm/followers","following_url":"https://api.github.com/users/vadimeisenbergibm/following{/other_user}","gists_url":"https://api.github.com/users/vadimeisenbergibm/gists{/gist_id}","starred_url":"https://api.github.com/users/vadimeisenbergibm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vadimeisenbergibm/subscriptions","organizations_url":"https://api.github.com/users/vadimeisenbergibm/orgs","repos_url":"https://api.github.com/users/vadimeisenbergibm/repos","events_url":"https://api.github.com/users/vadimeisenbergibm/events{/privacy}","received_events_url":"https://api.github.com/users/vadimeisenbergibm/received_events","type":"User","site_admin":false},"assignees":[{"login":"vadimeisenbergibm","id":16784982,"avatar_url":"https://avatars1.githubusercontent.com/u/16784982?v=4","gravatar_id":"","url":"https://api.github.com/users/vadimeisenbergibm","html_url":"https://github.com/vadimeisenbergibm","followers_url":"https://api.github.com/users/vadimeisenbergibm/followers","following_url":"https://api.github.com/users/vadimeisenbergibm/following{/other_user}","gists_url":"https://api.github.com/users/vadimeisenbergibm/gists{/gist_id}","starred_url":"https://api.github.com/users/vadimeisenbergibm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vadimeisenbergibm/subscriptions","organizations_url":"https://api.github.com/users/vadimeisenbergibm/orgs","repos_url":"https://api.github.com/users/vadimeisenbergibm/repos","events_url":"https://api.github.com/users/vadimeisenbergibm/events{/privacy}","received_events_url":"https://api.github.com/users/vadimeisenbergibm/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2017-11-03T22:57:41Z","updated_at":"2017-11-30T04:09:09Z","closed_at":"2017-11-30T04:09:09Z","author_association":"MEMBER","body":"@kyessenov commented on [Mon Oct 09 2017](https://github.com/istio/old_pilot_repo/issues/1417)\n\nContext: [production readiness proposal and plan](https://goo.gl/pmjuYg)\r\n\r\nThe feature “_cluster egress_” is identified as incomplete test coverage. As a measure to reach Istio production quality in 0.3, this issue is opened to track the progress of providing sufficient test coverage for the feature in question.\r\n\r\nThis issue is initially assigned to the working group leads.\r\n\r\n**Recommendations**:\r\n- Come up with a test plan for how the feature should be tested. Identify and document (in this issue, or a separate document this issue will link to) test cases and whether each will be covered by an integration test (with some level of mocking and/or starting up selected components in test environment), or end to end test (aka system test, which brings up the whole Istio to exercise the feature; currently live in the istio/istio repo).\r\n- If you expect the test plan is complex and controversial, consider having it formally reviewed.\r\n- State an ETA in the issue, and assign this to a developer who will execute the test plan.\r\n- Execute the test plan as the highest priority for 0.3.\r\n- For any bug or defect identified by the new test cases, file a new issue and link it from this one.\r\n- Close this issue only when the test plan is completely executed, and all additional issues identified in step 3 are fixed.\r\n\r\nIf you see a risk of not fixing this issue by end of 0.3, please contact istio-production-quality@googlegroups.com as soon as possible. We will also periodically ping the issue for update.\r\n\n\n---\n\n@rshriram commented on [Wed Oct 11 2017](https://github.com/istio/old_pilot_repo/issues/1417#issuecomment-335969481)\n\nNeed to be able to specify external mongo/redis or generic TCP services, and be able to collect envoy metrics for connections to these services, and be able to apply circuit breakers for connections to these services\n\n---\n\n@vadimeisenbergibm commented on [Tue Oct 17 2017](https://github.com/istio/old_pilot_repo/issues/1417#issuecomment-337238578)\n\nProposed syntax - using CIDR notation in `service` field.\r\n\r\n```yaml\r\napiVersion: config.istio.io/v1alpha2\r\nkind: EgressRule\r\nmetadata:\r\n  name: tcp-egress-rule\r\nspec:\r\n  destination:\r\n      service: 9.148.1.0/24\r\n  ports:\r\n    - port: 30000\r\n      protocol: tcp\r\n```\r\n\r\nThis rule will allow tcp connection to port 30000 for tcp protocol. Note that CIDR notation will be allowed for tcp protocol only, for example the following rule will be invalid:\r\n\r\n```yaml\r\napiVersion: config.istio.io/v1alpha2\r\nkind: EgressRule\r\nmetadata:\r\n  name: tcp-egress-rule\r\nspec:\r\n  destination:\r\n      service: 9.148.1.0/24\r\n  ports:\r\n    - port: 30000\r\n      protocol: tcp\r\n    - port: 80\r\n      protocol: http <-- unable to use http protocol for CIDR.\r\n```\r\n\r\n@rshriram @kyessenov what do you think? \n\n---\n\n@vadimeisenbergibm commented on [Tue Oct 17 2017](https://github.com/istio/old_pilot_repo/issues/1417#issuecomment-337243060)\n\nContinuing with https://github.com/istio/pilot/issues/1417#issuecomment-337238578, domain notation could not be used for tcp, so the following rule will not be valid:\r\n```yaml\r\napiVersion: config.istio.io/v1alpha2\r\nkind: EgressRule\r\nmetadata:\r\n  name: google-egress-rule\r\nspec:\r\n  destination:\r\n    service: *.google.com\r\n  ports:\r\n    - port: 80\r\n      protocol: http\r\n    - port: 30000\r\n      protocol: tcp <- unable to use FDQN for tcp rules\r\n```\r\n\n\n---\n\n@rshriram commented on [Tue Oct 17 2017](https://github.com/istio/old_pilot_repo/issues/1417#issuecomment-337248801)\n\n@vadimeisenbergibm this sounds pretty good. Also, the restriction applies IF and ONLY If there is a CIDR notation. If user specifies simple IP address, then she should still be able to define HTTP protocol.\r\n\r\nAnother thing that is missing is mongo, redis. I think for Mongo, the same principle as TCP would apply (use CIDR notation). But for Redis, the client connects to Envoy and envoy picks an upstream redis instance, or client accesses some IP address, we trap it on port 2379 and pick an upstream host based on it.\r\nI think for both of these cases, the user would probably specify `service: *` and use `protocol: mongo` or `protocol: redis` to tell us that its a mongo/redis service. In this case, we should just create a listener on the user specified port, with the appropriate filter.\r\n\r\n@nmnellis is actually using an IP address based egress rule on AWS, to monitor accesses to the metadata service (http).\n\n---\n\n@nmnellis commented on [Tue Oct 17 2017](https://github.com/istio/old_pilot_repo/issues/1417#issuecomment-337256110)\n\nsurprisingly this worked for us when talking to the EC2 metadata service\r\n```yaml\r\napiVersion: config.istio.io/v1alpha2\r\nkind: EgressRule\r\nmetadata:\r\n  name: ec2-instance-metadata-rule\r\n  namespace: istio-system\r\nspec:\r\n  destination:\r\n    service: \"169.254.169.254\"\r\n  ports:\r\n    - port: 80\r\n      protocol: http\r\n```\n\n---\n\n@vadimeisenbergibm commented on [Tue Oct 17 2017](https://github.com/istio/old_pilot_repo/issues/1417#issuecomment-337256784)\n\n@nmnellis - this is by design, according to the envoy's virtual host configuration. CIDR notation would not work, e.g. \"169.254.169.0/24\".\n\n---\n\n@vadimeisenbergibm commented on [Tue Oct 17 2017](https://github.com/istio/old_pilot_repo/issues/1417#issuecomment-337257757)\n\n@rshriram I confused with regard to mongo and redis. How the mongo and redis clusters will be configured, in the envoy configuration? Will the istio user provide custom envoy configuration for Istio, that will contain mongo and redis clusters?\n\n---\n\n@rshriram commented on [Tue Oct 17 2017](https://github.com/istio/old_pilot_repo/issues/1417#issuecomment-337279631)\n\nWe already support Mongo and redis. The user would do something like\r\n```yaml\r\napiVersion: config.istio.io/v1alpha2\r\nkind: EgressRule\r\nmetadata:\r\n  name: mongo-rule\r\n  namespace: istio-system\r\nspec:\r\n  destination:\r\n    service: \"169.254.169.254\"\r\n  ports:\r\n    - port: 3308\r\n      protocol: Mongo\r\n```\r\n\r\nor in a simpler way:\r\n\r\n```yaml\r\napiVersion: config.istio.io/v1alpha2\r\nkind: EgressRule\r\nmetadata:\r\n  name: ec2-instance-metadata-rule\r\n  namespace: istio-system\r\nspec:\r\n  destination:\r\n    service: *\r\n  ports:\r\n    - port: 3308\r\n      protocol: Mongo\r\n```\r\n\r\nWe would setup a listener on port 3308, with the Mongo filter installed and use the orig_dst cluster. Business as usual :). The benefit is that we get metrics for mongo/redis.\r\n\r\nNow, there is one caveat here: using TLS origination. One option is to add a new protocol MONGO-TLS.. Or we just add a simple `use_tls: true` in the Egress rule. IF set, we setup a cluster with SSL context. IF we use the `use_tls: true`, we can even get rid of the HTTPS port, and basically ask users to configure standard HTTP, and then set the `use_tls: true` (makes things much more readable and avoids ambiguity).\n\n---\n\n@vadimeisenbergibm commented on [Tue Oct 17 2017](https://github.com/istio/old_pilot_repo/issues/1417#issuecomment-337325972)\n\n@rshriram agreed regarding `use_tls: true`. With SNI support in Envoy https://github.com/envoyproxy/envoy/issues/1843 we could support the real HTTPS.\n\n---\n\n@rshriram commented on [Fri Oct 20 2017](https://github.com/istio/old_pilot_repo/issues/1417#issuecomment-338201130)\n\nCan I assign this issue to you ?\n\n---\n\n@vadimeisenbergibm commented on [Tue Oct 24 2017](https://github.com/istio/old_pilot_repo/issues/1417#issuecomment-339101910)\n\n@rshriram Sure, please assign the issue to me.\n\n---\n\n@vadimeisenbergibm commented on [Tue Oct 24 2017](https://github.com/istio/old_pilot_repo/issues/1417#issuecomment-339103109)\n\n@rshriram I wonder what will be gained by supporting MongoDB and Redis protocols explicitly, instead of plain TCP?\n\n---\n\n@rshriram commented on [Tue Oct 24 2017](https://github.com/istio/old_pilot_repo/issues/1417#issuecomment-339109051)\n\nMore metrics and control :). If we are supporting TCP, might as well support the other non HTTP protocols as well.\n\n"}}
{"actor":{"display_login":"rshriram"}}