Istiod

Istiod Service Port

• 15010: grpc-xds
• 15012: https-dns
• 15014: http-monitoring
• 443: https-webhook

Envoy-Proxy

Proxy Description

• UID information
• runAsUser: 1337: Do not redirect to envoy
• Proxy port definition
  • 15001: Proxy port listening for TCP outbound traffic
  • 15006: Proxy port listening for TCP inbound traffic
  • 15090: Not redirecting to Envoy,
  • 15021: Not redirecting to Envoy,
  • 15020: Not redirected to Envoy, health check (/app-health/core/livez, /app-health/core/readyz)
  • All IP Ranges, all ports: Redirect to 15001, 15006

istio-iptables

#istio-init container
istio-iptables \
-p "15001" \
-z "15006" \
-u "1337" \
-m REDIRECT \
-i '*' \
-x "" \
-b '*' \
-d 15090,15021,15020 \
--log_output_level=default:info

#Flags
-u: Redirect 하지 않을 UID. 보통 프록시의 UID를 지정한다. (-u 1337)
-p: 모든 TCP 트래픽을 Redirect 할 Envoy 포트
-z: 모든 Inbound 트래픽을 Redirect 할 포트
-b: Redirect 할 Inbound Port
-d: Envoy로 Redirect 하지 않을 Inbound Port
-i: Redirect 할 IP Range
-x: Envoy로 Redirect 하지 않을 IP Range