You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "pmajum (via GitHub)" <gi...@apache.org> on 2025/06/23 10:19:16 UTC
[I] help request: Istio mtls not working with apisix upstream k8s discovery [apisix]
pmajum opened a new issue, #12368:
URL: https://github.com/apache/apisix/issues/12368
### Description
We have istio service mesh injected into apisix namespace and our application namespace, and we have strict mtls applied.
But the apisix upstream call not participating in istio mtls giving the below error:
`upstream connect error or disconnect/reset before headers. reset reason: connection termination`
### Environment
- APISIX version (run `apisix version`):
- Operating system (run `uname -a`):
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`):
- etcd version, if relevant (run `curl http://127.0.0.1:9090/v1/server_info`):
- APISIX Dashboard version, if relevant:
- Plugin runner version, for issues related to plugin runners:
- LuaRocks version, for installation issues (run `luarocks --version`):
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Istio mtls not working with apisix upstream k8s discovery [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12368:
URL: https://github.com/apache/apisix/issues/12368#issuecomment-2998486884
Hi @pmajum, can you share how your apisix is ​​configured?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Istio mtls not working with apisix upstream k8s discovery [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12368:
URL: https://github.com/apache/apisix/issues/12368#issuecomment-3995726961
The current issue has been resolved.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Istio mtls not working with apisix upstream k8s discovery [apisix]
Posted by "pmajum (via GitHub)" <gi...@apache.org>.
pmajum commented on issue #12368:
URL: https://github.com/apache/apisix/issues/12368#issuecomment-2998726470
The apisix installation is under the radar of istio mesh, as we have enabled the istio-injection into istio-system namespace.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Istio mtls not working with apisix upstream k8s discovery [apisix]
Posted by "pmajum (via GitHub)" <gi...@apache.org>.
pmajum commented on issue #12368:
URL: https://github.com/apache/apisix/issues/12368#issuecomment-2998635942
Hi @Baoyuantop ,
We have created apisix with the kubernetes service discovery type with the attached config.
And we are providing the upstream details as:
`"upstream": {
"discovery_type": "kubernetes",
"service_name": "apisix/partyapplication:8080",
"type": "roundrobin"
}`
when the istio mtls is PERMISSIVE the upstream connection is working, but when the mtls is STRICT, then the upstream connection is reset.
From the kiali dashboard i observed that the upstream call is not getting intercepted by envoy proxy.
[apisix-deployment-config.txt](https://github.com/user-attachments/files/20875176/apisix-deployment-config.txt)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Istio mtls not working with apisix upstream k8s discovery [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12368:
URL: https://github.com/apache/apisix/issues/12368#issuecomment-3116919106
Hi @pmajum, any updates?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Istio mtls not working with apisix upstream k8s discovery [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12368:
URL: https://github.com/apache/apisix/issues/12368#issuecomment-3055981587
You can try dns service discovery:
```
{
"upstream": {
"type": "roundrobin",
"discovery_type": "dns",
"service_name": "partyapplication.apisix.svc.cluster.local:8080"
}
}
```
In addition, you may need to configure Istio's corresponding DestinationRule and ServiceEntry to ensure that the traffic is intercepted correctly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Istio mtls not working with apisix upstream k8s discovery [apisix]
Posted by "pmajum (via GitHub)" <gi...@apache.org>.
pmajum commented on issue #12368:
URL: https://github.com/apache/apisix/issues/12368#issuecomment-3139622139
Hi @Baoyuantop ,
We are using service_type: dns and its working thanks for your reply and help.
I have one query regarding the performance of apisix, i know this is out of context from this thread. Please let me know right channel to post this query.
We have apisix installation in k8s cluster with 1 replica of apisix and 1 replica of apisix dashboard and 3 replicas of etcd.
We are using openid-connect plugin to connect with keycloak.
Now what we are observing is the aoisix pod if the age of the pod goes beyond more than 6-7 days, the request is not working in apisix, it hangs forever and we are not seeing any logs in the apisix pod. So at that time we are forcefully killing the apisix pod.
After that the requests are working.
What i think is that may be some memory or cpu issue in apisix and it may happen OOM in the apisix pod.
So i wanted to know if our deployment topology is good for production? or we need to invest some thoughts around it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Istio mtls not working with apisix upstream k8s discovery [apisix]
Posted by "pmajum (via GitHub)" <gi...@apache.org>.
pmajum commented on issue #12368:
URL: https://github.com/apache/apisix/issues/12368#issuecomment-3004066078
Hi @tao12345666333 ,
I saw one article
https://apisix.apache.org/blog/2021/12/17/exposure-istio-with-apisix-ingress/
and have tried that also,
and its not working with the istio mesh mtls is strict throughout the mesh.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Istio mtls not working with apisix upstream k8s discovery [apisix]
Posted by "pmajum (via GitHub)" <gi...@apache.org>.
pmajum commented on issue #12368:
URL: https://github.com/apache/apisix/issues/12368#issuecomment-3003061543
Hi @Baoyuantop ,
Is there any issue with the above setup? we are getting this issue on the kubernetes **discovery_type** not able to go deep into what is happening there, from the envoy access logs it is found as
NR filter_chain_not_found
Please help me out here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: Istio mtls not working with apisix upstream k8s discovery [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop closed issue #12368: bug: Istio mtls not working with apisix upstream k8s discovery
URL: https://github.com/apache/apisix/issues/12368
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org