Istio ServiceEntry for outside db with mutual tls, cannot connect to db service
I am using istio 1.0.2 version with istio-demo-auth.yaml, I have a mssql db outside the k8s cluster, I want to connect it form the istio injected services. I try with this Consuming External TCP Services blogs, but the services cannot connect to the outside mssql instance. The service entry as below:
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: mssql-entry
namespace: multitenancy
spec:
hosts:
- mssql-master
addresses:
- $outside-db-ip/32
ports:
- number: 2433
name: db
protocol: TCP
location: MESH_EXTERNAL
resolution: STATIC
endpoints:
- address: $outside-db-ip
ports:
tcp: 2433
---
apiVersion: v1
kind: Service
metadata:
name: mssql-master
namespace: multitenancy
labels:
app: v1
spec:
ports:
- port: 2433
targetPort: 2433
protocol: TCP
---
apiVersion: v1
kind: Endpoints
metadata:
name: mssql-master
namespace: multitenancy
subsets:
- addresses:
- ip: $outside-db-ip
ports:
- port: 2433
protocol: TCP
And the services' log presenting " Prelogin error: host mssql-master port 2433 Error reading prelogin response: Connection reset ClientConnectionId:", seems not reached the mssql at all. How to configure outside cluster db for mutual tls services?
istio
asked Nov 12 '18 at 2:13
SmileSees
155
add a comment |
I am using istio 1.0.2 version with istio-demo-auth.yaml, I have a mssql db outside the k8s cluster, I want to connect it form the istio injected services. I try with this Consuming External TCP Services blogs, but the services cannot connect to the outside mssql instance. The service entry as below:
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: mssql-entry
namespace: multitenancy
spec:
hosts:
- mssql-master
addresses:
- $outside-db-ip/32
ports:
- number: 2433
name: db
protocol: TCP
location: MESH_EXTERNAL
resolution: STATIC
endpoints:
- address: $outside-db-ip
ports:
tcp: 2433
---
apiVersion: v1
kind: Service
metadata:
name: mssql-master
namespace: multitenancy
labels:
app: v1
spec:
ports:
- port: 2433
targetPort: 2433
protocol: TCP
---
apiVersion: v1
kind: Endpoints
metadata:
name: mssql-master
namespace: multitenancy
subsets:
- addresses:
- ip: $outside-db-ip
ports:
- port: 2433
protocol: TCP
And the services' log presenting " Prelogin error: host mssql-master port 2433 Error reading prelogin response: Connection reset ClientConnectionId:", seems not reached the mssql at all. How to configure outside cluster db for mutual tls services?
istio
asked Nov 12 '18 at 2:13
SmileSees
155
I add a destinationrule for mssql, to disable the tls for the mssql connection.
– SmileSees
Nov 13 '18 at 6:42
Does it help you to solve the issue?
– mk_sta
Nov 13 '18 at 11:29
@mk_sta Yes, after I disabled the tls for mssql destination, I can get the mssql connection in my services.
– SmileSees
Nov 14 '18 at 1:57
add a comment |
I am using istio 1.0.2 version with istio-demo-auth.yaml, I have a mssql db outside the k8s cluster, I want to connect it form the istio injected services. I try with this Consuming External TCP Services blogs, but the services cannot connect to the outside mssql instance. The service entry as below:
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: mssql-entry
namespace: multitenancy
spec:
hosts:
- mssql-master
addresses:
- $outside-db-ip/32
ports:
- number: 2433
name: db
protocol: TCP
location: MESH_EXTERNAL
resolution: STATIC
endpoints:
- address: $outside-db-ip
ports:
tcp: 2433
---
apiVersion: v1
kind: Service
metadata:
name: mssql-master
namespace: multitenancy
labels:
app: v1
spec:
ports:
- port: 2433
targetPort: 2433
protocol: TCP
---
apiVersion: v1
kind: Endpoints
metadata:
name: mssql-master
namespace: multitenancy
subsets:
- addresses:
- ip: $outside-db-ip
ports:
- port: 2433
protocol: TCP
And the services' log presenting " Prelogin error: host mssql-master port 2433 Error reading prelogin response: Connection reset ClientConnectionId:", seems not reached the mssql at all. How to configure outside cluster db for mutual tls services?
istio
asked Nov 12 '18 at 2:13
SmileSees
155
I am using istio 1.0.2 version with istio-demo-auth.yaml, I have a mssql db outside the k8s cluster, I want to connect it form the istio injected services. I try with this Consuming External TCP Services blogs, but the services cannot connect to the outside mssql instance. The service entry as below:
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: mssql-entry
namespace: multitenancy
spec:
hosts:
- mssql-master
addresses:
- $outside-db-ip/32
ports:
- number: 2433
name: db
protocol: TCP
location: MESH_EXTERNAL
resolution: STATIC
endpoints:
- address: $outside-db-ip
ports:
tcp: 2433
---
apiVersion: v1
kind: Service
metadata:
name: mssql-master
namespace: multitenancy
labels:
app: v1
spec:
ports:
- port: 2433
targetPort: 2433
protocol: TCP
---
apiVersion: v1
kind: Endpoints
metadata:
name: mssql-master
namespace: multitenancy
subsets:
- addresses:
- ip: $outside-db-ip
ports:
- port: 2433
protocol: TCP
And the services' log presenting " Prelogin error: host mssql-master port 2433 Error reading prelogin response: Connection reset ClientConnectionId:", seems not reached the mssql at all. How to configure outside cluster db for mutual tls services?
istio
istio
asked Nov 12 '18 at 2:13
SmileSees
155
asked Nov 12 '18 at 2:13
SmileSees
155
asked Nov 12 '18 at 2:13
SmileSees
155
asked Nov 12 '18 at 2:13
SmileSees
155
asked Nov 12 '18 at 2:13
SmileSees
155
155
I add a destinationrule for mssql, to disable the tls for the mssql connection.
– SmileSees
Nov 13 '18 at 6:42
Does it help you to solve the issue?
– mk_sta
Nov 13 '18 at 11:29
@mk_sta Yes, after I disabled the tls for mssql destination, I can get the mssql connection in my services.
– SmileSees
Nov 14 '18 at 1:57
add a comment |
I add a destinationrule for mssql, to disable the tls for the mssql connection.
– SmileSees
Nov 13 '18 at 6:42
Does it help you to solve the issue?
– mk_sta
Nov 13 '18 at 11:29
@mk_sta Yes, after I disabled the tls for mssql destination, I can get the mssql connection in my services.
– SmileSees
Nov 14 '18 at 1:57
I add a destinationrule for mssql, to disable the tls for the mssql connection.
– SmileSees
Nov 13 '18 at 6:42
I add a destinationrule for mssql, to disable the tls for the mssql connection.
– SmileSees
Nov 13 '18 at 6:42
Does it help you to solve the issue?
– mk_sta
Nov 13 '18 at 11:29
Does it help you to solve the issue?
– mk_sta
Nov 13 '18 at 11:29
@mk_sta Yes, after I disabled the tls for mssql destination, I can get the mssql connection in my services.
– SmileSees
Nov 14 '18 at 1:57
@mk_sta Yes, after I disabled the tls for mssql destination, I can get the mssql connection in my services.
– SmileSees
Nov 14 '18 at 1:57
add a comment |
1 Answer
1
active
oldest
votes
As @SmileSees mentioned, the issue has been resolved by disabling mutual TLS authentication for the target mssql instance. Due to the fact that the database instance located outside the Istio mesh and no sidecar Envoy injected for this service, TLS security connection was not established.
You can consider to use SPIFFE framework for securing services across heterogeneous environments.
Referenced links for further research:
- Mutual TLS authentication
- Authorization policy
- Istio security vs SPIFFE
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53255207%2fistio-serviceentry-for-outside-db-with-mutual-tls-cannot-connect-to-db-service%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
As @SmileSees mentioned, the issue has been resolved by disabling mutual TLS authentication for the target mssql instance. Due to the fact that the database instance located outside the Istio mesh and no sidecar Envoy injected for this service, TLS security connection was not established.
You can consider to use SPIFFE framework for securing services across heterogeneous environments.
Referenced links for further research:
- Mutual TLS authentication
- Authorization policy
- Istio security vs SPIFFE
add a comment |
As @SmileSees mentioned, the issue has been resolved by disabling mutual TLS authentication for the target mssql instance. Due to the fact that the database instance located outside the Istio mesh and no sidecar Envoy injected for this service, TLS security connection was not established.
You can consider to use SPIFFE framework for securing services across heterogeneous environments.
Referenced links for further research:
- Mutual TLS authentication
- Authorization policy
- Istio security vs SPIFFE
add a comment |
As @SmileSees mentioned, the issue has been resolved by disabling mutual TLS authentication for the target mssql instance. Due to the fact that the database instance located outside the Istio mesh and no sidecar Envoy injected for this service, TLS security connection was not established.
You can consider to use SPIFFE framework for securing services across heterogeneous environments.
Referenced links for further research:
- Mutual TLS authentication
- Authorization policy
- Istio security vs SPIFFE
As @SmileSees mentioned, the issue has been resolved by disabling mutual TLS authentication for the target mssql instance. Due to the fact that the database instance located outside the Istio mesh and no sidecar Envoy injected for this service, TLS security connection was not established.
You can consider to use SPIFFE framework for securing services across heterogeneous environments.
Referenced links for further research:
- Mutual TLS authentication
- Authorization policy
- Istio security vs SPIFFE
answered Nov 14 '18 at 11:22
community wiki
mk_sta
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53255207%2fistio-serviceentry-for-outside-db-with-mutual-tls-cannot-connect-to-db-service%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I add a destinationrule for mssql, to disable the tls for the mssql connection.
– SmileSees
Nov 13 '18 at 6:42
Does it help you to solve the issue?
– mk_sta
Nov 13 '18 at 11:29
@mk_sta Yes, after I disabled the tls for mssql destination, I can get the mssql connection in my services.
– SmileSees
Nov 14 '18 at 1:57