Traffic does not go through the Egress if loadBalancing.simple: PASSTHROUGH

user_12472052 0
Viewed 318

I have Kafka cluster with two nodes. node1 with ip 1.1.1.1, and node2 with ip 2.2.2.2 All traffic must go through Egres Controller. If a client from the application addresses a node with ip 1.1.1.1, then he should contact it without any balancing from Istio

Configuration:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: kafka
spec:
  hosts:
    - kafka.host
  addresses:
    - 1.1.1.1/32
    - 2.2.2.2/32
  ports:
    - number: 9092
      name: tcp-kafka
      protocol: TCP
  location: MESH_EXTERNAL
  resolution: STATIC
  endpoints:
    - address: 1.1.1.1
    - address: 2.2.2.2
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: kafka
spec:
  host: kafka.host
  trafficPolicy:
    loadBalancer:
      simple: PASSTHROUGH    # disabled loadBalancer
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: kafka
spec:
  selector:
    istio: istio-egressgateway
  servers:
    - port:
        number: 9092
        name: tcp-kafka
        protocol: TCP
      hosts:
        - kafka.host
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: kafka
spec:
  hosts:
    - kafka.host
  gateways:
    - mesh
    - kafka
  tcp:
    - match:
        - gateways:
            - mesh
          destinationSubnets:
            - 1.1.1.1/32
            - 2.2.2.2/32
          port: 9092
      route:
        - destination:
            host: istio-egressgateway
            port:
              number: 9092
    - match:
        - gateways:
            - kafka
          port: 9092
      route:
        - destination:
            host: kafka.host
            port:
              number: 9092
          weight: 100

Traffic reaches to Egress Controller and does not go outside, while in the egress controller logs:

[Envoy (Epoch 0)] [2020-07-31 13:52:21.351][58][warning][upstream] [external/envoy/source/common/upstream/original_dst_cluster.cc:76] original_dst_load_balancer: No downstream connection or no original_dst.
[2020-07-31T13:52:11.385Z] "- - -" 0 UH "-" "-" 0 0 0 - "-" "-" "-" "-" "-" - - 10.128.19.132:9092 10.128.13.52:47984 - -

P.S. If you set loadBalancer: ROUND_ROBIN or another in the DestinationRule, then everything works and traffic goes to external nodes. But there is no guarantee that when accessing ip 1.1.1.1 from the application, the traffic will go to the external server with ip 1.1.1.1

Istio v1.1

envoyproxy istio
1 Answers

I think you could try set up sticky sessions in DestinationRule for that.

Example from istio documentation:

LoadBalancerSettings

Load balancing policies to apply for a specific destination. See Envoy’s load balancing documentation for more details.

For example, the following rule uses a round robin load balancing policy for all traffic going to the ratings service.

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: bookinfo-ratings
spec:
  host: ratings.prod.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN

The following example sets up sticky sessions for the ratings service hashing-based load balancer for the same ratings service using the the User cookie as the hash key.

 apiVersion: networking.istio.io/v1alpha3
 kind: DestinationRule
 metadata:
   name: bookinfo-ratings
 spec:
   host: ratings.prod.svc.cluster.local
   trafficPolicy:
     loadBalancer:
       consistentHash:
         httpCookie:
           name: user
           ttl: 0s

There is link for v1.1 documentation.

There is an example with sticky sessions.

Hope you find this useful.

user_119777600
Related