Uploaded image for project: 'Maistra'
  1. Maistra
  2. MAISTRA-2230

Outbound flow is intercepted, inconsistent with configuration ALLOW_ANY

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • Icon: Major Major
    • None
    • maistra-2.0.2
    • envoy
    • None
    • False
    • False
    • qa_ack, ux_ack
    • Undefined

      in my case, Envoy already has a listener of 0.0.0.0_80, and there is no filter_chain_match. When the exit traffic port is 80, all traffic will go to this listener.
      This is my listener example:

      {
       "name": "0.0.0.0_80",
       "active_state": {
       "version_info": "2021-03-26T07:09:31Z/1187",
       "listener": {
       "@type": "type.googleapis.com/envoy.api.v2.Listener",
       "name": "0.0.0.0_80",
       "address": {
       "socket_address":
      { "address": "0.0.0.0", "port_value": 80 }
      },
       "filter_chains": [
       {
       "filters": [
       {
       "name": "envoy.http_connection_manager",
       "typed_config": {
       "@type": "type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager",
       "stat_prefix": "outbound_0.0.0.0_80",
       "rds": {
       "config_source": {
       "ads": {}
       },
       "route_config_name": "80"
       },
       "http_filters": [
       {
       "name": "istio.metadata_exchange",
       "typed_config": {
       "@type": "type.googleapis.com/udpa.type.v1.TypedStruct",
       "type_url": "type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
       "value": {
       "config": {
       "vm_config": {
       "runtime": "envoy.wasm.runtime.null",
       "code": {
       "local":
      { "inline_string": "envoy.wasm.metadata_exchange" }
      }
       },
       "configuration": "{}\n"
       }
       }
       }
       },
       {
       "name": "istio.alpn",
       "typed_config": {
       "@type": "type.googleapis.com/istio.envoy.config.filter.http.alpn.v2alpha1.FilterConfig",
       "alpn_override": [
      { "alpn_override": [ "istio-http/1.0", "istio" ] }
      ,
      { "upstream_protocol": "HTTP11", "alpn_override": [ "istio-http/1.1", "istio" ] }
      ,
      { "upstream_protocol": "HTTP2", "alpn_override": [ "istio-h2", "istio" ] }
      ]
       }
       },
       {
       "name": "envoy.cors",
       "typed_config":
      { "@type": "type.googleapis.com/envoy.config.filter.http.cors.v2.Cors" }
      },
       {
       "name": "envoy.fault",
       "typed_config":
      { "@type": "type.googleapis.com/envoy.config.filter.http.fault.v2.HTTPFault" }
      },
       {
       "name": "istio.stats",
       "typed_config": {
       "@type": "type.googleapis.com/udpa.type.v1.TypedStruct",
       "type_url": "type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
       "value": {
       "config": {
       "root_id": "stats_outbound",
       "vm_config": {
       "vm_id": "stats_outbound",
       "runtime": "envoy.wasm.runtime.null",
       "code": {
       "local":
      { "inline_string": "envoy.wasm.stats" }
      }
       },
       "configuration": "{\n \"debug\": \"false\",\n \"stat_prefix\": \"istio\"\n}\n"
       }
       }
       }
       },
       {
       "name": "envoy.router",
       "typed_config":
      { "@type": "type.googleapis.com/envoy.config.filter.http.router.v2.Router" }
      }
       ],
       "tracing": {
       "client_sampling":
      { "value": 100 }
      ,
       "random_sampling":
      { "value": 100 }
      ,
       "overall_sampling":
      { "value": 100 }
      },
       "access_log": [
       {
       "name": "envoy.file_access_log",
       "typed_config":
      { "@type": "type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog", "path": "/dev/stdout", "format": "[%START_TIME%] \"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%\" %RESPONSE_CODE% %RESPONSE_FLAGS% \"%DYNAMIC_METADATA(istio.mixer:status)%\" \"%UPSTREAM_TRANSPORT_FAILURE_REASON%\" %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% \"%REQ(X-FORWARDED-FOR)%\" \"%REQ(USER-AGENT)%\" \"%REQ(X-REQUEST-ID)%\" \"%REQ(:AUTHORITY)%\" \"%UPSTREAM_HOST%\" %UPSTREAM_CLUSTER% %UPSTREAM_LOCAL_ADDRESS% %DOWNSTREAM_LOCAL_ADDRESS% %DOWNSTREAM_REMOTE_ADDRESS% %REQUESTED_SERVER_NAME% %ROUTE_NAME%\n" }
      }
       ],
       "use_remote_address": false,
       "generate_request_id": true,
       "upgrade_configs": [
      { "upgrade_type": "websocket" }
      ],
       "stream_idle_timeout": "0s",
       "normalize_path": true
       }
       }
       ]
       }
       ],
       "deprecated_v1":
      { "bind_to_port": false }
      ,
       "traffic_direction": "OUTBOUND"
       },
       "last_updated": "2021-03-26T07:09:55.191Z"
       }
       }
      

      When our service has an external service dependency and port is 80, and the protocol is not HTTP, so it cannot pass this filter. Is there any way to solve this dilemma?

       

      ps : Everything was fine when I used the Community version of Istio 1.7.6

      when i set spec.proxy.networking.protocol.autoDetect.outbound,webhook fail
      admission webhook "smcp.validation.maistra.io" denied the request: [automatic protocol detection is not supported in v2.0; if specified, spec.proxy.networking.protocol.autoDetect.inbound must be set to false, automatic protocol detection is not supported in v2.0; if specified, spec.proxy.networking.protocol.autoDetect.outbound must be set to false]

            Unassigned Unassigned
            pantianying tianying pan
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: