Istio ServiceEntry for outside db with mutual tls, cannot connect to db service
up vote
0
down vote
favorite
I am using istio 1.0.2 version with istio-demo-auth.yaml, I have a mssql db outside the k8s cluster, I want to connect it form the istio injected services. I try with this Consuming External TCP Services blogs, but the services cannot connect to the outside mssql instance. The service entry as below:
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: mssql-entry
namespace: multitenancy
spec:
hosts:
- mssql-master
addresses:
- $outside-db-ip/32
ports:
- number: 2433
name: db
protocol: TCP
location: MESH_EXTERNAL
resolution: STATIC
endpoints:
- address: $outside-db-ip
ports:
tcp: 2433
---
apiVersion: v1
kind: Service
metadata:
name: mssql-master
namespace: multitenancy
labels:
app: v1
spec:
ports:
- port: 2433
targetPort: 2433
protocol: TCP
---
apiVersion: v1
kind: Endpoints
metadata:
name: mssql-master
namespace: multitenancy
subsets:
- addresses:
- ip: $outside-db-ip
ports:
- port: 2433
protocol: TCP
And the services' log presenting " Prelogin error: host mssql-master port 2433 Error reading prelogin response: Connection reset ClientConnectionId:", seems not reached the mssql at all. How to configure outside cluster db for mutual tls services?
istio
asked Nov 12 at 2:13
SmileSees
104
add a comment |
up vote
0
down vote
favorite
I am using istio 1.0.2 version with istio-demo-auth.yaml, I have a mssql db outside the k8s cluster, I want to connect it form the istio injected services. I try with this Consuming External TCP Services blogs, but the services cannot connect to the outside mssql instance. The service entry as below:
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: mssql-entry
namespace: multitenancy
spec:
hosts:
- mssql-master
addresses:
- $outside-db-ip/32
ports:
- number: 2433
name: db
protocol: TCP
location: MESH_EXTERNAL
resolution: STATIC
endpoints:
- address: $outside-db-ip
ports:
tcp: 2433
---
apiVersion: v1
kind: Service
metadata:
name: mssql-master
namespace: multitenancy
labels:
app: v1
spec:
ports:
- port: 2433
targetPort: 2433
protocol: TCP
---
apiVersion: v1
kind: Endpoints
metadata:
name: mssql-master
namespace: multitenancy
subsets:
- addresses:
- ip: $outside-db-ip
ports:
- port: 2433
protocol: TCP
And the services' log presenting " Prelogin error: host mssql-master port 2433 Error reading prelogin response: Connection reset ClientConnectionId:", seems not reached the mssql at all. How to configure outside cluster db for mutual tls services?
istio
asked Nov 12 at 2:13
SmileSees
104
I add a destinationrule for mssql, to disable the tls for the mssql connection.
– SmileSees
Nov 13 at 6:42
Does it help you to solve the issue?
– mk_sta
Nov 13 at 11:29
@mk_sta Yes, after I disabled the tls for mssql destination, I can get the mssql connection in my services.
– SmileSees
Nov 14 at 1:57
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I am using istio 1.0.2 version with istio-demo-auth.yaml, I have a mssql db outside the k8s cluster, I want to connect it form the istio injected services. I try with this Consuming External TCP Services blogs, but the services cannot connect to the outside mssql instance. The service entry as below:
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: mssql-entry
namespace: multitenancy
spec:
hosts:
- mssql-master
addresses:
- $outside-db-ip/32
ports:
- number: 2433
name: db
protocol: TCP
location: MESH_EXTERNAL
resolution: STATIC
endpoints:
- address: $outside-db-ip
ports:
tcp: 2433
---
apiVersion: v1
kind: Service
metadata:
name: mssql-master
namespace: multitenancy
labels:
app: v1
spec:
ports:
- port: 2433
targetPort: 2433
protocol: TCP
---
apiVersion: v1
kind: Endpoints
metadata:
name: mssql-master
namespace: multitenancy
subsets:
- addresses:
- ip: $outside-db-ip
ports:
- port: 2433
protocol: TCP
And the services' log presenting " Prelogin error: host mssql-master port 2433 Error reading prelogin response: Connection reset ClientConnectionId:", seems not reached the mssql at all. How to configure outside cluster db for mutual tls services?
istio
asked Nov 12 at 2:13
SmileSees
104
I am using istio 1.0.2 version with istio-demo-auth.yaml, I have a mssql db outside the k8s cluster, I want to connect it form the istio injected services. I try with this Consuming External TCP Services blogs, but the services cannot connect to the outside mssql instance. The service entry as below:
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: mssql-entry
namespace: multitenancy
spec:
hosts:
- mssql-master
addresses:
- $outside-db-ip/32
ports:
- number: 2433
name: db
protocol: TCP
location: MESH_EXTERNAL
resolution: STATIC
endpoints:
- address: $outside-db-ip
ports:
tcp: 2433
---
apiVersion: v1
kind: Service
metadata:
name: mssql-master
namespace: multitenancy
labels:
app: v1
spec:
ports:
- port: 2433
targetPort: 2433
protocol: TCP
---
apiVersion: v1
kind: Endpoints
metadata:
name: mssql-master
namespace: multitenancy
subsets:
- addresses:
- ip: $outside-db-ip
ports:
- port: 2433
protocol: TCP
And the services' log presenting " Prelogin error: host mssql-master port 2433 Error reading prelogin response: Connection reset ClientConnectionId:", seems not reached the mssql at all. How to configure outside cluster db for mutual tls services?
istio
istio
asked Nov 12 at 2:13
SmileSees
104
asked Nov 12 at 2:13
SmileSees
104
asked Nov 12 at 2:13
SmileSees
104
asked Nov 12 at 2:13
SmileSees
104
asked Nov 12 at 2:13
SmileSees
104
104
I add a destinationrule for mssql, to disable the tls for the mssql connection.
– SmileSees
Nov 13 at 6:42
Does it help you to solve the issue?
– mk_sta
Nov 13 at 11:29
@mk_sta Yes, after I disabled the tls for mssql destination, I can get the mssql connection in my services.
– SmileSees
Nov 14 at 1:57
add a comment |
I add a destinationrule for mssql, to disable the tls for the mssql connection.
– SmileSees
Nov 13 at 6:42
Does it help you to solve the issue?
– mk_sta
Nov 13 at 11:29
@mk_sta Yes, after I disabled the tls for mssql destination, I can get the mssql connection in my services.
– SmileSees
Nov 14 at 1:57
I add a destinationrule for mssql, to disable the tls for the mssql connection.
– SmileSees
Nov 13 at 6:42
I add a destinationrule for mssql, to disable the tls for the mssql connection.
– SmileSees
Nov 13 at 6:42
Does it help you to solve the issue?
– mk_sta
Nov 13 at 11:29
Does it help you to solve the issue?
– mk_sta
Nov 13 at 11:29
@mk_sta Yes, after I disabled the tls for mssql destination, I can get the mssql connection in my services.
– SmileSees
Nov 14 at 1:57
@mk_sta Yes, after I disabled the tls for mssql destination, I can get the mssql connection in my services.
– SmileSees
Nov 14 at 1:57
add a comment |
1 Answer
1
active
oldest
votes
up vote
0
down vote
accepted
As @SmileSees mentioned, the issue has been resolved by disabling mutual TLS authentication for the target mssql instance. Due to the fact that the database instance located outside the Istio mesh and no sidecar Envoy injected for this service, TLS security connection was not established.
You can consider to use SPIFFE framework for securing services across heterogeneous environments.
Referenced links for further research:
- Mutual TLS authentication
- Authorization policy
- Istio security vs SPIFFE
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
accepted
As @SmileSees mentioned, the issue has been resolved by disabling mutual TLS authentication for the target mssql instance. Due to the fact that the database instance located outside the Istio mesh and no sidecar Envoy injected for this service, TLS security connection was not established.
You can consider to use SPIFFE framework for securing services across heterogeneous environments.
Referenced links for further research:
- Mutual TLS authentication
- Authorization policy
- Istio security vs SPIFFE
add a comment |
up vote
0
down vote
accepted
As @SmileSees mentioned, the issue has been resolved by disabling mutual TLS authentication for the target mssql instance. Due to the fact that the database instance located outside the Istio mesh and no sidecar Envoy injected for this service, TLS security connection was not established.
You can consider to use SPIFFE framework for securing services across heterogeneous environments.
Referenced links for further research:
- Mutual TLS authentication
- Authorization policy
- Istio security vs SPIFFE
add a comment |
up vote
0
down vote
accepted
up vote
0
down vote
accepted
As @SmileSees mentioned, the issue has been resolved by disabling mutual TLS authentication for the target mssql instance. Due to the fact that the database instance located outside the Istio mesh and no sidecar Envoy injected for this service, TLS security connection was not established.
You can consider to use SPIFFE framework for securing services across heterogeneous environments.
Referenced links for further research:
- Mutual TLS authentication
- Authorization policy
- Istio security vs SPIFFE
As @SmileSees mentioned, the issue has been resolved by disabling mutual TLS authentication for the target mssql instance. Due to the fact that the database instance located outside the Istio mesh and no sidecar Envoy injected for this service, TLS security connection was not established.
You can consider to use SPIFFE framework for securing services across heterogeneous environments.
Referenced links for further research:
- Mutual TLS authentication
- Authorization policy
- Istio security vs SPIFFE
answered Nov 14 at 11:22
community wiki
mk_sta
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53255207%2fistio-serviceentry-for-outside-db-with-mutual-tls-cannot-connect-to-db-service%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I add a destinationrule for mssql, to disable the tls for the mssql connection.
– SmileSees
Nov 13 at 6:42
Does it help you to solve the issue?
– mk_sta
Nov 13 at 11:29
@mk_sta Yes, after I disabled the tls for mssql destination, I can get the mssql connection in my services.
– SmileSees
Nov 14 at 1:57