Pods and Services
To be a part of an Istio service mesh, pods and services in a Kubernetes cluster must satisfy the following requirements:
Named service ports: Service ports must be named. The port name key/value pairs must have the following syntax:
name: <protocol>[-<suffix>]. See Protocol Selection for more details.
Service association: A pod must belong to at least one Kubernetes service even if the pod does NOT expose any port. If a pod belongs to multiple Kubernetes services, the services cannot use the same port number for different protocols, for instance HTTP and TCP.
Deployments with app and version labels: We recommend adding an explicit
versionlabel to deployments. Add the labels to the deployment specification of pods deployed using the Kubernetes
versionlabels add contextual information to the metrics and telemetry Istio collects.
applabel: Each deployment specification should have a distinct
applabel with a meaningful value. The
applabel is used to add contextual information in distributed tracing.
versionlabel: This label indicates the version of the application corresponding to the particular deployment.
Application UIDs: Ensure your pods do not run applications as a user with the user ID (UID) value of 1337.
NET_ADMINcapability: If your cluster enforces pod security policies, pods must allow the
NET_ADMINcapability. If you use the Istio CNI Plugin, this requirement no longer applies. To learn more about the
NET_ADMINcapability, visit Required Pod Capabilities.
Ports used by Istio
The following ports and protocols are used by Istio. Ensure that there are no TCP headless services using a TCP port used by one of Istio’s services.
|8080||HTTP||Citadel agent||SDS service monitoring|
|9876||HTTP||Citadel, Citadel agent||ControlZ user interface|
|9901||GRPC||Galley||Mesh Configuration Protocol|
|15000||TCP||Envoy||Envoy admin port (commands/diagnostics)|
|15004||HTTP||Mixer, Pilot||Policy/Telemetry - |
|15010||HTTP||Pilot||Pilot service - XDS pilot - discovery|
|15011||TCP||Pilot||Pilot service - |
|15014||HTTP||Citadel, Citadel agent, Galley, Mixer, Pilot, Sidecar Injector||Control plane monitoring|
|15020||HTTP||Ingress Gateway||Pilot health checks|
|15029||HTTP||Kiali||Kiali User Interface|
|15030||HTTP||Prometheus||Prometheus User Interface|
|15031||HTTP||Grafana||Grafana User Interface|
|15032||HTTP||Tracing||Tracing User Interface|
|15443||TLS||Ingress and Egress Gateways||SNI|
|42422||TCP||Mixer||Telemetry - Prometheus|