Istio开启REGISTRY_ONLY模式下Pod间IP连通性问题

问题 #

当Istio的outboundTrafficPolicy配置为REGISTRY_ONLY模式时，集群内Pod无法通过Pod IP访问其他Pod；将模式修改为ALLOW_ANY后，Pod间可正常通过IP连通。需求是阻止集群外部调用，但允许Pod间通过IP通信，尝试配置excludeIPRanges和includeIPRange后问题仍未解决。

相关Istio ConfigMap配置如下：

apiVersion: v1
data:
  mesh: |-
    accessLogEncoding: TEXT
    accessLogFile: /dev/stdout
    accessLogFormat: ""
    defaultConfig:
      concurrency: 2
      configPath: ./etc/istio/proxy
      connectTimeout: 10s
      controlPlaneAuthPolicy: NONE
      discoveryAddress: istiod.istio-system.svc:15012
      drainDuration: 45s
      parentShutdownDuration: 1m0s
      proxyAdminPort: 15000
      proxyMetadata:
        DNS_AGENT: ""
      serviceCluster: istio-proxy
      tracing:
        zipkin:
          address: zipkin.istio-system:9411
    disableMixerHttpReports: true
    disablePolicyChecks: true
    enablePrometheusMerge: false
    ingressClass: istio
    ingressControllerMode: STRICT
    ingressService: istio-ingressgateway
    outboundTrafficPolicy:
      mode: REGISTRY_ONLY
    excludeIPRanges: ""
    protocolDetectionTimeout: 100ms
    reportBatchMaxEntries: 100
    reportBatchMaxTime: 1s
    sdsUdsPath: unix:/etc/istio/proxy/SDS
    trustDomain: cluster.local
    trustDomainAliases: null
  meshNetworks: 'networks: {}'
kind: ConfigMap
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","data":{"mesh":"accessLogEncoding: TEXT\naccessLogFile: /dev/stdout\naccessLogFormat: \"\"\ndefaultConfig:\n  concurrency: 2\n  configPath: ./etc/istio/proxy\n  connectTimeout: 10s\n  controlPlaneAuthPolicy: NONE\n  discoveryAddress: istiod.istio-system.svc:15012\n  drainDuration: 45s\n  parentShutdownDuration: 1m0s\n  proxyAdminPort: 15000\n  proxyMetadata:\n    DNS_AGENT: \"\"\n  serviceCluster: istio-proxy\n  tracing:\n    zipkin:\n      address: zipkin.istio-system:9411\ndisableMixerHttpReports: true\ndisablePolicyChecks: true\nenablePrometheusMerge: false\ningressClass: istio\ningressControllerMode: STRICT\ningressService: istio-ingressgateway\noutboundTrafficPolicy:\n  mode: REGISTRY_ONLY\nexcludeIPRanges: \"\"\nprotocolDetectionTimeout: 100ms\nreportBatchMaxEntries: 100\nreportBatchMaxTime: 1s\nsdsUdsPath: unix:/etc/istio/proxy/SDS\ntrustDomain: cluster.local\ntrustDomainAliases: null","meshNetworks":"networks: {}"},"kind":"ConfigMap","metadata":{"annotations":{},"labels":{"istio.io/rev":"default","release":"istio"},"name":"istio","namespace":"istio-system"}}
  creationTimestamp: "2021-01-04T10:57:02Z"
  labels:
    istio.io/rev: default
    release: istio
  name: istio
  namespace: istio-system
  resourceVersion: "3289298"
  selfLink: /api/v1/namespaces/istio-system/configmaps/istio
  uid: a912bef1-4be2-4a48-a632-0495a79cc880

解决方案 #

核心原因 #

REGISTRY_ONLY模式下，Istio仅允许访问服务注册表中存在的服务，Pod IP不在注册表范围内，因此被拦截。excludeIPRanges需正确配置集群内Pod的IP段，才能绕过Istio代理的拦截规则。

具体配置步骤 #

1. 获取集群Pod IP段
   执行以下命令获取集群的Pod CIDR范围：

   kubectl cluster-info dump | grep -m 1 cluster-cidr
   

   也可直接查看kube-controller-manager的启动参数，找到--cluster-cidr对应的取值（常见如10.244.0.0/16、192.168.0.0/16）。

2. 更新Istio ConfigMap
   修改mesh配置中的excludeIPRanges字段，填入获取到的Pod CIDR：

   outboundTrafficPolicy:
      mode: REGISTRY_ONLY
    excludeIPRanges: "10.244.0.0/16" # 替换为你的集群Pod实际CIDR
   

   若存在多个Pod IP段，用逗号分隔，例如："10.244.0.0/16,192.168.0.0/24"

3. 重启Pod加载新配置
   ConfigMap修改后，需重启受影响的Pod，让Istio代理重新加载配置：

   # 重启单个部署的Pod
   kubectl rollout restart deployment <部署名称> -n <命名空间>
   # 或批量重启所有启用Istio注入的Pod（谨慎操作）
   kubectl get pods --all-namespaces -l istio-injection=enabled -o name | xargs kubectl delete
   

验证方式 #

• 测试Pod间IP连通性：在任意Pod内执行curl <目标Pod IP>:<端口>，确认可正常访问。
• 测试外部访问拦截：尝试访问公网IP（如8.8.8.8），确认被拦截。

注意事项 #

• 若集群使用多Pod网段（如多节点集群分配不同网段），需将所有Pod网段加入excludeIPRanges。
• 若需更细粒度控制，可通过ServiceEntry将特定Pod IP加入服务注册表，或配置Sidecar资源的ejectionRoutes规则。

内容的提问来源于stack exchange，提问作者Rahul Gogyani