This article delves into the design principles, implementation, and how Ambient Mode enhances security and permission management in Istio CNI plugins. The content includes:

• Security risks of Init containers and their solutions.
• Working principles and advantages of Istio CNI.
• Implementation mechanism of Ambient Mode and its integration with CNI.

Overview of Istio Network Requirements and Solutions

Istio service mesh intercepts and manages application traffic through the Sidecar mode. This mode injects a Sidecar Proxy and init containers into application pods and uses iptables rules to manage network traffic. For detailed deployment and operation processes, please refer to Understanding Sidecar Injection, Transparent Traffic Hijacking, and Traffic Routing in Istio. Although this method is effective on most Kubernetes platforms, the high dependency on privileges raises security concerns in multi-tenant environments.

Limitations of Istio-init

During its initial network configuration, Istio adopted the istio-init container to initialize traffic interception rules, requiring containers to have advanced permissions to modify network configurations like IPTables rules. While this method effectively manages traffic, it significantly increases permission requirements and security risks. According to the Istio documentation, the istio-init container is injected into pods within the Istio mesh by default to hijack network traffic to Istio’s Sidecar proxy. This process requires granting the Service Account deploying the pod the NET_ADMIN container permission, which may contradict the security policies of some organizations.

Istio CNI Plugin

In response to this challenge, the Istio community introduced the Istio CNI plugin, which avoids the need for init containers, allowing direct manipulation at the Kubernetes network layer, thereby reducing permission requirements and simplifying the deployment process, but with CNI compatibility issues.

Introduction of Ambient Mode

Istio’s Ambient Mode is an innovative sidecar-less solution that enhances network flexibility and security by using Geneve tunnels or Istio CNI.

Only recently has the Istio community introduced a universal solution compatible with any CNI. This mode addresses compatibility issues with any CNI, enabling Istio to more effectively manage traffic between services without affecting existing network policies.

Security Considerations for NET_ADMIN Permissions

In containerized environments like Kubernetes and Docker, NET_ADMIN permissions allow processes within containers to perform extensive network-related operations, including modifying iptables rules, changing network interface configurations, managing IP routing tables, and controlling kernel parameters related to networking. However, the use of these permissions raises security concerns, especially regarding overprivileged access and potential attack surfaces.

Best practices include:

• Limiting scope of use: Grant NET_ADMIN permissions only when necessary and restrict them through Kubernetes network policies.
• Continuous monitoring and auditing: Enforce strict logging and monitoring for containers using NET_ADMIN permissions.

Working Principles of Istio CNI Plugin

The Istio CNI plugin is a binary file installed as an agent in the file system of each node. The following flowchart illustrates the working principles of the Istio CNI node agent:

• Istio CNI Node Agent acts as an agent installed on each node.
• It installs the Istio CNI plugin and updates the node’s CNI configuration.
• The agent monitors the CNI plugin and config paths for changes.
• In Sidecar Mode, it handles sidecar networking setups using iptables for pods.
• In Ambient Mode, it synchronizes pod events to an ambient watch server, which then configures iptables within pods.
• Nodes require elevated privileges like CAP_SYS_ADMIN, CAP_NET_ADMIN, and CAP_NET_RAW to function in either mode.

Resolving Conflicts Between Istio Ambient Mode and Kubernetes CNI

Istio’s Ambient Mode is designed to adapt to all CNIs, transparently handling traffic redirection within pods using ztunnel without affecting existing CNI configurations. In this mode, Ambient Mode manages traffic through ztunnel to flow through the Istio service mesh, while standard CNIs focus on providing standardized network access for pods.

The primary responsibilities of CNI are to address network connectivity between Kubernetes Pods, such as assigning IP addresses and forwarding packets. In contrast, Ambient Mode needs to import traffic into ztunnel, which may be incompatible with CNI’s network configuration. The main issues include:

• Mainstream CNI network configurations may conflict with Istio’s CNI extensions, causing interruptions in traffic processing.
• Using Istio CNI may affect the execution of these policies if the deployed network policies depend on CNI.

To address these issues, traffic redirection is managed by running ztunnel in the same user space as the pod, avoiding conflicts with the kernel space modified by CNI. Thus, pods can connect directly to ztunnel, bypassing the influence of CNI.

The following sequence diagram describes the process under Ambient mode:

• Ambient CNI Agent initiates interactions by listening for UDS events signaling pod creations.

• Ambient Watch Server modifies iptables within pods to redirect traffic to ztunnel as needed.

• ztunnel establishes connections and handles network traffic redirection within the Kubernetes cluster.

Resolving Conflicts Between Istio Ambient Mode and Kubernetes CNI

To mitigate these conflicts, Istio’s Ambient Mode avoids dependencies on the kernel space modified by CNI:

• Run ztunnel in user space: This strategy allows ztunnel to run in the same user space as the pod, avoiding direct conflicts with CNI.
• Ensure CNI compatibility: Istio CNI configurations must be carried out without affecting existing CNI plugin configurations, ensuring normal communication between pods and traffic management.

These measures help Istio’s Ambient Mode effectively manage traffic between services without disrupting existing CNI plugins.

Optimized Traffic Management with Istio Ambient Mode

Istio’s Ambient Mode employs an advanced traffic forwarding mechanism through node-local Ztunnel, allowing for the establishment of listening sockets within a Pod’s network namespace. This setup facilitates effective redirection of encrypted (mTLS) and plaintext traffic originating from the service mesh. Not only does this approach enhance the flexibility of traffic management, but it also prevents potential conflicts with existing CNI plugins. Below is a detailed implementation flow of this mode:

The specific steps involved are as follows:

1. Detection of Tags: The Istio CNI node agent detects Pods tagged with istio.io/dataplane-mode=ambient.
2. Triggering the CNI Plugin: Based on Pod events (either a new start or an existing Pod joining the mesh), the CNI plugin is triggered, leading the Istio CNI node agent to configure traffic redirection.
3. Configuring Redirection Rules: Network redirection rules are set up within the Pod’s network namespace to intercept and redirect traffic to the node-local ztunnel proxy.
4. Establishment of Listening Sockets: The node-local ztunnel creates listening sockets within the Pod’s network namespace to enable traffic redirection.
5. Traffic Handling: The node-local ztunnel handles encrypted (mTLS) and plaintext traffic within the mesh, ensuring secure and efficient data transfer.

Through this approach, Istio Ambient Mode provides a more effective and secure solution for managing inter-service traffic in Kubernetes environments.

Conclusion

This article thoroughly analyzes the design principles, implementation, and advantages of the Istio CNI plugin, particularly how Istio CNI addresses the permission and security issues present in traditional istio-init methods. Through these innovations, Istio has made significant progress in network security and operational simplicity, providing a more flexible and efficient method for implementing Istio in Kubernetes environments.

This blog was initially published at tetrate.io .