In my last two blogs:
I gave you a detailed overview of the traffic in the Istio data plane, but the data plane does not exist in isolation. This article will show you the ports and their usages for each component of both the control plane and data plane in Istio, which will help you understand the relationship between these flows and troubleshoot them.
Firstly, I will show you a global schematic. The following figure shows the components of a sidecar in the Istio data plane, and the objects that interact with it.
We can use the nsenter
command to enter the namespace of the productpage
Pod of the Bookinfo example and see the information about the ports it is listening on internally.
From the figure, we can see that besides the port 9080 that the productpage
application listens to, the Sidecar container also listens to a large number of other ports, such as 15000, 15001, 15004, 15006, 15021, 15090, etc. You can learn about the ports used in Istio in the Istio documentation.
Let’s go back into the productpage
Pod and use the lsof -i
command to see the ports it has open, as shown in the following figure.
We can see that there is a TCP connection established between the pilot-agent
and istiod
, the port in the listening described above, and the TCP connection established inside the Pod, which corresponds to the figure at the beginning of the article.
The root process of the Sidecar container (istio-proxy
) is pilot-agent
, and the startup command is shown below.
As we can see from the figure, the PID of its pilot-agent
process is 1, and it forked the Envoy process.
Check the ports it opens in Istiod, as shown in the figure below.
We can see the ports that are listened to, the inter-process and remote communication connections.
These ports can play a pivotal role when you are troubleshooting. They are described below according to the component and function in which the port is located.
The ports in Istiod are relatively few and single-function.
From the above, we see that there are numerous ports in the sidecar.
pilot-agent
processes, as explained in detail below./healthz/ready
path on this port, and Istio hands off the sidecar readiness checks to kubelet.pilot-agent
will scratch metrics.The above ports can be divided into the following categories.
Let’s look at the key ports in detail.
15000 is Envoy’s Admin interface, which allows us to modify Envoy and get a view and query metrics and configurations.
The Admin interface consists of a REST API with multiple endpoints and a simple user interface. You can enable the Envoy Admin interface view in the productpage
Pod using the following command:
kubectl -n default port-forward deploy/productpage-v1 15000
Visit http://localhost:15000
in your browser and you will see the Envoy Admin interface as shown below.
With the pilot-agent
proxy istiod
debug endpoint on port 8080, you can access localhost’s port 15004 in the data plane Pod to query the grid information, which has the same effect as port 8080 below.
You can also forward istiod
port 8080 locally by running the following command:
kubectl -n istio-system port-forward deploy/istiod 8080
Visit http://localhost:8080/debug
in your browser and you will see the debug endpoint as shown in the figure below.
Of course, this is only one way to get the mesh information and debug the mesh, you can also use istioctl
command or Kiali to debug it, which will be more efficient and intuitive.
Port 15020 has three main usages.
/stats/prometheus
./healthz/ready
and /app-health
.pilot-agent
processes: the corresponding debug endpoints are /quitquitquit
, debug/ndsz
and /debug/pprof
.The following figure shows the debugging information you see when you open http://localhost:15020/debug/pprof
in your browser.
The information in the figure shows the stack information of the pilot-agent
.
By understanding the component ports in Istio, you should have a better understanding of the relationship between the components in Istio and their internal traffic. Being familiar with the functions of these ports will help in troubleshooting the mesh.
Last updated on Dec 5, 2024