mirror of https://github.com/istio/istio.io.git
179 lines
31 KiB
HTML
179 lines
31 KiB
HTML
<!doctype html><html lang=en itemscope itemtype=https://schema.org/WebPage><head><meta charset=utf-8><meta http-equiv=x-ua-compatible content="IE=edge"><meta name=viewport content="width=device-width,initial-scale=1,shrink-to-fit=no"><meta name=theme-color content="#466BB0"><meta name=title content="Expanding into New Frontiers - Smart DNS Proxying in Istio"><meta name=description content="Workload Local DNS resolution to simplify VM integration, multicluster, and more."><meta name=author content="Shriram Rajagopalan (Tetrate.io) on behalf of Istio Networking WG"><meta name=keywords content="microservices,services,mesh,dns,sidecar,multicluster,vm,external services"><meta property="og:title" content="Expanding into New Frontiers - Smart DNS Proxying in Istio"><meta property="og:type" content="website"><meta property="og:description" content="Workload Local DNS resolution to simplify VM integration, multicluster, and more."><meta property="og:url" content="/v1.19/blog/2020/dns-proxy/"><meta property="og:image" content="https://raw.githubusercontent.com/istio/istio.io/master/static/img/istio-social.svg"><meta property="og:image:alt" content="Istio Logo"><meta property="og:image:width" content="1200"><meta property="og:image:height" content="600"><meta property="og:site_name" content="Istio"><meta name=twitter:card content="summary"><meta name=twitter:site content="@IstioMesh"><title>Istioldie 1.19 / Expanding into New Frontiers - Smart DNS Proxying in Istio</title><script async src="https://www.googletagmanager.com/gtag/js?id=UA-98480406-2"></script>
|
||
<script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","UA-98480406-2")</script><link rel=alternate type=application/rss+xml title="Istio Blog" href=/v1.19/blog/feed.xml><link rel=alternate type=application/rss+xml title="Istio News" href=/v1.19/news/feed.xml><link rel=alternate type=application/rss+xml title="Istio Blog and News" href=/v1.19/feed.xml><link rel="shortcut icon" href=/v1.19/favicons/favicon.ico><link rel=apple-touch-icon href=/v1.19/favicons/apple-touch-icon-180x180.png sizes=180x180><link rel=icon type=image/png href=/v1.19/favicons/favicon-16x16.png sizes=16x16><link rel=icon type=image/png href=/v1.19/favicons/favicon-32x32.png sizes=32x32><link rel=icon type=image/png href=/v1.19/favicons/android-36x36.png sizes=36x36><link rel=icon type=image/png href=/v1.19/favicons/android-48x48.png sizes=48x48><link rel=icon type=image/png href=/v1.19/favicons/android-72x72.png sizes=72x72><link rel=icon type=image/png href=/v1.19/favicons/android-96x96.png sizes=96xW96><link rel=icon type=image/png href=/v1.19/favicons/android-144x144.png sizes=144x144><link rel=icon type=image/png href=/v1.19/favicons/android-192x192.png sizes=192x192><link rel=icon type=image/svg+xml href=/v1.19/favicons/favicon.svg><link rel=icon type=image/png href=/v1.19/favicons/favicon.png><link rel=mask-icon href=/v1.19/favicons/safari-pinned-tab.svg color=#466bb0><link rel=manifest href=/v1.19/manifest.json><meta name=apple-mobile-web-app-title content="Istio"><meta name=application-name content="Istio"><meta name=msapplication-config content="/browserconfig.xml"><meta name=msapplication-TileColor content="#466BB0"><meta name=theme-color content="#466BB0"><link rel=stylesheet href=/v1.19/css/all.css><link rel=preconnect href=https://fonts.googleapis.com><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&display=swap"><script src=/v1.19/js/themes_init.min.js></script></head><body class="language-unknown archive-site"><script>const branchName="release-1.19",docTitle="Expanding into New Frontiers - Smart DNS Proxying in Istio",iconFile="/v1.19/img/icons.svg",buttonCopy="Copy to clipboard",buttonPrint="Print",buttonDownload="Download"</script><script src="https://www.google.com/cse/brand?form=search-form" defer></script>
|
||
<script src=/v1.19/js/all.min.js data-manual defer></script><header class=main-navigation><nav class="main-navigation-wrapper container-l"><div class=main-navigation-header><a id=brand href=/v1.19/ aria-label=logotype><span class=logo><svg xmlns="http://www.w3.org/2000/svg" width="128" height="60" viewBox="0 0 128 60"><path d="M58.434 48.823A.441.441.0 0158.3 48.497V22.583a.444.444.0 01.134-.326.446.446.0 01.327-.134h3.527a.447.447.0 01.325.134.447.447.0 01.134.326v25.914a.443.443.0 01-.134.326.444.444.0 01-.325.134h-3.527a.444.444.0 01-.327-.134z"/><path d="m70.969 48.477a6.556 6.556.0 01-2.818-1.955 4.338 4.338.0 01-1-2.78v-.345a.443.443.0 01.134-.326.444.444.0 01.326-.135h3.374a.444.444.0 01.326.135.445.445.0 01.134.326v.077a2.014 2.014.0 001.054 1.667 4.672 4.672.0 002.664.709 4.446 4.446.0 002.492-.633 1.862 1.862.0 00.958-1.591 1.426 1.426.0 00-.786-1.322 12.7 12.7.0 00-2.549-.939l-1.457-.46a21.526 21.526.0 01-3.3-1.227 6.57 6.57.0 01-2.262-1.783 4.435 4.435.0 01-.92-2.894 5.081 5.081.0 012.109-4.275 8.993 8.993.0 015.558-1.591 10.445 10.445.0 014.1.748 6.3 6.3.0 012.722 2.07 5 5 0 01.958 3.009.441.441.0 01-.134.326.441.441.0 01-.325.134h-3.258a.441.441.0 01-.326-.134.443.443.0 01-.134-.326 1.974 1.974.0 00-.978-1.667 4.647 4.647.0 00-2.665-.671 4.741 4.741.0 00-2.435.556 1.724 1.724.0 00-.938 1.553 1.512 1.512.0 00.9 1.4 15.875 15.875.0 003.01 1.055l.843.229a27.368 27.368.0 013.412 1.246 6.67 6.67.0 012.338 1.763 4.387 4.387.0 01.958 2.933 4.988 4.988.0 01-2.146 4.275 9.543 9.543.0 01-5.712 1.552 11.626 11.626.0 01-4.227-.709z"/><path d="m97.039 32.837a.443.443.0 01-.326.135h-3.911a.169.169.0 00-.191.192v9.239a2.951 2.951.0 00.632 2.108 2.7 2.7.0 002.013.652h1.15a.444.444.0 01.325.134.441.441.0 01.134.326v2.875a.471.471.0 01-.459.5l-1.994.039a8 8 0 01-4.524-1.035q-1.495-1.035-1.533-3.91V33.166A.17.17.0 0088.164 32.974H85.978A.441.441.0 0185.652 32.839.441.441.0 0185.518 32.513V29.83a.441.441.0 01.134-.326.444.444.0 01.326-.135h2.186a.169.169.0 00.191-.192v-4.485a.438.438.0 01.134-.326.44.44.0 01.325-.134h3.336a.443.443.0 01.325.134.442.442.0 01.135.326v4.485a.169.169.0 00.191.192h3.911a.446.446.0 01.326.135.446.446.0 01.134.326v2.683a.446.446.0 01-.133.324z"/><path d="m101.694 25.917a2.645 2.645.0 01-.767-1.955 2.65 2.65.0 01.767-1.955 2.65 2.65.0 011.955-.767 2.65 2.65.0 011.955.767 2.652 2.652.0 01.767 1.955 2.647 2.647.0 01-.767 1.955 2.646 2.646.0 01-1.955.767 2.645 2.645.0 01-1.955-.767zm-.211 22.906a.441.441.0 01-.134-.326V29.79a.444.444.0 01.134-.326.446.446.0 01.326-.134h3.527a.446.446.0 01.326.134.445.445.0 01.134.326v18.707a.443.443.0 01-.134.326.443.443.0 01-.326.134h-3.527a.443.443.0 01-.326-.134z"/><path d="m114.019 47.734a8.1 8.1.0 01-3.047-4.255 14.439 14.439.0 01-.652-4.37 14.3 14.3.0 01.614-4.371A7.869 7.869.0 01114 30.56a9.072 9.072.0 015.252-1.5 8.543 8.543.0 015.041 1.5 7.985 7.985.0 013.009 4.14 12.439 12.439.0 01.69 4.37 13.793 13.793.0 01-.651 4.37 8.255 8.255.0 01-3.028 4.275 8.475 8.475.0 01-5.1 1.553 8.754 8.754.0 01-5.194-1.534zm7.629-3.1a4.536 4.536.0 001.476-2.262 11.335 11.335.0 00.383-3.221 10.618 10.618.0 00-.383-3.22 4.169 4.169.0 00-1.457-2.243 4.066 4.066.0 00-2.531-.785 3.942 3.942.0 00-2.453.785 4.376 4.376.0 00-1.5 2.243 11.839 11.839.0 00-.383 3.22 11.84 11.84.0 00.383 3.221 4.222 4.222.0 001.476 2.262 4.075 4.075.0 002.549.8 3.8 3.8.0 002.44-.809z"/><path d="m15.105 32.057v15.565a.059.059.0 01-.049.059L.069 50.25A.06.06.0 01.005 50.167l14.987-33.47a.06.06.0 01.114.025z"/><path d="m17.631 23.087v24.6a.06.06.0 00.053.059l22.449 2.507a.06.06.0 00.061-.084L17.745.032a.06.06.0 00-.114.024z"/><path d="m39.961 52.548-24.833 7.45a.062.062.0 01-.043.0L.079 52.548a.059.059.0 01.026-.113h39.839a.06.06.0 01.017.113z"/></svg></span></a><button id=hamburger class=main-navigation-toggle aria-label="Open navigation"><svg class="icon menu-hamburger"><use xlink:href="/v1.19/img/icons.svg#menu-hamburger"/></svg></button>
|
||
<button id=menu-close class=main-navigation-toggle aria-label="Close navigation"><svg class="icon menu-close"><use xlink:href="/v1.19/img/icons.svg#menu-close"/></svg></button></div><div id=header-links class=main-navigation-links-wrapper><ul class=main-navigation-links><li class=main-navigation-links-item><a class="main-navigation-links-link has-dropdown"><span>About</span><svg class="icon dropdown-arrow"><use xlink:href="/v1.19/img/icons.svg#dropdown-arrow"/></svg></a><ul class=main-navigation-links-dropdown><li class=main-navigation-links-dropdown-item><a href=/v1.19/about/service-mesh class=main-navigation-links-link>Service mesh</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.19/about/solutions class=main-navigation-links-link>Solutions</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.19/about/case-studies class=main-navigation-links-link>Case studies</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.19/about/ecosystem class=main-navigation-links-link>Ecosystem</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.19/about/deployment class=main-navigation-links-link>Deployment</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.19/about/faq class=main-navigation-links-link>FAQ</a></li></ul></li><li class=main-navigation-links-item><a href=/v1.19/blog/ class=main-navigation-links-link><span>Blog</span></a></li><li class=main-navigation-links-item><a href=/v1.19/news/ class=main-navigation-links-link><span>News</span></a></li><li class=main-navigation-links-item><a href=/v1.19/get-involved/ class=main-navigation-links-link><span>Get involved</span></a></li><li class=main-navigation-links-item><a href=/v1.19/docs/ class=main-navigation-links-link><span>Documentation</span></a></li></ul><div class=main-navigation-footer><button id=search-show class=search-show title='Search this site' aria-label=Search><svg class="icon magnifier"><use xlink:href="/v1.19/img/icons.svg#magnifier"/></svg></button>
|
||
<a href=/v1.19/docs/setup/getting-started class="btn btn--primary" id=try-istio>Try Istio</a></div></div><form id=search-form class=search name=cse role=search><input type=hidden name=cx value=002184991200833970123:iwwf17ikgf4>
|
||
<input type=hidden name=ie value=utf-8>
|
||
<input type=hidden name=hl value=en>
|
||
<input type=hidden id=search-page-url value=/search>
|
||
<input id=search-textbox class="search-textbox form-control" name=q type=search aria-label='Search this site' placeholder=Search>
|
||
<button id=search-close title='Cancel search' type=reset aria-label='Cancel search'><svg class="icon menu-close"><use xlink:href="/v1.19/img/icons.svg#menu-close"/></svg></button></form></nav></header><div class=banner-container><a href=/v1.19/news/releases/1.19.x/announcing-1.19.4/ class=banner data-title="Latest Release-2023-11-13 00:00:00 +0000 UTC" data-period-start=1699833600000 data-period-end=1700438400000 data-max-impressions=3 data-timeout><div class=content><p>Istio 1.19.4 is now available! Click here to learn more</p></div><div class=frame></div></a></div><article class=post itemscope itemtype=http://schema.org/BlogPosting><div class=header-content><h1>Expanding into New Frontiers - Smart DNS Proxying in Istio</h1><p>Workload Local DNS resolution to simplify VM integration, multicluster, and more.</p></div><p class=post-author>Nov 12, 2020 <span>|</span> By Shriram Rajagopalan - Tetrate.io on behalf of Istio Networking WG</p><div><p>DNS resolution is a vital component of any application infrastructure
|
||
on Kubernetes. When your application code attempts to access another
|
||
service in the Kubernetes cluster or even a service on the internet,
|
||
it has to first lookup the IP address corresponding to the hostname of
|
||
the service, before initiating a connection to the service. This name
|
||
lookup process is often referred to as <strong>service discovery</strong>. In
|
||
Kubernetes, the cluster DNS server, be it <code>kube-dns</code> or CoreDNS,
|
||
resolves the service’s hostname to a unique non-routable virtual IP (VIP),
|
||
if it is a service of type <code>clusterIP</code>. The <code>kube-proxy</code> on each node
|
||
maps this VIP to a set of pods of the service, and forwards the traffic
|
||
to one of them selected at random. When using a service mesh, the
|
||
sidecar works similarly to the <code>kube-proxy</code> as far as traffic forwarding
|
||
is concerned.</p><p>The following diagram depicts the role of DNS today:</p><figure style=width:75%><div class=wrapper-with-intrinsic-ratio style=padding-bottom:57.00636942675159%><a data-skipendnotes=true href=/v1.19/blog/2020/dns-proxy/role-of-dns-today.png title="Role of DNS in Istio, today"><img class=element-to-stretch src=/v1.19/blog/2020/dns-proxy/role-of-dns-today.png alt="Role of DNS in Istio, today"></a></div><figcaption>Role of DNS in Istio, today</figcaption></figure><h2 id=problems-posed-by-dns>Problems posed by DNS</h2><p>While the role of DNS within the service mesh may seem insignificant,
|
||
it has consistently stood in the way of expanding the mesh to VMs and
|
||
enabling seamless multicluster access.</p><h3 id=vm-access-to-kubernetes-services>VM access to Kubernetes services</h3><p>Consider the case of a VM with a sidecar. As shown in the illustration
|
||
below, applications on the VM look up the IP addresses of services
|
||
inside the Kubernetes cluster as they typically have no access to the
|
||
cluster’s DNS server.</p><figure style=width:75%><div class=wrapper-with-intrinsic-ratio style=padding-bottom:42.37837837837838%><a data-skipendnotes=true href=/v1.19/blog/2020/dns-proxy/vm-dns-resolution-issues.png title="DNS resolution issues on VMs accessing Kubernetes services"><img class=element-to-stretch src=/v1.19/blog/2020/dns-proxy/vm-dns-resolution-issues.png alt="DNS resolution issues on VMs accessing Kubernetes services"></a></div><figcaption>DNS resolution issues on VMs accessing Kubernetes services</figcaption></figure><p>It is technically possible to use <code>kube-dns</code> as a name server on the VM if one is
|
||
willing to engage in some convoluted workarounds involving <code>dnsmasq</code> and
|
||
external exposure of <code>kube-dns</code> using <code>NodePort</code> services: assuming you
|
||
manage to convince your cluster administrator to do so. Even so, you are
|
||
opening the door to a host of <a href=https://blog.aquasec.com/dns-spoofing-kubernetes-clusters>security
|
||
issues</a>. At
|
||
the end of the day, these are point solutions that are typically out
|
||
of scope for those with limited organizational capability and domain
|
||
expertise.</p><h3 id=external-tcp-services-without-vips>External TCP services without VIPs</h3><p>It is not just the VMs in the mesh that suffer from the DNS issue. For
|
||
the sidecar to accurately distinguish traffic between two different
|
||
TCP services that are outside the mesh, the services must be on
|
||
different ports or they need to have a globally unique VIP, much like
|
||
the <code>clusterIP</code> assigned to Kubernetes services. But what if there is
|
||
no VIP? Cloud hosted services like hosted databases, typically do not
|
||
have a VIP. Instead, the provider’s DNS server returns one of the
|
||
instance IPs that can then be directly accessed by the
|
||
application. For example, consider the two service entries below,
|
||
pointing to two different AWS RDS services:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: networking.istio.io/v1alpha3
|
||
kind: ServiceEntry
|
||
metadata:
|
||
name: db1
|
||
namespace: ns1
|
||
spec:
|
||
hosts:
|
||
- mysql-instance1.us-east-1.rds.amazonaws.com
|
||
ports:
|
||
- name: mysql
|
||
number: 3306
|
||
protocol: TCP
|
||
resolution: DNS
|
||
---
|
||
apiVersion: networking.istio.io/v1alpha3
|
||
kind: ServiceEntry
|
||
metadata:
|
||
name: db2
|
||
namespace: ns1
|
||
spec:
|
||
hosts:
|
||
- mysql-instance2.us-east-1.rds.amazonaws.com
|
||
ports:
|
||
- name: mysql
|
||
number: 3306
|
||
protocol: TCP
|
||
resolution: DNS
|
||
</code></pre><p>The sidecar has a single listener on <code>0.0.0.0:3306</code> that looks up the
|
||
IP address of <code>mysql-instance1.us-east1.rds.amazonaws.com</code> from public
|
||
DNS servers and forwards traffic to it. It cannot route traffic to
|
||
<code>db2</code> as it has no way of distinguishing whether traffic arriving at
|
||
<code>0.0.0.0:3306</code> is bound for <code>db1</code> or <code>db2</code>. The only way to accomplish
|
||
this is to set the resolution to <code>NONE</code> causing the sidecar to
|
||
<em>blindly forward any traffic</em> on port <code>3306</code> to the original IP
|
||
requested by the application. This is akin to punching a hole in the
|
||
firewall allowing all traffic to port <code>3306</code> irrespective of the
|
||
destination IP. To get traffic flowing, you are now forced to
|
||
compromise on the security posture of your system.</p><h3 id=resolving-dns-for-services-in-remote-clusters>Resolving DNS for services in remote clusters</h3><p>The DNS limitations of a multicluster mesh are well known. Services in
|
||
one cluster cannot lookup the IP addresses of services in other
|
||
clusters, without clunky workarounds such as creating stub services in
|
||
the caller namespace.</p><h2 id=taking-control-of-dns>Taking control of DNS</h2><p>All in all, DNS has been a thorny issue in Istio for a while. It was
|
||
time to slay the beast. We (the Istio networking team) decided to
|
||
tackle the problem once and for all in a way that is completely
|
||
transparent to you, the end user. Our first attempt involved utilizing
|
||
Envoy’s DNS proxy. It turned out to be very unreliable, and
|
||
disappointing overall due to the general lack of sophistication in
|
||
the c-ares DNS library used by Envoy. Determined to solve the
|
||
problem, we decided to implement the DNS proxy in the Istio sidecar
|
||
agent, written in Go. We were able to optimize the implementation to
|
||
handle all the scenarios that we wanted to tackle without compromising
|
||
on scale and stability. The Go DNS library we use is the same one
|
||
used by scalable DNS implementations such as CoreDNS, Consul,
|
||
Mesos, etc. It has been battle tested in production for scale and stability.</p><p>Starting with Istio 1.8, the Istio agent on the sidecar will ship with
|
||
a caching DNS proxy, programmed dynamically by Istiod. Istiod pushes
|
||
the hostname-to-IP-address mappings for all the services that the
|
||
application may access based on the Kubernetes services and service
|
||
entries in the cluster. DNS lookup queries from the application are
|
||
transparently intercepted and served by the Istio agent in the pod or
|
||
VM. If the query is for a service within the mesh, <em>irrespective of
|
||
the cluster that the service is in</em>, the agent responds directly to the
|
||
application. If not, it forwards the query to the upstream name
|
||
servers defined in <code>/etc/resolv.conf</code>. The following diagram depicts
|
||
the interactions that occur when an application tries to access a
|
||
service using its hostname.</p><figure style=width:75%><div class=wrapper-with-intrinsic-ratio style=padding-bottom:41.07929515418502%><a data-skipendnotes=true href=/v1.19/blog/2020/dns-proxy/dns-interception-in-istio.png title="Smart DNS proxying in Istio sidecar agent"><img class=element-to-stretch src=/v1.19/blog/2020/dns-proxy/dns-interception-in-istio.png alt="Smart DNS proxying in Istio sidecar agent"></a></div><figcaption>Smart DNS proxying in Istio sidecar agent</figcaption></figure><p>As you will see in the following sections, <em>the DNS proxying feature
|
||
has had an enormous impact across many aspects of Istio.</em></p><h3 id=reduced-load-on-your-dns-servers-w-faster-resolution>Reduced load on your DNS servers w/ faster resolution</h3><p>The load on your cluster’s Kubernetes DNS server drops drastically as
|
||
almost all DNS queries are resolved within the pod by Istio. The
|
||
bigger the footprint of mesh on a cluster, the lesser the load on your
|
||
DNS servers. Implementing our own DNS proxy in the Istio agent has
|
||
allowed us to implement cool optimizations such as <a href=https://coredns.io/plugins/autopath/>CoreDNS
|
||
auto-path</a> without the
|
||
correctness issues that CoreDNS currently faces.</p><p>To understand the impact of this optimization, lets take a simple DNS
|
||
lookup scenario, in a standard Kubernetes cluster without any custom
|
||
DNS setup for pods - i.e., with the default setting of <code>ndots:5</code> in <code>/etc/resolv.conf</code>.
|
||
When your application starts a DNS lookup for
|
||
<code>productpage.ns1.svc.cluster.local</code>, it appends the DNS search
|
||
namespaces in <code>/etc/resolv.conf</code> (e.g., <code>ns1.svc.cluster.local</code>) as part
|
||
of the DNS query, before querying the host as-is. As a result, the
|
||
first DNS query that is actually sent out will look like
|
||
<code>productpage.ns1.svc.cluster.local.ns1.svc.cluster.local</code>, which will
|
||
inevitably fail DNS resolution when Istio is not involved. If your
|
||
<code>/etc/resolv.conf</code> has 5 search namespaces, the application will send
|
||
two DNS queries for each search namespace, one for the IPv4 <code>A</code> record
|
||
and another for the IPv6 <code>AAAA</code> record, and then a final pair of
|
||
queries with the exact hostname used in the code. <em>Before establishing the
|
||
connection, the application performs 12 DNS lookup queries for each host!</em></p><p>With Istio’s implementation of the CoreDNS style auto-path technique,
|
||
the sidecar agent will detect the real hostname being queried within
|
||
the first query and return a <code>cname</code> record to
|
||
<code>productpage.ns1.svc.cluster.local</code> as part of this DNS response, as
|
||
well as the <code>A/AAAA</code> record for
|
||
<code>productpage.ns1.svc.cluster.local</code>. The application receiving this
|
||
response can now extract the IP address immediately and proceed to
|
||
establishing a TCP connection to that IP. <em>The smart DNS proxy in the
|
||
Istio agent dramatically cuts down the number of DNS queries from 12
|
||
to just 2!</em></p><h3 id=vms-to-kubernetes-integration>VMs to Kubernetes integration</h3><p>Since the Istio agent performs local DNS resolution for services
|
||
within the mesh, DNS lookup queries for Kubernetes services from VMs will now
|
||
succeed without requiring clunky workarounds for exposing <code>kube-dns</code>
|
||
outside the cluster. The ability to seamlessly resolve internal
|
||
services in a cluster will now simplify your monolith to microservice
|
||
journey, as the monolith on VMs can now access microservices on
|
||
Kubernetes without additional levels of indirection via API gateways.</p><h3 id=automatic-vip-allocation-where-possible>Automatic VIP allocation where possible</h3><p>You may ask, how does this DNS functionality in the agent solve the
|
||
problem of distinguishing between multiple external TCP services
|
||
without VIPs on the same port?</p><p>Taking inspiration from Kubernetes, Istio will now automatically
|
||
allocate non-routable VIPs (from the Class E subnet) to such services
|
||
as long as they do not use a wildcard host. The Istio agent on the
|
||
sidecar will use the VIPs as responses to the DNS lookup queries from
|
||
the application. Envoy can now clearly distinguish traffic bound for
|
||
each external TCP service and forward it to the right target. With the
|
||
introduction of the DNS proxying, you will no longer need to use
|
||
<code>resolution: NONE</code> for non-wildcard TCP services, improving your
|
||
overall security posture. Istio cannot help much with wildcard
|
||
external services (e.g., <code>*.us-east1.rds.amazonaws.com</code>). You will
|
||
have to resort to NONE resolution mode to handle such services.</p><h3 id=multicluster-dns-lookup>Multicluster DNS lookup</h3><p>For the adventurous lot, attempting to weave a multicluster mesh where
|
||
applications directly call internal services of a namespace in a
|
||
remote cluster, the DNS proxy functionality comes in quite handy. Your
|
||
applications can <em>resolve Kubernetes services on any cluster in any
|
||
namespace</em>, without the need to create stub Kubernetes services in
|
||
every cluster.</p><p>The benefits of the DNS proxy extend beyond the multicluster models
|
||
that are currently described in Istio today. At Tetrate, we use this
|
||
mechanism extensively in our customers’ multicluster deployments to
|
||
enable sidecars to resolve DNS for hosts exposed at ingress gateways
|
||
of all the clusters in a mesh, and access them over mutual TLS.</p><h2 id=concluding-thoughts>Concluding thoughts</h2><p>The problems caused by lack of control over DNS have often been
|
||
overlooked and ignored in its entirety when it comes to weaving a mesh
|
||
across many clusters, different environments, and integrating external
|
||
services. The introduction of a caching DNS proxy in the Istio sidecar
|
||
agent solves these issues. Exercising control over the
|
||
application’s DNS resolution allows Istio to accurately identify the
|
||
target service to which traffic is bound, and enhance the overall
|
||
security, routing, and telemetry posture in Istio within and across
|
||
clusters.</p><p>Smart DNS proxying is enabled in the <code>preview</code>
|
||
profile in Istio 1.8. Please try it out!</p></div><nav class=pagenav><div class=left><a title="How to ensure your clusters are not impacted by Docker Hub rate limiting." href=/v1.19/blog/2020/docker-rate-limit/ class=next-link><svg class="icon left-arrow"><use xlink:href="/v1.19/img/icons.svg#left-arrow"/></svg>Handling Docker Hub rate limiting</a></div><div class=right><a title="Announcing the four newest Istio Steering Committee members." href=/v1.19/blog/2020/steering-election-results/ class=next-link>2020 Steering Committee Election Results<svg class="icon right-arrow"><use xlink:href="/v1.19/img/icons.svg#right-arrow"/></svg></a></div></nav></article><footer class=footer><div class="footer-wrapper container-l"><div class="user-links footer-links"><a class=channel title='GitHub is where development takes place on Istio code' href=https://github.com/istio/community aria-label=GitHub><svg class="icon github"><use xlink:href="/v1.19/img/icons.svg#github"/></svg></a><a class=channel title="Access our team drive if you'd like to take a look at the Istio technical design documents" href=https://groups.google.com/forum/#!forum/istio-team-drive-access aria-label="team drive"><svg class="icon drive"><use xlink:href="/v1.19/img/icons.svg#drive"/></svg></a><a class=channel title='Interactively discuss issues with the Istio community on Slack' href=https://slack.istio.io aria-label=slack><svg class="icon slack"><use xlink:href="/v1.19/img/icons.svg#slack"/></svg></a><a class=channel title='Stack Overflow is where you can ask questions and find curated answers on deploying, configuring, and using Istio' href=https://stackoverflow.com/questions/tagged/istio aria-label="Stack Overflow"><svg class="icon stackoverflow"><use xlink:href="/v1.19/img/icons.svg#stackoverflow"/></svg></a><a class=channel title='Follow us on Twitter to get the latest news' href=https://twitter.com/IstioMesh aria-label=Twitter><svg class="icon twitter"><use xlink:href="/v1.19/img/icons.svg#twitter"/></svg></a></div><hr class=footer-separator role=separator><div class="info footer-info"><a class=logo href=/v1.19/ aria-label=logotype><svg xmlns="http://www.w3.org/2000/svg" width="128" height="60" viewBox="0 0 128 60"><path d="M58.434 48.823A.441.441.0 0158.3 48.497V22.583a.444.444.0 01.134-.326.446.446.0 01.327-.134h3.527a.447.447.0 01.325.134.447.447.0 01.134.326v25.914a.443.443.0 01-.134.326.444.444.0 01-.325.134h-3.527a.444.444.0 01-.327-.134z"/><path d="m70.969 48.477a6.556 6.556.0 01-2.818-1.955 4.338 4.338.0 01-1-2.78v-.345a.443.443.0 01.134-.326.444.444.0 01.326-.135h3.374a.444.444.0 01.326.135.445.445.0 01.134.326v.077a2.014 2.014.0 001.054 1.667 4.672 4.672.0 002.664.709 4.446 4.446.0 002.492-.633 1.862 1.862.0 00.958-1.591 1.426 1.426.0 00-.786-1.322 12.7 12.7.0 00-2.549-.939l-1.457-.46a21.526 21.526.0 01-3.3-1.227 6.57 6.57.0 01-2.262-1.783 4.435 4.435.0 01-.92-2.894 5.081 5.081.0 012.109-4.275 8.993 8.993.0 015.558-1.591 10.445 10.445.0 014.1.748 6.3 6.3.0 012.722 2.07 5 5 0 01.958 3.009.441.441.0 01-.134.326.441.441.0 01-.325.134h-3.258a.441.441.0 01-.326-.134.443.443.0 01-.134-.326 1.974 1.974.0 00-.978-1.667 4.647 4.647.0 00-2.665-.671 4.741 4.741.0 00-2.435.556 1.724 1.724.0 00-.938 1.553 1.512 1.512.0 00.9 1.4 15.875 15.875.0 003.01 1.055l.843.229a27.368 27.368.0 013.412 1.246 6.67 6.67.0 012.338 1.763 4.387 4.387.0 01.958 2.933 4.988 4.988.0 01-2.146 4.275 9.543 9.543.0 01-5.712 1.552 11.626 11.626.0 01-4.227-.709z"/><path d="m97.039 32.837a.443.443.0 01-.326.135h-3.911a.169.169.0 00-.191.192v9.239a2.951 2.951.0 00.632 2.108 2.7 2.7.0 002.013.652h1.15a.444.444.0 01.325.134.441.441.0 01.134.326v2.875a.471.471.0 01-.459.5l-1.994.039a8 8 0 01-4.524-1.035q-1.495-1.035-1.533-3.91V33.166A.17.17.0 0088.164 32.974H85.978A.441.441.0 0185.652 32.839.441.441.0 0185.518 32.513V29.83a.441.441.0 01.134-.326.444.444.0 01.326-.135h2.186a.169.169.0 00.191-.192v-4.485a.438.438.0 01.134-.326.44.44.0 01.325-.134h3.336a.443.443.0 01.325.134.442.442.0 01.135.326v4.485a.169.169.0 00.191.192h3.911a.446.446.0 01.326.135.446.446.0 01.134.326v2.683a.446.446.0 01-.133.324z"/><path d="m101.694 25.917a2.645 2.645.0 01-.767-1.955 2.65 2.65.0 01.767-1.955 2.65 2.65.0 011.955-.767 2.65 2.65.0 011.955.767 2.652 2.652.0 01.767 1.955 2.647 2.647.0 01-.767 1.955 2.646 2.646.0 01-1.955.767 2.645 2.645.0 01-1.955-.767zm-.211 22.906a.441.441.0 01-.134-.326V29.79a.444.444.0 01.134-.326.446.446.0 01.326-.134h3.527a.446.446.0 01.326.134.445.445.0 01.134.326v18.707a.443.443.0 01-.134.326.443.443.0 01-.326.134h-3.527a.443.443.0 01-.326-.134z"/><path d="m114.019 47.734a8.1 8.1.0 01-3.047-4.255 14.439 14.439.0 01-.652-4.37 14.3 14.3.0 01.614-4.371A7.869 7.869.0 01114 30.56a9.072 9.072.0 015.252-1.5 8.543 8.543.0 015.041 1.5 7.985 7.985.0 013.009 4.14 12.439 12.439.0 01.69 4.37 13.793 13.793.0 01-.651 4.37 8.255 8.255.0 01-3.028 4.275 8.475 8.475.0 01-5.1 1.553 8.754 8.754.0 01-5.194-1.534zm7.629-3.1a4.536 4.536.0 001.476-2.262 11.335 11.335.0 00.383-3.221 10.618 10.618.0 00-.383-3.22 4.169 4.169.0 00-1.457-2.243 4.066 4.066.0 00-2.531-.785 3.942 3.942.0 00-2.453.785 4.376 4.376.0 00-1.5 2.243 11.839 11.839.0 00-.383 3.22 11.84 11.84.0 00.383 3.221 4.222 4.222.0 001.476 2.262 4.075 4.075.0 002.549.8 3.8 3.8.0 002.44-.809z"/><path d="m15.105 32.057v15.565a.059.059.0 01-.049.059L.069 50.25A.06.06.0 01.005 50.167l14.987-33.47a.06.06.0 01.114.025z"/><path d="m17.631 23.087v24.6a.06.06.0 00.053.059l22.449 2.507a.06.06.0 00.061-.084L17.745.032a.06.06.0 00-.114.024z"/><path d="m39.961 52.548-24.833 7.45a.062.062.0 01-.043.0L.079 52.548a.059.059.0 01.026-.113h39.839a.06.06.0 01.017.113z"/></svg></a><div class=footer-languages><a tabindex=-1 lang=en id=switch-lang-en class="footer-languages-item active"><svg class="icon tick"><use xlink:href="/v1.19/img/icons.svg#tick"/></svg>English</a>
|
||
<a tabindex=-1 lang=zh id=switch-lang-zh class=footer-languages-item>中文</a></div></div><ul class=footer-policies><li class=footer-policies-item><a class=footer-policies-link href=https://www.linuxfoundation.org/legal/terms>Terms and Conditions</a> |
|
||
<a class=footer-policies-link href=https://www.linuxfoundation.org/legal/privacy-policy>Privacy policy</a> |
|
||
<a class=footer-policies-link href=https://github.com/istio/istio.io/edit/release-1.19/content/en/blog/2020/dns-proxy/index.md>Edit this Page on GitHub</a></li></ul><div class=footer-base><span class=footer-base-copyright>© 2023 the Istio Authors.</span>
|
||
<span class=footer-base-version>Version
|
||
Archive
|
||
1.19.4</span><ul class=footer-base-releases><li class=footer-base-releases-item><a tabindex=-1 class=footer-base-releases-link onclick='return navigateToUrlOrRoot("https://istio.io/blog/2020/dns-proxy/"),!1'>current release</a></li><li class=footer-base-releases-item><a tabindex=-1 class=footer-base-releases-link onclick='return navigateToUrlOrRoot("https://preliminary.istio.io/blog/2020/dns-proxy/"),!1'>next release</a></li><li class=footer-base-releases-item><a tabindex=-1 class=footer-base-releases-link href=https://istio.io/archive>older releases</a></li></ul></div></div></footer><div id=scroll-to-top-container aria-hidden=true><button id=scroll-to-top title='Back to top' tabindex=-1><svg class="icon top"><use xlink:href="/v1.19/img/icons.svg#top"/></svg></button></div></body></html> |