Istio 1.9 changes

• Supported Kubernetes versions changed
• EnvoyFilter XDS v2 removal
• Service tags added to trace spans

• Virtual Machine Integration promoted to Beta
• Request/Response Classification promoted to Beta
• Kubernetes Gateway API support
• Improved sidecar injector selection

• Integration with external authorization systems
• Enable Security Token Service (STS) token exchange for XDS flow
• Add OIDC JWT authenticator

• Remote fetch and load of WebAssembly (Wasm) HTTP filters
• Introduce DNS_AUTO_ALLOCATE option
• List sidecar injectors

• Enhance access logs
• Add pprof endpoint to pilot-agent
• Allow gRPC logging for pilot
• DestinationRule inheritance
• Mirroring of images on gcr.io

For the full list of changes please refer to the official change notes.

In Istio 1.9, Kubernetes 1.16 is not officially supported, therefore it is recommended to upgrade to K8s 1.17 before upgrading to Istio 1.9!

More info can be found in Istio upgrade docs.

One more aspect to note here is that VMs can be attached to a mesh in single-network and multi-network setups as well.

There is always a need to more precisely monitor application traffic. That is why it's good to see Request Classification as a Beta feature in Istio 1.9.

The feature can be used with EnvoyFilters using the AttributeGen plugin. The resulting attribute can be added as a dimension to a standard Istio metric (e.g. istio_requests_total).

In Kubernetes, there is an ongoing effort to restructure the old ingress API and have a new well-defined API for service networking. This effort is called the Gateway API project.

If this effort rings a bell to you, but you remember it being named to Service APIs, don't worry, this one is not yet another project. These two are the same, only the Service APIs project was renamed to Gateway API in February 2021.

The goal of the project is to provide a good common API (which should cover all the common features of different ingress implementations), and built-in integration points for custom features in different implementations.

• explicit composition: concrete reference to Istio resources from the k8s Gateway resource
• implicit composition: Istio can layer the resources together without concrete references

Here's a quick intro on the subject by John Howard presented at IstioCon and a getting started guide for the Gateway API on the Istio page.

• Opting out individual pods with the sidecar.istio.io/inject: false label from an auto injected namespace still triggered the webhook and the pod was only filtered out in istiod's mutating webhook implementation.
• It was not possible to opt in a single pod with sidecar.istio.io/inject: true label if auto injection was not enabled for the whole namespace.

This feature can be enabled by using the CUSTOM action in Istio's Authorization Policy CR spec. Here's an example where the authorization of the requests arriving to the foo-gateway is delegated to the custom-authz authorization extension:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: ext-authz
  namespace: foo
spec:
  selector:
    matchLabels:
      app: foo-gateway
  action: CUSTOM
  provider:
    name: "custom-authz"

Here's how you can get started with the feature, there is a blog post and a video, which explain the feature in greater detail.

Experimental Features

Remote fetch and load of WebAssembly (Wasm) HTTP filters

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: basic-auth-config
  namespace: istio-system
spec:
  configPatches:
    - applyTo: EXTENSION_CONFIG
      match:
        context: GATEWAY
      patch:
        operation: ADD
        value:
          name: istio.basic_auth
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
            value:
              config:
                vm_config:
                  vm_id: basic-auth
                  runtime: envoy.wasm.runtime.v8
                  code:
                    remote:
                      http_uri:
                        uri: https://github.com/istio-ecosystem/wasm-extensions/releases/download/1.9.2/basic-auth.wasm
                # The configuration for the Wasm extension itself
                configuration:
                  "@type": type.googleapis.com/google.protobuf.StringValue
                  value: |
                    {
                      "basic_auth_rules": [
                        {
                          "prefix": "/productpage",
                          "request_methods":[ "GET", "POST" ],
                          "credentials":[ "ok:test", "YWRtaW4zOmFkbWluMw==" ]
                        }
                      ]
                    }

Here's the getting started doc for the WASM remote fetch and load feature.

More info can be found in theIstio docs on DNS proxying.

List sidecar injectors

$ istioctl x injector list
NAMESPACE  ISTIO-REVISION POD-REVISIONS
backend    18x            18x: 9
frontend   19x            18x: 4 NEEDS RESTART: 4

• RESPONSE_CODE_DETAILS (via_upstream , filter_chain_not_found, http1.codec_error, rbac_access_denied_matched_policy[none]):

  [2020-10-29T03:22:16.126Z] "GET /headers HTTP/1.1" 200 - via_upstream - "-" 0 547 5 4 "-" "curl/7.73.0-DEV" "24e58e43-e576-9048-829b-02e3f3da16f0" "httpbin:8000" "127.0.0.1:80" inbound|8000|| 127.0.0.1:51680 172.17.0.7:80 172.17.0.6:59022 outbound_.8000_._.httpbin.foo.svc.cluster.local default
  [2020-10-29T03:23:33.415Z] "- - -" 0 NR filter_chain_not_found - "-" 0 0 0 - "-" "-" "-" "-" "-" - - 172.17.0.7:80 172.17.0.6:59800 - -
  [2020-10-29T03:24:13.520Z] "- - HTTP/1.1" 400 DPE http1.codec_error - "-" 0 11 0 - "-" "-" "-" "-" "-" - - 172.17.0.7:80 172.17.0.6:60214 - -
  [2020-10-29T03:25:20.162Z] "GET /headers HTTP/1.1" 403 - rbac_access_denied_matched_policy[none] - "-" 0 19 0 - "-" "curl/7.73.0-DEV" "07541777-6ee2-908f-a78b-867fe257ac80" "httpbin:8000" "-" - - 172.17.0.7:80 172.17.0.6:60898 outbound_.8000_._.httpbin.foo.svc.cluster.local -
  [2020-10-29T03:26:11.561Z] "GET /headers HTTP/1.1" 403 - rbac_access_denied_matched_policy[ns[foo]-policy[httpbin]-rule[0]] - "-" 0 19 0 - "-" "curl/7.73.0-DEV" "090a1897-d696-99b1-90f0-2673113ba258" "httpbin:8000" "-" - - 172.17.0.7:80 172.17.0.6:33204 outbound_.8000_._.httpbin.foo.svc.cluster.local -

• CONNECTION_TERMINATION_DETAILS (rbac_access_denied_matched_policy[ns[foo]-policy[httpbin]-rule[0]]):

  [2020-10-29T03:22:16.126Z] "GET /headers HTTP/1.1" 200 - via_upstream - "-" 0 547 5 4 "-" "curl/7.73.0-DEV" "24e58e43-e576-9048-829b-02e3f3da16f0" "httpbin:8000" "127.0.0.1:80" inbound|8000|| 127.0.0.1:51680 172.17.0.7:80 172.17.0.6:59022 outbound_.8000_._.httpbin.foo.svc.cluster.local default
  [2020-10-29T03:23:33.415Z] "- - -" 0 NR filter_chain_not_found - "-" 0 0 0 - "-" "-" "-" "-" "-" - - 172.17.0.7:80 172.17.0.6:59800 - -
  [2020-10-29T03:24:13.520Z] "- - HTTP/1.1" 400 DPE http1.codec_error - "-" 0 11 0 - "-" "-" "-" "-" "-" - - 172.17.0.7:80 172.17.0.6:60214 - -
  [2020-10-29T03:25:20.162Z] "GET /headers HTTP/1.1" 403 - rbac_access_denied_matched_policy[none] - "-" 0 19 0 - "-" "curl/7.73.0-DEV" "07541777-6ee2-908f-a78b-867fe257ac80" "httpbin:8000" "-" - - 172.17.0.7:80 172.17.0.6:60898 outbound_.8000_._.httpbin.foo.svc.cluster.local -
  [2020-10-29T03:26:11.561Z] "GET /headers HTTP/1.1" 403 - rbac_access_denied_matched_policy[ns[foo]-policy[httpbin]-rule[0]] - "-" 0 19 0 - "-" "curl/7.73.0-DEV" "090a1897-d696-99b1-90f0-2673113ba258" "httpbin:8000" "-" - - 172.17.0.7:80 172.17.0.6:33204 outbound_.8000_._.httpbin.foo.svc.cluster.local -

Takeaway