This message occurs when a workload is listening on a
localhost network interface, but the port is exposed in the Service.
When this occurs, the port will not be accessible to other pods.
This check is primarily added to detect workloads on older Istio versions that may break when upgrading to Istio 1.10 or later. This behavior matches what would occur in a standard Kubernetes cluster without Istio, but older versions of Istio exposed these ports.
Service, selecting a
Pod running the command
nc localhost 8080 -l:
apiVersion: v1 kind: Service metadata: name: netcat spec: ports: - port: 8080 protocol: TCP selector: app: netcat
Because the application is serving traffic on
localhost, it is not accessible from other pods.
The above example shows using the simple
nc tool. Some equivalent examples in other languages:
How to resolve
If you did not intend to expose the application to other pods, you can remove the port from the
If you do want to expose the application to other pods, there are two options:
- Modify the application to bind to a network interface exposed to other pods. Typically, this means binding to
::, such as
nc 0.0.0.0 8080 -l.
- Create a
Sidecarconfiguration to customize the inbound networking configuration for the pod. For example, with the above application:
apiVersion: networking.istio.io/v1beta1 kind: Sidecar metadata: name: ratings spec: workloadSelector: labels: app: netcat ingress: - port: number: 8080 protocol: TCP name: tcp defaultEndpoint: 127.0.0.1:8080