Pods and Services

To be part of a mesh, Kubernetes pods and services must satisfy the following requirements:

  • Named service ports: Service ports must be named. The port name key/value pairs must have the following syntax: name: <protocol>[-<suffix>]. See Protocol Selection for more details.

  • Service association: A pod must belong to at least one Kubernetes service even if the pod does NOT expose any port. If a pod belongs to multiple Kubernetes services, the services cannot use the same port number for different protocols, for instance HTTP and TCP.

  • Deployments with app and version labels: We recommend adding an explicit app label and version label to deployments. Add the labels to the deployment specification of pods deployed using the Kubernetes Deployment. The app and version labels add contextual information to the metrics and telemetry Istio collects.

    • The app label: Each deployment specification should have a distinct app label with a meaningful value. The app label is used to add contextual information in distributed tracing.

    • The version label: This label indicates the version of the application corresponding to the particular deployment.

  • Application UIDs: Ensure your pods do not run applications as a user with the user ID (UID) value of 1337.

  • NET_ADMIN capability: If your cluster enforces pod security policies, pods must allow the NET_ADMIN capability. If you use the Istio CNI Plugin, this requirement no longer applies. To learn more about the NET_ADMIN capability, see Required pod capabilities, below.

Ports used by Istio

The following ports and protocols are used by Istio. Ensure that there are no TCP headless services using a TCP port used by one of Istio’s services.

PortProtocolUsed byDescription
8060HTTPCitadelGRPC server
8080HTTPCitadel agentSDS service monitoring
9090HTTPPrometheusPrometheus
9091HTTPMixerPolicy/Telemetry
9876HTTPCitadel, Citadel agentControlZ user interface
9901GRPCGalleyMesh Configuration Protocol
15000TCPEnvoyEnvoy admin port (commands/diagnostics)
15001TCPEnvoyEnvoy Outbound
15006TCPEnvoyEnvoy Inbound
15004HTTPMixer, PilotPolicy/Telemetry - mTLS
15010HTTPPilotPilot service - XDS pilot - discovery
15011TCPPilotPilot service - mTLS - Proxy - discovery
15014HTTPCitadel, Citadel agent, Galley, Mixer, Pilot, Sidecar InjectorControl plane monitoring
15020HTTPIngress GatewayPilot health checks
15029HTTPKialiKiali User Interface
15030HTTPPrometheusPrometheus User Interface
15031HTTPGrafanaGrafana User Interface
15032HTTPTracingTracing User Interface
15443TLSIngress and Egress GatewaysSNI
15090HTTPMixerProxy
42422TCPMixerTelemetry - Prometheus

Required pod capabilities

If pod security policies are enforced in your cluster and unless you use the Istio CNI Plugin, your pods must have the NET_ADMIN capability allowed. The initialization containers of the Envoy proxies require this capability.

To check if the NET_ADMIN capability is allowed for your pods, you need to check if their service account can use a pod security policy that allows the NET_ADMIN capability. If you haven’t specified a service account in your pods’ deployment, the pods run using the default service account in their deployment’s namespace.

To list the capabilities for a service account, replace <your namespace> and <your service account> with your values in the following command:

$ for psp in $(kubectl get psp -o jsonpath="{range .items[*]}{@.metadata.name}{'\n'}{end}"); do if [ $(kubectl auth can-i use psp/$psp --as=system:serviceaccount:<your namespace>:<your service account>) = yes ]; then kubectl get psp/$psp --no-headers -o=custom-columns=NAME:.metadata.name,CAPS:.spec.allowedCapabilities; fi; done

For example, to check for the default service account in the default namespace, run the following command:

$ for psp in $(kubectl get psp -o jsonpath="{range .items[*]}{@.metadata.name}{'\n'}{end}"); do if [ $(kubectl auth can-i use psp/$psp --as=system:serviceaccount:default:default) = yes ]; then kubectl get psp/$psp --no-headers -o=custom-columns=NAME:.metadata.name,CAPS:.spec.allowedCapabilities; fi; done

If you see NET_ADMIN or * in the list of capabilities of one of the allowed policies for your service account, your pods have permission to run the Istio init containers. Otherwise, you will need to provide the permission.

Was this information useful?
Do you have any suggestions for improvement?

Thanks for your feedback!