How to connect between one service sidecar in Istio with NATS cluster

Question

I was created a NATS cluster without inject to Istio.

apiVersion: nats.io/v1alpha2
kind: NatsCluster
metadata:
  name: nats
spec:
  size: 2
pod:
  annotations:
    sidecar.istio.io/inject: "false"
version: "2.0.0"

Now i has one sidecar istio, connect to Nats cluster above, but seems istio severed connection. My nats client on application closed, and Nats server notice: "Client parser ERROR, state=0 ..." the reason is there no mtls between the nats cluster and the sidecar? How i can fix this issue?

YungWei YungWei · Accepted Answer · 2020-03-13T06:33:27

for istio 1.8

nats and nats streaming ymal can be found on

https://github.com/nats-io/nats-operator

https://github.com/nats-io/nats-streaming-operator

If you don't connect by node port outside from kubernetes cluster. You just use default istio settings and inject sidecar for nats pods. It works. But if you want to connect nats by node port from outside. You need disable mtls. My setting is default mtls, pods of nats and nats streaming inject sidecar. And nats only accept traffic of text plain and nats only send traffic with text plain.

add following peer authentication:

    apiVersion: "security.istio.io/v1beta1"
    kind: "PeerAuthentication"
    metadata:
      name: "nats"
    spec:
      selector:
        matchLabels:
          app: nats
      mtls:
        mode: DISABLE
    ---
    apiVersion: "security.istio.io/v1beta1"
    kind: "PeerAuthentication"
    metadata:
      name: "nats-streaming"
    spec:
      selector:
        matchLabels:
          app: nats-streaming
      mtls:
        mode: DISABLE

add following destination rule:

    apiVersion: networking.istio.io/v1alpha3
    kind: DestinationRule
    metadata:
      name: nats
    spec:
      host: "nats-server.acm.svc.cluster.local"
      trafficPolicy:
        tls:
          mode: DISABLE
    ---
    apiVersion: networking.istio.io/v1alpha3
    kind: DestinationRule
    metadata:
      name: nats-server-nodeport
    spec:
      host: "nats-server-nodeport.acm.svc.cluster.local"
      trafficPolicy:
        tls:
          mode: DISABLE
    ---
    apiVersion: networking.istio.io/v1alpha3
    kind: DestinationRule
    metadata:
      name: nats-server-mgmt
    spec:
      host: "nats-server-mgmt.acm.svc.cluster.local"
      trafficPolicy:
        tls:
          mode: DISABLE

How to connect between one service sidecar in Istio with NATS cluster

1 Answers