CODEWITHSUNDEEP
kubernetesrabbitmqgoogle-kubernetes-engineistioenvoyproxy
Martin
Martin

Reputation: 41

Allow traffic to rabbitMQ service from Istio

I've setup a K8S-cluster in GKE and installed RabbitMQ (from the marketplace) and Istio (via Helm). I can access rabbitMQ from pods until I enable the envoy proxy to be injected into these pods, but after that the traffic will not reach rabbitMQ, and I can't figure out how to enable traffic to the rabbitmq service.

There is a service rabbitmq-rabbitmq-svc (in the rabbitmq namespace) that is of type LoadBalancer. I've tried a simple busybox when I don't have envoy running and then I have no trouble telneting to rabbitmq (port 5672), but as soon as I try with automatic envoy injection envoy prevents the traffic. I tried unsuccessfully to add a DestinationRule. (I've added a rule but it makes no difference)

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: rabbitmq-rabbitmq-svc
spec:
  host: rabbitmq.rabbitmq.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      simple: LEAST_CONN

It seems like it should be a simple solution, but I can't figure it out... :/

UPDATE Turns out it was a simple error in the hostname, ended up using this and it works:

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: rabbitmq-rabbitmq-svc
spec:
  host: rabbitmq-rabbitmq-svc.rabbitmq.svc.cluster.local

Upvotes: 0

Views: 5951

Answers (3)

matthewd98
matthewd98

Reputation: 194

The only thing I needed to do to get RabbitMQ clusters to work within Istio is to annotate the RabbitMQ pods as such:

apiVersion: rabbitmq.com/v1beta1
kind: RabbitmqCluster
metadata:
spec:
  override:
  statefulSet:
    spec:
      template:
        metadata:
          annotations:
            #annotate rabbitMQ pods to only redirect traffic on ports 15672 and 5672 to Envoy proxy sidecars.
            traffic.sidecar.istio.io/includeInboundPorts: "15672, 5672"          
            traffic.sidecar.istio.io/includeOutboundPorts: "15672, 5672"

For some reason the exclude port annotations weren't working so I just flipped it by using include port annotations. In my case, the global Istio config is controlled by another team in the company so perhaps there's a clash when trying to use the exclude port annotations.

Upvotes: 1

YungWei
YungWei

Reputation: 11

I maybe encounter the same problem with you before. But my app can connect rabbitmq by envoy after declaring epmd with 4369 port in rabbitmq service.

apiVersion: v1
kind: Service
metadata:
  name: rabbitmq
  labels:
    app: rabbitmq
spec:
  type: ClusterIP
  ports:
  - port: 5672
    targetPort: 5672
    name: message
  - port: 4369
    targetPort: 4369
    name: epmd
  - port: 15672
    targetPort: 15672
    name: management
  selector:
    app: rabbitmq

Upvotes: 0

Martin
Martin

Reputation: 41

Turns out it was a simple error in the hostname, the correct one was rabbitmq-rabbitmq-svc.rabbitmq.svc.cluster.local

Upvotes: 2

Related Questions