TIS1201 - Missing Addresses from Matching WorkloadEntries

One or more addresses are missing from the matching WorkloadEntries.

Recommendation: Ensure WorkloadEntry Addresses Are Registered in ServiceEntry

To ensure that WorkloadEntries are properly recognized in the mesh, create a corresponding ServiceEntry that includes the address specified in the WorkloadEntry.

Examples

1. WorkloadEntry Without a Corresponding ServiceEntry Address

   apiVersion: networking.istio.io/v1beta1
   kind: WorkloadEntry
   metadata:
     name: external-workload
     namespace: example-namespace
   spec:
     address: "192.168.1.10"
     labels:
       app: external-app
     serviceAccount: "external-service-account"

   Explanation: The WorkloadEntry defines an address (192.168.1.10) that should be part of the service mesh. However, there is no corresponding ServiceEntry with this address, which means that Istio cannot properly recognize and route traffic to the workload.

Recommendation

Add the missing ServiceEntry with the matching address to ensure that the WorkloadEntry is recognized and can be reached by the mesh.

1. Add a Corresponding ServiceEntry for the WorkloadEntry Address

   Create a ServiceEntry that includes the address specified in the WorkloadEntry.

   apiVersion: networking.istio.io/v1beta1
   kind: ServiceEntry
   metadata:
     name: external-service
     namespace: example-namespace
   spec:
     hosts:
     - "external-app.example.com"
     addresses:
     - "192.168.1.10"
     ports:
     - number: 80
       name: http
       protocol: HTTP
     location: MESH_EXTERNAL
     resolution: STATIC

   Explanation: Adding a ServiceEntry with the matching address ensures that the WorkloadEntry is properly registered in the service mesh. This allows Istio to recognize the workload and route traffic to it, enabling seamless communication between workloads.