Traffic Setting
Traffic Settings allow configuring the behavior of the proxy workloads in a set of namespaces owned by a traffic group. Specifically, it allows configuring the dependencies of proxy workloads on namespaces outside the traffic group as well as reliability settings for outbound calls made by the proxy workloads to other services.
The following example creates a traffic group for the proxy workloads in
ns1
, ns2
and ns3
namespaces owned by its parent workspace
w1
under tenant mycompany
. It then defines a traffic setting
for the all workloads in these namespaces, adding a dependency on
all the services in the shared db
namespace, and forwarding all
unknown traffic via the egress gateway in the istio-system
namespace.
apiVersion: traffic.tsb.tetrate.io/v2
kind: Group
metadata:
name: t1
workspace: w1
tenant: mycompany
organization: myorg
spec:
namespaceSelector:
names:
- "*/ns1"
- "*/ns2"
- "*/ns3"
configMode: BRIDGED
And the associated traffic settings for the proxy workloads:
apiVersion: traffic.tsb.tetrate.io/v2
kind: TrafficSetting
metadata:
name: defaults
group: t1
workspace: w1
tenant: mycompany
organization: myorg
spec:
outbound:
reachability:
mode: CUSTOM
hosts:
- "ns1/*"
- "ns2/*"
- "ns3/*"
- "db/*"
upstreamTrafficSettings:
- hosts:
- '*'
settings:
resilience:
circuitBreakerSensitivity: MEDIUM
egress:
host: istio-system/istio-egressgateway
To setup load balancing algorithm as ROUND_ROBIN
for all outbound requests
to service foo.bar.svc.cluster.local
from clients in t1
traffic group:
apiVersion: traffic.tsb.tetrate.io/v2
kind: TrafficSetting
metadata:
name: defaults
group: t1
workspace: w1
tenant: mycompany
organization: myorg
spec:
outbound:
upstreamTrafficSettings:
- hosts:
- 'foo.bar.svc.cluster.local'
settings:
loadBalancer:
simple: ROUND_ROBIN
upstreamTrafficSettings
can be used to configure the outbound traffic
with grouping a particular group of upstream hosts to have a certain setting.
In the below example all outbound requests to hosts matching wildcard
*.ns1.svc.cluster.local
will use request timeout of 10s while hosts matching
*.ns2.svc.cluster.local
and *.ns3.svc.cluster.local
will use request timeout of 5s.
apiVersion: traffic.tsb.tetrate.io/v2
kind: TrafficSetting
metadata:
name: defaults
group: t1
workspace: w1
tenant: mycompany
organization: myorg
spec:
outbound:
upstreamTrafficSettings:
- hosts:
- '*.ns1.svc.cluster.local'
settings:
resilience:
connectionPool:
http:
requestTimeout: 10s
- hosts:
- '*.ns2.svc.cluster.local'
- '*.ns3.svc.cluster.local'
settings:
resilience:
connectionPool:
http:
requestTimeout: 5s
The following traffic setting confines the reachability of proxy workloads
in the traffic group t1
to other namespaces inside the group. The
resilience and egress gateway settings will be inherited from the
workspace wide traffic setting.
apiVersion: traffic.tsb.tetrate.io/v2
kind: TrafficSetting
metadata:
name: defaults
group: t1
workspace: w1
tenant: mycompany
organization: myorg
spec:
outbound:
reachability:
mode: GROUP
The above fields are now moved to two different sections called inbound
and outbound
to allow better control over these fields. Please refer the
below example to configure a traffic setting for all services in traffic group
t1
configuring similar knobs as explained in earlier examples:
apiVersion: traffic.tsb.tetrate.io/v2
kind: TrafficSetting
metadata:
name: defaults
group: t1
workspace: w1
tenant: mycompany
organization: myorg
spec:
inbound:
resilience:
connectionPool:
tcp:
keepAlive:
idleTime: 300s
outbound:
reachability:
mode: GROUP
upstreamTrafficSettings:
- hosts:
- '*.ns1.svc.cluster.local'
settings:
resilience:
connectionPool:
http:
requestTimeout: 10s
This traffic setting configuration specifies upstream traffic settings
for specific hosts within the client
namespace. It is associated with
the w1
workspace and the t1
traffic group.
apiVersion: traffic.tsb.tetrate.io/v2
kind: TrafficSetting
metadata:
name: client-upstream-traffic-setting
namespace: client
group: t1
workspace: w1
tenant: mycompany
organization: myorg
spec:
outbound:
upstreamTrafficSettings:
- hosts:
- 'httpbin.app1.svc.cluster.local'
- '*.app3.svc.cluster.local'
- '*.app4.svc.cluster.local'
settings:
authentication:
trafficMode: REQUIRED
- hosts:
- '*.app2.svc.cluster.local'
- 'tetrate.app4.svc.cluster.local'
settings:
authentication:
trafficMode: OPTIONAL
This configuration specifies authentication requirements for traffic to the following hosts:
httpbin.app1.svc.cluster.local
requires mTLS authentication.- All non-injected services in
app3
namespace require mTLS authentication. - All non-injected services in
app4
namespace require mTLS authentication, except fortetrate.app4.svc.cluster.local
, which is excluded. - Authentication enforcement is skipped for all non-injected services in
app2
namespace.
AuthenticationSettings
Configuration for connection authentication parameters. This allows the enforcement of mutual TLS connections to upstream services that do not have a sidecar. This ensures that gateways or mesh workloads do not communicate in plain text with services outside the mesh.
Field | Description | Validation Rule |
---|---|---|
trafficMode | tetrateio.api.tsb.traffic.v2.AuthenticationSettings.AuthenticationMode | – |
DownstreamResilienceSettings
DownstreamResilienceSettings control the reliability knobs in Envoy when accepting inbound connections.
Field | Description | Validation Rule |
---|---|---|
connectionPool | tetrateio.api.tsb.traffic.v2.DownstreamResilienceSettings.ConnectionPoolSettings | – |
ConnectionPoolSettings
Connection pool settings for downstream connections.
Field | Description | Validation Rule |
---|---|---|
tcp | tetrateio.api.tsb.traffic.v2.DownstreamResilienceSettings.ConnectionPoolSettings.TCP | – |
TCP
TCP Settings for inbound requests.
Field | Description | Validation Rule |
---|---|---|
keepAlive | tetrateio.api.tsb.traffic.v2.TcpKeepAlive | – |
HTTPRetry
HTTPRetry defines the parameters for retrying API calls to a service.
Field | Description | Validation Rule |
---|---|---|
attempts | int32 Actual number of retries attempted depends on the httpReqTimeout. | int32 = { |
perTryTimeout | google.protobuf.Duration | – |
retryOn | string | string = { |