Health Checking of Istio Services

    The command approach works with Istio regardless of whether or not mutual TLS is enabled.

    The HTTP request approach, on the other hand, requires special Istio configuration when mutual TLS is enabled. This is because the health check requests to the service are sent by Kubelet, which does not have an Istio issued certificate. Therefore when mutual TLS is enabled, the health check requests will fail.

    Istio solves this problem by rewriting the application PodSpec readiness/liveness probe, so that the probe request is sent to the sidecar agent. The sidecar agent then redirects the request to the application, strips the response body, only returning the response code.

    This feature is enabled by default in all built-in Istio but can be disabled as described below.

    To configure strict mutual TLS, run:

    1. $ kubectl apply -f - <<EOF
    2. apiVersion: security.istio.io/v1beta1
    3. kind: PeerAuthentication
    4. metadata:
    6.   namespace: "istio-io-health"
    7.   mtls:
    8.     mode: STRICT
    9. EOF

    Next, run the following command to deploy the sample service:

    Zip

    To confirm that the liveness probes are working, check the status of the sample pod to verify that it is running.

    2. NAME                             READY     STATUS    RESTARTS   AGE
    3. liveness-6857c8775f-zdv9r        2/2       Running   0           4m

    You can with sidecar.istio.io/rewriteAppHTTPProbers: "false" to disable the probe rewrite option. Make sure you add the annotation to the pod resource because it will be ignored anywhere else (for example, on an enclosing deployment resource).

    This approach allows you to disable the health check probe rewrite gradually on individual deployments, without reinstalling Istio.

    Disable the probe rewrite globally

    using --set values.sidecarInjectorWebhook.rewriteAppHTTPProbe=false to disable the probe rewrite globally. Alternatively, update the configuration map for the Istio sidecar injector:

      Remove the namespace used for the examples: