Unable to modify externalTrafficPolicy

Question

I need to preserve source IPs until they reach my destination containers (X-Forwarded-For headers); on web, the solutions/suggestions are leading me to that it's to change externalTrafficPolicy to 'Local' on LB service definition; yet, using kubectl edit or patch didn't work (Azure platform keeps reverting the changes i've just made to their defaults). I use AKS managed Istio.

apiVersion: v1
kind: Service
metadata:
  annotations:
    meta.helm.sh/release-name: asm-igx-aks-istio-ingressgateway-external
    meta.helm.sh/release-namespace: aks-istio-ingress
  creationTimestamp: "0.0.0.0"
  finalizers:
  - service.kubernetes.io/load-balancer-cleanup
  labels:
    app: aks-istio-ingressgateway-external
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: aks-istio-ingressgateway-external
    app.kubernetes.io/version: 1.0.0
    helm.sh/chart: azure-service-mesh-istio-ingress-gateway-addon-1.0.0-0.0.0.0
    helm.toolkit.fluxcd.io/name: asm-ingress-aks-istio-ingressgateway-external
    helm.toolkit.fluxcd.io/namespace: 0.0.0.0
    istio: aks-istio-ingressgateway-external
  name: aks-istio-ingressgateway-external
  namespace: aks-istio-ingress
  resourceVersion: "0.0.0.0"
  uid: 0.0.0.0
spec:
  allocateLoadBalancerNodePorts: true
  clusterIP: 0.0.0.0
  clusterIPs:
  - 0.0.0.0
  externalTrafficPolicy: Cluster
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: 0.0.0.0
  ports:
  - name: status-port
    nodePort: 0.0.0.0
    port: 0.0.0.0
    protocol: TCP
    targetPort: 0.0.0.0
  - name: http2
    nodePort: 0.0.0.0
    port: 0.0.0.0
    protocol: TCP
    targetPort: 0.0.0.0
  - name: https
    nodePort: 0.0.0.0
    port: 0.0.0.0
    protocol: TCP
    targetPort: 0.0.0.0
  selector:
    app: aks-istio-ingressgateway-external
    istio: aks-istio-ingressgateway-external
  sessionAffinity: None
  type: LoadBalancer
status:
  loadBalancer:
    ingress:
    - ip: 0.0.0.0

Tried to use kubectl commands, but no luck Unable to find the corresponding helm charts that automatically deployed and managed aks istio ingress and other resources like LB

Answer 1

Given the details of your setup and the need to modify the externalTrafficPolicy of the Istio Ingress Gateway to Local, here's how to proceed based on the Helm deployment of your Istio components, specifically targeting the istio-ingress release in the istio-ingress namespace.

If the istio-ingress Helm release is using default values, you'll need to create a custom values file to override the externalTrafficPolicy for the Istio Ingress Gateway service.

1. Create a new YAML file named custom-values.yaml.

2. Add the following content to custom-values.yaml, assuming the gateway Helm chart structure allows for specifying service properties:

3. Apply the Changes with Helm

4. Upgrade your Helm release with the custom values to modify the externalTrafficPolicy. Run the following command in your terminal:

helm upgrade istio-ingress <chart-location> -n istio-ingress -f custom-values.yaml

Replace <chart-location> with the chart reference used during the initial installation.

5. Verify the service's externalTrafficPolicy is now set to Local by running:

 kubectl get svc istio-ingressgateway -n istio-ingress -o jsonpath="{.spec.externalTrafficPolicy}"

Example: My istio setup

In my case, the istio-ingress Helm release is using default values, therefore I will create a custom values file to override the externalTrafficPolicy for the Istio Ingress Gateway service as below-

vim custom-values.yaml

service:
  type: LoadBalancer
  externalTrafficPolicy: Local

Now, how to know where exactly to modify? For that, do a helm show values istio/gateway

here, based on the output of helm show values istio/gateway, to modify the externalTrafficPolicy for the Istio Ingress Gateway to Local, you should focus on the service section of the values. It's clear from the values output that externalTrafficPolicy is directly configurable under the service section. that's why I have modified my custom-values.yaml accordingly.

With your custom-values.yaml file now correctly structured, apply the changes

helm upgrade istio-ingress istio/gateway -n istio-ingress -f custom-values.yaml --wait

Now verify-

kubectl get svc istio-ingress -n istio-ingress -o jsonpath='{.spec.externalTrafficPolicy}'