MARGA by EknathaLabs

"Service mesh and Kubernetes networking" cheat sheet

"Check Services and endpoints, DNS, network policy, sidecars, sync and the response flags in proxy logs."

Service and endpoints

kubectl get svc,endpoints web -n shop
kubectl get svc web -n shop -o jsonpath='{.spec.selector}'
kubectl get pods -n shop --show-labels
kubectl get endpointslices -n shop

DNS from a pod

kubectl exec -n shop deploy/web -- cat /etc/resolv.conf
kubectl exec -n shop deploy/web -- nslookup db.shop
kubectl logs -n kube-system -l k8s-app=kube-dns --tail=20

Network policy

kubectl get networkpolicy -n shop
kubectl describe networkpolicy default-deny -n shop
kubectl exec -n shop deploy/web -- curl -s -m 2 http://db:5432

Mesh health

istioctl version
istioctl proxy-status
istioctl analyze -n shop
kubectl get pods -n shop
kubectl label namespace shop istio-injection=enabled
kubectl rollout restart deployment -n shop

Proxy logs and flags

kubectl logs web-7d -c istio-proxy --tail=20
Flag Meaning
UF Upstream connection failure
UH No healthy upstream
NR No route configured
UC Upstream connection terminated
URX Retry limit exceeded

Method for a failing call

  1. Find the first failing hop.
  2. istioctl proxy-status: is the config SYNCED?
  3. istioctl analyze: is the config valid?
  4. Read the response flag.
  5. Check endpoints, then policies (PeerAuthentication, AuthorizationPolicy).
  6. Call the pod IP directly to take the mesh out of the picture.

Quick mesh checks

istioctl analyze -n shop
istioctl proxy-status
istioctl proxy-config clusters POD.shop | head
kubectl get peerauthentication,authorizationpolicy -A

Cautions

Official references

Read the vendor and project documentation for the full, current detail.