tl;dr:

Backyards (now Cisco Service Mesh Manager) is the Banzai Cloud Istio distribution that just works. Backyards (now Cisco Service Mesh Manager) operationalizes the service mesh to bring deep observability, convenient management, and policy-based security to modern container-based applications.

Proxying on Kubernetes

• http://proxy.example.com:3128/ for HTTP proxy
• http://proxy.example.com:3129/ for HTTPS proxy

containers:
  - env:
      - name: "HTTP_PROXY"
        value: "http://proxy.example.com:3128"
      - name: "HTTPS_PROXY"
        value: "http://proxy.example.com:3129"
      - name: "NO_PROXY"
        value: "svc,local"

Admission webhooks to the rescue

spec:
  httpProxyEnvs:
    httpProxy: "http://proxy.example.com:3128"
    httpsProxy: "http://proxy.example.com:3129"
    noProxy: "svc,local"

Showtime

Setup

1. Create a Kubernetes cluster.

   You can create a Kubernetes cluster with the Banzai Cloud Pipeline platform on-prem, or over any one of five different cloud providers.

2. Point KUBECONFIG to your cluster.
3. Install Istio with Backyards (now Cisco Service Mesh Manager):This step usually takes a few minutes, and installs Istio and Backyards on your cluster.

Deploy an HTTPS proxy

1. <create an="" external="" namespace

$ kubectl create namespace external namespace/external
created

2. Deploy Tinyproxy

   $ kubectl apply -f - <<EOF
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: tinyproxy
     namespace: external
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: tinyproxy
     template:
       metadata:
         labels:
           app: tinyproxy
       spec:
         containers:
         - image: vimagick/tinyproxy
           imagePullPolicy: IfNotPresent
           name: tinyproxy
   EOF

3. Obtain the IP address of the proxy pod

$ export PROXY_IP=$(kubectl get pod -n external -l
app=tinyproxy -o jsonpath='{@.items..podIP}')

Configure the proxy settings

1. Set the proxy settings in the Istio custom resource

$ kubectl -n istio-system patch istio mesh --type=merge --patch "
spec:
  httpProxyEnvs:
    httpProxy: "http://$PROXY_IP:8888"
    httpsProxy: "http://$PROXY_IP:8888"
    noProxy: "svc,local"

Deploy a simple pod to check outgoing connections

1. Label the default namespace for automatic sidecar injection

$ backyards sp ai on default INFO[0002] auto sidecar
injection successfully set to namespace default

2. Use the following snippet to create a test pod.

   $ kubectl create -f - <<EOF
   apiVersion: v1
   kind: Pod
   metadata:
     name: curl-test
   spec:
     containers:
     - name: curl
       image: curlimages/curl:7.70.0
       command: [ "/bin/sh", "-c", "--" ]
       args: [ "while true; do sleep 3000; done;" ]
   EOF

3. Check the environment variables of the created pod to see if the automatic injection worked.

   $ kubectl -n default get pods curl-test -o yaml |grep "env:" -A 12|head -13
       env:
       - name: http_proxy
         value: http://10.20.1.127:8888
       - name: HTTP_PROXY
         value: http://10.20.1.127:8888
       - name: https_proxy
         value: http://10.20.1.127:8888
       - name: HTTPS_PROXY
         value: http://10.20.1.127:8888
       - name: no_proxy
         value: svc,local
       - name: NO_PROXY
         value: svc,local

   The HTTP(S) proxy environment variables were automatically injected to the pod, and the variables are set in both uppercase and lowercase.

4. Send a request from the curl-test pod in the default namespace to an external service.

   $ kubectl exec -it curl-test -c curl -- sh -c "curl http://httpbin.org/headers"
   {
     "headers": {
       "Accept": "*/*",
       "Host": "httpbin.org",
       "User-Agent": "curl/7.70.0-DEV",
       "X-Amzn-Trace-Id": "Root=1-5ef23da7-4c7406e8ef392f32b61d7ddb"
     }
   }

5. Check the access logs of the proxy for your request

   $ kubectl -n external logs -l app=tinyproxy |grep CONNECT
   CONNECT   Jun 23 17:36:27 [10]: Established connection to host "httpbin.org" using file descriptor 10.
   CONNECT   Jun 23 17:36:38 [6]: Connect (file descriptor 9): ip-10-20-1-173.eu-west-1.compute.internal [10.20.1.173]
   CONNECT   Jun 23 17:36:38 [6]: Request (file descriptor 9): GET http://httpbin.org/headers HTTP/1.1
   CONNECT   Jun 23 17:36:39 [6]: Established connection to host "httpbin.org" using file descriptor 10.

   

The future: transparent external proxy with Envoy