You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: support/azure/azure-kubernetes/extensions/istio-add-on-general-troubleshooting.md
+5-1Lines changed: 5 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: General Istio service mesh add-on troubleshooting
3
3
description: Learn how to do general troubleshooting of the Istio service mesh add-on for Azure Kubernetes Service (AKS).
4
-
ms.date: 10/17/2024
4
+
ms.date: 03/18/2025
5
5
author: nshankar13
6
6
ms.author: nshankar
7
7
editor: v-jsitser
@@ -241,6 +241,10 @@ If your application pod starts before the Envoy sidecar starts, the application
241
241
242
242
If your cluster uses an HTTP proxy for outbound internet access, you'll have to configure a Service Entry. For more information, see [HTTP proxy support in Azure Kubernetes Service](/azure/aks/http-proxy#istio-add-on-http-proxy-for-external-services).
243
243
244
+
### Step 6: Enable Envoy access logging
245
+
246
+
Enabling Envoy [access logging](https://istio.io/latest/docs/tasks/observability/logs/access-log/) helps identify and pinpoint issues in the gateways and sidecar proxies. For more information about logging and telemetry collection for the Istio add-on, see the documentation on [mesh configuration](/azure/aks/istio-meshconfig), [Telemetry API](/azure/aks/istio-telemetry), and [Istio metrics collection](/azure/aks/istio-metrics-managed-prometheus).
247
+
244
248
## Error messages
245
249
246
250
The following table contains a list of possible error messages (for deploying the add-on, enabling ingress gateways, and performing upgrades), the reason why an error occurred, and recommendations for resolving the error.
Copy file name to clipboardExpand all lines: support/azure/azure-kubernetes/extensions/istio-add-on-ingress-gateway.md
+8-4Lines changed: 8 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Istio service mesh add-on ingress gateway troubleshooting
3
3
description: Learn how to do ingress gateway troubleshooting on the Istio service mesh add-on for Azure Kubernetes Service (AKS).
4
-
ms.date: 07/03/2024
4
+
ms.date: 03/18/2025
5
5
author: nshankar13
6
6
ms.author: nshankar
7
7
editor: v-jsitser
@@ -21,9 +21,6 @@ For the Istio-based service mesh add-on, we offer the following ingress gateway
21
21
22
22
- An external ingress gateway that uses a publicly accessible IP address.
23
23
24
-
> [!NOTE]
25
-
> Microsoft doesn't support customizing the IP address for either the internal or external ingress gateways. Any IP customization changes to the Istio service mesh add-on will be reverted.
26
-
27
24
The add-on deploys Istio ingress gateway pods and deployments per revision. If you're doing a [canary upgrade](./istio-add-on-minor-revision-upgrade.md) and have two control plane revisions installed in your cluster, then you might have to troubleshoot multiple ingress gateway pods across both revisions.
28
25
29
26
## Troubleshooting checklist
@@ -97,6 +94,13 @@ After you enable the Azure Key Vault secrets provider add-on, you have to grant
97
94
98
95
After you create the `SecretProviderClass` resource, to ensure secrets sync from Azure Key Vault to the cluster, ensure the sample pod `secrets-store-sync-productpage` that references this resource is successfully deployed.
99
96
97
+
### Step 6: Customize ingress gateway service settings
98
+
99
+
The add-on also supports [customizing the Kubernetes service for the Istio ingress gateway](/azure/aks/istio-deploy-ingress#ingress-gateway-service-customizations) for certain annotations and the `.spec.externalTrafficPolicy` setting. In certain cases, changing `.spec.externalTrafficPolicy` to `Local` can assist with troubleshooting connectivity and networking issues, as it preserves the client source IP for the incoming request at the ingress gateway.
100
+
101
+
> [!NOTE]
102
+
> Changing `.spec.externalTrafficPolicy` to `Local` might cause imbalanced traffic spreading. Before applying this change, we recommend reading the Kubernetes documentation about [Preserving the client source IP](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip) to understand the tradeoffs between the different `externalTrafficPolicy` settings.
103
+
100
104
## References
101
105
102
106
-[Istio add-on ingress enablement and configuration](/azure/aks/istio-deploy-ingress)
0 commit comments