Skip to content

IPv6: istio proxy_init should not block connections to ::1 #10733

@arcimboldo

Description

@arcimboldo

Describe the bug

Connection to localhost (::1) are blocked when using IPv6. In many distributions localhost resolves to ::1 instead of 127.0.0.1, even when outbound ipv6 connectivity is not enabled. This causes connectivity to services in the same host/pod to be blocked in some setup.

Expected behavior

When using IPv4 istio does not intercept/block connections to localhost. I would expect the same behavior when using IPv6 localhost address ::1

Steps to reproduce the bug

Create an application that tries to talk to itself using ::1 on a machine/container where ipv6 localhost address is enabled. When using istio the connection will timeout

Version
Kubernetes (GKE) 1.11.5 and istio 1.0.3 but I can see that this is happening also on 1.0.5

Installation

Via GCE console, by selecting "Istio" as an addon

Environment

GKE, container is based on debian

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions