kubernetesistioistio-sidecar

Unable to log egress traffic HTTP requests with the istio-proxy

I am following this guide.

Ingress requests are getting logged. Egress traffic control is working as expected, except I am unable to log egress HTTP requests. What is missing?

apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: myapp
spec:
  workloadSelector:
    labels:
      app: myapp

  outboundTrafficPolicy:
    mode: REGISTRY_ONLY

  egress:
    - hosts:
        - default/*.example.com

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: example

spec:
  location: MESH_EXTERNAL
  resolution: NONE
  hosts:
    - '*.example.com'

  ports:
    - name: https
      protocol: TLS
      number: 443

apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: mesh-default
  namespace: istio-system
spec:
  accessLogging:
    - providers:
        - name: envoy

Kubernetes 1.22.2 Istio 1.11.4

Solution

  • For ingress traffic logging I am using EnvoyFilter to set log format and it is working without any additional configuration. In the egress case, I had to set accessLogFile: /dev/stdout.

    apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: config
  namespace: istio-system
spec:
  profile: default
  meshConfig:
    accessLogFile: /dev/stdout