Mizu – API traffic viewer for Kubernetes

Re:Mizu – API traffic viewer for Kubernetes by thanos999 on Tuesday April 12, 2022 @11:17AM (#31003816)

Istio delivers encrypted packets across services/ pods but in the pod, envoy proxy does the decryption and puts the packet unencrypted back on the interface to be consumed by the application.

In kubernetes, for calico CNI, the pod networking is done using veth pair. One interface remains on the host to be hooked to the host bridge and the other interface is sent to the pod namespace.

Mizu is deployed as a daemon set(one pod per node) and with enough privilege you can "tcpdump" the pod interface(the one where the envoy proxy puts back the packets unencrypted) (similar to "ip netns exec")

Basically, they tap the pod interface from host level. (They have a blog post about this as well: https://up9.com/gain-visibility-into-istio-mtls-traffic-with...)

This is my understanding so I might be wrong

[ Parent | on HN ]

Re:Mizu – API traffic viewer for Kubernetes by rednerrus on Tuesday April 12, 2022 @11:30AM (#31004015)

How much latency is this going to add?

[ Parent | on HN ]

Re:Mizu – API traffic viewer for Kubernetes by remram on Tuesday April 12, 2022 @07:00PM (#31009258)

It sounds like it's not adding anything on the path, that's just another process sniffing the interface. If that process doesn't read fast enough, I assume it will miss packets but not slow things down.

[ Parent | on HN ]