rmq pods do not form cluster with istio 1.6.8 mtls

[satishmane]

Hi @arielb135

Your example was quite good to understand. I setup accordingly. but still 3 pod rmq cluster does not form. I can see only one pod in cluster. Am I missing something?

`apiVersion: "security.istio.io/v1beta1" kind: "PeerAuthentication" metadata: name: dp-rabbitmq namespace: dp spec: selector: matchLabels: app: rabbitmq mtls: mode: STRICT portLevelMtls: #{} 4369: mode: DISABLE

---

apiVersion: networking.istio.io/v1alpha3 kind: ServiceEntry metadata: labels: app: rabbitmq release: dp-rabbitmq name: rabbitmq namespace: dp spec: hosts:

• dp-rabbitmq-0.dp-rabbitmq-discovery.dp.svc.cluster.local
• dp-rabbitmq-1.dp-rabbitmq-discovery.dp.svc.cluster.local
• dp-rabbitmq-2.dp-rabbitmq-discovery.dp.svc.cluster.local location: MESH_INTERNAL ports:
• name: http number: 15672 protocol: TCP
• name: amqp number: 5672 protocol: TCP
• name: epmd number: 4369 protocol: TCP
• name: mqtt number: 1883 protocol: TCP

• name: mqtt-ssl number: 8883 protocol: TCP resolution: NONE

  apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: labels: app: dp-rabbitmq release: rabbitmq name: rabbitmq-pod-level-mtls namespace: dp spec: host: '*.dp-rabbitmq-discovery.dp.svc.cluster.local' exportTo:

  • "*" trafficPolicy: tls: mode: ISTIO_MUTUAL

    apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: labels: app: dp-rabbitmq release: rabbitmq name: rabbitmq-service-level-mtls namespace: dp spec: host: 'dp-rabbitmq.dp.svc.cluster.local' trafficPolicy: tls: mode: ISTIO_MUTUAL

    apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: labels: app: dp-rabbitmq release: rabbitmq name: rabbitmq-headless-service-level-mtls namespace: dp spec: host: 'dp-rabbitmq-discovery.dp.svc.cluster.local' trafficPolicy: portLevelSettings:

  • port: number: 4369 tls: mode: DISABLE tls: mode: ISTIO_MUTUAL `

[matthewd98]

The only thing I needed to do to get RabbitMQ clusters to work within Istio is to annotate the RabbitMQ pods as such:

apiVersion: rabbitmq.com/v1beta1
kind: RabbitmqCluster
metadata:
spec:
  override:
  statefulSet:
    spec:
      template:
        metadata:
          annotations:
            #annotate rabbitMQ pods to only redirect traffic on ports 15672 and 5672 to Envoy proxy sidecars.
            **traffic.sidecar.istio.io/includeInboundPorts: "15672, 5672"          
            traffic.sidecar.istio.io/includeOutboundPorts: "15672, 5672"** 

For some reason the exclude port annotations weren't working so I just flipped it by using include port annotations. In my case, the global Istio config is controlled by another team in the company so perhaps there's a clash when trying to use the exclude port annotations.