Open ports on a private cluster

If you are installing in-cluster Cloud Service Mesh on a private cluster, you must open port 15017 in the firewall to get the webhooks used with automatic sidecar injection (auto-injection) and configuration validation to work.

The following steps describe how to add a firewall rule to include the new ports that you want to open.

1. Find the source range (master-ipv4-cidr) and targets of the cluster. In the following command, replace CLUSTER_NAME with the name of your cluster:

   gcloud compute firewall-rules list \
       --filter 'name~gke-CLUSTER_NAME-[0-9a-z]*-master' \
       --format 'table(
           name,
           network,
           direction,
           sourceRanges.list():label=SRC_RANGES,
           allowed[].map().firewall_rule().list():label=ALLOW,
           targetTags.list():label=TARGET_TAGS
       )'
   

2. Create the firewall rule. Choose from the following commands and replace CLUSTER_NAME with the name of the cluster of the previous command.

   • To enable auto-injection, run the following command to open port 15017:

     gcloud compute firewall-rules create allow-api-server-to-webhook-CLUSTER_NAME \
       --action ALLOW \
       --direction INGRESS \
       --source-ranges CONTROL_PLANE_RANGE \
       --rules tcp:15017 \
       --target-tags TARGET
     

     Replace the following:

     • CLUSTER_NAME: the name of your cluster
     • CONTROL_PLANE_RANGE: the cluster control plane's IP address range (masterIpv4CidrBlock) that you collected previously.
     • TARGET: the target (Targets) value that you collected previously.

   • If you also want to enable the istioctl version and istioctl ps commands, run the following command to open ports 15014, and 8080:

     gcloud compute firewall-rules create allow-debug-proxy-CLUSTER_NAME \
       --action ALLOW \
       --direction INGRESS \
       --source-ranges CONTROL_PLANE_RANGE \
       --rules tcp:15014,tcp:8080 \
       --target-tags TARGET
     

     Replace the following:

     • CLUSTER_NAME: the name of your cluster
     • CONTROL_PLANE_RANGE: the cluster control plane's IP address range (masterIpv4CidrBlock) that you collected previously.
     • TARGET: the target (Targets) value that you collected previously.