Having port range or port wildcard in configurations and rules

[tvdinh]

Describe the feature request
Having port range or port wildcard in configurations and rules.

Context:

1. Configure external service (Apache ActiceMQ server in particular) for Istio Service Mesh

2. External services like Apache ActiceMQ, they have a few standards ports but then also use a random port to communicate with established clients (via JMS etc.). So to whitelist them, it would be useful that port range/wildcard can be defined like the below.

For example, defining a ServiceEntry

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: "activemq"
spec:
  hosts:
  - activemq.external
  location: MESH_EXTERNAL
  resolution: DNS
  ports:
  - name: "all-ports-activemq"
    number: *
    protocol: TCP

Describe alternatives you've considered
No obvious alternatives. Please suggest if there is an alternative

Additional context

[howardjohn]

I am not sure this is really possible in Envoy. I assume you do not want to whitelist literally all traffic, and instead just any IP addressed returned from DNS for activemq.external, on any port?

As far as I know Envoy cannot do this; its DNS resolution is only for load balancing

[howardjohn]

And if you want to allow all traffic, you can use ALLOW_ANY

[tvdinh]

And if you want to allow all traffic, you can use ALLOW_ANY

ALLOW_ANY is not a preferable for my use case as mentioned in https://istio.io/docs/tasks/traffic-management/egress/egress-control/, we want any service internal/external to be registered (to be aware of)

I am not sure this is really possible in Envoy. I assume you do not want to whitelist literally all traffic, and instead just any IP addressed returned from DNS for activemq.external, on any port?

You are right, only for activemq.external host and any port.

I think the use case is quite straightforward, is there a way to achieve that ?

[howardjohn]

TCP traffic doesn't have a host header so you cannot do traffic routing based on host for tcp traffic

[tvdinh]

TCP traffic doesn't have a host header so you cannot do traffic routing based on host for tcp traffic

Thanks for pointing that out, I've used IP range instead and it works for single port, but the enquiry on the port range is still valid:

This works:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: "activemq"
spec:
  hosts:
  - dummy.com
  location: MESH_EXTERNAL
  resolution: NONE
  addresses:
  - <IP address> 
  ports:
  - name: "broker-port"
    number: 61616
    protocol: TCP

This doesn't:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: "activemq"
spec:
  hosts:
  - dummy.com
  location: MESH_EXTERNAL
  resolution: NONE
  addresses:
  - <IP address> 
  ports:
  - name: "all-ports"
    number: *
    protocol: TCP

[howardjohn]

Yeah that last one I think is feasible. Would need to double check with Envoy that we can listen in all ports but I think at least in the near future with some changes to the envoy config we are doing it should be find

[howardjohn]

#10533 is blocking

[ceastman-ibm]

@howardjohn You mentioned last year that it might be possible in the future, just checking on the status of having a wildcard or a range of ports for a single service entry.

[devenderkamble]

Is there a roadmap plan to implement this feature , wildcard or a range of ports for a single service entry.

[howardjohn]

This depends on #10533 which is a long ways off. So nothing in the medium term

[alexander-rondon]

I came across another use case for this feature, when I was trying to create a Service Entry for an Azure database where you have to allow outbound communication from the pod hosting the SQL client, in the Istio Mesh, to an external host in the port range 1433 to 65535, as required in Use Redirect connection policy with private endpoints

Something like this below will be really helpful instead of opting for 'global.proxy.excludeIPRanges' to allow external traffic.

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: azure-sql
spec:
  hosts:
    - "*.database.windows.net"
  ports:
    - name: https
      numbers: 1433 - 65535  # or just * 
      protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNAL