{"id":20157936,"url":"https://github.com/sabre1041/istio-pod-network-controller","last_synced_at":"2025-09-03T07:35:21.572Z","repository":{"id":142662666,"uuid":"141817295","full_name":"sabre1041/istio-pod-network-controller","owner":"sabre1041","description":"Controller to manage Istio Pod Network","archived":false,"fork":false,"pushed_at":"2019-09-17T16:28:17.000Z","size":28757,"stargazers_count":29,"open_issues_count":7,"forks_count":12,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-08-14T09:03:18.381Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sabre1041.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2018-07-21T13:50:16.000Z","updated_at":"2023-01-16T21:27:43.000Z","dependencies_parsed_at":"2024-01-07T18:09:29.743Z","dependency_job_id":null,"html_url":"https://github.com/sabre1041/istio-pod-network-controller","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/sabre1041/istio-pod-network-controller","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sabre1041%2Fistio-pod-network-controller","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sabre1041%2Fistio-pod-network-controller/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sabre1041%2Fistio-pod-network-controller/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sabre1041%2Fistio-pod-network-controller/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sabre1041","download_url":"https://codeload.github.com/sabre1041/istio-pod-network-controller/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sabre1041%2Fistio-pod-network-controller/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":273409497,"owners_count":25100444,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-03T02:00:09.631Z","response_time":76,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-13T23:48:22.016Z","updated_at":"2025-09-03T07:35:21.532Z","avatar_url":"https://github.com/sabre1041.png","language":"Go","funding_links":[],"categories":["Networking Utilities"],"sub_categories":[],"readme":"*This project has been superseded by https://github.com/istio/cni*\n\nIstio Pod Network Controller\n========================\n\nController to manage Istio Pod Network\n\n## Overview\n\nThis controller emulates the functionality of the [Istio init proxy](https://github.com/istio/init) to modify the _iptables_ rules so that the [Istio proxy](https://hub.docker.com/r/istio/proxyv2/) sidecar will properly intercept connections.\n\nThe primary benefit of this controller is that it helps alleviate a security issue of Istio which requires pods within the mesh to be running as privileged. Instead, privileged actions are performed by the controller instead of pods deployed by regular users. In OpenShift, this avoids the use of the `privileged` [Security Context Constraint](https://docs.openshift.com/container-platform/latest/admin_guide/manage_scc.html) and using a more restrictive policy, such as `nonroot`.\n\n## How this works\n\nThis controller is deployed as a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) that runs on each node. Each pod deployed by the DaemonSet takes on the responsibility of managing the pods that are deployed on the respective nodes the controller is deployed on.\n\nAs new pods that are to be added to the Istio mesh are created, the controller modifies iptables rules on the nodes so that the pod is able to join the mesh. Finally, the controller annotates the pod indicating that it has been successfully initialized. \n\nPod will be initialized if the pod's namespace is annotated with `istio-pod-network-controller/initialize: true` or if the pod itself is annotated with `istio-pod-network-controller/initialize: true`. The logic works the same as for the `istio-injection: enabled` label.\n\n## Installation on Kubernetes\n\n### Starting Kubernetes \n\nIf you don't have a kubernetes cluster available run this command to start a minikube instance large enough to host istio:\n```\nminikube start --memory=8192 --cpus=2 --kubernetes-version=v1.10.0 \\\n    --extra-config=controller-manager.cluster-signing-cert-file=\"/var/lib/localkube/certs/ca.crt\" \\\n    --extra-config=controller-manager.cluster-signing-key-file=\"/var/lib/localkube/certs/ca.key\"\n```\nIf you want to run minikube with the crio container runtime run the following:\n```\nminikube start --memory=8192 --cpus=2 --kubernetes-version=v1.10.0 \\\n    --extra-config=controller-manager.cluster-signing-cert-file=\"/var/lib/localkube/certs/ca.crt\" \\\n    --extra-config=controller-manager.cluster-signing-key-file=\"/var/lib/localkube/certs/ca.key\" \\\n    --network-plugin=cni \\\n    --container-runtime=cri-o \\\n    --bootstrapper=kubeadm\n```\n\n### Install Istio\n\nRun the following to install `Istio`\n```\nkubectl create namespace istio-system\nkubectl apply -f examples/istio-demo.yaml -n istio-system\n```\n\n### Install istio-pod-network-controller\n\nRun the following to install `istio-pod-network-controller`\n```\nhelm template -n istio-pod-network-controller ./chart/istio-pod-network-controller | kubectl apply -f -\n```\n\nif you are using with crio, run the following\n```\nhelm template -n istio-pod-network-controller --set containerRuntime=crio ./chart/istio-pod-network-controller | kubectl apply -f -\n```\n\n### Testing with automatic sidecar injection \n\nExecute the following commands:\n```\nkubectl create namespace bookinfo\nkubectl label namespace bookinfo istio-injection=enabled\nkubectl annotate namespace bookinfo istio-pod-network-controller/initialize=true\nkubectl apply -f examples/bookinfo.yaml -n bookinfo\n```\n\n## Installation on OpenShift\n\n### Starting OpenShift\n\nIf you don't have an OpenShift cluster available run this command to start a minikube instance large enough to host istio:\n```\nminishift start --ocp-tag=v3.9.40 --vm-driver=kvm \\\n    --cpus=2 --memory=8192 --skip-registration\n\n```\n\n### Install istio\n\n```\noc adm new-project istio-system --node-selector=\"\"\noc adm policy add-scc-to-user anyuid -z istio-ingress-service-account -n istio-system\noc adm policy add-scc-to-user anyuid -z default -n istio-system\noc adm policy add-scc-to-user anyuid -z prometheus -n istio-system\noc adm policy add-scc-to-user anyuid -z istio-egressgateway-service-account -n istio-system\noc adm policy add-scc-to-user anyuid -z istio-citadel-service-account -n istio-system\noc adm policy add-scc-to-user anyuid -z istio-ingressgateway-service-account -n istio-system\noc adm policy add-scc-to-user anyuid -z istio-cleanup-old-ca-service-account -n istio-system\noc adm policy add-scc-to-user anyuid -z istio-mixer-post-install-account -n istio-system\noc adm policy add-scc-to-user anyuid -z istio-mixer-service-account -n istio-system\noc adm policy add-scc-to-user anyuid -z istio-pilot-service-account -n istio-system\noc adm policy add-scc-to-user anyuid -z istio-sidecar-injector-service-account -n istio-system\noc adm policy add-scc-to-user anyuid -z istio-galley-service-account -n istio-system\noc apply -f examples/istio-demo.yaml -n istio-system\noc expose svc istio-ingressgateway -n istio-system\noc expose svc servicegraph -n istio-system\noc expose svc grafana -n istio-system\noc expose svc prometheus -n istio-system\noc expose svc tracing -n istio-system\n```\n\n### Install istio-pod-network-controller\n\nThe _istio-pod-network-controller_ is to be installed in the `istio-system` namespace along with with the other istio components\n\nTo install the _istio-pod-network-controller_, execute the following commands:\n\n```\nhelm template -n istio-pod-network-controller --set kubernetesDistribution=OpenShift ./chart/istio-pod-network-controller | oc apply -f -\n```\n\n## Testing with the bookinfo Application\n\nTo demonstrate the functionality of the `istio-pod-network-controller`, let's use he classic bookinfo application.\n\n### Testing with manual sidecar injection\n\nExecute the following commands:\n\n```\noc new-project bookinfo\noc annotate namespace bookinfo istio-pod-network-controller/initialize=true\noc adm policy add-scc-to-user anyuid -z default -n bookinfo\noc apply -f \u003c(istioctl kube-inject -f examples/bookinfo.yaml) -n bookinfo\noc expose svc productpage -n bookinfo\n```\n\n## Building\n\nInstructions for building this project can be found [here](./build.md)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsabre1041%2Fistio-pod-network-controller","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsabre1041%2Fistio-pod-network-controller","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsabre1041%2Fistio-pod-network-controller/lists"}