Open ports on a private cluster

If you are installing in-cluster Cloud Service Mesh on a private cluster, you must open port 15017 in the firewall to get the webhooks used with automatic sidecar injection (auto-injection) and configuration validation to work.

The following steps describe how to add a firewall rule to include the new ports that you want to open.

  1. Find the source range (master-ipv4-cidr) and targets of the cluster. In the following command, replace CLUSTER_NAME with the name of your cluster:

    gcloud compute firewall-rules list \
    --filter 'name~gke-CLUSTER_NAME-[0-9a-z]*-master' \
    --format 'table(
        name,
        network,
        direction,
        sourceRanges.list():label=SRC_RANGES,
        allowed[].map().firewall_rule().list():label=ALLOW,
        targetTags.list():label=TARGET_TAGS
    )'

  2. Create the firewall rule. Choose from the following commands and replace CLUSTER_NAME with the name of the cluster of the previous command.

    • To enable auto-injection, run the following command to open port 15017:

      gcloud compute firewall-rules create allow-api-server-to-webhook-CLUSTER_NAME \
  --action ALLOW \
  --direction INGRESS \
  --source-ranges CONTROL_PLANE_RANGE \
  --rules tcp:15017 \
  --target-tags TARGET

      Replace the following:

      • CLUSTER_NAME: the name of your cluster
      • CONTROL_PLANE_RANGE: the cluster control plane's IP address range (masterIpv4CidrBlock) that you collected previously.
      • TARGET: the target (Targets) value that you collected previously.

    • If you also want to enable the istioctl version and istioctl ps commands, run the following command to open ports 15014, and 8080:

      gcloud compute firewall-rules create allow-debug-proxy-CLUSTER_NAME \
  --action ALLOW \
  --direction INGRESS \
  --source-ranges CONTROL_PLANE_RANGE \
  --rules tcp:15014,tcp:8080 \
  --target-tags TARGET

      Replace the following:

      • CLUSTER_NAME: the name of your cluster
      • CONTROL_PLANE_RANGE: the cluster control plane's IP address range (masterIpv4CidrBlock) that you collected previously.
      • TARGET: the target (Targets) value that you collected previously.