Istio Support for Containers

Alert Logic has released Istio support for containers, which can virtually tap Istio-encrypted container-to-container traffic.

The Alert Logic Agent Container now includes an Istio detector to inspect the traffic between your containers. If you already have the agent container installed, no further action is necessary. If you do not have the agent container installed yet, go to Install the Alert Logic Agent Container

If you have a container environment but do not use Istio, the detector does not affect your environments.

Requirements

Alert Logic supports detection for Istio versions 1.4 and above.

Technical description

IDS agent will detect Kubernetes pods running Istio 1.4 and above in mutual TLS mode, and try to capture a clear-text (rather than encrypted) copy of the application and control-plane traffic where possible.

Configure Istio for optimal performance

The automatic update to the agent allows Alert Logic to see traffic and generate incidents. These incidents are limited with only the Kubernetes pod IP address in them. This helps you pinpoint the specific container but not the attack source.

To address these limits, configure Istio to provide Alert Logic with an X-Forwarded-For header with a meaningful originator address.

For example, run the commands below on an AWS deployment:

Copy
$ istioctl manifest <apply|generate> -f <(echo 'apiVersion: install.istio.io/v1alpha2
kind: IstioControlPlane
spec:
  values:
    gateways:
      istio-ingressgateway:
        serviceAnnotations:
          "service.beta.kubernetes.io/aws-load-balancer-backend-protocol": <http|https>
    pilot:
      env:
        PILOT_SIDECAR_USE_REMOTE_ADDRESS: true
')