By default, Service Mesh (ASM) injects an istio-init init container into each pod to configure iptables rules for traffic redirection. This init container requires the NET_ADMIN capability, which means any user or service account deploying pods must have elevated Kubernetes role-based access control (RBAC) permissions. The ASM Container Network Interface (CNI) plug-in reduces this requirement by moving iptables configuration to the node-level CNI chain, so pods no longer need the istio-init container or elevated privileges.
How it works
Without the CNI plug-in (default)
ASM injects an istio-init container into each pod. This init container configures iptables rules to redirect traffic through the Envoy sidecar proxy before other containers start. Because istio-init modifies the pod's network namespace, it requires the NET_ADMIN capability -- meaning any user or service account deploying pods must have elevated RBAC permissions.
With the CNI plug-in
The ASM CNI plug-in moves iptables configuration from the istio-init container to the node-level CNI chain. Traffic redirection rules are applied during the pod's network setup phase, before any containers start. Pods no longer need the istio-init container or the NET_ADMIN capability.
Each pod's iptables rules belong to its own network namespace, so changes to one pod do not affect other pods on the same node.
The ASM CNI plug-in does not replace your cluster's existing CNI. It is installed as a chained plug-in whose configuration is added to the existing CNI plug-ins so that it can be called when containers are started.
Pod identification
The CNI plug-in applies traffic redirection only to pods that meet all of the following conditions:
| Condition | Description |
|---|---|
| Namespace not excluded | The pod's namespace is not in the excludeNamespaces list |
| Sidecar present | The pod contains a container named istio-proxy |
| Multi-container | The pod contains more than one container |
| Injection not disabled | The pod either has no sidecar.istio.io/inject annotation, or the annotation value is not false |
Prerequisites
Before you begin, make sure that you have:
-
An ASM instance running version 1.14.3.86 or later. For more information, see Create an ASM instance
-
A kubectl client connected to the ASM instance. For more information, see Use kubectl on the control plane to access Istio resources
Enable the CNI plug-in
-
Log on to the ASM console.
-
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose .
-
On the ASM CNI Plug-in page, turn on Enable Grid CNI Plugin, select the namespaces to exclude, and then click Update Settings.
Pods in excluded namespaces continue to use the
istio-initcontainer for network configuration instead of the CNI plug-in. -
Wait until the Status column changes from Updating to Running. The CNI plug-in is now enabled.
Verify the iptables rules
Deploy the Bookinfo sample application to confirm that the CNI plug-in configures iptables rules correctly.
-
Create a file named bookinfo.yaml with the following content:
-
Deploy the Bookinfo application:
kubectl apply -f bookinfo.yaml -
Get the container ID and node name of the productpage pod:
ns=default podname=$(kubectl get pod | grep productpage | awk '{print $1}') # For Docker runtime: container_id=$(kubectl get pod -n ${ns} ${podname} -o jsonpath="{.status.containerStatuses[?(@.name=='istio-proxy')].containerID}" | sed -n 's/docker:\/\/\(.*\)/\1/p') # For containerd runtime: container_id=$(kubectl get pod -n ${ns} ${podname} -o jsonpath="{.status.containerStatuses[?(@.name=='istio-proxy')].containerID}" | sed -n 's/containerd:\/\/\(.*\)/\1/p') echo $container_id # Get the node name kubectl get pod ${podname} -o jsonpath="{.spec.nodeName}" -
Log on to the node (for example, via SSH) and get the PID of the container:
# For Docker runtime: docker inspect --format '{{ .State.Pid }}' $container_id # For containerd runtime: crictl inspect $container_id | jq ".info.pid" -
Enter the network namespace of the productpage container and list the NAT table rules:
nsenter -t <pid> -n iptables -L -t nat -n -v --line-numbers -xReplace
<pid>with the PID from the previous step.