Traffic Flow (After iptables Applied)

Traffic Flow (After iptables Applied) An architecture diagram generated by Archify. Application · localhost:8080 · Pod network namespace · APP container Application localhost:8080 APP container OUTPUT Chain · iptables nat · outbound · Pod network namespace · ! --uid-owner 1337 OUTPUT Chain iptables nat · outbound ! --uid-owner 1337 Listener 15001 · Envoy outbound · routing · Pod network namespace · UID 1337 Listener 15001 Envoy outbound · routing UID 1337 External Service · reviews:9080 · Architecture component External Service reviews:9080 PREROUTING Chain · iptables nat · inbound · Pod network namespace · REDIRECT 15006 PREROUTING Chain iptables nat · inbound REDIRECT 15006 Listener 15006 · Envoy inbound · mTLS check · Pod network namespace · UID 1337 Listener 15006 Envoy inbound · mTLS check UID 1337 1. curl reviews:9080 2. REDIRECT :15001 3. Routing · UID 1337 bypass 4. Incoming request 5. REDIRECT :15006 6. mTLS check, then localhost:8080 Pod network namespace Legend Frontend Backend Security External

iptables nat rules

  • • OUTPUT: TCP except UID 1337 (Envoy) → REDIRECT 15001
  • • PREROUTING: inbound TCP → REDIRECT 15006

Excluded from interception

  • • localhost (127.0.0.1) traffic
  • • Istiod communication on 15012
  • • DNS (UDP 53)