Egress Traffic

CStack blocks egress traffic by default for security reasons.

This documentation provides you information and steps to manage the outgoing whitelist.

Egress IPs

Please use these internet IPs if your target endpoint requires whitelisting.

Managing Whitelists

To create your own whitelist, you would need to create a ServiceEntry object in your manifest repository.

A ServiceEntry object is scoped to namespaces and cannot be scoped to a deployment. In other words, if a ServiceEntry is created for a namespace, it will be used for all deployments within that namespace. To segregate egress traffic based on applications/deployments, we recommend deploying your applications/deployments in different namespaces.

We strongly discourage the use of “*” for whitelisting.

Note: CStack has whitelisted egress to *.gov.sg by default.

Example

# A specific domain whitelist
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: my-whitelist
spec:
  hosts: 
    - www.google.com
    - www.microsoft.com
  exportTo:
    - "."
  ports:
    - number: 80
      name: http-port
      protocol: HTTP
    - number: 443
      name: https
      protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNALCopy to clipboardErrorCopied

# A wildcard domain whitelist
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: my-whitelist-wildcard
spec:
  hosts:
    - "*.google.com"
    - "*.microsoft.com"
  exportTo:
    - "."
  ports:
    - number: 80
      name: http-port
      protocol: HTTP
    - number: 443
      name: https
      protocol: HTTPS
  resolution: NONE
  location: MESH_EXTERNALCopy to clipboardErrorCopied

You could read more details from Istio.io.