Collect L7 logs using the Waypoint collector
Enable the Istio Ambient Mode Waypoint-based L7 collector to capture HTTP/1, HTTP/2, and gRPC traffic.
Prerequisites
- A workload running in Calico's bundled Istio Service Mesh.
Enable the collector
Once a workload is set up to be in the service mesh, L7 collection is enabled by adding a waypoint proxy, and labeling the namespace to use it.
This will create an Istio Waypoint proxy that includes a sidecar container to capture the L7 logs.
cat << EOF | kubectl apply -n <namespace> -f -
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: <waypoint-name>
labels:
istio.io/waypoint-for: all
spec:
gatewayClassName: istio-waypoint
listeners:
- name: mesh
port: 15008
protocol: HBONE
EOF
kubectl label namespace <namespace> istio.io/use-waypoint=<waypoint-name>
Replace the following:
<namespace>: The namespace your workload is in.<waypoint-name>: What you want your waypoint proxy gateway to be called.
Verify the collector is running
kubectl get pods -n <namespace> -l gateway.networking.k8s.io/gateway-name=<waypoint-name> \
-o jsonpath='{range.items[*]}{.metadata.name}{"\t"}{.status.phase}{"\t"}{.spec.containers[*].name}{"\n"}{end}'
You should see both the istio-proxy and l7-collector containers listed.
Remove the Waypoint collector
kubectl label namespace <namespace> istio.io/use-waypoint-
Disable the Waypoint collector
If you are running waypoint proxies but you don't want sidecars added, the Waypoint collector sidecar can be disabled:
kubectl patch istio default --type=merge -p '{"spec":{"waypointLogging":"Disabled"}}'
Note that this applies to all waypoint proxies in the cluster.
View L7 logs
Waypoint collector logs are viewed in the UI for L7 logs along with the other types of L7 logs.
They will be labeled with the collector_type: envoy-access-log and the
collector_name: waypoint.
L7 logs take several minutes to appear in the web console after the Waypoint collector is enabled.