Skip to main content
Calico Cloud documentation

Collect L7 logs using the Waypoint collector

Enable the Istio Ambient Mode Waypoint-based L7 collector to capture HTTP/1, HTTP/2, and gRPC traffic.

Prerequisites​

Enable the collector​

Once a workload is set up to be in the service mesh, L7 collection is enabled by adding a waypoint proxy, and labeling the namespace to use it.

This will create an Istio Waypoint proxy that includes a sidecar container to capture the L7 logs.

cat << EOF | kubectl apply -n <namespace> -f -
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: <waypoint-name>
labels:
istio.io/waypoint-for: all
spec:
gatewayClassName: istio-waypoint
listeners:
- name: mesh
port: 15008
protocol: HBONE
EOF
kubectl label namespace <namespace> istio.io/use-waypoint=<waypoint-name>

Replace the following:

  • <namespace>: The namespace your workload is in.
  • <waypoint-name>: What you want your waypoint proxy gateway to be called.

Verify the collector is running​

kubectl get pods -n <namespace> -l gateway.networking.k8s.io/gateway-name=<waypoint-name> \
-o jsonpath='{range.items[*]}{.metadata.name}{"\t"}{.status.phase}{"\t"}{.spec.containers[*].name}{"\n"}{end}'

You should see both the istio-proxy and l7-collector containers listed.

Remove the Waypoint collector​

kubectl label namespace <namespace> istio.io/use-waypoint-

Disable the Waypoint collector​

If you are running waypoint proxies but you don't want sidecars added, the Waypoint collector sidecar can be disabled:

kubectl patch istio default --type=merge -p '{"spec":{"waypointLogging":"Disabled"}}'

Note that this applies to all waypoint proxies in the cluster.

View L7 logs​

Waypoint collector logs are viewed in the UI for L7 logs along with the other types of L7 logs.

They will be labeled with the collector_type: envoy-access-log and the collector_name: waypoint.

note

L7 logs take several minutes to appear in the web console after the Waypoint collector is enabled.

Additional information​