Istio: UDP support

[kyessenov]

@kyessenov commented on Thu Jan 26 2017

Proxy manager should be in charge of routing UDP traffic. There are many pieces needed for this to work:

• Envoy UDP routing support
• IP tables rules to trap UDP traffic
• Code to handle UDP protocol in the Manager services model

---

@rshriram commented on Thu Jan 26 2017

Do we need to handle UDP now? If we only trap tcp traffic, applications can
continue to use kube proxy as is for UDP right?

Until we have a solid use case for UDP and UDP routing or mixer related
stuff, it seems pointless to bloat envoy codebase with unnecessary
complexity.

On Thu, Jan 26, 2017 at 7:18 PM Kuat [e-mail] wrote:

Proxy manager should be in charge of routing UDP traffic. There are many
pieces needed for this to work:

• Envoy UDP routing support
• IP tables rules to trap UDP traffic
• Code to handle UDP protocol in the Manager services model

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/istio/manager/issues/62, or mute the thread
https://github.com/notifications/unsubscribe-auth/AH0qd5lqmPJdmxhHlhGXJ4eD239ROHEfks5rWTfSgaJpZM4LvToe
.

>

~shriram

---

@kyessenov commented on Thu Jan 26 2017

This is not a high priority item. As of now, we're not handling UDP traffic
at all, and don't have a good use case why we should.

On Thu, Jan 26, 2017, 4:41 PM Shriram Rajagopalan [e-mail]
wrote:

Do we need to handle UDP now? If we only trap tcp traffic, applications can
continue to use kube proxy as is for UDP right?

Until we have a solid use case for UDP and UDP routing or mixer related
stuff, it seems pointless to bloat envoy codebase with unnecessary
complexity.

On Thu, Jan 26, 2017 at 7:18 PM Kuat [e-mail] wrote:

Proxy manager should be in charge of routing UDP traffic. There are many
pieces needed for this to work:

• Envoy UDP routing support
• IP tables rules to trap UDP traffic
• Code to handle UDP protocol in the Manager services model

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/istio/manager/issues/62, or mute the thread
<
https://github.com/notifications/unsubscribe-auth/AH0qd5lqmPJdmxhHlhGXJ4eD239ROHEfks5rWTfSgaJpZM4LvToe

.

>

~shriram

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/istio/manager/issues/62#issuecomment-275558914, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AJGIxh09sriOe9luRa89y_gbwFyywHcTks5rWT0ggaJpZM4LvToe
.

---

@rshriram commented on Mon Feb 06 2017

@moderation you had a use case right?

---

@moderation commented on Tue Feb 07 2017

Yes. We are interested in using Envoy as an external service proxy for a PaaS. Typically this proxy will broker HTTP connections and TCP database connections etc. There are some people accessing Kafka external from the PaaS and the authentication scheme uses Kerberos and therefore requires UDP.

Another potential use case is in the public cloud where creating an encrypted service mesh that can handle things like DNS and NTP.

It looks like Nginx supports UDP load balancing / proxying but like a lot of their functionality it is only available in the commercial Nginx Plus product.

---

@rshriram commented on Tue Feb 07 2017

@moderation, thanks for the use case. Will take a look at adding this
support to envoy.
On Tue, Feb 7, 2017 at 9:54 AM moderation [e-mail] wrote:

Yes. We are interested in using Envoy as an external service proxy for a
PaaS. Typically this proxy will broker HTTP connections and TCP database
connections etc. There are some people accessing Kafka external from the
PaaS and the authentication scheme uses Kerberos and therefore requires UDP.

Another potential use case is in the public cloud where creating an
encrypted service mesh that can handle things like DNS and NTP.

It looks like Nginx supports UDP load balancing / proxying but like a lot
of their functionality it is only available in the commercial Nginx Plus
product.

—
You are receiving this because you commented.

Reply to this email directly, view it on GitHub
https://github.com/istio/manager/issues/62#issuecomment-278022929, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AH0qd54r-5AYbd-2jzmJ_EXQpYaPjfQdks5raIWsgaJpZM4LvToe
.

>

~shriram

---

@drasko commented on Thu May 25 2017

+1 for UDP, needed for CoAP and LwM2M IoT scenarios.

---

@shalako commented on Tue Oct 31 2017

+1 for UDP support. Needed for IOT use cases; specifically LWM2M and CoAP protocols.

---

@kyessenov commented on Fri Aug 04 2017

Thanks for your interest. This is blocked by Envoy issue https://github.com/lyft/envoy/issues/492

[cmluciano]

/assign

[lixiaobing1]

+1 for UDP, there is a strong use in telecommunication, all data is transferred with UDP in 3G PS, 4G both FDD and TDD, also in future 5G. I think we should start the support for UDP immediateley.

[mattouille]

I'll plus one the Telecom usecase here and broaden it to IOT/m2m devices. A huge array of existing IOT and m2m protocols are using UDP. We've been writing our new IOT platform and unfortunately will not be able to utilize a service mesh because of this.

[stale[bot]]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 2 weeks unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.

[shalako]

@cmluciano Are you working on this actively?

[varnaik]

+1 for UDP support in istio . UDP is the transport layer protocol used for communication between various entities in EPC( Evolved Packet Core ) in telecom.

[cmluciano]

@shalako Just confirmed some timelines on the Envoy community call today. I halted progress for a while awaiting some Envoy refactorings & Istio 1.0 priorities. I will be continuing progress on this for an alpha implementation targeted for late Q3/early Q4.

[shalako]

Another use case for UDP support: https://www.eclipse.org/hono/

[joseba4242]

+1 for UDP support. Use case is DNS, NTP, Syslog and SNMP Traps.

[dstockton]

+1 for UDP

[MightyDjinn]

+1 for UDP support. Use case is RADIUS.

[unnicris]

+1 for UDP

[howels]

+1 for UDP, TFTP and syslog are required for our use-case.

[lvjing2]

+1

[akpsgit]

+1 for UDP

[Aug-G]

+1

[arunvg]

+1

[Lax77]

+1 for UDP

[AWKIF]

+1

[dcberg]

+1 for UDP .... would like to use dynamic routing for establishing VPN connections.

[cmluciano]

Thanks everyone for the feedback. The Envoy community has recently landed basic UDP listener support in Envoy. Next the community will be focussing on the actual proxying work within the Q1 timeframe in 2019.

[dstockton]

@cmluciano thanks for taking the time to update this thread 👍

[ekoome]

+1 RTP media & SIP proxing

[skinnycheetah]

+1 for UDP routing
a great use case is handling DNS communication, for reasons such as telecommunication apps and security/policy based DNS routing.

[asudhakarreddy]

+1 for UDP routing
Network device management apps required UDP support, services like Syslog, SNMP traps, and TFTP

[hxalid]

+1 for UDP routing. Hashicorp Consul needs UDP routing for WAN.

[howels]

Envoy appears to have UDP support. Is the integration of UDP into Istio being tracked anywhere?

https://github.com/envoyproxy/envoy/pull/5108

[stephenmuss]

Would also like to see UDP for sending custom application metrics to StatsD.

[kigawas]

We also need UDP forwarding for P2P protocols or blockchain systems. Would appreciate it if it's integrated.

[Kiddinglife]

+1 udp heavily used in game backend developments

[dzmitry-lahoda]

i am from games to. we consider if could virtualize games, could help a lot.

[asitaru]

+1 We would like to get some updates now that UDP is supported in envoy.

[hzxuzhonghu]

/cc @louiscryan @rshriram @costinm @howardjohn Is there a plan for this?

[howardjohn]

@hzxuzhonghu see https://github.com/istio/istio/issues/15057#issuecomment-506561935.

[asitaru]

@howardjohn Envoy now has support for UDP.

[howardjohn]

My understanding is the second part is equally as important to Envoy's support, which @rlenglet is working on.

This requires using the iptables TPROXY mode. Using TPROXY requires running the Envoy sidecar proxy with CAP_NET_ADMIN, which is not acceptable for many users if running in the same pod. So to make UDP redirection viable, we'll have to run Envoy sidecar proxies outside of the application pod, which is something we plan to do as part of Istio CNI, but we've just started that work.

[jgilgamesh]

+1 for VPN UDP use case
+1 for any updates on availability

[lamplet]

+1 for SIP

[MitchK]

Required for P2P auto discovery In Blockchain systems like Ethereum.

[Joong]

+1 for SIP
+1 for UDP

[prestonvanloon]

Any update on UDP support? Last update was planned for Q1 2019 and it's now Q3 2019

[bpulito]

+1 for SIP
+1 for RTP

[blockspacer]

+1 for UDP

[SofianeSadi]

+1 for UDP (RTP media / SIP)

[readverish]

+1 for UDP (Telco applications using SIP)

[vanloswang]

UDP +1

[DevAndrewGeorge]

What is causing UDP support to lag behind? Is it a lack of contributors? A lack of support? A lack of time? This would be a very advantageous feature as we make ample of use of the UDP protocol. If the maintainers are looking for help, let us know, and we'll try to contribute.

[prestonvanloon]

Following up on this. It's officially Q4 (last update due Q1). Can we get any update on this?

[kucerarichard]

+1 UDP multicast for Infinispan to run out of the box with discovery, currently using weavenet for this.

[lgillstrom]

+1 UDP, any update?

[ramaraochavali]

Please follow this https://github.com/envoyproxy/envoy/issues/492 for UDP support in Envoy

[devkid]

Apparently there is UDP proxy support now in envoy: https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/udp_filters/udp_proxy

[xabinapal]

UDP +1, use case is VPN; and we discovered that ingress-nginx is too slow for this. Now that envoy supports UDP, it would be nice to have this functionality.

[mischka]

UDP +1

[fscz]

UDP +1.
Would like to use it for DNS.

[lsgrep]

DNS, VPN and of course QUIC, please add support for UDP

[hobbytp]

UDP +1
Some 3GPP CR is considering about supporting HTTP3/QUIC which is based on UDP in 5G spec,

[beriberikix]

Even previously cellular versions rely on UDP. For example, for carrier certification to operate on a network for NB-IoT (release 14,) you must be able to demonstrate you can bootstrap a device with LwM2M, which is based on UDP/CoAP.

[fentas]

I think we all have our use-cases and figured out the importance of UDP support.
Can we concentrate on removing the stale tag and setting it to a milestone?
Would be awesome - as it apparently landed in envoy. :unicorn:

[qingkunl]

UDP +1
For video streaming service

[maxenglander]

UDP +1 for DNS observability

So to make UDP redirection viable, we'll have to run Envoy sidecar proxies outside of the application pod, which is something we plan to do as part of Istio CNI, but we've just started that work.

@howardjohn @rlenglet that's interesting, is there any ticket or doc to follow along with that work?

[yydzhou]

UDP +1
For video streaming service

[dongnt1612]

UDP +1
For PFCP message in 5G

[agueijo]

+1 WebRTC UDP

[pangbo521624]

+1 For Massive IoT protocols

[diabloxenon]

+1 UDP for hosting DNS service

[c4m4]

Any update on this?

[EvaldoNeto]

UDP +1 for radius service

[wuestkamp]

+1 for hosting dns service

[ejc3]

Why does Istio list UDP support here: https://istio.io/latest/docs/ops/configuration/traffic-management/protocol-selection/

[howardjohn]

@ejc3 this has been updated in master: https://preliminary.istio.io/latest/docs/ops/configuration/traffic-management/protocol-selection/ which hopefully gives more insight

[armand1m]

+1 for hosting chat services like Mumble