Open Port Inventory

A Service Mesh Manager installation requires the following open service ports. Opening only the required ports helps to keep deployment’s attack surface is the as small as possible. Each service is described in YAML format, with the list of all the ports how the service uses them. This helps to understand the risks associated with all the open ports.

Every service is described in a YAML file using the following format:

namespace: smm-system
name: mesh-manager
description: is used by our mesh-manager instance which manages istio operators on a kubernetes cluster
ports:
  - name: https
    number: 443
    use: handle https traffic and queries with tls/ssl

Useful commands

The following commands help you examine the services of your Service Mesh Manager deployment.

List services under smm-system namespace:

kubectl get services -n smm-system

Inspect a particular service, for example, smm-leo:

kubectl describe service smm-leo -n smm-system

Services (namespace-scoped)

cert-manager

The cert-manager namespace contains the following services.

cert-manager

The cert-manager instance of Service Mesh Manager provides Kubernetes certificate management as part of the controller-component. The service uses these ports:

  • tcp-prometheus-servicemonitor (9402): The default port for the cert-manager service.

cert-manager-webhook

The cert-manager instance of Service Mesh Manager uses the service as part of the webhook-component. The service uses these ports:

  • https (443): Incoming http traffic for the webhooks.

istio-system

The istio-system namespace contains the following services.

istio-meshexpansion-cp-v112x

Service Mesh Manager provides multicluster expansion capabilities using this service, which is used for version 1.10 istio mesh-gateway expansion. The service uses these ports:

  • tcp-status-port (15021): Health check (readiness-probe) port for Mesh Overview functionality and troubleshooting istio related issues.

  • tls-istiod (15012): Handles incoming gRPC traffic for accessing to istiod from passive clusters.

  • tls-istiodwebhook (15017): Handles incoming gRPC traffic for the istiod webhooks.

  • tls (15443): Handles incoming TLS traffic from other clusters.

  • tcp-smm-als-tls (50600): Handles incoming TLS traffic to access log services.

  • tcp-smm-zipkin-tls (59411): Default Zipkin port that handles incoming HTTPS traffic for distributed tracing services.

istio-meshexpansion-cp-v112x-external

Service Mesh Manager provides multicluster expansion capabilities using this external service, which is used for version 1.10 istio mesh-gateway expansion. The service uses these ports:

  • tcp-status-port (15021): Health check (readiness-probe) port for Mesh Overview functionality and troubleshooting istio related issues.

  • tls-istiod (15012): Handles incoming gRPC traffic for accessing to istiod from passive clusters.

  • tls-istiodwebhook (15017): Handles incoming gRPC traffic for the istiod webhooks.

  • tls (15443): Handles incoming TLS traffic from other clusters.

  • tcp-smm-als-tls (50600): Handles incoming TLS traffic to access log services.

  • tcp-smm-zipkin-tls (59411): Default Zipkin port that handles incoming HTTPS traffic for distributed tracing services.

istio-meshexpansion-cp-v113x

Service Mesh Manager provides multicluster expansion capabilities using this service, which is used for version 1.10 istio mesh-gateway expansion. The service uses these ports:

  • tcp-status-port (15021): Health check (readiness-probe) port for Mesh Overview functionality and troubleshooting istio related issues.

  • tls-istiod (15012): Handles incoming gRPC traffic for accessing to istiod from passive clusters.

  • tls-istiodwebhook (15017): Handles incoming gRPC traffic for the istiod webhooks.

  • tls (15443): Handles incoming TLS traffic from other clusters.

  • tcp-smm-als-tls (50600): Handles incoming TLS traffic to access log services.

  • tcp-smm-zipkin-tls (59411): Default Zipkin port that handles incoming HTTPS traffic for distributed tracing services.

istio-meshexpansion-cp-v113x-external

Service Mesh Manager provides multicluster expansion capabilities using this external service, which is used for version 1.10 istio mesh-gateway expansion. The service uses these ports:

  • tcp-status-port (15021): Health check (readiness-probe) port for Mesh Overview functionality and troubleshooting istio related issues.

  • tls-istiod (15012): Handles incoming gRPC traffic for accessing to istiod from passive clusters.

  • tls-istiodwebhook (15017): Handles incoming gRPC traffic for the istiod webhooks.

  • tls (15443): Handles incoming TLS traffic from other clusters.

  • tcp-smm-als-tls (50600): Handles incoming TLS traffic to access log services.

  • tcp-smm-zipkin-tls (59411): Default Zipkin port that handles incoming HTTPS traffic for distributed tracing services.

istiod-cp-v112x

Used by the Istio 1.10 control plane. The service uses these ports:

  • grpc-xds (15010): Handles gRPC traffic for xds transport protocol, which is used for Envoy discovery services and Istio proxies.

  • https-dns (15012): Handles DNS requests (with TLS) for the Istio service-mesh.

  • https-webhook (443): Handles incoming HTTPS traffic (with TLS) for Istio webhook management.

  • http-monitoring (15014): Handles HTTP requests or queries for monitoring of the traffic management between microservices.

istiod-cp-v113x

Used by the Istio 1.10 control plane. The service uses these ports:

  • grpc-xds (15010): Handles gRPC traffic for xds transport protocol, which is used for Envoy discovery services and Istio proxies.

  • https-dns (15012): Handles DNS requests (with TLS) for the Istio service-mesh.

  • https-webhook (443): Handles incoming HTTPS traffic (with TLS) for Istio webhook management.

  • http-monitoring (15014): Handles HTTP requests or queries for monitoring of the traffic management between microservices.

smm-system

The smm-system namespace contains the following services.

istio-operator-v112x

Istio-operator version 1.12, which is the controller of Istio resources, uses this service to manage Istio 1.12 deployments. The service uses these ports:

  • https (443): Handles the incoming HTTPS traffic for the Istio webhook.

istio-operator-v112x-authproxy

RBAC-authenticated endpoints use this service for istio-operator version 1.12. The service uses these ports:

  • https (8443): Authenticated (RBAC or TLS) endpoint for providing access to Prometheus metrics.

istio-operator-v113x

Istio-operator version 1.13, which is the controller of Istio resources, uses this service to manage Istio 1.13 deployments. The service uses these ports:

  • https (443): Handles the incoming HTTPS traffic for the Istio webhook.

istio-operator-v113x-authproxy

RBAC-authenticated endpoints use this service for istio-operator version 1.13. The service uses these ports:

  • https (8443): Authenticated (RBAC or TLS) endpoint for providing access to Prometheus metrics.

mesh-manager

The mesh-manager instance of Service Mesh Manager that manages Istio operators on a Kubernetes cluster uses this service. The service uses these ports:

  • https (443): Handles HTTPS traffic and queries with TLS/SSL.

mesh-manager-authproxy

The mesh-manager instance of Service Mesh Manager acts as an authentication proxy to the mesh-manager service. The service uses these ports:

  • https (8443): Authenticated (RBAC or TLS) endpoint for providing access to Prometheus metrics.

prometheus-node-exporter

The Prometheus instances use this service as an exporter for Kubernetes nodes. The service uses these ports:

  • metrics (19101): Exposes node-level metrics to Prometheus.

prometheus-operated

Used by the Prometheus instances of Service Mesh Manager. The service uses these ports:

  • http (9090): Handles normal HTTP traffic and Prometheus queries.

  • grpc (10901): Default port to handle incoming gRPC traffic.

smm

The Service Mesh Manager uses this service as part of the application-component. The service uses these ports:

  • http (80): Handles GraphQL API traffic and queries.

  • http-metrics (10000): Exports metrics to the Prometheus service.

smm-als

The Service Mesh Manager uses the smm-als service as part of the als-component. The service uses these ports:

  • grpc-als (50600): The container port of the grpc-als container, used for accessing log services.

smm-authentication

The smm-authentication instance verifies that a user has a valid token or certificate to make API calls to the backend service. The service uses these ports:

  • http (80): Handles HTTP traffic and GraphQL queries.

smm-expansion-gw

This is an external service of the mesh expansion gw of the local cluster. It is synced with the cluster registry to provide reachability of smm from the peer clusters even in case of multiple active istio controlplanes. The service uses these ports:

smm-federation-gateway

The smm-federation-gateway instance provides federation to GraphQL services via this service. The service uses these ports:

  • http (80): Handles HTTP traffic and GraphQL queries.

smm-grafana

The Service Mesh Manager uses the Grafana dashboard monitoring service as part of the grafana-component. The service uses these ports:

  • http (3000): Exposes GraphQL web interface and API endpoints over HTTP.

smm-health

is used by our for smm-health instance which includes health controller and exporter and is part of health-component The service uses these ports:

  • http-metrics (8080): export metrics to prometheus service

smm-health-api

The smm-health-api instance uses the service for the GraphQL API. The service uses these ports:

  • http-graphql (80): Handles HTTP traffic and GraphQL queries.

smm-ingressgateway

The service is part of the ingressgateway-component which acts as a loadbalancer, receiving incoming HTTP or TCP connections. The service uses these ports:

  • http2 (80): Handles traffic to the Service Mesh Manager dashboard.

smm-jaeger-agent

Jaeger agents can send traces to the Jaeger collector. The service is part of the tracing-component. The service uses these ports:

  • udp-agent-zipkin (5775): Default UDP port for zipkin-thrift tracing services.

  • udp-agent-compact (6831): Default UDP port for the Jaeger agent endpoint.

  • udp-agent-binary (6832): Default UDP port for the Jaeger agent binary protocol.

smm-jaeger-collector

The Jaeger collector receives traces from Jaeger agents via this service. It is part of the tracing-component. The service uses these ports:

  • tcp-smm-jaeger-collector-tchannel (14267): Default TCP port of tchannel for Jaeger collector.

  • http-jaeger-collector (14268): Default port of Jaeger collector to handle HTTP traffic.

smm-jaeger-query

Service Mesh Manager uses this service to access Jaeger. It is part of the tracing-component. The service uses these ports:

  • http-query (16686): Handles normal HTTP traffic and queries for the tracing services.

smm-kubelet-node-discovery

kubelet uses this service to export metrics. The service uses these ports:

  • https-metrics (10250): kubelet-service default port, used for exporting metrics to Prometheus services over TLS/SSL.

  • http-metrics (10255): kubelet-service default port, used for exporting metrics to Prometheus services without encryption.

  • cadvisor (4194): Port of container advisor that exposes Prometheus out of the box.

smm-kubestatemetrics

Part of the kubestatemetrics-component. The service uses these ports:

  • http-monitoring (42422): Monitoring port for the kube-state-metrics application (HTTP).

  • http-telemetry (15014): Telemetry port for the kube-state-metrics application (HTTP).

smm-leo

Makes cert-manager Istio-aware. It is part of the leo-component. The service uses these ports:

  • http-metrics (8080): Export metrics to Prometheus services.

smm-prometheus

Used for event monitoring and alerting as part of the prometheus-component. The service uses these ports:

  • http (59090): Default port of the Prometheus service for handing HTTP traffic and queries.

smm-prometheus-operator

The smm-prometheus-operator instance which is the controller of the Prometheus application uses this service. The service uses these ports:

  • http (8080): Incoming webhook traffic and Prometheus exporter for operator metrics.

smm-sre-alert-exporter

Used by the smm-sre-alert-exporter instance. The service uses these ports:

  • http-metrics (8080): Used for exporting Prometheus alerting status as metrics.

smm-sre-api

The smm-sre-api instance uses this service for the GraphQL API. The service uses these ports:

  • http-graphql (80): Handles HTTP traffics and GraphQL queries.

smm-sre-controller

Used by the smm-sre instance, as part of the sre-controller-component. The service uses these ports:

  • http-metrics (8080): Exports metrics to the Prometheus service.

smm-tracing

The Service Mesh Manager uses this service as part of the tracing-component. The service uses these ports:

  • http-query (80): Handles the Jaeger user interface and HTTP API traffic.

smm-vm-integration

The vm-integration instance uses the service for the GraphQL API. The service uses these ports:

  • http (8080): Handles GraphQL API traffic and queries.

  • http-metrics (8081): HTTP metrics from the controller.

  • http-istiostate (8082): Metrics mapping istio resources to together.

smm-web

The Service Mesh Manager uses this service as part of the web-component. The service uses these ports:

  • http (80): Serves static web content used by the Service Mesh Manager dashboard.

  • http-downloads (81): Serves the functionaliy for downloading the SMM binary file and is used by Service Mesh Manager dashboard.

smm-zipkin

The Service Mesh Manager uses this service as part of the tracing-component. The service uses these ports:

  • http (59411): Default Zipkin port for handling HTTP traffic and distributed tracing mechanisms.