Managing TCP Traffic

1. Configuring TCP Proxy

Property	Value	Description
tcpProxy.enabled	`true`	Enables or disables the TCP proxy functionality
tcpProxy.port	`8080`	Port on which the TCP proxy listens for incoming connections
tcpProxy.backend	`backend-service:80`	Backend service address to which TCP traffic is forwarded
tcpProxy.timeout	`30s`	Timeout for TCP connections in seconds

Example: TCP Proxy Configuration

tcpProxy:
  enabled: true
  port: 8080
  backend: backend-service:80
  timeout: 30s

2. Implementing TCP Routing

Property	Description	Example
tcpRoutes	Defines TCP routing rules for traffic	`{ "tcpRoutes": [ { "port": 8080, "destination": "service-a" } ] }`
port	Port number to listen on for TCP traffic	`8080`
destination	Service name to forward traffic to	`service-a`

Example: TCP Route Configuration

tcpRoutes:
  - port: 8080
    destination: service-a

Note: TCP routing is applied at the service mesh level, not at the application layer.

Warning: Ensure that the destination service is available in the mesh for proper routing.

3. Configuring TCP Traffic Splitting

Property	Description	Values	Notes
tcpTrafficSplitting.enabled	Enables or disables TCP traffic splitting	`true` / `false`	Default: `false`
tcpTrafficSplitting.routes	List of routing rules for TCP traffic	Array of route objects	Each route defines a destination and weight
tcpTrafficSplitting.routes.destination	Target service or IP	`string`	Can be a service name or IP address
tcpTrafficSplitting.routes.weight	Percentage of traffic to send to this route	`number`	Must sum to 100 across all routes

Example: Configuring TCP Traffic Splitting

tcpTrafficSplitting:
  enabled: true
  routes:
    - destination: "service-a"
      weight: 70
    - destination: "service-b"
      weight: 30

Note: Traffic splitting is applied at the service mesh level and affects all TCP connections to the specified services.

4. Setting TCP Connection Limits

Property	Values	Description
tcp.connectionLimits.maxConnections	`1000`	Maximum number of concurrent TCP connections allowed per service
tcp.connectionLimits.maxPendingRequests	`500`	Maximum number of pending TCP requests before rejecting new ones
tcp.connectionLimits.maxRetries	`3`	Number of retry attempts for failed TCP connections

Example: Configuring TCP Connection Limits in Istio

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: tcp-connection-limits
spec:
  host: backend-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 1000
        maxPendingRequests: 500
        maxRetries: 3

5. Implementing TCP Health Checks

Property	Value	Description
tcp.healthCheck.enabled	`true`	Enables TCP health checks for the service
tcp.healthCheck.interval	`5s`	Interval between health check probes
tcp.healthCheck.timeout	`2s`	Timeout for each health check probe
tcp.healthCheck.failureThreshold	`3`	Number of consecutive failures before marking as unhealthy
tcp.healthCheck.successThreshold	`1`	Number of consecutive successes before marking as healthy

Example: TCP Health Check Configuration

tcp:
  healthCheck:
    enabled: true
    interval: 5s
    timeout: 2s
    failureThreshold: 3
    successThreshold: 1

Note: Health checks are essential for maintaining service availability and ensuring that only healthy endpoints receive traffic.

6. Configuring TCP Idle Timeout

Property	Value	Description
tcp.idleTimeout	`30s`	Maximum time a TCP connection can remain idle before being closed
tcp.idleTimeout.unit	`s`	Time unit for idle timeout (s, m, h)

Example: Setting TCP Idle Timeout

tcp:
  idleTimeout: 60s

Note: Setting a shorter idle timeout can help free up resources faster, but may cause issues if connections are expected to remain open for longer periods.

7. Managing TCP Connection Pooling

Property	Description	Default Value	Notes
maxConnections	Maximum number of connections to a destination	`1024`	Controls connection reuse limits
maxPendingRequests	Maximum number of pending requests to a destination	`1024`	Applies to each connection
maxRequestsPerConnection	Maximum number of requests per connection	`1000000`	Enforces connection reuse limits
maxIdleTime	Maximum idle time before closing a connection	`5m`	Configurable in seconds or minutes

Example: Configuring Connection Pooling in Istio

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: tcp-connection-pooling
spec:
  host: backend-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 2048
        maxRequestsPerConnection: 500000
        maxIdleTime: 30s

Note: Connection pooling helps reduce overhead by reusing connections, which is especially beneficial in high-traffic TCP services.

8. Implementing TCP Access Logging

Property	Description	Default Value	Notes
accessLog.enabled	Enables or disables TCP access logging	`false`	Set to `true` to enable logging
accessLog.format	Format of the log entry (JSON, text)	`json`	Use `text` for human-readable logs
accessLog.path	Path to the log file or stdout	`/dev/stdout`	Can be a file path or `/dev/stdout`

Example: Enabling TCP Access Logging

tcp:
  accessLog:
    enabled: true
    format: json
    path: /var/log/tcp-access.log

Note: Ensure that the logging path has appropriate permissions for writing logs.

9. Securing TCP Traffic with mTLS

Feature	Description	Configuration	Status
mTLS	Mutual Transport Layer Security for TCP traffic	Enabled via `peerAuthentication`	NEW
Client Certificate	Required for client to server authentication	Configured in `peerAuthentication`	NEW
Server Certificate	Required for server to client authentication	Configured in `peerAuthentication`	NEW
Policy Mode	Enforces mTLS for all TCP traffic in the mesh	`STRICT` or `PERMISSIVE`	NEW

Example: Enabling mTLS for TCP Traffic

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: tcp-mtls
spec:
  selector:
    matchLabels:
      app: tcp-service
  mtls:
    mode: STRICT

Note: mTLS is enforced at the service level and requires certificates to be configured in the mesh.

10. Troubleshooting TCP Issues

Issue	Description	Common Causes	Solution
Connection timeouts	Client cannot establish a TCP connection to the service	Firewall rules, incorrect port configuration, network policies	Verify service port and ensure it's exposed. Check network policies and firewall rules.
Packet loss	Some TCP packets are not reaching the destination	Network congestion, misconfigured routers, high latency	Monitor network traffic. Use tools like `tcpdump` or `Wireshark` to analyze packet flow.
High latency	Increased delay in TCP packet delivery	Network congestion, inefficient routing, service overload	Use `tcping` or `ping` to measure latency. Optimize service configuration and routing.
Reset connections (RST)	Unexpected TCP connection reset by peer	Service crash, misconfigured load balancer, client-side timeout	Check logs for service crashes. Ensure load balancer and client timeouts are aligned.

Example: Using tcpdump to analyze TCP traffic

tcpdump -i any -n port 8080

Note: Use tcpdump or Wireshark to capture and analyze TCP traffic for troubleshooting.

Warning: Ensure that network policies and firewall rules do not block necessary TCP traffic.

11. Implementing TCP Rate Limiting

Property	Values	Description
tcp.rateLimit	`false`	Enable or disable TCP rate limiting
tcp.rateLimit.requestsPerSecond	`100`	Maximum number of TCP requests per second
tcp.rateLimit.burst	`50`	Number of requests allowed to exceed the rate limit before being dropped

Example: Configuring TCP Rate Limiting

tcp:
  rateLimit:
    enabled: true
    requestsPerSecond: 200
    burst: 100

Note: Rate limiting is applied per connection and can be configured at the service or global level.

Warning: Misconfiguring rate limits can lead to service degradation or dropped connections.

12. Managing TCP Keep-Alive Settings

Setting	Description	Default Value	Notes
tcp.keepalive.probes	Number of keep-alive probes to send before marking the connection as dead	`3`	Used in conjunction with `tcp.keepalive.time` and `tcp.keepalive.interval`
tcp.keepalive.time	Time (in seconds) to wait before sending the first keep-alive probe	`7200`	Typically set to 2 hours (7200 seconds)
tcp.keepalive.interval	Interval (in seconds) between keep-alive probes	`75`	Should be less than `tcp.keepalive.time`

Example: Configuring TCP Keep-Alive in Envoy

static_resources:
  listeners:
  - name: listener_tcp
    address:
      socket_address: { address: 0.0.0.0, port_value: 8080 }
    filter_chains:
    - filters:
      - name: envoy.filters.listener.tcp_proxy
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.listener.tcp_proxy.v3.TcpProxy
          stat_prefix: tcp
          cluster: backend_cluster
          idle_timeout: 300s
          keepalive:
            probes: 3
            time: 7200s
            interval: 75s

Note: Keep-alive settings are critical for long-lived TCP connections to detect and clean up stale connections.