3

I'm using istio-proxy sidecar with Kubernetes, sidecars are automatically added to the Kubernetes pods. I want to turn off the access log for one single deployment (without disabling the sidecar). is there an annotation to do that?

Maoz Zadok
  • 4,871
  • 3
  • 33
  • 43
  • Could you try to exec into your deployment with `kubectl exec` and try with this command `curl -X POST http://localhost:15000/logging?level=off `? There is envoy documentation about [that](https://www.envoyproxy.io/docs/envoy/latest/operations/admin#post--logging). – Jakub Nov 30 '20 at 13:24
  • I have many pods, it has to be part of the deployment – Maoz Zadok Nov 30 '20 at 13:50
  • That's the only way I know, other would be with istioctl as mentioned in [documentation](https://istio.io/latest/docs/tasks/observability/logs/access-log/#disable-envoy-s-access-logging), but that's gonna disable it globally. – Jakub Nov 30 '20 at 13:53
  • if that so, init container that executes the curl post request can maybe do the trick – Maoz Zadok Nov 30 '20 at 14:13

1 Answers1

0

As I mentioned in comments

If you want to disable envoy’s access logging globally you can use istioctl/operator to do that.

There is istio documentation about that.

Remove, or set to "", the meshConfig.accessLogFile setting in your Istio install configuration.

There is istioctl command:

istioctl install --set meshConfig.accessLogFile=""

There is an example with istio operator:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: default
  meshConfig:
    accessLogFile: ""

If you want to disable it for a specific pod you can use use below command, there is envoy documentation about that.

curl -X POST http://localhost:15000/logging?level=off

As you're looking for a way to do that for deployment that trick with init container and above curl command might actually work.

Jakub
  • 8,189
  • 1
  • 17
  • 31
  • 2
    actually, I'm not sure that init container will work because the init container starts before the istio-proxy container, so the istio-proxy will not be available yet while executing the init-container process – Maoz Zadok Dec 09 '20 at 07:00