Ports#

Service ports must be named <protocol>[-<suffix>]#

Warning

Any unlisted ports will bypass the proxy and all associated mesh policies.

Protocol	Port Name	Port Name w/ Suffix
HTTP	http	http-<suffix>
HTTP2	http2	http2-<suffix>
HTTPS	https	https-<suffix>
TLS	tls	tls-<suffix>
GRPC	grpc	grpc-<suffix>
TCP	tcp	tcp-<suffix>
Mongo	mongo	mongo-<suffix>
MySQL	mysql	mysql-<suffix>
Redis	redis	redis-<suffix>

apiVersion: v1
kind: Service
metadata:
  name: example-api
  namespace: default
  labels:
    app: example-api
spec:
  ports:
    - port: 1080
      name: http-api
      targetPort: http-api
    - port: 1090
      name: grpc-api
      targetPort: grpc-api
  selector:
    app: example-api

Pods must include an explicit list of ports each container listens on#

apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: example-api
  namespace: default
spec:
template:
  metadata:
    labels:
      app: example-api
  spec:
    containers:
      - name: example-api
        ports:
          - containerPort: 1080
            name: grpc-api
          - containerPort: 1090
            name: http-api

To avoid port conflicts with sidecars, applications should not use any of the ports used by Envoy#

Istio Ports#

Port	Protocol	Used by	Description
443	HTTPS	Istiod	Webhooks
8080	HTTP	Istiod	Debug interface
15000	TCP	Envoy	Envoy admin port (commands/diagnostics)
15001	TCP	Envoy	Envoy outbound
15006	TCP	Envoy	Envoy inbound
15008	TCP	Envoy	Envoy tunnel port (inbound)
15010	GRPC	Istiod	XDS and CA services (plaintext)
15012	GRPC	Istiod	XDS and CA services (TLS, recommended for production use)
15014	HTTP	Istiod	Control plane monitoring
15020	HTTP	Envoy	Merged Prometheus telemetry from Istio agent, Envoy, and application
15021	HTTP	Envoy	Health checks
15090	HTTP	Envoy	Envoy Prometheus telemetry
15443	TLS	Ingress and Egress Gateways	Envoy Prometheus telemetry

TCP headless services must not use any of the following restricted ports#

Aspen Mesh Ports#

Port	Protocol	Used by	Description
80	HTTP	Alertmanager, AM Dashboard, Jaeger	Client ports for AM Controlplane
5553	TCP	Jaeger	Jaeger Prometheus telemetry
7000	TCP	Jaeger	Cassandra inbound
7001	TLS	Jaeger	Cassandra inbound (SSL)
7199	TLS	Jaeger	Cassandra admin port (diagnostics)
7979	HTTP	External DNS	External DNS inbound
9042	TCP	Jaeger	Cassandra inbound (CQL)
9105	HTTP	AM Controlplane	AM Controlplane outbound (metrics)
9160	TCP	Jaeger	Cassandra inbound (thrift)
9402	TCP	Cert Manager	Cert manager inbound
9411	TCP	Jaeger	Zipkin compatible endpoint for Jaeger Collector
14250	GRPC	Jaeger	Jaeger internal inbound
14267	TCP	Jaeger	TChannel RPC
14268	HTTP	Jaeger	Binary thrift protocol compatible endpoint for Jaeger Collector
19000	GRPC	AM Controlplane	gRPC Web Proxy
19001	HTTP	AM Controlplane	Serve AM frontend
19005	HTTP	AM Controlplane	Alertmanager outbound
19006	HTTPS	AM Controlplane	Webhooks
19090	TCP	AM Metrics Collector	Serve metrics frontend