I have a kubernetes cluster that has applications running in an Istio service mesh. In one application I am trying to send an email using SMTP. How do I set up Istio rules to allow my applications to use my external SMTP server?
Initially I was getting an exception "Could not connect to SMTP host: in-v3.mailjet.com, port: 587, response: -1." as detailed here. After visiting this site I realized I needed to provide egress rules which I did as per below
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: mailjet
spec:
hosts:
- "in-v3.mailjet.com"
location: MESH_EXTERNAL
ports:
- number: 587
name: tls
protocol: TLS
resolution: DNS
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: mailjet
spec:
hosts:
- "*.mailjet.com"
tls:
- match:
- port: 587
sni_hosts:
- "*.mailjet.com"
route:
- destination:
host: "*.mailjet.com"
port:
number: 587
weight: 100
I am no longer getting the "Could not connect to SMTP host" exception but I am getting a SocketTieoutException
[0m[31m06:56:39,048 ERROR [stderr] (default task-55) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
[0m[31m06:56:39,048 ERROR [stderr] (default task-55) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
[0m[31m06:56:39,048 ERROR [stderr] (default task-55) at java.lang.Thread.run(Thread.java:748)
[0m[31m06:56:39,048 ERROR [stderr] (default task-55) Caused by: javax.mail.MessagingException: Exception reading response;
[0m[31m06:56:39,048 ERROR [stderr] (default task-55) nested exception is:
[0m[31m06:56:39,048 ERROR [stderr] (default task-55) java.net.SocketTimeoutException: Read timed out
[0m[31m06:56:39,048 ERROR [stderr] (default task-55) at com.sun.mail.smtp.SMTPTransport.readServerResponse(SMTPTransport.java:2460)
[0m[31m06:56:39,048 ERROR [stderr] (default task-55) at com.sun.mail.smtp.SMTPTransport.openServer(SMTPTransport.java:2187)
[0m[31m06:56:39,048 ERROR [stderr] (default task-55) at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:740)
[0m[31m06:56:39,048 ERROR [stderr] (default task-55) at javax.mail.Service.connect(Service.java:366)
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) at javax.mail.Service.connect(Service.java:246)
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) at javax.mail.Service.connect(Service.java:267)
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) at org.keycloak.email.DefaultEmailSenderProvider.send(DefaultEmailSenderProvider.java:138)
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) ... 73 more
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) Caused by: java.net.SocketTimeoutException: Read timed out
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) at java.net.SocketInputStream.socketRead0(Native Method)
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) at java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) at java.net.SocketInputStream.read(SocketInputStream.java:171)
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) at java.net.SocketInputStream.read(SocketInputStream.java:141)
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) at com.sun.mail.util.TraceInputStream.read(TraceInputStream.java:126)
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) at java.io.BufferedInputStream.fill(BufferedInputStream.java:246)
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) at java.io.BufferedInputStream.read(BufferedInputStream.java:265)
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) at com.sun.mail.util.LineInputStream.readLine(LineInputStream.java:106)
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) at com.sun.mail.smtp.SMTPTransport.readServerResponse(SMTPTransport.java:2440)
[0m[31m06:56:39,049 ERROR [stderr] (default task-55) ... 79 more
[0m[31m06:56:39,049 ERROR [org.keycloak.services.resources.admin.RealmAdminResource] (default task-55) Failed to send email
javax.mail.MessagingException: Exception reading response;
nested exception is:
java.net.SocketTimeoutException: Read timed out
What do I need to do to successfully send an email within a Kubernetes cluster with an Istio service mesh?
After comparing with Mesh-external service entry for an external MySQL instance I managed to get this working using TCP as per below. I tried TLS with the IP address but that did not work. It would be nice however if I did not have to specify the IP address
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: mailjet
spec:
hosts:
- in-v3.mailjet.com
addresses:
- 104.199.96.85/32
ports:
- name: tls
number: 587
protocol: tcp
location: MESH_EXTERNAL
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: mailjet
spec:
hosts:
- in-v3.mailjet.com
tcp:
- match:
- port: 587
route:
- destination:
host: in-v3.mailjet.com
port:
number: 587
---