Can't see access log with Istio CNI installed (1.6.5)

1

Hi there,
I am having trouble to see access log from istio-proxy sidecar when using Istio CNI. Just wondering if I did anything wrong.

The installation file as below (EKS1.6):
—
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
profile: default
meshConfig:
outboundTrafficPolicy:
mode: REGISTRY_ONLY
accessLogFile: “/dev/stdout”
accessLogFormat: JSON
components:
cni:
enabled: true
namespace: kube-system
values:
global:
defaultNodeSelector:
node.kubernetes.io/role: utils
imagePullPolicy: Always
gateways:
istio-ingressgateway:
serviceAnnotations:
service.beta.kubernetes.io/aws-load-balancer-internal: “0.0.0.0/0”
cni:
cniBinDir: /opt/cni/bin
cniConfDir: /etc/cni/net.d
psp_cluster_role: eks:podsecuritypolicy:privileged
excludeNamespaces:
- istio-system
- kube-system
- kube-node-lease
- kube-public
logLevel: info

The logs appears in the istio-proxy looks like this:
|2020-08-03T21:09:36.766305Z|info|transport: loopyWriter.run returning. connection error: desc = “transport is closing”|
|—|---|—|
|2020-08-03T21:09:36.766324Z|info|pickfirstBalancer: HandleSubConnStateChange: 0xc0008f25d0, {CONNECTING }|
|2020-08-03T21:09:36.766351Z|info|Channel Connectivity change to CONNECTING|
|2020-08-03T21:09:36.766328Z|info|Subchannel picks a new address “istiod.istio-system.svc:15012” to connect|
|2020-08-03T21:09:36.775325Z|info|Subchannel Connectivity change to READY|
|2020-08-03T21:09:36.775365Z|info|pickfirstBalancer: HandleSubConnStateChange: 0xc0008f25d0, {READY }|
|2020-08-03T21:09:36.775374Z|info|Channel Connectivity change to READY|

Would anyone have any idea why the access log doesn’t show? Thanks.

2

Not sure if this is the case, it seems I can get some access logging via running:

istioctl proxy-config log [podname].[namespace] --level http:debug

However it’s odd as this is not documented in https://istio.io/latest/docs/tasks/observability/logs/access-log/ as the method proposed in the link doesn’t seem to work.

Could anyone confirm? Thanks.