{
  "port": 15000,
  "protocol": "tcp",
  "service": "Envoy admin (in practice) / hydap (IANA)",
  "oneLiner": "Registered to HYPACK survey software; on any Kubernetes node it is the Envoy sidecar's admin interface.",
  "whatItIs": "IANA assigns 15000 to `hydap`, \"Hypack Data Aquisition\", used by HYPACK's hydrographic survey packages. Far more common today is Envoy: Istio documents 15000 as the \"Envoy admin port (commands/diagnostics)\" on every injected sidecar, alongside 15001 outbound, 15006 inbound, 15021 health and 15090 telemetry. The admin interface is a plain HTTP endpoint that dumps the proxy's full configuration and stats and can change log levels or drain listeners, which is why Istio marks it pod-internal only. Outside a mesh, 15000 is also a popular round number for application listeners.",
  "exposure": {
    "verdict": "never",
    "note": "Envoy's own documentation warns the admin endpoint must not be exposed: `/config_dump` can reveal secrets and its handlers can modify or shut down the proxy. Bind it to localhost."
  },
  "checkCommand": "curl -s http://TARGET:15000/server_info",
  "links": [
    {
      "title": "Envoy — administration interface",
      "url": "https://www.envoyproxy.io/docs/envoy/latest/operations/admin",
      "kind": "official-docs"
    },
    {
      "title": "Istio — ports used by Istio",
      "url": "https://istio.io/latest/docs/ops/deployment/application-requirements/",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 15000 (hydap)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=15000",
      "kind": "iana"
    }
  ]
}