Commit Graph

204 Commits

Author SHA1 Message Date
Jason Wang 7e12b4ec2f Add v1beta1 for Networking APIs (#1232)
* Add v1beta1 networking APIs

* rebase and regen
2020-01-15 09:42:00 -08:00
Morven Cao 80fb3f4c49 move status out of operator spec api. (#1231) 2020-01-10 16:08:14 -08:00
Yangmin Zhu 660e8ea299 add deny and negative match in authorization policy (#1222)
* add deny support in authorization policy

* add exclude semantics

* update comments

* update comments

* address comments

* update comments
2020-01-10 14:09:49 -08:00
Morven Cao 2f9dfd28a2 add service annotation to KubernetesResourcesSpec in operator api. (#1230) 2020-01-10 11:40:08 -08:00
Zhonghu Xu e7b15ef814 Remove some fields in virtualservice (#1214)
* Remove deprecated fields in VS

* gen crd
2020-01-10 02:44:35 -08:00
ZereChen 08509ba5b8 add allow_origins in CorsPolicy. (#1197) 2020-01-10 01:00:34 -08:00
Kun Chang ad468de08f add enabled for locality lb (#1182) 2020-01-08 09:15:19 -08:00
Martin Ostrowski 0593b0ef35 Move operator API to separate dir (#1223)
* Move operator API to separate dir

* Update linter settings

* Add make gen files

* Add values field to gateways

* Make gen

* Add enablement for gateways

* Remove CoreDNS from core components list
2020-01-06 09:02:25 -08:00
Diem Vu 7a503499ce Deprecate obsolete fields in authN alpha policy. (#1206)
* Deprecate obsolete fields in authN alpha policy.

* Update comments

* Address comments
2020-01-03 09:52:23 -08:00
Ying Zhu b5c3569683 deprecate consecutive_errors and add consecutive_gateway_errors & consecutive_5xx_errors (#1189)
* istio-api: add consecutive_5xx_errors for outlier detection

This CL adds consecutive_5xx_errors field in OutlierDetection.
This field describes the number of 5xx errors before a host is
ejected from the connection pool.

I made changes to destination_rule.proto, the other files are auto-generated.

Change-Id: Ib5097b3c6bf3ea2b8b2f857491537acb674ae1ff
Reviewed-on: https://gerrit.musta.ch/c/public/istio-api/+/195
Reviewed-by: Brian Wolfe <brian.wolfe@airbnb.com>
Reviewed-by: Jungho Ahn <jungho.ahn@airbnb.com>
Reviewed-by: Weibo He <weibo.he@airbnb.com>

* Revert "istio-api: add consecutive_5xx_errors for outlier detection"

This reverts commit 064b737396200a84ed5fd6303ae6b68b48c569b3.

Reason for revert: decided to deprecate consecutive_errors

Change-Id: I95e3191db30711b1ce7abdebe7639de4899f2ab1
Reviewed-on: https://gerrit.musta.ch/c/public/istio-api/+/163
Reviewed-by: Jungho Ahn <jungho.ahn@airbnb.com>

* istio-api: deprecate consecutive_errors and add gateway & 5xx errors

With the original consecutive_errors design, there is no way to turn
off consecutive gateway errors. This CL deprecate the field and add two
new fields: consecutive_gateway_errors and consecutive_5xx_errors.

See discussions here: https://github.com/istio/api/issues/909

Change-Id: I0e98990d194216cef842fb792a76a5f59b6e674e
Reviewed-on: https://gerrit.musta.ch/c/public/istio-api/+/199
Reviewed-by: Jungho Ahn <jungho.ahn@airbnb.com>
Reviewed-by: Weibo He <weibo.he@airbnb.com>

* istio-api: consecutive 5xx defaults to 5, gateway defaults to 0

This CL changes the description of consecutive_5xx_errors and
consecutive_gateway errors. 5xx defaults to 5 and gateway defaults to 0.

Change-Id: I6c3b29cf92df1c972a7850a726eb159b5e23bf90
Reviewed-on: https://gerrit.musta.ch/c/public/istio-api/+/211
Reviewed-by: Jungho Ahn <jungho.ahn@airbnb.com>

* istio-api: reword consecutive 5xx & gateway descriptions

This CL rewords the descriptions of consecutive 5xx & gateway as
suggected in https://github.com/istio/api/pull/1189/files.

Change-Id: Ia95c03da78a2c9f12c8762b9d8fb95e7add08516
Reviewed-on: https://gerrit.musta.ch/c/public/istio-api/+/214
Reviewed-by: Jungho Ahn <jungho.ahn@airbnb.com>
2019-12-20 09:53:05 -08:00
Martin Ostrowski 5a4614ed97 Fixes for synthetic and k8s types (#1211)
* Fixes for synthetic and k8s types

* Lint, gen
2019-12-19 14:16:05 -08:00
Diem Vu 3738877341 Add forward spec to JWTRule (#1172)
* Add forward spec to JWTRule

* Drop forward_original

* Rename forward-xxx to output-

* Update proto.lock due to Jwt -> JwtRule rename

* Add back the option to keep the original token

* Update comment for less google specific

* Rename retain_ to forward_

* Fix rebase proto.lock
2019-12-16 19:20:50 -08:00
Costin Manolache f04959cc85 Few small updates to the mesh config API (#1194)
* Few small updates to the mesh config API

* Make gen, update

* Update based on feedback

* Add hide from docs until impl is ready
2019-12-12 12:52:02 -08:00
Martin Ostrowski 2bfe3e1437 Refactor and integrate MeshConfig and IstioControlPlaneSpec (#1177)
* Refactor and integrate MeshConfig and IstioControlPlaneSpec

* Fix hub comment

* Review comments

* Update status

* Added istiod

* Review comments

* Remove stray message

* Proto gen fixes

* Mirror k8s structs that have import problems

* Remove debug

* Update comment

* Consolidate some types

* Merge gateways

* Remove proxy config type

* Add name field for gateways

* Update gateways

* Update generated files

* Update go.mod

* Licenses

* Lint

* More lint, add gw label

* Add lint debug output

* Address comments

* Removing debug character
2019-12-10 09:32:28 -08:00
Brian Wolfe 2a7248f229 VirtualService: use a double for mirror_percent (#1173)
To support mirroring less than 1% of traffic to a destination, the
mirror_percent field should provide specification of percentages less
than 1. Envoy permits mirroring fractions as small as 1 in 1,000,000.
The Delay and Abort messages already encountered this issue and
solved it by using a Percent (== double) field called percentage instead
of an integer field called percent.

Here, we support small fractions in mirroring using the same pattern,
using mirror_percentage in place of mirror_percent and deprecating the
mirror_percent field.

When reading mirror_percentage, we will need to handle rounding
of numbers near 1.0e-6 carefully because the floating point
representation will not be exact.
2019-11-25 18:37:42 -08:00
Diem Vu 62bf0afefa Add RequestAuthetication API (#1151)
* Add RequestAuthetication API

* Address comments

* Make JWTHeader type to define header with prefix

* Revert go.sum

* Address more comments

* Add blank line to end of file

* Update JwtHeader field

* Rename JwtHeader to JWTHeader for consistency

* Update security/v1beta1/jwt.proto

Co-Authored-By: Sven Mawson <sven@google.com>

* Update make gen

* Regenerate file after rebase

* Update comment

* Rebase
2019-11-12 19:06:52 -08:00
aattuluri 9a5ec23e27 Add locality load balancer settings on destination rule (#1141)
* Move locality load balancer settings to destination rule and use it in config.

* Add proto generated files with protolock

* Update based on proto run.

* Fix conventions

* Additional changes after generation

* Update the protolock status files.

* Add locality load balancer settings under port traffic policy

* Moved locality load balancer settings under load balancer settings.

* Remove extra lines added.

* Update after make gen.
2019-10-28 11:16:01 -07:00
Diem Vu 1bbff2ef25 Remove unimplemented/unused labels in authn target selector (#1118)
* Remove unimplemented/unused labels in authn target selector

* Rebase
2019-10-22 13:51:09 -07:00
Yan Xue 31d048906d update alpn filter api (#1128)
* update alpn filter api

* update api
2019-10-16 08:15:39 -07:00
Jason Wang bfa91e88ab Change quota charge to int32 (#1129)
* Change quota charge to int32

* update proto lock

* retro add release locks
2019-10-15 14:07:38 -07:00
Jason Wang 1187adbd14 Use field_behavior as an option for required fields (#1125)
* use field_behavior opiton for required fields

* modify makefile to replace import path for field_behavior

* generate after image update

* changes after comments from policy and telemetry team

* regen after changes

* update networking and rebase
2019-10-14 10:42:57 -07:00
Yan Xue 593785242b add config for ALPN filter (#1120) 2019-10-08 18:17:36 -07:00
Douglas Reid 096de7877b feat(mesh config): add support for disabling reporting via mixer (#1112)
This PR establishes a way to disable telemetry reporting via Mixer. This
is part of the transition to the extensibility v2 architecture in which
there will be no Mixer in Istio. We need a mechanism to allow
selectively disabling Mixer for experimentation, development, and
migration.

This option is hidden, as it is meant only for experimental usage.

This new field is needed, as setting `mixer_report_server` to be empty
would break TCP reporting during the transition state. When TCP support
reaches parity, this field can be retired in favor of unsetting
`mixer_report_server`.

Related issue: https://github.com/istio/istio/issues/15935

Signed-off-by: Douglas Reid <douglas-reid@users.noreply.github.com>
2019-10-03 08:18:28 -07:00
Douglas Reid 88a7b5f700 feat(mixerclient): add field to ignore forwarded attributes (#1085)
* feat(mixerclient): add field to signal mixerclient to ignore forwarded attributes

Signed-off-by: Douglas Reid <douglas-reid@users.noreply.github.com>

* add clarification on precedence

Signed-off-by: Douglas Reid <douglas-reid@users.noreply.github.com>
2019-10-02 15:32:28 -07:00
lei-tang ca4d65802c K8sCertificateSetting configures the provision of certificates (#1105) 2019-09-30 17:46:24 -07:00
Phillip Quy Le 33a483a29b Add trust_domain_aliases (#1109)
* Add trust_domain_aliases

* Address comment

* Address comment
2019-09-30 15:07:24 -07:00
Gregory Hanson 5e9ae71274 removed port name from the port selector (#1100) 2019-09-25 07:27:42 -07:00
Nino Kodabande 4de186df9e Allow to describe the source of configuration in configSource (#1083) 2019-09-23 09:42:12 -07:00
Jonh Wendell 8920ca4382 Add mirror_percent (#1079)
This allows us to mirror only a percentage of the traffic, instead
of always mirroring 100%.

This partially fixes https://github.com/istio/istio/issues/14437, in
conjuction with https://github.com/istio/istio/pull/16939.
2019-09-13 12:48:55 -07:00
Martin Taillefer d5a84f4eac
Enable all linters on this repo. (#1077)
* Enable all linters on this repo.

- Fix a few linting errors.
2019-09-09 10:31:28 -07:00
Martin Taillefer cd150f8ca1
Update common files. (#1075) 2019-09-08 08:12:11 -07:00
Rama Chavali adb6f9e24b add stat name patterns to mesh config (#1063)
Signed-off-by: Rama Chavali <rama.rao@salesforce.com>
2019-08-28 20:21:30 -07:00
Rama Chavali 4d7314930b revert stat name from destination rule (#1062)
Signed-off-by: Rama Chavali <rama.rao@salesforce.com>
2019-08-27 20:19:52 -07:00
Rama Chavali 47d59557d3 add stat name pattern (#1056)
* add stat name pattern

Signed-off-by: Rama Chavali <rama.rao@salesforce.com>

* add subset name

Signed-off-by: Rama Chavali <rama.rao@salesforce.com>
2019-08-27 10:11:54 -07:00
Martin Taillefer 1c58b135ae
Update common files. (#1055)
- Fix some broken dependency tracking.

- Remove a superfluous proto import to get rid of a warning.

- Explicitly select an older build-tools container version, since
the current one has some problems building the protos.
2019-08-26 09:57:37 -07:00
Jianfei Hu 64b0d85137 Add feature flag enable_auto_mtls in mesh config. (#1028)
* update the meshconfig for istio mtls auto feature.

* update with wrapper boolvalue.
2019-08-23 10:45:26 -07:00
Martin Taillefer 9dc74657c5
Update common files. (#1050)
This introduces a new protoc compiler, which affects the python code
gen a bit.
2019-08-21 19:43:58 -07:00
Limin Wang 2745b7cd41 Add WorkloadSelector definition in a common directory. (#1032)
* Add WorkloadSelector definition in a common directory.

* Address comments and fix test.

* Try to fix presubmit test.

* Remove "hide from doc".
2019-08-13 12:47:54 -07:00
Shriram Rajagopalan 93fc23ae4a
Protocol Detection Timeout (#1033)
* Protocol Detection Timeout

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* proto commit

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>
2019-08-12 21:24:07 -04:00
Yangmin Zhu 3a122a92ea remove the out-dated authorization policy (#1031)
* remove the out-dated authorization policy

* fix releaselock-1.1
2019-08-12 18:22:52 -07:00
Yangmin Zhu b632c65780 Add authorization policy v1beta1 (#918)
* add authorization policy v1beta1

* address comments

* use workload selector in Sidecar
2019-08-08 20:37:50 -07:00
Shriram Rajagopalan 0e77ec0023
Named routes in VS and few more fields in envoyfilter api (#1026)
* adding few more fields to envoyfilter api

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* nits

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* adding names to virtual service routes

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* proto commit

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* return name to envoy filter

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* docs

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>
2019-08-08 14:32:17 -04:00
Gao Hongtao 8b97a45b01 Add Keepalive settings for envoy ALS and metrics services (#1024)
Signed-off-by: Gao Hongtao <hanahmily@gmail.com>
2019-08-07 22:11:36 -04:00
Shriram Rajagopalan 2691e01957
[proxy] Add TLS Settings for envoy ALS and metrics services (#1023)
* Add TLS settings for envoy ALS and metrics services

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* files

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>
2019-08-07 20:02:24 -04:00
Shriram Rajagopalan 590323566e
fix proxy version match (#1012)
* fix proxy version match

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* bad merge

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>
2019-07-31 18:32:11 -04:00
Steven Dake 0988834cd4 DNM - a test of gogo forked tooling 2019-07-30 08:22:31 -07:00
Shriram Rajagopalan fee961ba53
EnvoyFilter: add ability to match on proxy metadata and version (#1003)
* add a proxy version check for envoy patch match

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* update docs

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* update protolock

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* generic proxy match

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>
2019-07-29 14:06:31 -04:00
Martin Taillefer 4285569620
Cleanup makefile (#999)
- Make more human-readable

- Properly track all dependencies

- Simplify container usage

- Combine rules to reduce # tool invocations

- Fix missing python binding for rbac protos.

- Include html link checking as part of linting.

- Retire CircleCi job, since that's now taken care of by the above linting change.

As a result of these changes, a full rebuild takes considerably less time
(1/10th maybe)
2019-07-27 09:34:41 -07:00
Chris Sherry 67272e757e Add TLS certificate default validation options (#973)
* Add TLS certificate default validation options

* Fix nits in gateway.proto

* Regenerate files

* Simplify spki comment

* Remove trusted_ca field and CertificateValidationContext message.
Move validate_certificate_spki near other validation settings.
Add validate_certificate_hash.

* Add TLS certificate default validation options

* Fix nits in gateway.proto

* Regenerate files

* Simplify spki comment

* Remove trusted_ca field and CertificateValidationContext message.
Move validate_certificate_spki near other validation settings.
Add validate_certificate_hash.

* Rebase from upstream

* Revert "Merge branch 'certificateValidation' of https://github.com/Phlak106/api into certificateValidation"

This reverts commit 8ee3ba7931, reversing
changes made to 01f3b1decc.

* update proto.lock with make proto-commit
2019-07-26 22:12:00 +00:00
Martin Taillefer ae67f60b2e Generate a doc page for our annotations. (#993) 2019-07-25 21:09:24 +00:00