Commit Graph

176 Commits

Author SHA1 Message Date
Jonh Wendell 8920ca4382 Add mirror_percent (#1079)
This allows us to mirror only a percentage of the traffic, instead
of always mirroring 100%.

This partially fixes https://github.com/istio/istio/issues/14437, in
conjuction with https://github.com/istio/istio/pull/16939.
2019-09-13 12:48:55 -07:00
Martin Taillefer d5a84f4eac
Enable all linters on this repo. (#1077)
* Enable all linters on this repo.

- Fix a few linting errors.
2019-09-09 10:31:28 -07:00
Martin Taillefer cd150f8ca1
Update common files. (#1075) 2019-09-08 08:12:11 -07:00
Rama Chavali adb6f9e24b add stat name patterns to mesh config (#1063)
Signed-off-by: Rama Chavali <rama.rao@salesforce.com>
2019-08-28 20:21:30 -07:00
Rama Chavali 4d7314930b revert stat name from destination rule (#1062)
Signed-off-by: Rama Chavali <rama.rao@salesforce.com>
2019-08-27 20:19:52 -07:00
Rama Chavali 47d59557d3 add stat name pattern (#1056)
* add stat name pattern

Signed-off-by: Rama Chavali <rama.rao@salesforce.com>

* add subset name

Signed-off-by: Rama Chavali <rama.rao@salesforce.com>
2019-08-27 10:11:54 -07:00
Martin Taillefer 1c58b135ae
Update common files. (#1055)
- Fix some broken dependency tracking.

- Remove a superfluous proto import to get rid of a warning.

- Explicitly select an older build-tools container version, since
the current one has some problems building the protos.
2019-08-26 09:57:37 -07:00
Jianfei Hu 64b0d85137 Add feature flag enable_auto_mtls in mesh config. (#1028)
* update the meshconfig for istio mtls auto feature.

* update with wrapper boolvalue.
2019-08-23 10:45:26 -07:00
Martin Taillefer 9dc74657c5
Update common files. (#1050)
This introduces a new protoc compiler, which affects the python code
gen a bit.
2019-08-21 19:43:58 -07:00
Limin Wang 2745b7cd41 Add WorkloadSelector definition in a common directory. (#1032)
* Add WorkloadSelector definition in a common directory.

* Address comments and fix test.

* Try to fix presubmit test.

* Remove "hide from doc".
2019-08-13 12:47:54 -07:00
Shriram Rajagopalan 93fc23ae4a
Protocol Detection Timeout (#1033)
* Protocol Detection Timeout

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* proto commit

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>
2019-08-12 21:24:07 -04:00
Yangmin Zhu 3a122a92ea remove the out-dated authorization policy (#1031)
* remove the out-dated authorization policy

* fix releaselock-1.1
2019-08-12 18:22:52 -07:00
Yangmin Zhu b632c65780 Add authorization policy v1beta1 (#918)
* add authorization policy v1beta1

* address comments

* use workload selector in Sidecar
2019-08-08 20:37:50 -07:00
Shriram Rajagopalan 0e77ec0023
Named routes in VS and few more fields in envoyfilter api (#1026)
* adding few more fields to envoyfilter api

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* nits

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* adding names to virtual service routes

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* proto commit

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* return name to envoy filter

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* docs

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>
2019-08-08 14:32:17 -04:00
Gao Hongtao 8b97a45b01 Add Keepalive settings for envoy ALS and metrics services (#1024)
Signed-off-by: Gao Hongtao <hanahmily@gmail.com>
2019-08-07 22:11:36 -04:00
Shriram Rajagopalan 2691e01957
[proxy] Add TLS Settings for envoy ALS and metrics services (#1023)
* Add TLS settings for envoy ALS and metrics services

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* files

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>
2019-08-07 20:02:24 -04:00
Shriram Rajagopalan 590323566e
fix proxy version match (#1012)
* fix proxy version match

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* bad merge

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>
2019-07-31 18:32:11 -04:00
Steven Dake 0988834cd4 DNM - a test of gogo forked tooling 2019-07-30 08:22:31 -07:00
Shriram Rajagopalan fee961ba53
EnvoyFilter: add ability to match on proxy metadata and version (#1003)
* add a proxy version check for envoy patch match

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* update docs

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* update protolock

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* generic proxy match

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>
2019-07-29 14:06:31 -04:00
Martin Taillefer 4285569620
Cleanup makefile (#999)
- Make more human-readable

- Properly track all dependencies

- Simplify container usage

- Combine rules to reduce # tool invocations

- Fix missing python binding for rbac protos.

- Include html link checking as part of linting.

- Retire CircleCi job, since that's now taken care of by the above linting change.

As a result of these changes, a full rebuild takes considerably less time
(1/10th maybe)
2019-07-27 09:34:41 -07:00
Chris Sherry 67272e757e Add TLS certificate default validation options (#973)
* Add TLS certificate default validation options

* Fix nits in gateway.proto

* Regenerate files

* Simplify spki comment

* Remove trusted_ca field and CertificateValidationContext message.
Move validate_certificate_spki near other validation settings.
Add validate_certificate_hash.

* Add TLS certificate default validation options

* Fix nits in gateway.proto

* Regenerate files

* Simplify spki comment

* Remove trusted_ca field and CertificateValidationContext message.
Move validate_certificate_spki near other validation settings.
Add validate_certificate_hash.

* Rebase from upstream

* Revert "Merge branch 'certificateValidation' of https://github.com/Phlak106/api into certificateValidation"

This reverts commit 8ee3ba7931, reversing
changes made to 01f3b1decc.

* update proto.lock with make proto-commit
2019-07-26 22:12:00 +00:00
Martin Taillefer ae67f60b2e Generate a doc page for our annotations. (#993) 2019-07-25 21:09:24 +00:00
Zhonghu Xu 1eedae8506 Revert "Add feature gate in global config (#958)" (#988)
This reverts commit e710196a11.
2019-07-24 21:28:59 +00:00
Sam Naser 48457f4161 Introduce ISTIO_MUTUAL TLSmode in gateway.proto (#991)
It is not possible to specify Istio certificate locations using MUTUAL
mode, so we must introduce ISTIO_MUTUAL TLSmode (as found in
destination_rule.proto). Allows us to use secure mTLS connection
between the gateway and workloads with SDS enabled
2019-07-24 17:56:52 +00:00
Kun Chang 99722f53e7 add parameter to specify HTTP redirect code (#970) 2019-07-17 23:51:23 -04:00
Yangmin Zhu 36b4225204 authn: add a field to confrol trust domain validation (#980)
* authn: add a field to confrol trust domain validation

* update comments
2019-07-18 00:35:42 +00:00
Shriram Rajagopalan 115cae5613
Tweaks to EnvoyFilter docs and minor api fix (#982)
* tweaks to envoy filter docs and api

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* protolock

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>
2019-07-16 13:11:33 -04:00
Keith Byrne 6eaef57d82 Add support for STRING_MAP in policy API (#925)
* Add support for STRING_MAP as a supported Value

This change will support implementing STRING_MAP in out of process
adapters.

https://github.com/istio/istio/issues/7645#issuecomment-417306781

* Commit proto.lock.
2019-07-09 14:14:12 -07:00
Zhonghu Xu e710196a11 Add feature gate in global config (#958)
* add feature in mesh config

* gen

* make proto-commit
2019-07-08 21:54:23 -07:00
Utako Ueda 70f6e4eada include PatchContext in EnvoyFilter_EnvoyConfigObjectMatch (#971) 2019-07-08 13:04:18 -07:00
Nupur Garg bcef516bf9 Add a Status field in CheckResponse Quota Result (#967)
* Add a Status field in CheckResponse Quota Result

This is the QuotaResult that is used by grpcServer in istio.io/istio and we can set this when not able to fetch quota and check call can fail in proxy based on fail-open policy set by user.

Ref: istio/istio#12115

* Run make proto-commit
2019-07-08 11:45:18 -07:00
Robert Panzer 4b6c61ecac Fixes #12873. Add property Sidecar.OutboundTrafficPolicy to configure… (#964)
* Fixes #12873. Add property Sidecar.OutboundTrafficPolicy to configure outbound traffic policy individually per application

* Fix difference in proto.lock
2019-07-08 13:58:44 -04:00
mandarjog be8a513844 Add stackdriver tracing config (#959)
Update per comments
2019-07-01 12:43:42 -07:00
Shriram Rajagopalan 8685353777 fix field type (#956)
Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>
2019-06-24 11:47:50 -07:00
Shriram Rajagopalan 812ed88951
Enhancing EnvoyFilter with listener/cluster/route mods (#899)
* Add replace/merge semantics in EnvoyFilter

Signed-off-by: Shriram Rajagopalan <rshriram@gmail.com>

* updates

Signed-off-by: Shriram Rajagopalan <rshriram@gmail.com>

* Using JSON XPaths

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* doc updates

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* protolock

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* updates

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* updates

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* proto lock

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* updates

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* release-lock status

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* undo

* Revert "undo"

This reverts commit ae659a19b3.

* proper undo

* multiple matches

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* doc updates

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* rework apis

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* fixes

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* update release lock

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* updates

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* fixes

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* port names

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>

* hide from docs

Signed-off-by: Shriram Rajagopalan <rshriram@tetrate.io>
2019-06-24 14:16:44 -04:00
Gao Hongtao 6f137ab2ce Replacing envoy_google_grpc with envoy_grpc for als (#937) 2019-06-03 19:31:28 -07:00
mandarjog 5dd7dbbe45 H2 auto upgrade options (#930)
* Add h2upgrade policy

* review comments

* Add generated files
2019-06-01 20:47:16 -07:00
Gao Hongtao a92ad44857 Adding envoy gRPC access log service configuration to MeshConfig (#911)
* Adding envoy_accesslog_service to MeshConfig

* Update config message name

* Adding envoy_accesslog_service to MeshConfig
2019-05-31 08:47:44 -04:00
Hai Huang 9f689ccd27 adding fields to allow batch reporting options to be tunable as helm values (#929) 2019-05-29 11:45:17 -07:00
Venil Noronha 1dffc8d3d2 Add parameter to ignore HTTP match case (#926)
This adds a ignoreUriCase parameter to HTTPMatchRequest to allow for
configuring case-insensitive HTTP URI matching.

Signed-off-by: Venil Noronha <veniln@vmware.com>
2019-05-21 17:40:26 -07:00
Nupur Garg 657d9f2e55 Add a status field in QuotaResult (#921)
* Add a status field in QuotaResult

This is so that we can result status when we are not able to fetch quota and check call can fail based on fail-open policy set by user.
Issue: https://github.com/istio/istio/issues/12115

* Fix build
2019-05-16 13:05:03 -07:00
Hai Huang fb2153e2f1 adding report_batch_max_request and report_batch_max_time to TransportConfig (#914)
* adding report_batch_max_request and report_batch_max_time to TransportConfig

* run make proto-commit

* added comment on the default-value behavior

* added more descriptive comments on the 2 added fields
2019-05-02 06:32:50 -07:00
Arian Motamedi 6b8d1849e7 Adding idle_timeout field to DestinationRule (#891)
* adding idle_timeout setting for upstream connections.

* typo: removing extra whitespace from idle_timeout documentation.

* running proto-commit.
2019-04-05 10:27:52 -04:00
Venil Noronha 8a1240dcc3 Add configuration for matching on query params (#883)
This adds the necessary configuration for matching over query
parameters.

Signed-off-by: Venil Noronha <veniln@vmware.com>
2019-04-02 08:34:26 -04:00
Quanjie Lin c443173254 add sds related param to proxyconfig proto (#884)
* add sds related param to proxyconfig proto

* fix build

* update comment
2019-03-27 16:50:42 -07:00
John Howard 87afa02b7b Merge release-1.1 into master (#872)
* Doc fixes.

* Add high-level overview and diagrams for MCP (#805)

* document MCP

* add additional note on NACK behavior

* add a note about ignoring stale nonces

* Add envoy metrics service configuration to ProxyConfig (#803)

* Add envoy metrics service configuration to ProxyConfig

Similar to the statsd sink config, this change is in preparation for adding support for the envoy metrics service API.

* Update proto.lock

* Reorder metrics_service_address just after statsd_udp_address

* Update comment in the authN API to match with 1.1 behavior (#808)

* Rename metrics_service_address to clarify that it is for Envoy's API (#809)

Since "metrics service" is so ambiguous, this change specifically denotes that the config is for Envoy's metrics service API. The comments also now link to detailed info about the metrics service API.

* Generate separate HTML page per proto under networking (#811)

* Generate separate pages for each networking proto

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* update

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* tweaks

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* Fix interdoc references

* separate doc and go gen

* change dash to underscore

* fix

* more fixes

* makefile fix

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* remove bad target

* Revert "change dash to underscore"

This reverts commit 7fbced66f6.

* final update

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* Revert "Generate separate HTML page per proto under networking (#811)"

This reverts commit 5f14eadd since it breaks the ability
to generate reference docs in istio.io

* Update to latest tools.

* Revert "Update to latest tools."

This reverts commit 231fadc5 which I accidentally pushed to the
wrong place.

* fix mcp update error diagram (#810)

* update istio/tools (#815)

* Revert "Revert "Generate separate HTML page per proto under networking (#811)"" (#818)

* Minor updates for building docker images. (#817)

* Add spell checking for docs. (#819)

* Add a bunch of words to the custom dictionary.

* Document exportTo restrictions (#820)

* Doc fixes. (#821)

* Proxy config: Add tls_certs_to_watch field (#824)

* Proxy config: Add tls_certs_to_watch field

* Address PR comment

* Revert "Proxy config: Add tls_certs_to_watch field (#824)" (#825)

This reverts commit e613e358ae.

* Update gateway and sidecar hosts doc (#826)

* Update gateway and sidecar hosts doc

* regen

* review comments

* Update API docs (service entry, gateway, sidecar) (#831)

* Update sidecar and gateway docs

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* gen docs

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* update service entry

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* updates

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* add configurable dns refresh rate to mesh for strict dns cluster,  (#832)

* add configurable dns refresh rate to mesh for strict dns cluster, issue #12181

* add lock file

* Hosts are not ignored in ServiceEntry for HTTPs (#833)

* Hosts are not ignored in ServiceEntry for HTTPs

* Clarify

* Reword

* Generate protos

* Address code review comments

* Fix typo

* generate

* make mixer config marshal deterministic (#846)

Signed-off-by: Kuat Yessenov <kuat@google.com>

* Fix some doc errors. (#854)

This started out to just fix a bad link to unblock work on
istio.io, but I ended up fixing a bunch of typos/incorrect format
throughout.

* Fix two more broken links. (#856)

* Fix CRD examples for release-1.1 (#859)

* fix MeshNetworks demo (#841)

* fix MeshNetworks demo

* generate

* update

* last minute doc fixes (#865)

Signed-off-by: Shriram Rajagopalan <rshriram@gmail.com>

* Clarify comment for server_name field in Mixer oop auth config (#800)

* add mixerclient config to istio.io reference docs (#827)

* Envoyfilter docs fix (#867)

* Tweaks to get the mixer client config docs to be published. (#868)

* Change where the Mixer client docs are published.
2019-03-21 13:54:42 -07:00
Ozben Evren 5a79ba0ecb Merge release-1.1 to master (#840)
* Doc fixes.

* Add high-level overview and diagrams for MCP (#805)

* document MCP

* add additional note on NACK behavior

* add a note about ignoring stale nonces

* Add envoy metrics service configuration to ProxyConfig (#803)

* Add envoy metrics service configuration to ProxyConfig

Similar to the statsd sink config, this change is in preparation for adding support for the envoy metrics service API.

* Update proto.lock

* Reorder metrics_service_address just after statsd_udp_address

* Update comment in the authN API to match with 1.1 behavior (#808)

* Rename metrics_service_address to clarify that it is for Envoy's API (#809)

Since "metrics service" is so ambiguous, this change specifically denotes that the config is for Envoy's metrics service API. The comments also now link to detailed info about the metrics service API.

* Generate separate HTML page per proto under networking (#811)

* Generate separate pages for each networking proto

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* update

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* tweaks

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* Fix interdoc references

* separate doc and go gen

* change dash to underscore

* fix

* more fixes

* makefile fix

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* remove bad target

* Revert "change dash to underscore"

This reverts commit 7fbced66f6.

* final update

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* Revert "Generate separate HTML page per proto under networking (#811)"

This reverts commit 5f14eadd since it breaks the ability
to generate reference docs in istio.io

* Update to latest tools.

* Revert "Update to latest tools."

This reverts commit 231fadc5 which I accidentally pushed to the
wrong place.

* fix mcp update error diagram (#810)

* update istio/tools (#815)

* Revert "Revert "Generate separate HTML page per proto under networking (#811)"" (#818)

* Minor updates for building docker images. (#817)

* Add spell checking for docs. (#819)

* Add a bunch of words to the custom dictionary.

* Document exportTo restrictions (#820)

* Doc fixes. (#821)

* Proxy config: Add tls_certs_to_watch field (#824)

* Proxy config: Add tls_certs_to_watch field

* Address PR comment

* Revert "Proxy config: Add tls_certs_to_watch field (#824)" (#825)

This reverts commit e613e358ae.

* Update gateway and sidecar hosts doc (#826)

* Update gateway and sidecar hosts doc

* regen

* review comments

* Update API docs (service entry, gateway, sidecar) (#831)

* Update sidecar and gateway docs

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* gen docs

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* update service entry

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* updates

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* add configurable dns refresh rate to mesh for strict dns cluster,  (#832)

* add configurable dns refresh rate to mesh for strict dns cluster, issue #12181

* add lock file

* Post-merge generation
2019-03-09 07:47:29 -08:00
Yangmin Zhu 5f7cfed842 Add jwks to JWT policy to allow using public key for token validation. (#829)
* Add jwks to allow using public key directly in JWT policy.

Signed-off-by: Yangmin Zhu <ymzhu@google.com>

* do not use oneof

* fix build
2019-03-05 11:31:32 -08:00
louiscryan 823a224f0b Merge branch 'release-1.1' into Merge11ToMaster 2019-02-20 16:27:40 -08:00
Caleb Gilmour f6b6c4168d Add Datadog tracing to proxy config (#797)
Signed-off-by: Caleb Gilmour <caleb.gilmour@datadoghq.com>
2019-02-18 13:47:25 -08:00