istio
/
istio.io
mirror of https://github.com/istio/istio.io.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add instructions to set global_downstream_max_connections (#12761) 

* doc-global-downstream-max-conn-helm

* Add instructions to set global_downstream_max_connections with Helm
* Fix https://github.com/istio/istio/issues/37443

* Fix linting errors

* Address comments

* Remove global_downstream_max_connections from .spelling and add backticks where missing

* Simplify instructions on how to set global_downstream_max_connections
This commit is contained in:
SRodi 2023-02-23 16:25:55 +00:00 committed by GitHub
parent ff3b750d40
commit 073ccdec9d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.spelling
View File

@ -1113,4 +1113,4 @@ Zipkin
Ziyang
Zolotusky
ztunnel
ztunnels
ztunnels

11
content/en/docs/ops/best-practices/security/index.md
View File

@ -675,4 +675,13 @@ While most cloud providers support this feature now, many local development tool
By default, Istio (and Envoy) have no limit on the number of downstream connections. This can be exploited by a malicious actor (see [security bulletin 2020-007](/news/security/istio-security-2020-007/)). To work around you this, you must configure an appropriate connection limit for your environment.
{{< boilerplate cve-2020-007-configmap >}}
### Configure `global_downstream_max_connections` value
The following configuration can be supplied during installation:
{{< text yaml >}}
meshConfig:
defaultConfig:
runtimeValues:
"overload.global_downstream_max_connections": "100000"
{{< /text >}}