istio
/
istio.io
mirror of https://github.com/istio/istio.io.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

update ref docs (#15307)

This commit is contained in:
zirain 2024-06-21 15:48:20 +08:00 committed by GitHub
parent 55175adf84
commit 1e0556d43a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
35 changed files with 328 additions and 580 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
content/en/docs/reference/commands/install-cni/index.html
View File

@ -81,11 +81,11 @@ remove_toc_prefix: 'install-cni '
</tr> </tr>
<tr> <tr>
<td><code>--log_caller &lt;string&gt;</code></td> <td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td> <td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_output_level &lt;string&gt;</code></td> <td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td> <td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_rotate &lt;string&gt;</code></td> <td><code>--log_rotate &lt;string&gt;</code></td>
@ -105,7 +105,7 @@ remove_toc_prefix: 'install-cni '
</tr> </tr>
<tr> <tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td> <td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td> <td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_target &lt;stringArray&gt;</code></td> <td><code>--log_target &lt;stringArray&gt;</code></td>
@ -203,11 +203,11 @@ See each sub-command&#39;s help for details on how to use the generated script.
</tr> </tr>
<tr> <tr>
<td><code>--log_caller &lt;string&gt;</code></td> <td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td> <td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_output_level &lt;string&gt;</code></td> <td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td> <td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_rotate &lt;string&gt;</code></td> <td><code>--log_rotate &lt;string&gt;</code></td>
@ -227,7 +227,7 @@ See each sub-command&#39;s help for details on how to use the generated script.
</tr> </tr>
<tr> <tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td> <td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td> <td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_target &lt;stringArray&gt;</code></td> <td><code>--log_target &lt;stringArray&gt;</code></td>
@ -272,11 +272,11 @@ If it is not installed already, you can install it via your OS&#39;s package man
</tr> </tr>
<tr> <tr>
<td><code>--log_caller &lt;string&gt;</code></td> <td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td> <td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_output_level &lt;string&gt;</code></td> <td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td> <td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_rotate &lt;string&gt;</code></td> <td><code>--log_rotate &lt;string&gt;</code></td>
@ -296,7 +296,7 @@ If it is not installed already, you can install it via your OS&#39;s package man
</tr> </tr>
<tr> <tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td> <td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td> <td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_target &lt;stringArray&gt;</code></td> <td><code>--log_target &lt;stringArray&gt;</code></td>
@ -340,11 +340,11 @@ If it is not installed already, you can install it via your OS&#39;s package man
</tr> </tr>
<tr> <tr>
<td><code>--log_caller &lt;string&gt;</code></td> <td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td> <td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_output_level &lt;string&gt;</code></td> <td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td> <td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_rotate &lt;string&gt;</code></td> <td><code>--log_rotate &lt;string&gt;</code></td>
@ -364,7 +364,7 @@ If it is not installed already, you can install it via your OS&#39;s package man
</tr> </tr>
<tr> <tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td> <td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td> <td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_target &lt;stringArray&gt;</code></td> <td><code>--log_target &lt;stringArray&gt;</code></td>
@ -407,11 +407,11 @@ to your powershell profile.
</tr> </tr>
<tr> <tr>
<td><code>--log_caller &lt;string&gt;</code></td> <td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td> <td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_output_level &lt;string&gt;</code></td> <td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td> <td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_rotate &lt;string&gt;</code></td> <td><code>--log_rotate &lt;string&gt;</code></td>
@ -431,7 +431,7 @@ to your powershell profile.
</tr> </tr>
<tr> <tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td> <td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td> <td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_target &lt;stringArray&gt;</code></td> <td><code>--log_target &lt;stringArray&gt;</code></td>
@ -481,11 +481,11 @@ to enable it. You can execute the following once:</p>
</tr> </tr>
<tr> <tr>
<td><code>--log_caller &lt;string&gt;</code></td> <td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td> <td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_output_level &lt;string&gt;</code></td> <td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td> <td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_rotate &lt;string&gt;</code></td> <td><code>--log_rotate &lt;string&gt;</code></td>
@ -505,7 +505,7 @@ to enable it. You can execute the following once:</p>
</tr> </tr>
<tr> <tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td> <td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td> <td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_target &lt;stringArray&gt;</code></td> <td><code>--log_target &lt;stringArray&gt;</code></td>
@ -548,12 +548,12 @@ to enable it. You can execute the following once:</p>
<tr> <tr>
<td><code>--log_caller &lt;string&gt;</code></td> <td><code>--log_caller &lt;string&gt;</code></td>
<td></td> <td></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td> <td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_output_level &lt;string&gt;</code></td> <td><code>--log_output_level &lt;string&gt;</code></td>
<td></td> <td></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td> <td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_rotate &lt;string&gt;</code></td> <td><code>--log_rotate &lt;string&gt;</code></td>
@ -578,7 +578,7 @@ to enable it. You can execute the following once:</p>
<tr> <tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td> <td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td></td> <td></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td> <td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_target &lt;stringArray&gt;</code></td> <td><code>--log_target &lt;stringArray&gt;</code></td>

154
content/en/docs/reference/config/annotations/index.html
View File

@ -913,160 +913,6 @@ Istio supports to control its behavior.
</tr> </tr>
</tbody> </tbody>
</table> </table>
<h2 id="TrafficExcludeInboundPorts">traffic.istio.io/excludeInboundPorts</h2>
<table class="annotations">
<tbody>
<tr>
<th>Name</th>
<td><code>traffic.istio.io/excludeInboundPorts</code></td>
</tr>
<tr>
<th>Feature Status</th>
<td>Alpha</td>
</tr>
<tr>
<th>Resource Types</th>
<td>[Pod]</td>
</tr>
<tr>
<th>Description</th>
<td><p>A comma separated list of inbound ports to be excluded from redirection to Envoy. Only applies when all inbound traffic (i.e. &lsquo;*&rsquo;) is being redirected.</p>
</td>
</tr>
</tbody>
</table>
<h2 id="TrafficExcludeInterfaces">traffic.istio.io/excludeInterfaces</h2>
<table class="annotations">
<tbody>
<tr>
<th>Name</th>
<td><code>traffic.istio.io/excludeInterfaces</code></td>
</tr>
<tr>
<th>Feature Status</th>
<td>Alpha</td>
</tr>
<tr>
<th>Resource Types</th>
<td>[Pod]</td>
</tr>
<tr>
<th>Description</th>
<td><p>A comma separated list of interfaces to be excluded from Istio traffic capture</p>
</td>
</tr>
</tbody>
</table>
<h2 id="TrafficExcludeOutboundIPRanges">traffic.istio.io/excludeOutboundIPRanges</h2>
<table class="annotations">
<tbody>
<tr>
<th>Name</th>
<td><code>traffic.istio.io/excludeOutboundIPRanges</code></td>
</tr>
<tr>
<th>Feature Status</th>
<td>Alpha</td>
</tr>
<tr>
<th>Resource Types</th>
<td>[Pod]</td>
</tr>
<tr>
<th>Description</th>
<td><p>A comma separated list of IP ranges in CIDR form to be excluded from redirection. Only applies when all outbound traffic (i.e. &lsquo;*&rsquo;) is being redirected.</p>
</td>
</tr>
</tbody>
</table>
<h2 id="TrafficExcludeOutboundPorts">traffic.istio.io/excludeOutboundPorts</h2>
<table class="annotations">
<tbody>
<tr>
<th>Name</th>
<td><code>traffic.istio.io/excludeOutboundPorts</code></td>
</tr>
<tr>
<th>Feature Status</th>
<td>Alpha</td>
</tr>
<tr>
<th>Resource Types</th>
<td>[Pod]</td>
</tr>
<tr>
<th>Description</th>
<td><p>A comma separated list of outbound ports to be excluded from redirection to Envoy.</p>
</td>
</tr>
</tbody>
</table>
<h2 id="TrafficIncludeInboundPorts">traffic.istio.io/includeInboundPorts</h2>
<table class="annotations">
<tbody>
<tr>
<th>Name</th>
<td><code>traffic.istio.io/includeInboundPorts</code></td>
</tr>
<tr>
<th>Feature Status</th>
<td>Alpha</td>
</tr>
<tr>
<th>Resource Types</th>
<td>[Pod]</td>
</tr>
<tr>
<th>Description</th>
<td><p>A comma separated list of inbound ports for which traffic is to be redirected to Envoy. The wildcard character &lsquo;*&rsquo; can be used to configure redirection for all ports. An empty list will disable all inbound redirection.</p>
</td>
</tr>
</tbody>
</table>
<h2 id="TrafficIncludeOutboundIPRanges">traffic.istio.io/includeOutboundIPRanges</h2>
<table class="annotations">
<tbody>
<tr>
<th>Name</th>
<td><code>traffic.istio.io/includeOutboundIPRanges</code></td>
</tr>
<tr>
<th>Feature Status</th>
<td>Alpha</td>
</tr>
<tr>
<th>Resource Types</th>
<td>[Pod]</td>
</tr>
<tr>
<th>Description</th>
<td><p>A comma separated list of IP ranges in CIDR form to redirect to Envoy (optional). The wildcard character &lsquo;*&rsquo; can be used to redirect all outbound traffic. An empty list will disable all outbound redirection.</p>
</td>
</tr>
</tbody>
</table>
<h2 id="TrafficIncludeOutboundPorts">traffic.istio.io/includeOutboundPorts</h2>
<table class="annotations">
<tbody>
<tr>
<th>Name</th>
<td><code>traffic.istio.io/includeOutboundPorts</code></td>
</tr>
<tr>
<th>Feature Status</th>
<td>Alpha</td>
</tr>
<tr>
<th>Resource Types</th>
<td>[Pod]</td>
</tr>
<tr>
<th>Description</th>
<td><p>A comma separated list of outbound ports for which traffic is to be redirected to Envoy, regardless of the destination IP.</p>
</td>
</tr>
</tbody>
</table>
<h2 id="TrafficNodeSelector">traffic.istio.io/nodeSelector</h2> <h2 id="TrafficNodeSelector">traffic.istio.io/nodeSelector</h2>
<table class="annotations"> <table class="annotations">
<tbody> <tbody>

2
content/en/docs/reference/config/istio.mesh.v1alpha1/index.html
View File

@ -3957,7 +3957,7 @@ No
<td><code>envoyDebugHeaders</code></td> <td><code>envoyDebugHeaders</code></td>
<td><code><a href="#ProxyConfig-ProxyHeaders-EnvoyDebugHeaders">EnvoyDebugHeaders</a></code></td> <td><code><a href="#ProxyConfig-ProxyHeaders-EnvoyDebugHeaders">EnvoyDebugHeaders</a></code></td>
<td> <td>
<p>Controls various <code>X-Envoy-*</code> headers, such as <code>X-Envoy-Overloaded</code> and `X-Envoy-Upstream-Service-Time. If enabled, <p>Controls various <code>X-Envoy-*</code> headers, such as <code>X-Envoy-Overloaded</code> and <code>X-Envoy-Upstream-Service-Time</code>. If enabled,
these headers will be included. these headers will be included.
If disabled, these headers will not be set. If they are already present, they will be preserved. If disabled, these headers will not be set. If they are already present, they will be preserved.
See the <a href="https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/router/v3/router.proto#envoy-v3-api-field-extensions-filters-http-router-v3-router-suppress-envoy-headers">Envoy documentation</a> for more details. See the <a href="https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/router/v3/router.proto#envoy-v3-api-field-extensions-filters-http-router-v3-router-suppress-envoy-headers">Envoy documentation</a> for more details.

24
content/en/docs/reference/config/networking/destination-rule/index.html
View File

@ -16,7 +16,7 @@ for load balancing, connection pool size from the sidecar, and outlier
detection settings to detect and evict unhealthy hosts from the load detection settings to detect and evict unhealthy hosts from the load
balancing pool. For example, a simple load balancing policy for the balancing pool. For example, a simple load balancing policy for the
ratings service would look as follows:</p> ratings service would look as follows:</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: bookinfo-ratings name: bookinfo-ratings
@ -31,7 +31,7 @@ spec:
following rule uses a round robin load balancing policy for all traffic following rule uses a round robin load balancing policy for all traffic
going to a subset named testversion that is composed of endpoints (e.g., going to a subset named testversion that is composed of endpoints (e.g.,
pods) with labels (version:v3).</p> pods) with labels (version:v3).</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: bookinfo-ratings name: bookinfo-ratings
@ -54,7 +54,7 @@ a route rule explicitly sends traffic to this subset.</p>
following rule uses the least connection load balancing policy for all following rule uses the least connection load balancing policy for all
traffic to port 80, while uses a round robin load balancing setting for traffic to port 80, while uses a round robin load balancing setting for
traffic to the port 9080.</p> traffic to the port 9080.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: bookinfo-ratings-port name: bookinfo-ratings-port
@ -74,7 +74,7 @@ spec:
<p>Destination Rules can be customized to specific workloads as well. <p>Destination Rules can be customized to specific workloads as well.
The following example shows how a destination rule can be applied to a The following example shows how a destination rule can be applied to a
specific workload using the workloadSelector configuration.</p> specific workload using the workloadSelector configuration.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: configure-client-mtls-dr-with-workloadselector name: configure-client-mtls-dr-with-workloadselector
@ -311,7 +311,7 @@ service-level can be overridden at a subset-level. The following rule
uses a round robin load balancing policy for all traffic going to a uses a round robin load balancing policy for all traffic going to a
subset named testversion that is composed of endpoints (e.g., pods) with subset named testversion that is composed of endpoints (e.g., pods) with
labels (version:v3).</p> labels (version:v3).</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: bookinfo-ratings name: bookinfo-ratings
@ -395,7 +395,7 @@ load balancing
for more details.</p> for more details.</p>
<p>For example, the following rule uses a round robin load balancing policy <p>For example, the following rule uses a round robin load balancing policy
for all traffic going to the ratings service.</p> for all traffic going to the ratings service.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: bookinfo-ratings name: bookinfo-ratings
@ -408,7 +408,7 @@ spec:
<p>The following example sets up sticky sessions for the ratings service <p>The following example sets up sticky sessions for the ratings service
hashing-based load balancer for the same ratings service using the hashing-based load balancer for the same ratings service using the
the User cookie as the hash key.</p> the User cookie as the hash key.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: bookinfo-ratings name: bookinfo-ratings
@ -492,7 +492,7 @@ for more details. Connection pool settings can be applied at the TCP
level as well as at HTTP level.</p> level as well as at HTTP level.</p>
<p>For example, the following rule sets a limit of 100 connections to redis <p>For example, the following rule sets a limit of 100 connections to redis
service called myredissrv with a connect timeout of 30ms</p> service called myredissrv with a connect timeout of 30ms</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: bookinfo-redis name: bookinfo-redis
@ -559,7 +559,7 @@ with no more than 10 req/connection to the &ldquo;reviews&rdquo; service. In add
it sets a limit of 1000 concurrent HTTP2 requests and configures upstream it sets a limit of 1000 concurrent HTTP2 requests and configures upstream
hosts to be scanned every 5 mins so that any host that fails 7 consecutive hosts to be scanned every 5 mins so that any host that fails 7 consecutive
times with a 502, 503, or 504 error code will be ejected for 15 minutes.</p> times with a 502, 503, or 504 error code will be ejected for 15 minutes.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: reviews-cb-policy name: reviews-cb-policy
@ -728,7 +728,7 @@ context</a>
for more details. These settings are common to both HTTP and TCP upstreams.</p> for more details. These settings are common to both HTTP and TCP upstreams.</p>
<p>For example, the following rule configures a client to use mutual TLS <p>For example, the following rule configures a client to use mutual TLS
for connections to upstream database cluster.</p> for connections to upstream database cluster.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: db-mtls name: db-mtls
@ -743,7 +743,7 @@ spec:
</code></pre> </code></pre>
<p>The following rule configures a client to use TLS when talking to a <p>The following rule configures a client to use TLS when talking to a
foreign service whose domain matches *.foo.com.</p> foreign service whose domain matches *.foo.com.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: tls-foo name: tls-foo
@ -755,7 +755,7 @@ spec:
</code></pre> </code></pre>
<p>The following rule configures a client to use Istio mutual TLS when talking <p>The following rule configures a client to use Istio mutual TLS when talking
to rating services.</p> to rating services.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: ratings-istio-mtls name: ratings-istio-mtls

7
content/en/docs/reference/config/networking/envoy-filter/index.html
View File

@ -389,12 +389,13 @@ No
<td><code>targetRefs</code></td> <td><code>targetRefs</code></td>
<td><code><a href="/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td> <td><code><a href="/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td>
<td> <td>
<p>Optional. The targetRef specifies the gateway the policy should be <p>Optional. The targetRefs specifies a list of resources the policy should be
applied to. The targeted resource specified will determine which applied to. The targeted resources specified will determine which workloads
workloads the policy applies to.</p> the policy applies to.</p>
<p>Currently, the following resource attachment types are supported:</p> <p>Currently, the following resource attachment types are supported:</p>
<ul> <ul>
<li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li> <li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li>
<li><code>kind: Service</code> with <code>&quot;&quot;</code> in the same namespace. This type is only supported for waypoints.</li>
</ul> </ul>
<p>If not set, the policy is applied as defined by the selector. <p>If not set, the policy is applied as defined by the selector.
At most one of the selector and targetRefs can be set.</p> At most one of the selector and targetRefs can be set.</p>

14
content/en/docs/reference/config/networking/gateway/index.html
View File

@ -20,7 +20,7 @@ as a load balancer exposing port 80 and 9080 (http), 443 (https),
applied to the proxy running on a pod with labels <code>app: my-gateway-controller</code>. While Istio will configure the proxy to listen applied to the proxy running on a pod with labels <code>app: my-gateway-controller</code>. While Istio will configure the proxy to listen
on these ports, it is the responsibility of the user to ensure that on these ports, it is the responsibility of the user to ensure that
external traffic to these ports are allowed into the mesh.</p> external traffic to these ports are allowed into the mesh.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Gateway kind: Gateway
metadata: metadata:
name: my-gateway name: my-gateway
@ -84,7 +84,7 @@ in the qa version. The same rule is also applicable inside the mesh for
requests to the &ldquo;reviews.prod.svc.cluster.local&rdquo; service. This rule is requests to the &ldquo;reviews.prod.svc.cluster.local&rdquo; service. This rule is
applicable across ports 443, 9080. Note that <code>http://uk.bookinfo.com</code> applicable across ports 443, 9080. Note that <code>http://uk.bookinfo.com</code>
gets redirected to <code>https://uk.bookinfo.com</code> (i.e. 80 redirects to 443).</p> gets redirected to <code>https://uk.bookinfo.com</code> (i.e. 80 redirects to 443).</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: bookinfo-rule name: bookinfo-rule
@ -124,7 +124,7 @@ spec:
port 27017 to internal Mongo server on port 5555. This rule is not port 27017 to internal Mongo server on port 5555. This rule is not
applicable internally in the mesh as the gateway list omits the applicable internally in the mesh as the gateway list omits the
reserved name <code>mesh</code>.</p> reserved name <code>mesh</code>.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: bookinfo-mongo name: bookinfo-mongo
@ -148,7 +148,7 @@ a gateway server using the namespace/hostname syntax in the hosts field.
For example, the following Gateway allows any virtual service in the ns1 For example, the following Gateway allows any virtual service in the ns1
namespace to bind to it, while restricting only the virtual service with namespace to bind to it, while restricting only the virtual service with
foo.bar.com host in the ns2 namespace to bind to it.</p> foo.bar.com host in the ns2 namespace to bind to it.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Gateway kind: Gateway
metadata: metadata:
name: my-gateway name: my-gateway
@ -221,7 +221,7 @@ No
<section> <section>
<p><code>Server</code> describes the properties of the proxy on a given load balancer <p><code>Server</code> describes the properties of the proxy on a given load balancer
port. For example,</p> port. For example,</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Gateway kind: Gateway
metadata: metadata:
name: my-ingress name: my-ingress
@ -237,7 +237,7 @@ spec:
- &quot;*&quot; - &quot;*&quot;
</code></pre> </code></pre>
<p>Another example</p> <p>Another example</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Gateway kind: Gateway
metadata: metadata:
name: my-tcp-ingress name: my-tcp-ingress
@ -253,7 +253,7 @@ spec:
- &quot;*&quot; - &quot;*&quot;
</code></pre> </code></pre>
<p>The following is an example of TLS configuration for port 443</p> <p>The following is an example of TLS configuration for port 443</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Gateway kind: Gateway
metadata: metadata:
name: my-tls-ingress name: my-tls-ingress

30
content/en/docs/reference/config/networking/service-entry/index.html
View File

@ -28,7 +28,7 @@ services.</p>
<p>The following example declares a few external APIs accessed by internal <p>The following example declares a few external APIs accessed by internal
applications over HTTPS. The sidecar inspects the SNI value in the applications over HTTPS. The sidecar inspects the SNI value in the
ClientHello message to route to the appropriate external service.</p> ClientHello message to route to the appropriate external service.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-https name: external-svc-https
@ -48,7 +48,7 @@ spec:
unmanaged VMs to Istio&rsquo;s registry, so that these services can be treated unmanaged VMs to Istio&rsquo;s registry, so that these services can be treated
as any other service in the mesh. The associated DestinationRule is used as any other service in the mesh. The associated DestinationRule is used
to initiate mTLS connections to the database instances.</p> to initiate mTLS connections to the database instances.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-mongocluster name: external-svc-mongocluster
@ -68,7 +68,7 @@ spec:
- address: 3.3.3.3 - address: 3.3.3.3
</code></pre> </code></pre>
<p>and the associated DestinationRule</p> <p>and the associated DestinationRule</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: mtls-mongocluster name: mtls-mongocluster
@ -84,7 +84,7 @@ spec:
<p>The following example uses a combination of service entry and TLS <p>The following example uses a combination of service entry and TLS
routing in a virtual service to steer traffic based on the SNI value to routing in a virtual service to steer traffic based on the SNI value to
an internal egress firewall.</p> an internal egress firewall.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-redirect name: external-svc-redirect
@ -100,7 +100,7 @@ spec:
resolution: NONE resolution: NONE
</code></pre> </code></pre>
<p>And the associated VirtualService to route based on the SNI value.</p> <p>And the associated VirtualService to route based on the SNI value.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: tls-routing name: tls-routing
@ -127,7 +127,7 @@ declaration to other namespaces in the mesh. By default, a service is exported
to all namespaces. The following example restricts the visibility to the to all namespaces. The following example restricts the visibility to the
current namespace, represented by &ldquo;.&rdquo;, so that it cannot be used by other current namespace, represented by &ldquo;.&rdquo;, so that it cannot be used by other
namespaces.</p> namespaces.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-httpbin name: external-svc-httpbin
@ -145,7 +145,7 @@ spec:
resolution: DNS resolution: DNS
</code></pre> </code></pre>
<p>Define a gateway to handle all egress traffic.</p> <p>Define a gateway to handle all egress traffic.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Gateway kind: Gateway
metadata: metadata:
name: istio-egressgateway name: istio-egressgateway
@ -167,7 +167,7 @@ well as route from the gateway to the external service. Note that the
virtual service is exported to all namespaces enabling them to route traffic virtual service is exported to all namespaces enabling them to route traffic
through the gateway to the external service. Forcing traffic to go through through the gateway to the external service. Forcing traffic to go through
a managed middle proxy like this is a common practice.</p> a managed middle proxy like this is a common practice.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: gateway-routing name: gateway-routing
@ -200,7 +200,7 @@ spec:
external services. If the connection has to be routed to the IP address external services. If the connection has to be routed to the IP address
requested by the application (i.e. application resolves DNS and attempts requested by the application (i.e. application resolves DNS and attempts
to connect to a specific IP), the resolution mode must be set to <code>NONE</code>.</p> to connect to a specific IP), the resolution mode must be set to <code>NONE</code>.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-wildcard-example name: external-svc-wildcard-example
@ -217,7 +217,7 @@ spec:
<p>The following example demonstrates a service that is available via a <p>The following example demonstrates a service that is available via a
Unix Domain Socket on the host of the client. The resolution must be Unix Domain Socket on the host of the client. The resolution must be
set to STATIC to use Unix address endpoints.</p> set to STATIC to use Unix address endpoints.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: unix-domain-socket-example name: unix-domain-socket-example
@ -240,7 +240,7 @@ reroute API calls for the <code>VirtualService</code> to a chosen backend. For
example, the following configuration creates a non-existent external example, the following configuration creates a non-existent external
service called foo.bar.com backed by three domains: us.foo.bar.com:8080, service called foo.bar.com backed by three domains: us.foo.bar.com:8080,
uk.foo.bar.com:9080, and in.foo.bar.com:7080</p> uk.foo.bar.com:9080, and in.foo.bar.com:7080</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-dns name: external-svc-dns
@ -271,7 +271,7 @@ be translated to <code>http://uk.foo.bar.com/baz</code>.</p>
<p>The following example illustrates the usage of a <code>ServiceEntry</code> <p>The following example illustrates the usage of a <code>ServiceEntry</code>
containing a subject alternate name containing a subject alternate name
whose format conforms to the <a href="https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md">SPIFFE standard</a>:</p> whose format conforms to the <a href="https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md">SPIFFE standard</a>:</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: httpbin name: httpbin
@ -298,7 +298,7 @@ VM-based instances with sidecars as well as a set of Kubernetes
pods managed by a standard deployment object. Consumers of this pods managed by a standard deployment object. Consumers of this
service in the mesh will be automatically load balanced across the service in the mesh will be automatically load balanced across the
VMs and Kubernetes.</p> VMs and Kubernetes.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: WorkloadEntry kind: WorkloadEntry
metadata: metadata:
name: details-vm-1 name: details-vm-1
@ -309,7 +309,7 @@ spec:
app: details app: details
instance-id: vm1 instance-id: vm1
--- ---
apiVersion: networking.istio.io/v1beta1 apiVersion: networking.istio.io/v1
kind: WorkloadEntry kind: WorkloadEntry
metadata: metadata:
name: details-vm-2 name: details-vm-2
@ -324,7 +324,7 @@ spec:
<code>app: details</code> using the same service account <code>details</code>, the <code>app: details</code> using the same service account <code>details</code>, the
following service entry declares a service spanning both VMs and following service entry declares a service spanning both VMs and
Kubernetes:</p> Kubernetes:</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: details-svc name: details-svc

18
content/en/docs/reference/config/networking/sidecar/index.html
View File

@ -48,7 +48,7 @@ in the root namespace called <code>istio-config</code>, that configures
sidecars in all namespaces to allow egress traffic only to other sidecars in all namespaces to allow egress traffic only to other
workloads in the same namespace as well as to services in the workloads in the same namespace as well as to services in the
<code>istio-system</code> namespace.</p> <code>istio-system</code> namespace.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Sidecar kind: Sidecar
metadata: metadata:
name: default name: default
@ -64,7 +64,7 @@ spec:
above, and configures the sidecars in the namespace to allow egress above, and configures the sidecars in the namespace to allow egress
traffic to public services in the <code>prod-us1</code>, <code>prod-apis</code>, and the traffic to public services in the <code>prod-us1</code>, <code>prod-apis</code>, and the
<code>istio-system</code> namespaces.</p> <code>istio-system</code> namespaces.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Sidecar kind: Sidecar
metadata: metadata:
name: default name: default
@ -84,7 +84,7 @@ the attached workload instance listening on a Unix domain
socket. In the egress direction, in addition to the <code>istio-system</code> socket. In the egress direction, in addition to the <code>istio-system</code>
namespace, the sidecar proxies only HTTP traffic bound for port namespace, the sidecar proxies only HTTP traffic bound for port
9080 for services in the <code>prod-us1</code> namespace.</p> 9080 for services in the <code>prod-us1</code> namespace.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Sidecar kind: Sidecar
metadata: metadata:
name: ratings name: ratings
@ -123,7 +123,7 @@ it to the application listening on <code>127.0.0.1:8080</code>. It also allows
the application to communicate with a backing MySQL database on the application to communicate with a backing MySQL database on
<code>127.0.0.1:3306</code>, that then gets proxied to the externally hosted <code>127.0.0.1:3306</code>, that then gets proxied to the externally hosted
MySQL service at <code>mysql.foo.com:3306</code>.</p> MySQL service at <code>mysql.foo.com:3306</code>.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Sidecar kind: Sidecar
metadata: metadata:
name: no-ip-tables name: no-ip-tables
@ -150,7 +150,7 @@ spec:
- &quot;*/mysql.foo.com&quot; - &quot;*/mysql.foo.com&quot;
</code></pre> </code></pre>
<p>And the associated service entry for routing to <code>mysql.foo.com:3306</code></p> <p>And the associated service entry for routing to <code>mysql.foo.com:3306</code></p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-mysql name: external-svc-mysql
@ -176,7 +176,7 @@ listener on <code>172.16.1.32:80</code> (the VM&rsquo;s IP) for traffic arriving
<p><strong>NOTE</strong>: The <code>ISTIO_META_INTERCEPTION_MODE</code> metadata on the <p><strong>NOTE</strong>: The <code>ISTIO_META_INTERCEPTION_MODE</code> metadata on the
proxy in the VM should contain <code>REDIRECT</code> or <code>TPROXY</code> as its value, proxy in the VM should contain <code>REDIRECT</code> or <code>TPROXY</code> as its value,
implying that IP tables based traffic capture is active.</p> implying that IP tables based traffic capture is active.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Sidecar kind: Sidecar
metadata: metadata:
name: partial-ip-tables name: partial-ip-tables
@ -214,7 +214,7 @@ in order to set mTLS mode to &ldquo;DISABLE&rdquo; on specific
ports. ports.
In this example, the mTLS mode is disabled on PORT 80. In this example, the mTLS mode is disabled on PORT 80.
This feature is currently experimental.</p> This feature is currently experimental.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Sidecar kind: Sidecar
metadata: metadata:
name: ratings name: ratings
@ -249,7 +249,7 @@ spec:
selector: selector:
app: ratings app: ratings
--- ---
apiVersion: security.istio.io/v1beta1 apiVersion: security.istio.io/v1
kind: PeerAuthentication kind: PeerAuthentication
metadata: metadata:
name: ratings-peer-auth name: ratings-peer-auth
@ -271,7 +271,7 @@ connections to the service) as well as servers (for inbound connections to a ser
instance). Using the <code>InboundConnectionPool</code> and per-port <code>ConnectionPool</code> settings instance). Using the <code>InboundConnectionPool</code> and per-port <code>ConnectionPool</code> settings
in a <code>Sidecar</code> allow you to control those connection pools for the server separately in a <code>Sidecar</code> allow you to control those connection pools for the server separately
from the settings pushed to all clients.</p> from the settings pushed to all clients.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Sidecar kind: Sidecar
metadata: metadata:
name: connection-pool-settings name: connection-pool-settings

52
content/en/docs/reference/config/networking/virtual-service/index.html
View File

@ -43,7 +43,7 @@ to be customized for specific client contexts.</p>
pods of the reviews service with label &ldquo;version: v1&rdquo;. In addition, pods of the reviews service with label &ldquo;version: v1&rdquo;. In addition,
HTTP requests with path starting with /wpcatalog/ or /consumercatalog/ will HTTP requests with path starting with /wpcatalog/ or /consumercatalog/ will
be rewritten to /newcatalog and sent to pods with label &ldquo;version: v2&rdquo;.</p> be rewritten to /newcatalog and sent to pods with label &ldquo;version: v2&rdquo;.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: reviews-route name: reviews-route
@ -72,7 +72,7 @@ spec:
<p>A subset/version of a route destination is identified with a reference <p>A subset/version of a route destination is identified with a reference
to a named service subset which must be declared in a corresponding to a named service subset which must be declared in a corresponding
<code>DestinationRule</code>.</p> <code>DestinationRule</code>.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: reviews-destination name: reviews-destination
@ -249,7 +249,7 @@ domain names over short names.</em></p>
<p>The following Kubernetes example routes all traffic by default to pods <p>The following Kubernetes example routes all traffic by default to pods
of the reviews service with label &ldquo;version: v1&rdquo; (i.e., subset v1), and of the reviews service with label &ldquo;version: v1&rdquo; (i.e., subset v1), and
some to subset v2, in a Kubernetes environment.</p> some to subset v2, in a Kubernetes environment.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: reviews-route name: reviews-route
@ -275,7 +275,7 @@ spec:
subset: v1 subset: v1
</code></pre> </code></pre>
<p>And the associated DestinationRule</p> <p>And the associated DestinationRule</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: reviews-destination name: reviews-destination
@ -299,7 +299,7 @@ that this rule is set in the istio-system namespace but uses the fully
qualified domain name of the productpage service, qualified domain name of the productpage service,
productpage.prod.svc.cluster.local. Therefore the rule&rsquo;s namespace does productpage.prod.svc.cluster.local. Therefore the rule&rsquo;s namespace does
not have an impact in resolving the name of the productpage service.</p> not have an impact in resolving the name of the productpage service.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: my-productpage-rule name: my-productpage-rule
@ -318,7 +318,7 @@ services must first be added to Istio&rsquo;s internal service registry using th
ServiceEntry resource. VirtualServices can then be defined to control traffic ServiceEntry resource. VirtualServices can then be defined to control traffic
bound to these external services. For example, the following rules define a bound to these external services. For example, the following rules define a
Service for wikipedia.org and set a timeout of 5s for HTTP requests.</p> Service for wikipedia.org and set a timeout of 5s for HTTP requests.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-wikipedia name: external-svc-wikipedia
@ -332,7 +332,7 @@ spec:
protocol: HTTP protocol: HTTP
resolution: DNS resolution: DNS
--- ---
apiVersion: networking.istio.io/v1beta1 apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: my-wiki-rule name: my-wiki-rule
@ -638,7 +638,7 @@ No
<p>Describes the delegate VirtualService. <p>Describes the delegate VirtualService.
The following routing rules forward the traffic to <code>/productpage</code> by a delegate VirtualService named <code>productpage</code>, The following routing rules forward the traffic to <code>/productpage</code> by a delegate VirtualService named <code>productpage</code>,
forward the traffic to <code>/reviews</code> by a delegate VirtualService named <code>reviews</code>.</p> forward the traffic to <code>/reviews</code> by a delegate VirtualService named <code>reviews</code>.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: bookinfo name: bookinfo
@ -661,7 +661,7 @@ spec:
name: reviews name: reviews
namespace: nsB namespace: nsB
</code></pre> </code></pre>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: productpage name: productpage
@ -678,7 +678,7 @@ spec:
- destination: - destination:
host: productpage.nsA.svc.cluster.local host: productpage.nsA.svc.cluster.local
</code></pre> </code></pre>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: reviews name: reviews
@ -735,7 +735,7 @@ The following VirtualService adds a <code>test</code> header with the value <cod
to requests that are routed to any <code>reviews</code> service destination. to requests that are routed to any <code>reviews</code> service destination.
It also removes the <code>foo</code> response header, but only from responses It also removes the <code>foo</code> response header, but only from responses
coming from the <code>v1</code> subset (version) of the <code>reviews</code> service.</p> coming from the <code>v1</code> subset (version) of the <code>reviews</code> service.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: reviews-route name: reviews-route
@ -805,7 +805,7 @@ No
traffic (TLS/HTTPS) The following routing rule forwards unterminated TLS traffic (TLS/HTTPS) The following routing rule forwards unterminated TLS
traffic arriving at port 443 of gateway called &ldquo;mygateway&rdquo; to internal traffic arriving at port 443 of gateway called &ldquo;mygateway&rdquo; to internal
services in the mesh based on the SNI value.</p> services in the mesh based on the SNI value.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: bookinfo-sni name: bookinfo-sni
@ -874,7 +874,7 @@ No
<p>Describes match conditions and actions for routing TCP traffic. The <p>Describes match conditions and actions for routing TCP traffic. The
following routing rule forwards traffic arriving at port 27017 for following routing rule forwards traffic arriving at port 27017 for
mongo.prod.svc.cluster.local to another Mongo server on port 5555.</p> mongo.prod.svc.cluster.local to another Mongo server on port 5555.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: bookinfo-mongo name: bookinfo-mongo
@ -936,7 +936,7 @@ rule to be applied to the HTTP request. For example, the following
restricts the rule to match only requests where the URL path restricts the rule to match only requests where the URL path
starts with /ratings/v2/ and the request contains a custom <code>end-user</code> header starts with /ratings/v2/ and the request contains a custom <code>end-user</code> header
with value <code>jason</code>.</p> with value <code>jason</code>.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -1246,7 +1246,7 @@ determine the proportion of traffic it receives. For example, the
following rule will route 25% of traffic for the &ldquo;reviews&rdquo; service to following rule will route 25% of traffic for the &ldquo;reviews&rdquo; service to
instances with the &ldquo;v2&rdquo; tag and the remaining traffic (i.e., 75%) to instances with the &ldquo;v2&rdquo; tag and the remaining traffic (i.e., 75%) to
&ldquo;v1&rdquo;.</p> &ldquo;v1&rdquo;.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: reviews-route name: reviews-route
@ -1265,7 +1265,7 @@ spec:
weight: 75 weight: 75
</code></pre> </code></pre>
<p>And the associated DestinationRule</p> <p>And the associated DestinationRule</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: reviews-destination name: reviews-destination
@ -1282,7 +1282,7 @@ spec:
<p>Traffic can also be split across two entirely different services without <p>Traffic can also be split across two entirely different services without
having to define new subsets. For example, the following rule forwards 25% of having to define new subsets. For example, the following rule forwards 25% of
traffic to reviews.com to dev.reviews.com</p> traffic to reviews.com to dev.reviews.com</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: reviews-route-two-domains name: reviews-route-two-domains
@ -1577,7 +1577,7 @@ where the Authority/Host and the URI in the response can be swapped with
the specified values. For example, the following rule redirects the specified values. For example, the following rule redirects
requests for /v1/getProductRatings API on the ratings service to requests for /v1/getProductRatings API on the ratings service to
/v1/bookRatings provided by the bookratings service.</p> /v1/bookRatings provided by the bookratings service.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -1689,7 +1689,7 @@ No
<p>HTTPDirectResponse can be used to send a fixed response to clients. <p>HTTPDirectResponse can be used to send a fixed response to clients.
For example, the following rule returns a fixed 503 status with a body For example, the following rule returns a fixed 503 status with a body
to requests for /v1/getProductRatings API.</p> to requests for /v1/getProductRatings API.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -1708,7 +1708,7 @@ spec:
</code></pre> </code></pre>
<p>It is also possible to specify a binary response body. <p>It is also possible to specify a binary response body.
This is mostly useful for non text-based protocols such as gRPC.</p> This is mostly useful for non text-based protocols such as gRPC.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -1728,7 +1728,7 @@ spec:
<p>It is good practice to add headers in the HTTPRoute <p>It is good practice to add headers in the HTTPRoute
as well as the direct_response, for example to specify as well as the direct_response, for example to specify
the returned Content-Type.</p> the returned Content-Type.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -1830,7 +1830,7 @@ before forwarding the request to the destination. Rewrite primitive can
be used only with HTTPRouteDestination. The following example be used only with HTTPRouteDestination. The following example
demonstrates how to rewrite the URL prefix for api call (/ratings) to demonstrates how to rewrite the URL prefix for api call (/ratings) to
ratings service before making the actual API call.</p> ratings service before making the actual API call.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -2000,7 +2000,7 @@ example, the following rule sets the maximum number of retries to 3 when
calling ratings:v1 service, with a 2s timeout per retry attempt. calling ratings:v1 service, with a 2s timeout per retry attempt.
A retry will be attempted if there is a connect-failure, refused_stream A retry will be attempted if there is a connect-failure, refused_stream
or when the upstream server responds with Service Unavailable(503).</p> or when the upstream server responds with Service Unavailable(503).</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -2097,7 +2097,7 @@ the following rule restricts cross origin requests to those originating
from example.com domain using HTTP POST/GET, and sets the from example.com domain using HTTP POST/GET, and sets the
<code>Access-Control-Allow-Credentials</code> header to false. In addition, it only <code>Access-Control-Allow-Credentials</code> header to false. In addition, it only
exposes <code>X-Foo-bar</code> header and sets an expiry period of 1 day.</p> exposes <code>X-Foo-bar</code> header and sets an expiry period of 1 day.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -2413,7 +2413,7 @@ No
forwarding path. The following example will introduce a 5 second delay forwarding path. The following example will introduce a 5 second delay
in 1 out of every 1000 requests to the &ldquo;v1&rdquo; version of the &ldquo;reviews&rdquo; in 1 out of every 1000 requests to the &ldquo;v1&rdquo; version of the &ldquo;reviews&rdquo;
service from all pods with label env: prod</p> service from all pods with label env: prod</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: reviews-route name: reviews-route
@ -2493,7 +2493,7 @@ No
<p>Abort specification is used to prematurely abort a request with a <p>Abort specification is used to prematurely abort a request with a
pre-specified error code. The following example will return an HTTP 400 pre-specified error code. The following example will return an HTTP 400
error code for 1 out of every 1000 requests to the &ldquo;ratings&rdquo; service &ldquo;v1&rdquo;.</p> error code for 1 out of every 1000 requests to the &ldquo;ratings&rdquo; service &ldquo;v1&rdquo;.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route

10
content/en/docs/reference/config/networking/workload-entry/index.html
View File

@ -30,7 +30,7 @@ account. The service is exposed on port 80 to applications in the
mesh. The HTTP traffic to this service is wrapped in Istio mutual mesh. The HTTP traffic to this service is wrapped in Istio mutual
TLS and sent to sidecars on VMs on target port 8080, that in turn TLS and sent to sidecars on VMs on target port 8080, that in turn
forward it to the application on localhost on the same port.</p> forward it to the application on localhost on the same port.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: WorkloadEntry kind: WorkloadEntry
metadata: metadata:
name: details-svc name: details-svc
@ -46,7 +46,7 @@ spec:
instance-id: vm1 instance-id: vm1
</code></pre> </code></pre>
<p>and the associated service entry</p> <p>and the associated service entry</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: details-svc name: details-svc
@ -69,7 +69,7 @@ its fully qualified DNS name. The service entry&rsquo;s resolution
mode should be changed to DNS to indicate that the client-side mode should be changed to DNS to indicate that the client-side
sidecars should dynamically resolve the DNS name at runtime before sidecars should dynamically resolve the DNS name at runtime before
forwarding the request.</p> forwarding the request.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: WorkloadEntry kind: WorkloadEntry
metadata: metadata:
name: details-svc name: details-svc
@ -85,7 +85,7 @@ spec:
instance-id: vm1 instance-id: vm1
</code></pre> </code></pre>
<p>and the associated service entry</p> <p>and the associated service entry</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: details-svc name: details-svc
@ -109,7 +109,7 @@ to write a <code>WorkloadEntry</code> in the local cluster that represents
the Workload(s) in the remote network with the given labels. A the Workload(s) in the remote network with the given labels. A
single <code>WorkloadEntry</code> with weights represent the aggregate of all single <code>WorkloadEntry</code> with weights represent the aggregate of all
the actual workloads in a given remote network.</p> the actual workloads in a given remote network.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: WorkloadEntry kind: WorkloadEntry
metadata: metadata:
name: foo-workloads-cluster-2 name: foo-workloads-cluster-2

2
content/en/docs/reference/config/networking/workload-group/index.html
View File

@ -22,7 +22,7 @@ of workloads that will be registered under <code>reviews</code> in namespace
instance during the bootstrap process, and the ports 3550 and 8080 instance during the bootstrap process, and the ports 3550 and 8080
will be associated with the workload group and use service account <code>default</code>. will be associated with the workload group and use service account <code>default</code>.
<code>app.kubernetes.io/version</code> is just an arbitrary example of a label.</p> <code>app.kubernetes.io/version</code> is just an arbitrary example of a label.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: WorkloadGroup kind: WorkloadGroup
metadata: metadata:
name: reviews name: reviews

7
content/en/docs/reference/config/proxy_extensions/wasm-plugin/index.html
View File

@ -205,12 +205,13 @@ No
<td><code>targetRefs</code></td> <td><code>targetRefs</code></td>
<td><code><a href="/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td> <td><code><a href="/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td>
<td> <td>
<p>Optional. The targetRef specifies the gateway the policy should be <p>Optional. The targetRefs specifies a list of resources the policy should be
applied to. The targeted resource specified will determine which applied to. The targeted resources specified will determine which workloads
workloads the policy applies to.</p> the policy applies to.</p>
<p>Currently, the following resource attachment types are supported:</p> <p>Currently, the following resource attachment types are supported:</p>
<ul> <ul>
<li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li> <li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li>
<li><code>kind: Service</code> with <code>&quot;&quot;</code> in the same namespace. This type is only supported for waypoints.</li>
</ul> </ul>
<p>If not set, the policy is applied as defined by the selector. <p>If not set, the policy is applied as defined by the selector.
At most one of the selector and targetRefs can be set.</p> At most one of the selector and targetRefs can be set.</p>

13
content/en/docs/reference/config/security/authorization-policy/index.html
View File

@ -230,12 +230,13 @@ No
<td><code>targetRefs</code></td> <td><code>targetRefs</code></td>
<td><code><a href="/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td> <td><code><a href="/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td>
<td> <td>
<p>Optional. The targetRef specifies the gateway the policy should be <p>Optional. The targetRefs specifies a list of resources the policy should be
applied to. The targeted resource specified will determine which applied to. The targeted resources specified will determine which workloads
workloads the policy applies to.</p> the policy applies to.</p>
<p>Currently, the following resource attachment types are supported:</p> <p>Currently, the following resource attachment types are supported:</p>
<ul> <ul>
<li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li> <li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li>
<li><code>kind: Service</code> with <code>&quot;&quot;</code> in the same namespace. This type is only supported for waypoints.</li>
</ul> </ul>
<p>If not set, the policy is applied as defined by the selector. <p>If not set, the policy is applied as defined by the selector.
At most one of the selector and targetRefs can be set.</p> At most one of the selector and targetRefs can be set.</p>
@ -611,8 +612,8 @@ To be a valid path template, the path must not contain <code>*</code>, <code>{</
<li><code>/foo/{*}</code> matches <code>/foo/bar</code> but not <code>/foo/bar/baz</code></li> <li><code>/foo/{*}</code> matches <code>/foo/bar</code> but not <code>/foo/bar/baz</code></li>
<li><code>/foo/{**}/</code> matches <code>/foo/bar/</code>, <code>/foo/bar/baz.txt</code>, and <code>/foo//</code> but not <code>/foo/bar</code></li> <li><code>/foo/{**}/</code> matches <code>/foo/bar/</code>, <code>/foo/bar/baz.txt</code>, and <code>/foo//</code> but not <code>/foo/bar</code></li>
<li><code>/foo/{*}/bar/{**}</code> matches <code>/foo/buzz/bar/</code> and <code>/foo/buzz/bar/baz</code></li> <li><code>/foo/{*}/bar/{**}</code> matches <code>/foo/buzz/bar/</code> and <code>/foo/buzz/bar/baz</code></li>
<li><code>/*/baz/{*}`` is not a valid path template since it includes </code>*` outside of a supported operator</li> <li><code>/*/baz/{*}</code> is not a valid path template since it includes <code>*</code> outside of a supported operator</li>
<li><code>/**/baz/{*}`` is not a valid path template since it includes </code>**` outside of a supported operator</li> <li><code>/**/baz/{*}</code> is not a valid path template since it includes <code>**</code> outside of a supported operator</li>
<li><code>/{**}/foo/{*}</code> is not a valid path template since <code>{**}</code> is not the last operator</li> <li><code>/{**}/foo/{*}</code> is not a valid path template since <code>{**}</code> is not the last operator</li>
<li><code>/foo/{*}.txt</code> is invalid since there are characters other than <code>{*}</code> in the path segment</li> <li><code>/foo/{*}.txt</code> is invalid since there are characters other than <code>{*}</code> in the path segment</li>
</ul> </ul>
@ -819,7 +820,7 @@ One example use case of the extension is to integrate with a custom external aut
the authorization decision to it.</p> the authorization decision to it.</p>
<p>The following authorization policy applies to an ingress gateway and delegates the authorization check to a named extension <p>The following authorization policy applies to an ingress gateway and delegates the authorization check to a named extension
<code>my-custom-authz</code> if the request path has prefix <code>/admin/</code>.</p> <code>my-custom-authz</code> if the request path has prefix <code>/admin/</code>.</p>
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: security.istio.io/v1
kind: AuthorizationPolicy kind: AuthorizationPolicy
metadata: metadata:
name: ext-authz name: ext-authz

10
content/en/docs/reference/config/security/peer_authentication/index.html
View File

@ -18,7 +18,7 @@ Development of PeerAuthentication is currently frozen and likely to be replaced
PeerAuthentication defines how traffic will be tunneled (or not) to the sidecar.</p> PeerAuthentication defines how traffic will be tunneled (or not) to the sidecar.</p>
<p>Examples:</p> <p>Examples:</p>
<p>Policy to allow mTLS traffic for all workloads under namespace <code>foo</code>:</p> <p>Policy to allow mTLS traffic for all workloads under namespace <code>foo</code>:</p>
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: security.istio.io/v1
kind: PeerAuthentication kind: PeerAuthentication
metadata: metadata:
name: default name: default
@ -30,7 +30,7 @@ spec:
<p>For mesh level, put the policy in root-namespace according to your Istio installation.</p> <p>For mesh level, put the policy in root-namespace according to your Istio installation.</p>
<p>Policies to allow both mTLS and plaintext traffic for all workloads under namespace <code>foo</code>, but <p>Policies to allow both mTLS and plaintext traffic for all workloads under namespace <code>foo</code>, but
require mTLS for workload <code>finance</code>.</p> require mTLS for workload <code>finance</code>.</p>
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: security.istio.io/v1
kind: PeerAuthentication kind: PeerAuthentication
metadata: metadata:
name: default name: default
@ -39,7 +39,7 @@ spec:
mtls: mtls:
mode: PERMISSIVE mode: PERMISSIVE
--- ---
apiVersion: security.istio.io/v1beta1 apiVersion: security.istio.io/v1
kind: PeerAuthentication kind: PeerAuthentication
metadata: metadata:
name: finance name: finance
@ -54,7 +54,7 @@ spec:
<p>Policy that enables strict mTLS for all <code>finance</code> workloads, but leaves the port <code>8080</code> to <p>Policy that enables strict mTLS for all <code>finance</code> workloads, but leaves the port <code>8080</code> to
plaintext. Note the port value in the <code>portLevelMtls</code> field refers to the port plaintext. Note the port value in the <code>portLevelMtls</code> field refers to the port
of the workload, not the port of the Kubernetes service.</p> of the workload, not the port of the Kubernetes service.</p>
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: security.istio.io/v1
kind: PeerAuthentication kind: PeerAuthentication
metadata: metadata:
name: default name: default
@ -71,7 +71,7 @@ spec:
</code></pre> </code></pre>
<p>Policy that inherits mTLS mode from namespace (or mesh) settings, and disables <p>Policy that inherits mTLS mode from namespace (or mesh) settings, and disables
mTLS for workload port <code>8080</code>.</p> mTLS for workload port <code>8080</code>.</p>
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: security.istio.io/v1
kind: PeerAuthentication kind: PeerAuthentication
metadata: metadata:
name: default name: default

9
content/en/docs/reference/config/security/request_authentication/index.html
View File

@ -179,7 +179,7 @@ spec:
- source: - source:
requestPrincipals: [&quot;*&quot;] requestPrincipals: [&quot;*&quot;]
--- ---
apiVersion: networking.istio.io/v1alpha3 apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: route-jwt name: route-jwt
@ -234,12 +234,13 @@ No
<td><code>targetRefs</code></td> <td><code>targetRefs</code></td>
<td><code><a href="/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td> <td><code><a href="/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td>
<td> <td>
<p>Optional. The targetRef specifies the gateway the policy should be <p>Optional. The targetRefs specifies a list of resources the policy should be
applied to. The targeted resource specified will determine which applied to. The targeted resources specified will determine which workloads
workloads the policy applies to.</p> the policy applies to.</p>
<p>Currently, the following resource attachment types are supported:</p> <p>Currently, the following resource attachment types are supported:</p>
<ul> <ul>
<li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li> <li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li>
<li><code>kind: Service</code> with <code>&quot;&quot;</code> in the same namespace. This type is only supported for waypoints.</li>
</ul> </ul>
<p>If not set, the policy is applied as defined by the selector. <p>If not set, the policy is applied as defined by the selector.
At most one of the selector and targetRefs can be set.</p> At most one of the selector and targetRefs can be set.</p>

27
content/en/docs/reference/config/telemetry/index.html
View File

@ -25,7 +25,7 @@ selecting any given workload.</p>
</ol> </ol>
<h4 id="examples">Examples</h4> <h4 id="examples">Examples</h4>
<p>Policy to enable random sampling for 10% of traffic:</p> <p>Policy to enable random sampling for 10% of traffic:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: mesh-default name: mesh-default
@ -37,7 +37,7 @@ spec:
</code></pre> </code></pre>
<p>Policy to disable trace reporting for the <code>foo</code> workload (note: tracing <p>Policy to disable trace reporting for the <code>foo</code> workload (note: tracing
context will still be propagated):</p> context will still be propagated):</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: foo-tracing name: foo-tracing
@ -50,7 +50,7 @@ spec:
- disableSpanReporting: true - disableSpanReporting: true
</code></pre> </code></pre>
<p>Policy to select the alternate zipkin provider for trace reporting:</p> <p>Policy to select the alternate zipkin provider for trace reporting:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: foo-tracing-alternate name: foo-tracing-alternate
@ -65,7 +65,7 @@ spec:
randomSamplingPercentage: 10.00 randomSamplingPercentage: 10.00
</code></pre> </code></pre>
<p>Policy to tailor the zipkin provider to sample traces from Client workloads only:</p> <p>Policy to tailor the zipkin provider to sample traces from Client workloads only:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: mesh-default name: mesh-default
@ -78,7 +78,7 @@ spec:
- name: &quot;zipkin&quot; - name: &quot;zipkin&quot;
</code></pre> </code></pre>
<p>Policy to add a custom tag from a literal value:</p> <p>Policy to add a custom tag from a literal value:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: mesh-default name: mesh-default
@ -93,7 +93,7 @@ spec:
value: &quot;foo&quot; value: &quot;foo&quot;
</code></pre> </code></pre>
<p>Policy to disable server-side metrics for Prometheus for an entire mesh:</p> <p>Policy to disable server-side metrics for Prometheus for an entire mesh:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: mesh-default name: mesh-default
@ -110,7 +110,7 @@ spec:
disabled: true disabled: true
</code></pre> </code></pre>
<p>Policy to add dimensions to all Prometheus metrics for the <code>foo</code> namespace:</p> <p>Policy to add dimensions to all Prometheus metrics for the <code>foo</code> namespace:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: namespace-metrics name: namespace-metrics
@ -130,7 +130,7 @@ spec:
</code></pre> </code></pre>
<p>Policy to remove the <code>response_code</code> dimension on some Prometheus metrics for <p>Policy to remove the <code>response_code</code> dimension on some Prometheus metrics for
the <code>bar.foo</code> workload:</p> the <code>bar.foo</code> workload:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: remove-response-code name: remove-response-code
@ -165,7 +165,7 @@ spec:
operation: REMOVE operation: REMOVE
</code></pre> </code></pre>
<p>Policy to enable access logging for the entire mesh:</p> <p>Policy to enable access logging for the entire mesh:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: mesh-default name: mesh-default
@ -181,7 +181,7 @@ spec:
# those cases, `disabled: false` must be set explicitly to override. # those cases, `disabled: false` must be set explicitly to override.
</code></pre> </code></pre>
<p>Policy to disable access logging for the <code>foo</code> namespace:</p> <p>Policy to disable access logging for the <code>foo</code> namespace:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: namespace-no-log name: namespace-no-log
@ -223,12 +223,13 @@ No
<td><code>targetRefs</code></td> <td><code>targetRefs</code></td>
<td><code><a href="/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td> <td><code><a href="/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td>
<td> <td>
<p>Optional. The targetRef specifies the gateway the policy should be <p>Optional. The targetRefs specifies a list of resources the policy should be
applied to. The targeted resource specified will determine which applied to. The targeted resources specified will determine which workloads
workloads the policy applies to.</p> the policy applies to.</p>
<p>Currently, the following resource attachment types are supported:</p> <p>Currently, the following resource attachment types are supported:</p>
<ul> <ul>
<li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li> <li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li>
<li><code>kind: Service</code> with <code>&quot;&quot;</code> in the same namespace. This type is only supported for waypoints.</li>
</ul> </ul>
<p>If not set, the policy is applied as defined by the selector. <p>If not set, the policy is applied as defined by the selector.
At most one of the selector and targetRefs can be set.</p> At most one of the selector and targetRefs can be set.</p>

10
content/en/docs/reference/config/type/workload-selector/index.html
View File

@ -74,9 +74,9 @@ Yes
</section> </section>
<h2 id="PolicyTargetReference">PolicyTargetReference</h2> <h2 id="PolicyTargetReference">PolicyTargetReference</h2>
<section> <section>
<p>PolicyTargetReference format as defined by <a href="https://gateway-api.sigs.k8s.io/geps/gep-713/#policy-targetref-api">GEP-713</a>.</p> <p>PolicyTargetReference format as defined by <a href="https://gateway-api.sigs.k8s.io/geps/gep-2648/#direct-policy-design-rules">GEP-2648</a>.</p>
<p>PolicyTargetReferences specifies the targeted resource which the policy <p>PolicyTargetReference specifies the targeted resource which the policy
can be applied to. It must only target a single resource at a time, but it should be applied to. It must only target a single resource at a time, but it
can be used to target larger resources such as Gateways that may apply to can be used to target larger resources such as Gateways that may apply to
multiple child resources. The PolicyTargetReference will be used instead of multiple child resources. The PolicyTargetReference will be used instead of
a WorkloadSelector in the RequestAuthentication, AuthorizationPolicy, a WorkloadSelector in the RequestAuthentication, AuthorizationPolicy,
@ -91,8 +91,8 @@ metadata:
name: httpbin name: httpbin
namespace: foo namespace: foo
spec: spec:
targetRef: targetRefs:
name: waypoint - name: waypoint
kind: Gateway kind: Gateway
group: gateway.networking.k8s.io group: gateway.networking.k8s.io
action: DENY action: DENY

42
content/zh/docs/reference/commands/install-cni/index.html
View File

@ -81,11 +81,11 @@ remove_toc_prefix: 'install-cni '
</tr> </tr>
<tr> <tr>
<td><code>--log_caller &lt;string&gt;</code></td> <td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td> <td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_output_level &lt;string&gt;</code></td> <td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td> <td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_rotate &lt;string&gt;</code></td> <td><code>--log_rotate &lt;string&gt;</code></td>
@ -105,7 +105,7 @@ remove_toc_prefix: 'install-cni '
</tr> </tr>
<tr> <tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td> <td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td> <td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_target &lt;stringArray&gt;</code></td> <td><code>--log_target &lt;stringArray&gt;</code></td>
@ -203,11 +203,11 @@ See each sub-command&#39;s help for details on how to use the generated script.
</tr> </tr>
<tr> <tr>
<td><code>--log_caller &lt;string&gt;</code></td> <td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td> <td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_output_level &lt;string&gt;</code></td> <td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td> <td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_rotate &lt;string&gt;</code></td> <td><code>--log_rotate &lt;string&gt;</code></td>
@ -227,7 +227,7 @@ See each sub-command&#39;s help for details on how to use the generated script.
</tr> </tr>
<tr> <tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td> <td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td> <td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_target &lt;stringArray&gt;</code></td> <td><code>--log_target &lt;stringArray&gt;</code></td>
@ -272,11 +272,11 @@ If it is not installed already, you can install it via your OS&#39;s package man
</tr> </tr>
<tr> <tr>
<td><code>--log_caller &lt;string&gt;</code></td> <td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td> <td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_output_level &lt;string&gt;</code></td> <td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td> <td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_rotate &lt;string&gt;</code></td> <td><code>--log_rotate &lt;string&gt;</code></td>
@ -296,7 +296,7 @@ If it is not installed already, you can install it via your OS&#39;s package man
</tr> </tr>
<tr> <tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td> <td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td> <td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_target &lt;stringArray&gt;</code></td> <td><code>--log_target &lt;stringArray&gt;</code></td>
@ -340,11 +340,11 @@ If it is not installed already, you can install it via your OS&#39;s package man
</tr> </tr>
<tr> <tr>
<td><code>--log_caller &lt;string&gt;</code></td> <td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td> <td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_output_level &lt;string&gt;</code></td> <td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td> <td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_rotate &lt;string&gt;</code></td> <td><code>--log_rotate &lt;string&gt;</code></td>
@ -364,7 +364,7 @@ If it is not installed already, you can install it via your OS&#39;s package man
</tr> </tr>
<tr> <tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td> <td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td> <td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_target &lt;stringArray&gt;</code></td> <td><code>--log_target &lt;stringArray&gt;</code></td>
@ -407,11 +407,11 @@ to your powershell profile.
</tr> </tr>
<tr> <tr>
<td><code>--log_caller &lt;string&gt;</code></td> <td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td> <td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_output_level &lt;string&gt;</code></td> <td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td> <td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_rotate &lt;string&gt;</code></td> <td><code>--log_rotate &lt;string&gt;</code></td>
@ -431,7 +431,7 @@ to your powershell profile.
</tr> </tr>
<tr> <tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td> <td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td> <td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_target &lt;stringArray&gt;</code></td> <td><code>--log_target &lt;stringArray&gt;</code></td>
@ -481,11 +481,11 @@ to enable it. You can execute the following once:</p>
</tr> </tr>
<tr> <tr>
<td><code>--log_caller &lt;string&gt;</code></td> <td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td> <td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_output_level &lt;string&gt;</code></td> <td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td> <td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_rotate &lt;string&gt;</code></td> <td><code>--log_rotate &lt;string&gt;</code></td>
@ -505,7 +505,7 @@ to enable it. You can execute the following once:</p>
</tr> </tr>
<tr> <tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td> <td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td> <td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_target &lt;stringArray&gt;</code></td> <td><code>--log_target &lt;stringArray&gt;</code></td>
@ -548,12 +548,12 @@ to enable it. You can execute the following once:</p>
<tr> <tr>
<td><code>--log_caller &lt;string&gt;</code></td> <td><code>--log_caller &lt;string&gt;</code></td>
<td></td> <td></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td> <td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_output_level &lt;string&gt;</code></td> <td><code>--log_output_level &lt;string&gt;</code></td>
<td></td> <td></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td> <td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default ``)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_rotate &lt;string&gt;</code></td> <td><code>--log_rotate &lt;string&gt;</code></td>
@ -578,7 +578,7 @@ to enable it. You can execute the following once:</p>
<tr> <tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td> <td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td></td> <td></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, ambient, cni, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td> <td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, cni-agent, controllers, default, grpc, install, iptables, klog, model, monitoring, repair, spiffe, trustBundle, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td>
</tr> </tr>
<tr> <tr>
<td><code>--log_target &lt;stringArray&gt;</code></td> <td><code>--log_target &lt;stringArray&gt;</code></td>

154
content/zh/docs/reference/config/annotations/index.html
View File

@ -913,160 +913,6 @@ Istio supports to control its behavior.
</tr> </tr>
</tbody> </tbody>
</table> </table>
<h2 id="TrafficExcludeInboundPorts">traffic.istio.io/excludeInboundPorts</h2>
<table class="annotations">
<tbody>
<tr>
<th>Name</th>
<td><code>traffic.istio.io/excludeInboundPorts</code></td>
</tr>
<tr>
<th>Feature Status</th>
<td>Alpha</td>
</tr>
<tr>
<th>Resource Types</th>
<td>[Pod]</td>
</tr>
<tr>
<th>Description</th>
<td><p>A comma separated list of inbound ports to be excluded from redirection to Envoy. Only applies when all inbound traffic (i.e. &lsquo;*&rsquo;) is being redirected.</p>
</td>
</tr>
</tbody>
</table>
<h2 id="TrafficExcludeInterfaces">traffic.istio.io/excludeInterfaces</h2>
<table class="annotations">
<tbody>
<tr>
<th>Name</th>
<td><code>traffic.istio.io/excludeInterfaces</code></td>
</tr>
<tr>
<th>Feature Status</th>
<td>Alpha</td>
</tr>
<tr>
<th>Resource Types</th>
<td>[Pod]</td>
</tr>
<tr>
<th>Description</th>
<td><p>A comma separated list of interfaces to be excluded from Istio traffic capture</p>
</td>
</tr>
</tbody>
</table>
<h2 id="TrafficExcludeOutboundIPRanges">traffic.istio.io/excludeOutboundIPRanges</h2>
<table class="annotations">
<tbody>
<tr>
<th>Name</th>
<td><code>traffic.istio.io/excludeOutboundIPRanges</code></td>
</tr>
<tr>
<th>Feature Status</th>
<td>Alpha</td>
</tr>
<tr>
<th>Resource Types</th>
<td>[Pod]</td>
</tr>
<tr>
<th>Description</th>
<td><p>A comma separated list of IP ranges in CIDR form to be excluded from redirection. Only applies when all outbound traffic (i.e. &lsquo;*&rsquo;) is being redirected.</p>
</td>
</tr>
</tbody>
</table>
<h2 id="TrafficExcludeOutboundPorts">traffic.istio.io/excludeOutboundPorts</h2>
<table class="annotations">
<tbody>
<tr>
<th>Name</th>
<td><code>traffic.istio.io/excludeOutboundPorts</code></td>
</tr>
<tr>
<th>Feature Status</th>
<td>Alpha</td>
</tr>
<tr>
<th>Resource Types</th>
<td>[Pod]</td>
</tr>
<tr>
<th>Description</th>
<td><p>A comma separated list of outbound ports to be excluded from redirection to Envoy.</p>
</td>
</tr>
</tbody>
</table>
<h2 id="TrafficIncludeInboundPorts">traffic.istio.io/includeInboundPorts</h2>
<table class="annotations">
<tbody>
<tr>
<th>Name</th>
<td><code>traffic.istio.io/includeInboundPorts</code></td>
</tr>
<tr>
<th>Feature Status</th>
<td>Alpha</td>
</tr>
<tr>
<th>Resource Types</th>
<td>[Pod]</td>
</tr>
<tr>
<th>Description</th>
<td><p>A comma separated list of inbound ports for which traffic is to be redirected to Envoy. The wildcard character &lsquo;*&rsquo; can be used to configure redirection for all ports. An empty list will disable all inbound redirection.</p>
</td>
</tr>
</tbody>
</table>
<h2 id="TrafficIncludeOutboundIPRanges">traffic.istio.io/includeOutboundIPRanges</h2>
<table class="annotations">
<tbody>
<tr>
<th>Name</th>
<td><code>traffic.istio.io/includeOutboundIPRanges</code></td>
</tr>
<tr>
<th>Feature Status</th>
<td>Alpha</td>
</tr>
<tr>
<th>Resource Types</th>
<td>[Pod]</td>
</tr>
<tr>
<th>Description</th>
<td><p>A comma separated list of IP ranges in CIDR form to redirect to Envoy (optional). The wildcard character &lsquo;*&rsquo; can be used to redirect all outbound traffic. An empty list will disable all outbound redirection.</p>
</td>
</tr>
</tbody>
</table>
<h2 id="TrafficIncludeOutboundPorts">traffic.istio.io/includeOutboundPorts</h2>
<table class="annotations">
<tbody>
<tr>
<th>Name</th>
<td><code>traffic.istio.io/includeOutboundPorts</code></td>
</tr>
<tr>
<th>Feature Status</th>
<td>Alpha</td>
</tr>
<tr>
<th>Resource Types</th>
<td>[Pod]</td>
</tr>
<tr>
<th>Description</th>
<td><p>A comma separated list of outbound ports for which traffic is to be redirected to Envoy, regardless of the destination IP.</p>
</td>
</tr>
</tbody>
</table>
<h2 id="TrafficNodeSelector">traffic.istio.io/nodeSelector</h2> <h2 id="TrafficNodeSelector">traffic.istio.io/nodeSelector</h2>
<table class="annotations"> <table class="annotations">
<tbody> <tbody>

2
content/zh/docs/reference/config/istio.mesh.v1alpha1/index.html
View File

@ -3957,7 +3957,7 @@ No
<td><code>envoyDebugHeaders</code></td> <td><code>envoyDebugHeaders</code></td>
<td><code><a href="#ProxyConfig-ProxyHeaders-EnvoyDebugHeaders">EnvoyDebugHeaders</a></code></td> <td><code><a href="#ProxyConfig-ProxyHeaders-EnvoyDebugHeaders">EnvoyDebugHeaders</a></code></td>
<td> <td>
<p>Controls various <code>X-Envoy-*</code> headers, such as <code>X-Envoy-Overloaded</code> and `X-Envoy-Upstream-Service-Time. If enabled, <p>Controls various <code>X-Envoy-*</code> headers, such as <code>X-Envoy-Overloaded</code> and <code>X-Envoy-Upstream-Service-Time</code>. If enabled,
these headers will be included. these headers will be included.
If disabled, these headers will not be set. If they are already present, they will be preserved. If disabled, these headers will not be set. If they are already present, they will be preserved.
See the <a href="https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/router/v3/router.proto#envoy-v3-api-field-extensions-filters-http-router-v3-router-suppress-envoy-headers">Envoy documentation</a> for more details. See the <a href="https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/router/v3/router.proto#envoy-v3-api-field-extensions-filters-http-router-v3-router-suppress-envoy-headers">Envoy documentation</a> for more details.

24
content/zh/docs/reference/config/networking/destination-rule/index.html
View File

@ -16,7 +16,7 @@ for load balancing, connection pool size from the sidecar, and outlier
detection settings to detect and evict unhealthy hosts from the load detection settings to detect and evict unhealthy hosts from the load
balancing pool. For example, a simple load balancing policy for the balancing pool. For example, a simple load balancing policy for the
ratings service would look as follows:</p> ratings service would look as follows:</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: bookinfo-ratings name: bookinfo-ratings
@ -31,7 +31,7 @@ spec:
following rule uses a round robin load balancing policy for all traffic following rule uses a round robin load balancing policy for all traffic
going to a subset named testversion that is composed of endpoints (e.g., going to a subset named testversion that is composed of endpoints (e.g.,
pods) with labels (version:v3).</p> pods) with labels (version:v3).</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: bookinfo-ratings name: bookinfo-ratings
@ -54,7 +54,7 @@ a route rule explicitly sends traffic to this subset.</p>
following rule uses the least connection load balancing policy for all following rule uses the least connection load balancing policy for all
traffic to port 80, while uses a round robin load balancing setting for traffic to port 80, while uses a round robin load balancing setting for
traffic to the port 9080.</p> traffic to the port 9080.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: bookinfo-ratings-port name: bookinfo-ratings-port
@ -74,7 +74,7 @@ spec:
<p>Destination Rules can be customized to specific workloads as well. <p>Destination Rules can be customized to specific workloads as well.
The following example shows how a destination rule can be applied to a The following example shows how a destination rule can be applied to a
specific workload using the workloadSelector configuration.</p> specific workload using the workloadSelector configuration.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: configure-client-mtls-dr-with-workloadselector name: configure-client-mtls-dr-with-workloadselector
@ -311,7 +311,7 @@ service-level can be overridden at a subset-level. The following rule
uses a round robin load balancing policy for all traffic going to a uses a round robin load balancing policy for all traffic going to a
subset named testversion that is composed of endpoints (e.g., pods) with subset named testversion that is composed of endpoints (e.g., pods) with
labels (version:v3).</p> labels (version:v3).</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: bookinfo-ratings name: bookinfo-ratings
@ -395,7 +395,7 @@ load balancing
for more details.</p> for more details.</p>
<p>For example, the following rule uses a round robin load balancing policy <p>For example, the following rule uses a round robin load balancing policy
for all traffic going to the ratings service.</p> for all traffic going to the ratings service.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: bookinfo-ratings name: bookinfo-ratings
@ -408,7 +408,7 @@ spec:
<p>The following example sets up sticky sessions for the ratings service <p>The following example sets up sticky sessions for the ratings service
hashing-based load balancer for the same ratings service using the hashing-based load balancer for the same ratings service using the
the User cookie as the hash key.</p> the User cookie as the hash key.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: bookinfo-ratings name: bookinfo-ratings
@ -492,7 +492,7 @@ for more details. Connection pool settings can be applied at the TCP
level as well as at HTTP level.</p> level as well as at HTTP level.</p>
<p>For example, the following rule sets a limit of 100 connections to redis <p>For example, the following rule sets a limit of 100 connections to redis
service called myredissrv with a connect timeout of 30ms</p> service called myredissrv with a connect timeout of 30ms</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: bookinfo-redis name: bookinfo-redis
@ -559,7 +559,7 @@ with no more than 10 req/connection to the &ldquo;reviews&rdquo; service. In add
it sets a limit of 1000 concurrent HTTP2 requests and configures upstream it sets a limit of 1000 concurrent HTTP2 requests and configures upstream
hosts to be scanned every 5 mins so that any host that fails 7 consecutive hosts to be scanned every 5 mins so that any host that fails 7 consecutive
times with a 502, 503, or 504 error code will be ejected for 15 minutes.</p> times with a 502, 503, or 504 error code will be ejected for 15 minutes.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: reviews-cb-policy name: reviews-cb-policy
@ -728,7 +728,7 @@ context</a>
for more details. These settings are common to both HTTP and TCP upstreams.</p> for more details. These settings are common to both HTTP and TCP upstreams.</p>
<p>For example, the following rule configures a client to use mutual TLS <p>For example, the following rule configures a client to use mutual TLS
for connections to upstream database cluster.</p> for connections to upstream database cluster.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: db-mtls name: db-mtls
@ -743,7 +743,7 @@ spec:
</code></pre> </code></pre>
<p>The following rule configures a client to use TLS when talking to a <p>The following rule configures a client to use TLS when talking to a
foreign service whose domain matches *.foo.com.</p> foreign service whose domain matches *.foo.com.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: tls-foo name: tls-foo
@ -755,7 +755,7 @@ spec:
</code></pre> </code></pre>
<p>The following rule configures a client to use Istio mutual TLS when talking <p>The following rule configures a client to use Istio mutual TLS when talking
to rating services.</p> to rating services.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: ratings-istio-mtls name: ratings-istio-mtls

7
content/zh/docs/reference/config/networking/envoy-filter/index.html
View File

@ -389,12 +389,13 @@ No
<td><code>targetRefs</code></td> <td><code>targetRefs</code></td>
<td><code><a href="/zh/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td> <td><code><a href="/zh/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td>
<td> <td>
<p>Optional. The targetRef specifies the gateway the policy should be <p>Optional. The targetRefs specifies a list of resources the policy should be
applied to. The targeted resource specified will determine which applied to. The targeted resources specified will determine which workloads
workloads the policy applies to.</p> the policy applies to.</p>
<p>Currently, the following resource attachment types are supported:</p> <p>Currently, the following resource attachment types are supported:</p>
<ul> <ul>
<li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li> <li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li>
<li><code>kind: Service</code> with <code>&quot;&quot;</code> in the same namespace. This type is only supported for waypoints.</li>
</ul> </ul>
<p>If not set, the policy is applied as defined by the selector. <p>If not set, the policy is applied as defined by the selector.
At most one of the selector and targetRefs can be set.</p> At most one of the selector and targetRefs can be set.</p>

14
content/zh/docs/reference/config/networking/gateway/index.html
View File

@ -20,7 +20,7 @@ as a load balancer exposing port 80 and 9080 (http), 443 (https),
applied to the proxy running on a pod with labels <code>app: my-gateway-controller</code>. While Istio will configure the proxy to listen applied to the proxy running on a pod with labels <code>app: my-gateway-controller</code>. While Istio will configure the proxy to listen
on these ports, it is the responsibility of the user to ensure that on these ports, it is the responsibility of the user to ensure that
external traffic to these ports are allowed into the mesh.</p> external traffic to these ports are allowed into the mesh.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Gateway kind: Gateway
metadata: metadata:
name: my-gateway name: my-gateway
@ -84,7 +84,7 @@ in the qa version. The same rule is also applicable inside the mesh for
requests to the &ldquo;reviews.prod.svc.cluster.local&rdquo; service. This rule is requests to the &ldquo;reviews.prod.svc.cluster.local&rdquo; service. This rule is
applicable across ports 443, 9080. Note that <code>http://uk.bookinfo.com</code> applicable across ports 443, 9080. Note that <code>http://uk.bookinfo.com</code>
gets redirected to <code>https://uk.bookinfo.com</code> (i.e. 80 redirects to 443).</p> gets redirected to <code>https://uk.bookinfo.com</code> (i.e. 80 redirects to 443).</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: bookinfo-rule name: bookinfo-rule
@ -124,7 +124,7 @@ spec:
port 27017 to internal Mongo server on port 5555. This rule is not port 27017 to internal Mongo server on port 5555. This rule is not
applicable internally in the mesh as the gateway list omits the applicable internally in the mesh as the gateway list omits the
reserved name <code>mesh</code>.</p> reserved name <code>mesh</code>.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: bookinfo-mongo name: bookinfo-mongo
@ -148,7 +148,7 @@ a gateway server using the namespace/hostname syntax in the hosts field.
For example, the following Gateway allows any virtual service in the ns1 For example, the following Gateway allows any virtual service in the ns1
namespace to bind to it, while restricting only the virtual service with namespace to bind to it, while restricting only the virtual service with
foo.bar.com host in the ns2 namespace to bind to it.</p> foo.bar.com host in the ns2 namespace to bind to it.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Gateway kind: Gateway
metadata: metadata:
name: my-gateway name: my-gateway
@ -221,7 +221,7 @@ No
<section> <section>
<p><code>Server</code> describes the properties of the proxy on a given load balancer <p><code>Server</code> describes the properties of the proxy on a given load balancer
port. For example,</p> port. For example,</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Gateway kind: Gateway
metadata: metadata:
name: my-ingress name: my-ingress
@ -237,7 +237,7 @@ spec:
- &quot;*&quot; - &quot;*&quot;
</code></pre> </code></pre>
<p>Another example</p> <p>Another example</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Gateway kind: Gateway
metadata: metadata:
name: my-tcp-ingress name: my-tcp-ingress
@ -253,7 +253,7 @@ spec:
- &quot;*&quot; - &quot;*&quot;
</code></pre> </code></pre>
<p>The following is an example of TLS configuration for port 443</p> <p>The following is an example of TLS configuration for port 443</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Gateway kind: Gateway
metadata: metadata:
name: my-tls-ingress name: my-tls-ingress

30
content/zh/docs/reference/config/networking/service-entry/index.html
View File

@ -28,7 +28,7 @@ services.</p>
<p>The following example declares a few external APIs accessed by internal <p>The following example declares a few external APIs accessed by internal
applications over HTTPS. The sidecar inspects the SNI value in the applications over HTTPS. The sidecar inspects the SNI value in the
ClientHello message to route to the appropriate external service.</p> ClientHello message to route to the appropriate external service.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-https name: external-svc-https
@ -48,7 +48,7 @@ spec:
unmanaged VMs to Istio&rsquo;s registry, so that these services can be treated unmanaged VMs to Istio&rsquo;s registry, so that these services can be treated
as any other service in the mesh. The associated DestinationRule is used as any other service in the mesh. The associated DestinationRule is used
to initiate mTLS connections to the database instances.</p> to initiate mTLS connections to the database instances.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-mongocluster name: external-svc-mongocluster
@ -68,7 +68,7 @@ spec:
- address: 3.3.3.3 - address: 3.3.3.3
</code></pre> </code></pre>
<p>and the associated DestinationRule</p> <p>and the associated DestinationRule</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: mtls-mongocluster name: mtls-mongocluster
@ -84,7 +84,7 @@ spec:
<p>The following example uses a combination of service entry and TLS <p>The following example uses a combination of service entry and TLS
routing in a virtual service to steer traffic based on the SNI value to routing in a virtual service to steer traffic based on the SNI value to
an internal egress firewall.</p> an internal egress firewall.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-redirect name: external-svc-redirect
@ -100,7 +100,7 @@ spec:
resolution: NONE resolution: NONE
</code></pre> </code></pre>
<p>And the associated VirtualService to route based on the SNI value.</p> <p>And the associated VirtualService to route based on the SNI value.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: tls-routing name: tls-routing
@ -127,7 +127,7 @@ declaration to other namespaces in the mesh. By default, a service is exported
to all namespaces. The following example restricts the visibility to the to all namespaces. The following example restricts the visibility to the
current namespace, represented by &ldquo;.&rdquo;, so that it cannot be used by other current namespace, represented by &ldquo;.&rdquo;, so that it cannot be used by other
namespaces.</p> namespaces.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-httpbin name: external-svc-httpbin
@ -145,7 +145,7 @@ spec:
resolution: DNS resolution: DNS
</code></pre> </code></pre>
<p>Define a gateway to handle all egress traffic.</p> <p>Define a gateway to handle all egress traffic.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Gateway kind: Gateway
metadata: metadata:
name: istio-egressgateway name: istio-egressgateway
@ -167,7 +167,7 @@ well as route from the gateway to the external service. Note that the
virtual service is exported to all namespaces enabling them to route traffic virtual service is exported to all namespaces enabling them to route traffic
through the gateway to the external service. Forcing traffic to go through through the gateway to the external service. Forcing traffic to go through
a managed middle proxy like this is a common practice.</p> a managed middle proxy like this is a common practice.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: gateway-routing name: gateway-routing
@ -200,7 +200,7 @@ spec:
external services. If the connection has to be routed to the IP address external services. If the connection has to be routed to the IP address
requested by the application (i.e. application resolves DNS and attempts requested by the application (i.e. application resolves DNS and attempts
to connect to a specific IP), the resolution mode must be set to <code>NONE</code>.</p> to connect to a specific IP), the resolution mode must be set to <code>NONE</code>.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-wildcard-example name: external-svc-wildcard-example
@ -217,7 +217,7 @@ spec:
<p>The following example demonstrates a service that is available via a <p>The following example demonstrates a service that is available via a
Unix Domain Socket on the host of the client. The resolution must be Unix Domain Socket on the host of the client. The resolution must be
set to STATIC to use Unix address endpoints.</p> set to STATIC to use Unix address endpoints.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: unix-domain-socket-example name: unix-domain-socket-example
@ -240,7 +240,7 @@ reroute API calls for the <code>VirtualService</code> to a chosen backend. For
example, the following configuration creates a non-existent external example, the following configuration creates a non-existent external
service called foo.bar.com backed by three domains: us.foo.bar.com:8080, service called foo.bar.com backed by three domains: us.foo.bar.com:8080,
uk.foo.bar.com:9080, and in.foo.bar.com:7080</p> uk.foo.bar.com:9080, and in.foo.bar.com:7080</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-dns name: external-svc-dns
@ -271,7 +271,7 @@ be translated to <code>http://uk.foo.bar.com/baz</code>.</p>
<p>The following example illustrates the usage of a <code>ServiceEntry</code> <p>The following example illustrates the usage of a <code>ServiceEntry</code>
containing a subject alternate name containing a subject alternate name
whose format conforms to the <a href="https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md">SPIFFE standard</a>:</p> whose format conforms to the <a href="https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md">SPIFFE standard</a>:</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: httpbin name: httpbin
@ -298,7 +298,7 @@ VM-based instances with sidecars as well as a set of Kubernetes
pods managed by a standard deployment object. Consumers of this pods managed by a standard deployment object. Consumers of this
service in the mesh will be automatically load balanced across the service in the mesh will be automatically load balanced across the
VMs and Kubernetes.</p> VMs and Kubernetes.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: WorkloadEntry kind: WorkloadEntry
metadata: metadata:
name: details-vm-1 name: details-vm-1
@ -309,7 +309,7 @@ spec:
app: details app: details
instance-id: vm1 instance-id: vm1
--- ---
apiVersion: networking.istio.io/v1beta1 apiVersion: networking.istio.io/v1
kind: WorkloadEntry kind: WorkloadEntry
metadata: metadata:
name: details-vm-2 name: details-vm-2
@ -324,7 +324,7 @@ spec:
<code>app: details</code> using the same service account <code>details</code>, the <code>app: details</code> using the same service account <code>details</code>, the
following service entry declares a service spanning both VMs and following service entry declares a service spanning both VMs and
Kubernetes:</p> Kubernetes:</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: details-svc name: details-svc

18
content/zh/docs/reference/config/networking/sidecar/index.html
View File

@ -48,7 +48,7 @@ in the root namespace called <code>istio-config</code>, that configures
sidecars in all namespaces to allow egress traffic only to other sidecars in all namespaces to allow egress traffic only to other
workloads in the same namespace as well as to services in the workloads in the same namespace as well as to services in the
<code>istio-system</code> namespace.</p> <code>istio-system</code> namespace.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Sidecar kind: Sidecar
metadata: metadata:
name: default name: default
@ -64,7 +64,7 @@ spec:
above, and configures the sidecars in the namespace to allow egress above, and configures the sidecars in the namespace to allow egress
traffic to public services in the <code>prod-us1</code>, <code>prod-apis</code>, and the traffic to public services in the <code>prod-us1</code>, <code>prod-apis</code>, and the
<code>istio-system</code> namespaces.</p> <code>istio-system</code> namespaces.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Sidecar kind: Sidecar
metadata: metadata:
name: default name: default
@ -84,7 +84,7 @@ the attached workload instance listening on a Unix domain
socket. In the egress direction, in addition to the <code>istio-system</code> socket. In the egress direction, in addition to the <code>istio-system</code>
namespace, the sidecar proxies only HTTP traffic bound for port namespace, the sidecar proxies only HTTP traffic bound for port
9080 for services in the <code>prod-us1</code> namespace.</p> 9080 for services in the <code>prod-us1</code> namespace.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Sidecar kind: Sidecar
metadata: metadata:
name: ratings name: ratings
@ -123,7 +123,7 @@ it to the application listening on <code>127.0.0.1:8080</code>. It also allows
the application to communicate with a backing MySQL database on the application to communicate with a backing MySQL database on
<code>127.0.0.1:3306</code>, that then gets proxied to the externally hosted <code>127.0.0.1:3306</code>, that then gets proxied to the externally hosted
MySQL service at <code>mysql.foo.com:3306</code>.</p> MySQL service at <code>mysql.foo.com:3306</code>.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Sidecar kind: Sidecar
metadata: metadata:
name: no-ip-tables name: no-ip-tables
@ -150,7 +150,7 @@ spec:
- &quot;*/mysql.foo.com&quot; - &quot;*/mysql.foo.com&quot;
</code></pre> </code></pre>
<p>And the associated service entry for routing to <code>mysql.foo.com:3306</code></p> <p>And the associated service entry for routing to <code>mysql.foo.com:3306</code></p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-mysql name: external-svc-mysql
@ -176,7 +176,7 @@ listener on <code>172.16.1.32:80</code> (the VM&rsquo;s IP) for traffic arriving
<p><strong>NOTE</strong>: The <code>ISTIO_META_INTERCEPTION_MODE</code> metadata on the <p><strong>NOTE</strong>: The <code>ISTIO_META_INTERCEPTION_MODE</code> metadata on the
proxy in the VM should contain <code>REDIRECT</code> or <code>TPROXY</code> as its value, proxy in the VM should contain <code>REDIRECT</code> or <code>TPROXY</code> as its value,
implying that IP tables based traffic capture is active.</p> implying that IP tables based traffic capture is active.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Sidecar kind: Sidecar
metadata: metadata:
name: partial-ip-tables name: partial-ip-tables
@ -214,7 +214,7 @@ in order to set mTLS mode to &ldquo;DISABLE&rdquo; on specific
ports. ports.
In this example, the mTLS mode is disabled on PORT 80. In this example, the mTLS mode is disabled on PORT 80.
This feature is currently experimental.</p> This feature is currently experimental.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Sidecar kind: Sidecar
metadata: metadata:
name: ratings name: ratings
@ -249,7 +249,7 @@ spec:
selector: selector:
app: ratings app: ratings
--- ---
apiVersion: security.istio.io/v1beta1 apiVersion: security.istio.io/v1
kind: PeerAuthentication kind: PeerAuthentication
metadata: metadata:
name: ratings-peer-auth name: ratings-peer-auth
@ -271,7 +271,7 @@ connections to the service) as well as servers (for inbound connections to a ser
instance). Using the <code>InboundConnectionPool</code> and per-port <code>ConnectionPool</code> settings instance). Using the <code>InboundConnectionPool</code> and per-port <code>ConnectionPool</code> settings
in a <code>Sidecar</code> allow you to control those connection pools for the server separately in a <code>Sidecar</code> allow you to control those connection pools for the server separately
from the settings pushed to all clients.</p> from the settings pushed to all clients.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: Sidecar kind: Sidecar
metadata: metadata:
name: connection-pool-settings name: connection-pool-settings

52
content/zh/docs/reference/config/networking/virtual-service/index.html
View File

@ -43,7 +43,7 @@ to be customized for specific client contexts.</p>
pods of the reviews service with label &ldquo;version: v1&rdquo;. In addition, pods of the reviews service with label &ldquo;version: v1&rdquo;. In addition,
HTTP requests with path starting with /wpcatalog/ or /consumercatalog/ will HTTP requests with path starting with /wpcatalog/ or /consumercatalog/ will
be rewritten to /newcatalog and sent to pods with label &ldquo;version: v2&rdquo;.</p> be rewritten to /newcatalog and sent to pods with label &ldquo;version: v2&rdquo;.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: reviews-route name: reviews-route
@ -72,7 +72,7 @@ spec:
<p>A subset/version of a route destination is identified with a reference <p>A subset/version of a route destination is identified with a reference
to a named service subset which must be declared in a corresponding to a named service subset which must be declared in a corresponding
<code>DestinationRule</code>.</p> <code>DestinationRule</code>.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: reviews-destination name: reviews-destination
@ -249,7 +249,7 @@ domain names over short names.</em></p>
<p>The following Kubernetes example routes all traffic by default to pods <p>The following Kubernetes example routes all traffic by default to pods
of the reviews service with label &ldquo;version: v1&rdquo; (i.e., subset v1), and of the reviews service with label &ldquo;version: v1&rdquo; (i.e., subset v1), and
some to subset v2, in a Kubernetes environment.</p> some to subset v2, in a Kubernetes environment.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: reviews-route name: reviews-route
@ -275,7 +275,7 @@ spec:
subset: v1 subset: v1
</code></pre> </code></pre>
<p>And the associated DestinationRule</p> <p>And the associated DestinationRule</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: reviews-destination name: reviews-destination
@ -299,7 +299,7 @@ that this rule is set in the istio-system namespace but uses the fully
qualified domain name of the productpage service, qualified domain name of the productpage service,
productpage.prod.svc.cluster.local. Therefore the rule&rsquo;s namespace does productpage.prod.svc.cluster.local. Therefore the rule&rsquo;s namespace does
not have an impact in resolving the name of the productpage service.</p> not have an impact in resolving the name of the productpage service.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: my-productpage-rule name: my-productpage-rule
@ -318,7 +318,7 @@ services must first be added to Istio&rsquo;s internal service registry using th
ServiceEntry resource. VirtualServices can then be defined to control traffic ServiceEntry resource. VirtualServices can then be defined to control traffic
bound to these external services. For example, the following rules define a bound to these external services. For example, the following rules define a
Service for wikipedia.org and set a timeout of 5s for HTTP requests.</p> Service for wikipedia.org and set a timeout of 5s for HTTP requests.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: external-svc-wikipedia name: external-svc-wikipedia
@ -332,7 +332,7 @@ spec:
protocol: HTTP protocol: HTTP
resolution: DNS resolution: DNS
--- ---
apiVersion: networking.istio.io/v1beta1 apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: my-wiki-rule name: my-wiki-rule
@ -638,7 +638,7 @@ No
<p>Describes the delegate VirtualService. <p>Describes the delegate VirtualService.
The following routing rules forward the traffic to <code>/productpage</code> by a delegate VirtualService named <code>productpage</code>, The following routing rules forward the traffic to <code>/productpage</code> by a delegate VirtualService named <code>productpage</code>,
forward the traffic to <code>/reviews</code> by a delegate VirtualService named <code>reviews</code>.</p> forward the traffic to <code>/reviews</code> by a delegate VirtualService named <code>reviews</code>.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: bookinfo name: bookinfo
@ -661,7 +661,7 @@ spec:
name: reviews name: reviews
namespace: nsB namespace: nsB
</code></pre> </code></pre>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: productpage name: productpage
@ -678,7 +678,7 @@ spec:
- destination: - destination:
host: productpage.nsA.svc.cluster.local host: productpage.nsA.svc.cluster.local
</code></pre> </code></pre>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: reviews name: reviews
@ -735,7 +735,7 @@ The following VirtualService adds a <code>test</code> header with the value <cod
to requests that are routed to any <code>reviews</code> service destination. to requests that are routed to any <code>reviews</code> service destination.
It also removes the <code>foo</code> response header, but only from responses It also removes the <code>foo</code> response header, but only from responses
coming from the <code>v1</code> subset (version) of the <code>reviews</code> service.</p> coming from the <code>v1</code> subset (version) of the <code>reviews</code> service.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: reviews-route name: reviews-route
@ -805,7 +805,7 @@ No
traffic (TLS/HTTPS) The following routing rule forwards unterminated TLS traffic (TLS/HTTPS) The following routing rule forwards unterminated TLS
traffic arriving at port 443 of gateway called &ldquo;mygateway&rdquo; to internal traffic arriving at port 443 of gateway called &ldquo;mygateway&rdquo; to internal
services in the mesh based on the SNI value.</p> services in the mesh based on the SNI value.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: bookinfo-sni name: bookinfo-sni
@ -874,7 +874,7 @@ No
<p>Describes match conditions and actions for routing TCP traffic. The <p>Describes match conditions and actions for routing TCP traffic. The
following routing rule forwards traffic arriving at port 27017 for following routing rule forwards traffic arriving at port 27017 for
mongo.prod.svc.cluster.local to another Mongo server on port 5555.</p> mongo.prod.svc.cluster.local to another Mongo server on port 5555.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: bookinfo-mongo name: bookinfo-mongo
@ -936,7 +936,7 @@ rule to be applied to the HTTP request. For example, the following
restricts the rule to match only requests where the URL path restricts the rule to match only requests where the URL path
starts with /ratings/v2/ and the request contains a custom <code>end-user</code> header starts with /ratings/v2/ and the request contains a custom <code>end-user</code> header
with value <code>jason</code>.</p> with value <code>jason</code>.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -1246,7 +1246,7 @@ determine the proportion of traffic it receives. For example, the
following rule will route 25% of traffic for the &ldquo;reviews&rdquo; service to following rule will route 25% of traffic for the &ldquo;reviews&rdquo; service to
instances with the &ldquo;v2&rdquo; tag and the remaining traffic (i.e., 75%) to instances with the &ldquo;v2&rdquo; tag and the remaining traffic (i.e., 75%) to
&ldquo;v1&rdquo;.</p> &ldquo;v1&rdquo;.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: reviews-route name: reviews-route
@ -1265,7 +1265,7 @@ spec:
weight: 75 weight: 75
</code></pre> </code></pre>
<p>And the associated DestinationRule</p> <p>And the associated DestinationRule</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: DestinationRule kind: DestinationRule
metadata: metadata:
name: reviews-destination name: reviews-destination
@ -1282,7 +1282,7 @@ spec:
<p>Traffic can also be split across two entirely different services without <p>Traffic can also be split across two entirely different services without
having to define new subsets. For example, the following rule forwards 25% of having to define new subsets. For example, the following rule forwards 25% of
traffic to reviews.com to dev.reviews.com</p> traffic to reviews.com to dev.reviews.com</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: reviews-route-two-domains name: reviews-route-two-domains
@ -1577,7 +1577,7 @@ where the Authority/Host and the URI in the response can be swapped with
the specified values. For example, the following rule redirects the specified values. For example, the following rule redirects
requests for /v1/getProductRatings API on the ratings service to requests for /v1/getProductRatings API on the ratings service to
/v1/bookRatings provided by the bookratings service.</p> /v1/bookRatings provided by the bookratings service.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -1689,7 +1689,7 @@ No
<p>HTTPDirectResponse can be used to send a fixed response to clients. <p>HTTPDirectResponse can be used to send a fixed response to clients.
For example, the following rule returns a fixed 503 status with a body For example, the following rule returns a fixed 503 status with a body
to requests for /v1/getProductRatings API.</p> to requests for /v1/getProductRatings API.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -1708,7 +1708,7 @@ spec:
</code></pre> </code></pre>
<p>It is also possible to specify a binary response body. <p>It is also possible to specify a binary response body.
This is mostly useful for non text-based protocols such as gRPC.</p> This is mostly useful for non text-based protocols such as gRPC.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -1728,7 +1728,7 @@ spec:
<p>It is good practice to add headers in the HTTPRoute <p>It is good practice to add headers in the HTTPRoute
as well as the direct_response, for example to specify as well as the direct_response, for example to specify
the returned Content-Type.</p> the returned Content-Type.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -1830,7 +1830,7 @@ before forwarding the request to the destination. Rewrite primitive can
be used only with HTTPRouteDestination. The following example be used only with HTTPRouteDestination. The following example
demonstrates how to rewrite the URL prefix for api call (/ratings) to demonstrates how to rewrite the URL prefix for api call (/ratings) to
ratings service before making the actual API call.</p> ratings service before making the actual API call.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -2000,7 +2000,7 @@ example, the following rule sets the maximum number of retries to 3 when
calling ratings:v1 service, with a 2s timeout per retry attempt. calling ratings:v1 service, with a 2s timeout per retry attempt.
A retry will be attempted if there is a connect-failure, refused_stream A retry will be attempted if there is a connect-failure, refused_stream
or when the upstream server responds with Service Unavailable(503).</p> or when the upstream server responds with Service Unavailable(503).</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -2097,7 +2097,7 @@ the following rule restricts cross origin requests to those originating
from example.com domain using HTTP POST/GET, and sets the from example.com domain using HTTP POST/GET, and sets the
<code>Access-Control-Allow-Credentials</code> header to false. In addition, it only <code>Access-Control-Allow-Credentials</code> header to false. In addition, it only
exposes <code>X-Foo-bar</code> header and sets an expiry period of 1 day.</p> exposes <code>X-Foo-bar</code> header and sets an expiry period of 1 day.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route
@ -2413,7 +2413,7 @@ No
forwarding path. The following example will introduce a 5 second delay forwarding path. The following example will introduce a 5 second delay
in 1 out of every 1000 requests to the &ldquo;v1&rdquo; version of the &ldquo;reviews&rdquo; in 1 out of every 1000 requests to the &ldquo;v1&rdquo; version of the &ldquo;reviews&rdquo;
service from all pods with label env: prod</p> service from all pods with label env: prod</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: reviews-route name: reviews-route
@ -2493,7 +2493,7 @@ No
<p>Abort specification is used to prematurely abort a request with a <p>Abort specification is used to prematurely abort a request with a
pre-specified error code. The following example will return an HTTP 400 pre-specified error code. The following example will return an HTTP 400
error code for 1 out of every 1000 requests to the &ldquo;ratings&rdquo; service &ldquo;v1&rdquo;.</p> error code for 1 out of every 1000 requests to the &ldquo;ratings&rdquo; service &ldquo;v1&rdquo;.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: ratings-route name: ratings-route

10
content/zh/docs/reference/config/networking/workload-entry/index.html
View File

@ -30,7 +30,7 @@ account. The service is exposed on port 80 to applications in the
mesh. The HTTP traffic to this service is wrapped in Istio mutual mesh. The HTTP traffic to this service is wrapped in Istio mutual
TLS and sent to sidecars on VMs on target port 8080, that in turn TLS and sent to sidecars on VMs on target port 8080, that in turn
forward it to the application on localhost on the same port.</p> forward it to the application on localhost on the same port.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: WorkloadEntry kind: WorkloadEntry
metadata: metadata:
name: details-svc name: details-svc
@ -46,7 +46,7 @@ spec:
instance-id: vm1 instance-id: vm1
</code></pre> </code></pre>
<p>and the associated service entry</p> <p>and the associated service entry</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: details-svc name: details-svc
@ -69,7 +69,7 @@ its fully qualified DNS name. The service entry&rsquo;s resolution
mode should be changed to DNS to indicate that the client-side mode should be changed to DNS to indicate that the client-side
sidecars should dynamically resolve the DNS name at runtime before sidecars should dynamically resolve the DNS name at runtime before
forwarding the request.</p> forwarding the request.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: WorkloadEntry kind: WorkloadEntry
metadata: metadata:
name: details-svc name: details-svc
@ -85,7 +85,7 @@ spec:
instance-id: vm1 instance-id: vm1
</code></pre> </code></pre>
<p>and the associated service entry</p> <p>and the associated service entry</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: ServiceEntry kind: ServiceEntry
metadata: metadata:
name: details-svc name: details-svc
@ -109,7 +109,7 @@ to write a <code>WorkloadEntry</code> in the local cluster that represents
the Workload(s) in the remote network with the given labels. A the Workload(s) in the remote network with the given labels. A
single <code>WorkloadEntry</code> with weights represent the aggregate of all single <code>WorkloadEntry</code> with weights represent the aggregate of all
the actual workloads in a given remote network.</p> the actual workloads in a given remote network.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: WorkloadEntry kind: WorkloadEntry
metadata: metadata:
name: foo-workloads-cluster-2 name: foo-workloads-cluster-2

2
content/zh/docs/reference/config/networking/workload-group/index.html
View File

@ -22,7 +22,7 @@ of workloads that will be registered under <code>reviews</code> in namespace
instance during the bootstrap process, and the ports 3550 and 8080 instance during the bootstrap process, and the ports 3550 and 8080
will be associated with the workload group and use service account <code>default</code>. will be associated with the workload group and use service account <code>default</code>.
<code>app.kubernetes.io/version</code> is just an arbitrary example of a label.</p> <code>app.kubernetes.io/version</code> is just an arbitrary example of a label.</p>
<pre><code class="language-yaml">apiVersion: networking.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1
kind: WorkloadGroup kind: WorkloadGroup
metadata: metadata:
name: reviews name: reviews

7
content/zh/docs/reference/config/proxy_extensions/wasm-plugin/index.html
View File

@ -205,12 +205,13 @@ No
<td><code>targetRefs</code></td> <td><code>targetRefs</code></td>
<td><code><a href="/zh/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td> <td><code><a href="/zh/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td>
<td> <td>
<p>Optional. The targetRef specifies the gateway the policy should be <p>Optional. The targetRefs specifies a list of resources the policy should be
applied to. The targeted resource specified will determine which applied to. The targeted resources specified will determine which workloads
workloads the policy applies to.</p> the policy applies to.</p>
<p>Currently, the following resource attachment types are supported:</p> <p>Currently, the following resource attachment types are supported:</p>
<ul> <ul>
<li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li> <li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li>
<li><code>kind: Service</code> with <code>&quot;&quot;</code> in the same namespace. This type is only supported for waypoints.</li>
</ul> </ul>
<p>If not set, the policy is applied as defined by the selector. <p>If not set, the policy is applied as defined by the selector.
At most one of the selector and targetRefs can be set.</p> At most one of the selector and targetRefs can be set.</p>

13
content/zh/docs/reference/config/security/authorization-policy/index.html
View File

@ -230,12 +230,13 @@ No
<td><code>targetRefs</code></td> <td><code>targetRefs</code></td>
<td><code><a href="/zh/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td> <td><code><a href="/zh/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td>
<td> <td>
<p>Optional. The targetRef specifies the gateway the policy should be <p>Optional. The targetRefs specifies a list of resources the policy should be
applied to. The targeted resource specified will determine which applied to. The targeted resources specified will determine which workloads
workloads the policy applies to.</p> the policy applies to.</p>
<p>Currently, the following resource attachment types are supported:</p> <p>Currently, the following resource attachment types are supported:</p>
<ul> <ul>
<li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li> <li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li>
<li><code>kind: Service</code> with <code>&quot;&quot;</code> in the same namespace. This type is only supported for waypoints.</li>
</ul> </ul>
<p>If not set, the policy is applied as defined by the selector. <p>If not set, the policy is applied as defined by the selector.
At most one of the selector and targetRefs can be set.</p> At most one of the selector and targetRefs can be set.</p>
@ -611,8 +612,8 @@ To be a valid path template, the path must not contain <code>*</code>, <code>{</
<li><code>/foo/{*}</code> matches <code>/foo/bar</code> but not <code>/foo/bar/baz</code></li> <li><code>/foo/{*}</code> matches <code>/foo/bar</code> but not <code>/foo/bar/baz</code></li>
<li><code>/foo/{**}/</code> matches <code>/foo/bar/</code>, <code>/foo/bar/baz.txt</code>, and <code>/foo//</code> but not <code>/foo/bar</code></li> <li><code>/foo/{**}/</code> matches <code>/foo/bar/</code>, <code>/foo/bar/baz.txt</code>, and <code>/foo//</code> but not <code>/foo/bar</code></li>
<li><code>/foo/{*}/bar/{**}</code> matches <code>/foo/buzz/bar/</code> and <code>/foo/buzz/bar/baz</code></li> <li><code>/foo/{*}/bar/{**}</code> matches <code>/foo/buzz/bar/</code> and <code>/foo/buzz/bar/baz</code></li>
<li><code>/*/baz/{*}`` is not a valid path template since it includes </code>*` outside of a supported operator</li> <li><code>/*/baz/{*}</code> is not a valid path template since it includes <code>*</code> outside of a supported operator</li>
<li><code>/**/baz/{*}`` is not a valid path template since it includes </code>**` outside of a supported operator</li> <li><code>/**/baz/{*}</code> is not a valid path template since it includes <code>**</code> outside of a supported operator</li>
<li><code>/{**}/foo/{*}</code> is not a valid path template since <code>{**}</code> is not the last operator</li> <li><code>/{**}/foo/{*}</code> is not a valid path template since <code>{**}</code> is not the last operator</li>
<li><code>/foo/{*}.txt</code> is invalid since there are characters other than <code>{*}</code> in the path segment</li> <li><code>/foo/{*}.txt</code> is invalid since there are characters other than <code>{*}</code> in the path segment</li>
</ul> </ul>
@ -819,7 +820,7 @@ One example use case of the extension is to integrate with a custom external aut
the authorization decision to it.</p> the authorization decision to it.</p>
<p>The following authorization policy applies to an ingress gateway and delegates the authorization check to a named extension <p>The following authorization policy applies to an ingress gateway and delegates the authorization check to a named extension
<code>my-custom-authz</code> if the request path has prefix <code>/admin/</code>.</p> <code>my-custom-authz</code> if the request path has prefix <code>/admin/</code>.</p>
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: security.istio.io/v1
kind: AuthorizationPolicy kind: AuthorizationPolicy
metadata: metadata:
name: ext-authz name: ext-authz

10
content/zh/docs/reference/config/security/peer_authentication/index.html
View File

@ -18,7 +18,7 @@ Development of PeerAuthentication is currently frozen and likely to be replaced
PeerAuthentication defines how traffic will be tunneled (or not) to the sidecar.</p> PeerAuthentication defines how traffic will be tunneled (or not) to the sidecar.</p>
<p>Examples:</p> <p>Examples:</p>
<p>Policy to allow mTLS traffic for all workloads under namespace <code>foo</code>:</p> <p>Policy to allow mTLS traffic for all workloads under namespace <code>foo</code>:</p>
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: security.istio.io/v1
kind: PeerAuthentication kind: PeerAuthentication
metadata: metadata:
name: default name: default
@ -30,7 +30,7 @@ spec:
<p>For mesh level, put the policy in root-namespace according to your Istio installation.</p> <p>For mesh level, put the policy in root-namespace according to your Istio installation.</p>
<p>Policies to allow both mTLS and plaintext traffic for all workloads under namespace <code>foo</code>, but <p>Policies to allow both mTLS and plaintext traffic for all workloads under namespace <code>foo</code>, but
require mTLS for workload <code>finance</code>.</p> require mTLS for workload <code>finance</code>.</p>
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: security.istio.io/v1
kind: PeerAuthentication kind: PeerAuthentication
metadata: metadata:
name: default name: default
@ -39,7 +39,7 @@ spec:
mtls: mtls:
mode: PERMISSIVE mode: PERMISSIVE
--- ---
apiVersion: security.istio.io/v1beta1 apiVersion: security.istio.io/v1
kind: PeerAuthentication kind: PeerAuthentication
metadata: metadata:
name: finance name: finance
@ -54,7 +54,7 @@ spec:
<p>Policy that enables strict mTLS for all <code>finance</code> workloads, but leaves the port <code>8080</code> to <p>Policy that enables strict mTLS for all <code>finance</code> workloads, but leaves the port <code>8080</code> to
plaintext. Note the port value in the <code>portLevelMtls</code> field refers to the port plaintext. Note the port value in the <code>portLevelMtls</code> field refers to the port
of the workload, not the port of the Kubernetes service.</p> of the workload, not the port of the Kubernetes service.</p>
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: security.istio.io/v1
kind: PeerAuthentication kind: PeerAuthentication
metadata: metadata:
name: default name: default
@ -71,7 +71,7 @@ spec:
</code></pre> </code></pre>
<p>Policy that inherits mTLS mode from namespace (or mesh) settings, and disables <p>Policy that inherits mTLS mode from namespace (or mesh) settings, and disables
mTLS for workload port <code>8080</code>.</p> mTLS for workload port <code>8080</code>.</p>
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1 <pre><code class="language-yaml">apiVersion: security.istio.io/v1
kind: PeerAuthentication kind: PeerAuthentication
metadata: metadata:
name: default name: default

9
content/zh/docs/reference/config/security/request_authentication/index.html
View File

@ -179,7 +179,7 @@ spec:
- source: - source:
requestPrincipals: [&quot;*&quot;] requestPrincipals: [&quot;*&quot;]
--- ---
apiVersion: networking.istio.io/v1alpha3 apiVersion: networking.istio.io/v1
kind: VirtualService kind: VirtualService
metadata: metadata:
name: route-jwt name: route-jwt
@ -234,12 +234,13 @@ No
<td><code>targetRefs</code></td> <td><code>targetRefs</code></td>
<td><code><a href="/zh/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td> <td><code><a href="/zh/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td>
<td> <td>
<p>Optional. The targetRef specifies the gateway the policy should be <p>Optional. The targetRefs specifies a list of resources the policy should be
applied to. The targeted resource specified will determine which applied to. The targeted resources specified will determine which workloads
workloads the policy applies to.</p> the policy applies to.</p>
<p>Currently, the following resource attachment types are supported:</p> <p>Currently, the following resource attachment types are supported:</p>
<ul> <ul>
<li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li> <li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li>
<li><code>kind: Service</code> with <code>&quot;&quot;</code> in the same namespace. This type is only supported for waypoints.</li>
</ul> </ul>
<p>If not set, the policy is applied as defined by the selector. <p>If not set, the policy is applied as defined by the selector.
At most one of the selector and targetRefs can be set.</p> At most one of the selector and targetRefs can be set.</p>

27
content/zh/docs/reference/config/telemetry/index.html
View File

@ -25,7 +25,7 @@ selecting any given workload.</p>
</ol> </ol>
<h4 id="examples">Examples</h4> <h4 id="examples">Examples</h4>
<p>Policy to enable random sampling for 10% of traffic:</p> <p>Policy to enable random sampling for 10% of traffic:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: mesh-default name: mesh-default
@ -37,7 +37,7 @@ spec:
</code></pre> </code></pre>
<p>Policy to disable trace reporting for the <code>foo</code> workload (note: tracing <p>Policy to disable trace reporting for the <code>foo</code> workload (note: tracing
context will still be propagated):</p> context will still be propagated):</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: foo-tracing name: foo-tracing
@ -50,7 +50,7 @@ spec:
- disableSpanReporting: true - disableSpanReporting: true
</code></pre> </code></pre>
<p>Policy to select the alternate zipkin provider for trace reporting:</p> <p>Policy to select the alternate zipkin provider for trace reporting:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: foo-tracing-alternate name: foo-tracing-alternate
@ -65,7 +65,7 @@ spec:
randomSamplingPercentage: 10.00 randomSamplingPercentage: 10.00
</code></pre> </code></pre>
<p>Policy to tailor the zipkin provider to sample traces from Client workloads only:</p> <p>Policy to tailor the zipkin provider to sample traces from Client workloads only:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: mesh-default name: mesh-default
@ -78,7 +78,7 @@ spec:
- name: &quot;zipkin&quot; - name: &quot;zipkin&quot;
</code></pre> </code></pre>
<p>Policy to add a custom tag from a literal value:</p> <p>Policy to add a custom tag from a literal value:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: mesh-default name: mesh-default
@ -93,7 +93,7 @@ spec:
value: &quot;foo&quot; value: &quot;foo&quot;
</code></pre> </code></pre>
<p>Policy to disable server-side metrics for Prometheus for an entire mesh:</p> <p>Policy to disable server-side metrics for Prometheus for an entire mesh:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: mesh-default name: mesh-default
@ -110,7 +110,7 @@ spec:
disabled: true disabled: true
</code></pre> </code></pre>
<p>Policy to add dimensions to all Prometheus metrics for the <code>foo</code> namespace:</p> <p>Policy to add dimensions to all Prometheus metrics for the <code>foo</code> namespace:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: namespace-metrics name: namespace-metrics
@ -130,7 +130,7 @@ spec:
</code></pre> </code></pre>
<p>Policy to remove the <code>response_code</code> dimension on some Prometheus metrics for <p>Policy to remove the <code>response_code</code> dimension on some Prometheus metrics for
the <code>bar.foo</code> workload:</p> the <code>bar.foo</code> workload:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: remove-response-code name: remove-response-code
@ -165,7 +165,7 @@ spec:
operation: REMOVE operation: REMOVE
</code></pre> </code></pre>
<p>Policy to enable access logging for the entire mesh:</p> <p>Policy to enable access logging for the entire mesh:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: mesh-default name: mesh-default
@ -181,7 +181,7 @@ spec:
# those cases, `disabled: false` must be set explicitly to override. # those cases, `disabled: false` must be set explicitly to override.
</code></pre> </code></pre>
<p>Policy to disable access logging for the <code>foo</code> namespace:</p> <p>Policy to disable access logging for the <code>foo</code> namespace:</p>
<pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1alpha1 <pre><code class="language-yaml">apiVersion: telemetry.istio.io/v1
kind: Telemetry kind: Telemetry
metadata: metadata:
name: namespace-no-log name: namespace-no-log
@ -223,12 +223,13 @@ No
<td><code>targetRefs</code></td> <td><code>targetRefs</code></td>
<td><code><a href="/zh/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td> <td><code><a href="/zh/docs/reference/config/type/workload-selector/#PolicyTargetReference">PolicyTargetReference[]</a></code></td>
<td> <td>
<p>Optional. The targetRef specifies the gateway the policy should be <p>Optional. The targetRefs specifies a list of resources the policy should be
applied to. The targeted resource specified will determine which applied to. The targeted resources specified will determine which workloads
workloads the policy applies to.</p> the policy applies to.</p>
<p>Currently, the following resource attachment types are supported:</p> <p>Currently, the following resource attachment types are supported:</p>
<ul> <ul>
<li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li> <li><code>kind: Gateway</code> with <code>group: gateway.networking.k8s.io</code> in the same namespace.</li>
<li><code>kind: Service</code> with <code>&quot;&quot;</code> in the same namespace. This type is only supported for waypoints.</li>
</ul> </ul>
<p>If not set, the policy is applied as defined by the selector. <p>If not set, the policy is applied as defined by the selector.
At most one of the selector and targetRefs can be set.</p> At most one of the selector and targetRefs can be set.</p>

10
content/zh/docs/reference/config/type/workload-selector/index.html
View File

@ -74,9 +74,9 @@ Yes
</section> </section>
<h2 id="PolicyTargetReference">PolicyTargetReference</h2> <h2 id="PolicyTargetReference">PolicyTargetReference</h2>
<section> <section>
<p>PolicyTargetReference format as defined by <a href="https://gateway-api.sigs.k8s.io/geps/gep-713/#policy-targetref-api">GEP-713</a>.</p> <p>PolicyTargetReference format as defined by <a href="https://gateway-api.sigs.k8s.io/geps/gep-2648/#direct-policy-design-rules">GEP-2648</a>.</p>
<p>PolicyTargetReferences specifies the targeted resource which the policy <p>PolicyTargetReference specifies the targeted resource which the policy
can be applied to. It must only target a single resource at a time, but it should be applied to. It must only target a single resource at a time, but it
can be used to target larger resources such as Gateways that may apply to can be used to target larger resources such as Gateways that may apply to
multiple child resources. The PolicyTargetReference will be used instead of multiple child resources. The PolicyTargetReference will be used instead of
a WorkloadSelector in the RequestAuthentication, AuthorizationPolicy, a WorkloadSelector in the RequestAuthentication, AuthorizationPolicy,
@ -91,8 +91,8 @@ metadata:
name: httpbin name: httpbin
namespace: foo namespace: foo
spec: spec:
targetRef: targetRefs:
name: waypoint - name: waypoint
kind: Gateway kind: Gateway
group: gateway.networking.k8s.io group: gateway.networking.k8s.io
action: DENY action: DENY

46
data/features.yaml
View File

@ -414,3 +414,49 @@ features:
link: "https://istio.io/latest/docs/setup/additional-setup/dual-stack/" link: "https://istio.io/latest/docs/setup/additional-setup/dual-stack/"
nextExpectedPromotion: "" nextExpectedPromotion: ""
area: Core area: Core
# Ambient
- name: "Ztunnel Core"
level:
checklist: features/ambient.md
maturity: Beta
area: Ambient
- name: "Waypoints Core"
level:
checklist: features/ambient.md
maturity: Beta
area: Ambient
- name: "Authorization Policies"
level:
checklist: features/ambient.md
maturity: Beta
area: Ambient
- name: "Gateway API (HTTPRoute)"
level:
checklist: features/ambient.md
maturity: Beta
area: Ambient
- name: "Sidecar Interop"
level:
checklist: features/ambient.md
maturity: Alpha
area: Ambient
- name: "DNS Proxying"
level:
checklist: features/ambient.md
maturity: Alpha
area: Ambient
- name: "Multi-cluster"
level:
checklist: features/ambient.md
maturity: Alpha
area: Ambient
- name: "Multi-network"
level:
checklist: features/ambient.md
maturity: Experimental
area: Ambient
- name: "Dual Stack, IPv6"
level:
checklist: features/ambient.md
maturity: Experimental
area: Ambient