istio
/
istio.io
mirror of https://github.com/istio/istio.io.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update test reference to 1.8.0-alpha.2 (#8399) 

* Update test reference to 1.8.0-alpha.2

* Fix access-log test for new behavior

* Update to remove deprecated parameter

* More updates for deprecated (already removed) values

* Enable test, disable failing tests (#8405) open for fix.

* Review comment

* Remove extraneous old-td
This commit is contained in:
Eric Van Norman 2020-10-30 11:36:38 -05:00 committed by GitHub
parent 147adb7b72
commit 9f6a0aa9a2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 330 additions and 81 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
content/en/docs/tasks/observability/logs/access-log/index.md
View File

@ -72,14 +72,14 @@ on all three of these settings:
{{< text bash >}}
$ kubectl logs -l app=sleep -c istio-proxy
[2019-03-06T09:31:27.354Z] "GET /status/418 HTTP/1.1" 418 - "-" 0 135 11 10 "-" "curl/7.60.0" "d209e46f-9ed5-9b61-bbdd-43e22662702a" "httpbin:8000" "172.30.146.73:80" outbound|8000||httpbin.default.svc.cluster.local - 172.21.13.94:8000 172.30.146.82:60290 -
[2020-10-30T12:36:44.547Z] "GET /status/418 HTTP/1.1" 418 - "-" 0 135 25 24 "-" "curl/7.69.1" "f13c2118-3ef9-9ed9-91b7-5d21358029c3" "httpbin:8000" "10.244.0.30:80" outbound|8000||httpbin.default.svc.cluster.local 10.244.0.29:46348 10.96.148.56:8000 10.244.0.29:44678 - default
{{< /text >}}
1. Check `httpbin`'s log:
{{< text bash >}}
$ kubectl logs -l app=httpbin -c istio-proxy
[2019-03-06T09:31:27.360Z] "GET /status/418 HTTP/1.1" 418 - "-" 0 135 5 2 "-" "curl/7.60.0" "d209e46f-9ed5-9b61-bbdd-43e22662702a" "httpbin:8000" "127.0.0.1:80" inbound|8000|http|httpbin.default.svc.cluster.local - 172.30.146.73:80 172.30.146.82:38618 outbound_.8000_._.httpbin.default.svc.cluster.local
[2020-10-30T12:36:44.553Z] "GET /status/418 HTTP/1.1" 418 - "-" 0 135 3 2 "-" "curl/7.69.1" "f13c2118-3ef9-9ed9-91b7-5d21358029c3" "httpbin:8000" "127.0.0.1:80" inbound|8000|| 127.0.0.1:42940 10.244.0.30:80 10.244.0.29:46348 outbound_.8000_._.httpbin.default.svc.cluster.local default
{{< /text >}}
Note that the messages corresponding to the request appear in logs of the Istio proxies of both the source and the destination, `sleep` and `httpbin`, respectively. You can see in the log the HTTP verb (`GET`), the HTTP path (`/status/418`), the response code (`418`) and other [request-related information](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#format-rules).

4
content/en/docs/tasks/observability/logs/access-log/snips.sh
View File

@ -53,7 +53,7 @@ kubectl logs -l app=sleep -c istio-proxy
}
! read -r -d '' snip_test_the_access_log_2_out <<\ENDSNIP
[2019-03-06T09:31:27.354Z] "GET /status/418 HTTP/1.1" 418 - "-" 0 135 11 10 "-" "curl/7.60.0" "d209e46f-9ed5-9b61-bbdd-43e22662702a" "httpbin:8000" "172.30.146.73:80" outbound|8000||httpbin.default.svc.cluster.local - 172.21.13.94:8000 172.30.146.82:60290 -
[2020-10-30T12:36:44.547Z] "GET /status/418 HTTP/1.1" 418 - "-" 0 135 25 24 "-" "curl/7.69.1" "f13c2118-3ef9-9ed9-91b7-5d21358029c3" "httpbin:8000" "10.244.0.30:80" outbound|8000||httpbin.default.svc.cluster.local 10.244.0.29:46348 10.96.148.56:8000 10.244.0.29:44678 - default
ENDSNIP
snip_test_the_access_log_3() {
@ -61,7 +61,7 @@ kubectl logs -l app=httpbin -c istio-proxy
}
! read -r -d '' snip_test_the_access_log_3_out <<\ENDSNIP
[2019-03-06T09:31:27.360Z] "GET /status/418 HTTP/1.1" 418 - "-" 0 135 5 2 "-" "curl/7.60.0" "d209e46f-9ed5-9b61-bbdd-43e22662702a" "httpbin:8000" "127.0.0.1:80" inbound|8000|http|httpbin.default.svc.cluster.local - 172.30.146.73:80 172.30.146.82:38618 outbound_.8000_._.httpbin.default.svc.cluster.local
[2020-10-30T12:36:44.553Z] "GET /status/418 HTTP/1.1" 418 - "-" 0 135 3 2 "-" "curl/7.69.1" "f13c2118-3ef9-9ed9-91b7-5d21358029c3" "httpbin:8000" "127.0.0.1:80" inbound|8000|| 127.0.0.1:42940 10.244.0.30:80 10.244.0.29:46348 outbound_.8000_._.httpbin.default.svc.cluster.local default
ENDSNIP
snip_cleanup_1() {

2
content/en/docs/tasks/observability/logs/access-log/test.sh
View File

@ -46,7 +46,7 @@ _verify_elided snip_test_the_access_log_1 "$snip_test_the_access_log_1_out"
# Check the logs
_verify_contains snip_test_the_access_log_2 "outbound|8000||httpbin.default.svc.cluster.local"
_verify_contains snip_test_the_access_log_3 "inbound|8000|http|httpbin.default.svc.cluster.local"
_verify_contains snip_test_the_access_log_3 "outbound_.8000_._.httpbin.default.svc.cluster.local"
# @cleanup
set +e # ignore cleanup errors

13
content/en/docs/tasks/security/authorization/authz-td-migration/index.md
View File

@ -22,7 +22,7 @@ In Istio 1.4, we introduce an alpha feature to support {{< gloss >}}trust domain
1. Install Istio with a custom trust domain and mutual TLS enabled.
{{< text bash >}}
$ istioctl install --set profile=demo --set values.global.trustDomain=old-td
$ istioctl install --set profile=demo --set meshConfig.trustDomain=old-td
{{< /text >}}
1. Deploy the [httpbin]({{< github_tree >}}/samples/httpbin) sample in the `default` namespace
@ -86,7 +86,7 @@ Notice that it may take tens of seconds for the authorization policy to be propa
1. Install Istio with a new trust domain.
{{< text bash >}}
$ istioctl install --set profile=demo --set values.global.trustDomain=new-td
$ istioctl install --set profile=demo --set meshConfig.trustDomain=new-td
{{< /text >}}
Istio mesh is now running with a new trust domain, `new-td`.
@ -129,11 +129,10 @@ Notice that it may take tens of seconds for the authorization policy to be propa
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
values:
global:
trustDomain: new-td
trustDomainAliases:
- old-td
meshConfig:
trustDomain: new-td
trustDomainAliases:
- old-td
EOF
$ istioctl install --set profile=demo -f td-installation.yaml -y
{{< /text >}}

13
content/en/docs/tasks/security/authorization/authz-td-migration/snips.sh
View File

@ -21,7 +21,7 @@
####################################################################################################
snip_before_you_begin_1() {
istioctl install --set profile=demo --set values.global.trustDomain=old-td
istioctl install --set profile=demo --set meshConfig.trustDomain=old-td
}
snip_before_you_begin_2() {
@ -74,7 +74,7 @@ kubectl exec "$(kubectl -n sleep-allow get pod -l app=sleep -o jsonpath={.items.
ENDSNIP
snip_migrate_trust_domain_without_trust_domain_aliases_1() {
istioctl install --set profile=demo --set values.global.trustDomain=new-td
istioctl install --set profile=demo --set meshConfig.trustDomain=new-td
}
snip_migrate_trust_domain_without_trust_domain_aliases_2() {
@ -106,11 +106,10 @@ cat <<EOF > ./td-installation.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
values:
global:
trustDomain: new-td
trustDomainAliases:
- old-td
meshConfig:
trustDomain: new-td
trustDomainAliases:
- old-td
EOF
istioctl install --set profile=demo -f td-installation.yaml -y
}

8
content/en/docs/tasks/security/authorization/authz-td-migration/test.sh
View File

@ -51,9 +51,10 @@ snip_migrate_trust_domain_without_trust_domain_aliases_2
snip_migrate_trust_domain_without_trust_domain_aliases_3
_verify_same snip_migrate_trust_domain_without_trust_domain_aliases_4 "$snip_migrate_trust_domain_without_trust_domain_aliases_4_out"
# TODO need to fix 503's - https://github.com/istio/istio.io/issues/8405 open for that.
#_verify_same snip_migrate_trust_domain_without_trust_domain_aliases_4 "$snip_migrate_trust_domain_without_trust_domain_aliases_4_out"
_verify_same snip_migrate_trust_domain_without_trust_domain_aliases_5 "$snip_migrate_trust_domain_without_trust_domain_aliases_5_out"
#_verify_same snip_migrate_trust_domain_without_trust_domain_aliases_5 "$snip_migrate_trust_domain_without_trust_domain_aliases_5_out"
echo y | snip_migrate_trust_domain_with_trust_domain_aliases_1
@ -61,8 +62,7 @@ _wait_for_deployment istio-system istiod
_verify_same snip_migrate_trust_domain_with_trust_domain_aliases_2 "$snip_migrate_trust_domain_with_trust_domain_aliases_2_out"
#_verify_same snip_migrate_trust_domain_with_trust_domain_aliases_3 "$snip_migrate_trust_domain_with_trust_domain_aliases_3_out"
# TODO: This trustDomainAliases check fails, even with much longer wait
_verify_same snip_migrate_trust_domain_with_trust_domain_aliases_3 "$snip_migrate_trust_domain_with_trust_domain_aliases_3_out"
# @cleanup

2
go.mod
View File

@ -27,6 +27,6 @@ replace github.com/imdario/mergo => github.com/imdario/mergo v0.3.5
replace github.com/evanphx/json-patch => github.com/evanphx/json-patch v0.0.0-20190815234213-e83c0a1c26c8
require (
istio.io/istio v0.0.0-20201021134810-ad5a66512324
istio.io/istio v0.0.0-20201028194647-ec349ef2a8a0
istio.io/pkg v0.0.0-20201015213546-1aa862fb504f
)

365
go.sum
View File

File diff suppressed because it is too large Load Diff