mirror of https://github.com/istio/istio.io.git
Change 'plain text' to plaintext. (#4103)
This commit is contained in:
Martin Taillefer
GitHub
parent
0590227ae3
commit
c86583e1f4
|
|
@ -357,6 +357,7 @@ peek
|
|||
pem
|
||||
PKI
|
||||
PKIs
|
||||
plaintext
|
||||
platform-specific
|
||||
pluggability
|
||||
pluggable
|
||||
|
|
|
|||
|
|
@ -248,7 +248,7 @@ For a client to call a server with mutual TLS authentication:
|
|||
#### Permissive mode
|
||||
|
||||
Istio mutual TLS has a permissive mode, which allows a service to accept
|
||||
both plain text traffic and mutual TLS traffic at the same time. This
|
||||
both plaintext traffic and mutual TLS traffic at the same time. This
|
||||
feature greatly improves the mutual TLS onboarding experience.
|
||||
|
||||
Many non-Istio clients communicating with a non-Istio server presents a
|
||||
|
|
@ -259,10 +259,10 @@ do so on some clients. Even after installing the Istio sidecar on the
|
|||
server, the operator cannot enable mutual TLS without breaking existing
|
||||
communications.
|
||||
|
||||
With the permissive mode enabled, the server accepts both plain text and
|
||||
With the permissive mode enabled, the server accepts both plaintext and
|
||||
mutual TLS traffic. The mode provides great flexibility for the
|
||||
on-boarding process. The server's installed Istio sidecar takes mutual TLS
|
||||
traffic immediately without breaking existing plain text traffic. As a
|
||||
traffic immediately without breaking existing plaintext traffic. As a
|
||||
result, the operator can gradually install and configure the client's
|
||||
Istio sidecars to send mutual TLS traffic. Once the configuration of the
|
||||
clients is complete, the operator can configure the server to mutual TLS
|
||||
|
|
@ -508,7 +508,7 @@ recommendations to avoid disruption when updating your authentication policies:
|
|||
|
||||
- To enable or disable mutual TLS: Use a temporary policy with a `mode:` key
|
||||
and a `PERMISSIVE` value. This configures receiving services to accept both
|
||||
types of traffic: plain text and TLS. Thus, no request is dropped. Once all
|
||||
types of traffic: plaintext and TLS. Thus, no request is dropped. Once all
|
||||
clients switch to the expected protocol, with or without mutual TLS, you can
|
||||
replace the `PERMISSIVE` policy with the final policy. For more information,
|
||||
visit the [Mutual TLS Migration tutorial](/docs/tasks/security/mtls-migration).
|
||||
|
|
|
|||
|
|
@ -155,7 +155,7 @@ The tables below show changes made to the installation options used to customize
|
|||
| `global.tracer.zipkin.address` | `""` | |
|
||||
| `global.defaultNodeSelector` | `{}` | `Default node selector to be applied to all deployments so that all pods can beconstrained to run a particular nodes. Each component can overwrite these defaultvalues by adding its node selector block in the relevant section below and settingthe desired values.` |
|
||||
| `global.meshExpansion.enabled` | `false` | |
|
||||
| `global.meshExpansion.useILB` | `false` | `If set to true, the pilot and citadel mtls and the plain text pilot portswill be exposed on an internal gateway` |
|
||||
| `global.meshExpansion.useILB` | `false` | `If set to true, the pilot and citadel mutual TLS and the plaintext Pilot ports will be exposed on an internal gateway` |
|
||||
| `global.multiCluster.enabled` | `false` | `Set to true to connect two kubernetes clusters via their respectiveingressgateway services when pods in each cluster cannot directlytalk to one another. All clusters should be using Istio mTLS and musthave a shared root CA for this model to work.` |
|
||||
| `global.defaultPodDisruptionBudget.enabled` | `true` | |
|
||||
| `global.useMCP` | `true` | `Use the Mesh Control Protocol (MCP) for configuring Mixer andPilot. Requires galley (--set galley.enabled=true).` |
|
||||
|
|
|
|||
|
|
@ -42,8 +42,8 @@ This permits customization of Istio to operator specific requirements.
|
|||
{{< tabset cookie-name="profile" >}}
|
||||
|
||||
{{< tab name="permissive mutual TLS" cookie-value="permissive" >}}
|
||||
When using the permissive mutual TLS mode, all services accept both plain text and
|
||||
mutual TLS traffic. Clients send plain text traffic unless configured for
|
||||
When using the permissive mutual TLS mode, all services accept both plaintext and
|
||||
mutual TLS traffic. Clients send plaintext traffic unless configured for
|
||||
[mutual migration](/docs/tasks/security/mtls-migration/#configure-clients-to-send-mutual-tls-traffic).
|
||||
Visit our [mutual TLS permissive mode page](/docs/concepts/security/#permissive-mode)
|
||||
for more information.
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@ You can configure Istio services to send mutual
|
|||
TLS traffic to that service while connections from legacy services will not
|
||||
lose communication. Moreover, you can use the
|
||||
[Grafana dashboard](/docs/tasks/telemetry/metrics/using-istio-dashboard/) to check which services are
|
||||
still sending plain text traffic to the service in "PERMISSIVE" mode and choose to lock
|
||||
still sending plaintext traffic to the service in "PERMISSIVE" mode and choose to lock
|
||||
down once the migration is done.
|
||||
|
||||
## Before you begin
|
||||
|
|
@ -90,7 +90,7 @@ spec:
|
|||
EOF
|
||||
{{< /text >}}
|
||||
|
||||
`sleep.foo` and `sleep.bar` should start sending mutual TLS traffic to `httpbin.foo`. And `sleep.legacy` still sends plain text
|
||||
`sleep.foo` and `sleep.bar` should start sending mutual TLS traffic to `httpbin.foo`. And `sleep.legacy` still sends plaintext
|
||||
traffic to `httpbin.foo` since it does not have sidecar thus `DestinationRule` does not apply.
|
||||
|
||||
Now we confirm all requests to `httpbin.foo` still succeed.
|
||||
|
|
@ -137,7 +137,7 @@ $ for from in "foo" "bar" "legacy"; do kubectl exec $(kubectl get pod -l app=sle
|
|||
{{< /text >}}
|
||||
|
||||
If you can't migrate all your services to Istio (injecting Envoy sidecar), you have to stay at `PERMISSIVE` mode.
|
||||
However, when configured with `PERMISSIVE` mode, no authentication or authorization checks will be performed for the plain text traffic by default.
|
||||
However, when configured with `PERMISSIVE` mode, no authentication or authorization checks will be performed for plaintext traffic by default.
|
||||
We recommend you use [Istio Authorization](/docs/tasks/security/authz-http/) to configure different paths with different authorization policies.
|
||||
|
||||
## Cleanup
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
{"version":3,"sources":["../../src/ts/themes_init.ts"],"names":[],"mappings":"kBAcM,CAAA,cAAc,CAAG,Y,CACjB,SAAS,CAAG,Y,CACZ,aAAa,CAAG,iB,CAChB,UAAU,CAAG,a,CACb,cAAc,CAAG,kB,CACjB,WAAW,CAAG,O,CAEpB,QAAS,CAAA,eAAT,CAAyB,CAAzB,CAA6C,CAE3B,MAAV,GAAA,CAFqC,CAGrC,CAAK,CAAG,SAH6B,CAIpB,OAAV,GAAA,CAJ8B,GAKrC,CAAK,CAAG,UAL6B,EAQrC,CAAK,GAAK,SAR2B,CASrC,QAAQ,CAAC,eAAT,CAAyB,SAAzB,CAAmC,GAAnC,CAAuC,cAAvC,CATqC,CAWrC,QAAQ,CAAC,eAAT,CAAyB,SAAzB,CAAmC,MAAnC,CAA0C,cAA1C,CAXqC,CAgBzC,GAAI,CAAA,CAAI,CAAG,QAAQ,CAAC,cAAT,CAAwB,cAAxB,CAAX,CACI,CAjBqC,GAkBjC,CAAK,GAAK,SAlBuB,CAmBjC,CAAI,CAAC,SAAL,CAAe,MAAf,CAAsB,MAAtB,CAnBiC,CAqBjC,CAAI,CAAC,SAAL,CAAe,GAAf,CAAmB,MAAnB,CArBiC,EAyBzC,CAAI,CAAG,QAAQ,CAAC,cAAT,CAAwB,aAAxB,CAzBkC,CA0BrC,CA1BqC,GA2BjC,CAAK,GAAK,SA3BuB,CA4BjC,CAAI,CAAC,SAAL,CAAe,GAAf,CAAmB,MAAnB,CA5BiC,CA8BjC,CAAI,CAAC,SAAL,CAAe,MAAf,CAAsB,MAAtB,CA9BiC,CAiC5C,CAED,QAAS,CAAA,UAAT,CAAoB,CAApB,CAAgC,MACtB,CAAA,CAAM,CAAG,CAAI,CAAG,GADM,CAEtB,CAAE,CAAG,QAAQ,CAAC,MAAT,CAAgB,KAAhB,CAAsB,GAAtB,CAFiB,CAG5B,IAAK,GAAI,CAAA,CAAT,GAAc,CAAA,CAAd,CAAkB,MACS,GAAhB,GAAA,CAAC,CAAC,MAAF,CAAS,CAAT,CADO,EAEV,CAAC,CAAG,CAAC,CAAC,SAAF,CAAY,CAAZ,CAAe,CAAC,CAAC,MAAjB,CAAJ,CAGJ,GAA0B,CAAtB,GAAA,CAAC,CAAC,OAAF,CAAU,CAAV,CAAJ,CACI,MAAO,CAAA,CAAC,CAAC,SAAF,CAAY,CAAM,CAAC,MAAnB,CAA2B,CAAC,CAAC,MAA7B,CAEd,CACD,MAAO,KACV,CAED,QAAS,CAAA,iBAAT,EAA0B,CACtB,GAAI,MAAM,CAAC,UAAP,CAAkB,8BAAlB,EAAkD,OAAtD,CACI,MAAO,CAAA,SAAP,CAFkB,MAGX,CAAA,MAAM,CAAC,UAAP,CAAkB,+BAAlB,EAAmD,OAHxC,CAIX,UAJW,CAMf,IACV,CAGD,GAAI,CAAA,WAAW,CAAG,UAAU,CAAC,WAAD,CAA5B,CACoB,IAAhB,GAAA,W,GACA,WAAW,CAAG,iBAAiB,E,EAEnC,eAAe,CAAC,WAAD,C","file":"themes_init.min.js","sourcesContent":["// Copyright 2019 Istio Authors\r//\r// Licensed under the Apache License, Version 2.0 (the \"License\");\r// you may not use this file except in compliance with the License.\r// You may obtain a copy of the License at\r//\r// http://www.apache.org/licenses/LICENSE-2.0\r//\r// Unless required by applicable law or agreed to in writing, software\r// distributed under the License is distributed on an \"AS IS\" BASIS,\r// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r// See the License for the specific language governing permissions and\r// limitations under the License.\r\rconst darkThemeClass = \"dark-theme\";\rconst darkTheme = \"Dark Theme\";\rconst darkThemeItem = \"dark-theme-item\";\rconst lightTheme = \"Light Theme\";\rconst lightThemeItem = \"light-theme-item\";\rconst styleCookie = \"style\";\r\rfunction applyStyleSheet(theme: string | null): void {\r // convert legacy cookie values\r if (theme === \"dark\") {\r theme = darkTheme;\r } else if (theme === \"light\") {\r theme = lightTheme;\r }\r\r if (theme === darkTheme) {\r document.documentElement.classList.add(darkThemeClass);\r } else {\r document.documentElement.classList.remove(darkThemeClass);\r }\r\r // set the active theme menu item\r\r let item = document.getElementById(lightThemeItem);\r if (item) {\r if (theme === darkTheme) {\r item.classList.remove(active);\r } else {\r item.classList.add(active);\r }\r }\r\r item = document.getElementById(darkThemeItem);\r if (item) {\r if (theme === darkTheme) {\r item.classList.add(active);\r } else {\r item.classList.remove(active);\r }\r }\r}\r\rfunction readCookie(name: string): string | null {\r const nameEQ = name + \"=\";\r const ca = document.cookie.split(\";\");\r for (let c of ca) {\r while (c.charAt(0) === \" \") {\r c = c.substring(1, c.length);\r }\r\r if (c.indexOf(nameEQ) === 0) {\r return c.substring(nameEQ.length, c.length);\r }\r }\r return null;\r}\r\rfunction readSystemDefault(): string | null {\r if (window.matchMedia(\"(prefers-color-scheme: dark)\").matches) {\r return darkTheme;\r } else if (window.matchMedia(\"(prefers-color-scheme: light)\").matches) {\r return lightTheme;\r }\r return null;\r}\r\r\rlet cookieValue = readCookie(styleCookie);\rif (cookieValue === null) {\r cookieValue = readSystemDefault();\r}\rapplyStyleSheet(cookieValue);\r"]}
|
||||
{"version":3,"sources":["../../src/ts/themes_init.ts"],"names":[],"mappings":"kBAcM,CAAA,cAAc,CAAG,Y,CACjB,SAAS,CAAG,Y,CACZ,aAAa,CAAG,iB,CAChB,UAAU,CAAG,a,CACb,cAAc,CAAG,kB,CACjB,WAAW,CAAG,O,CAEpB,QAAS,CAAA,eAAT,CAAyB,CAAzB,CAA6C,CAE3B,MAAV,GAAA,CAFqC,CAGrC,CAAK,CAAG,SAH6B,CAIpB,OAAV,GAAA,CAJ8B,GAKrC,CAAK,CAAG,UAL6B,EAQrC,CAAK,GAAK,SAR2B,CASrC,QAAQ,CAAC,eAAT,CAAyB,SAAzB,CAAmC,GAAnC,CAAuC,cAAvC,CATqC,CAWrC,QAAQ,CAAC,eAAT,CAAyB,SAAzB,CAAmC,MAAnC,CAA0C,cAA1C,CAXqC,CAgBzC,GAAI,CAAA,CAAI,CAAG,QAAQ,CAAC,cAAT,CAAwB,cAAxB,CAAX,CACI,CAjBqC,GAkBjC,CAAK,GAAK,SAlBuB,CAmBjC,CAAI,CAAC,SAAL,CAAe,MAAf,CAAsB,MAAtB,CAnBiC,CAqBjC,CAAI,CAAC,SAAL,CAAe,GAAf,CAAmB,MAAnB,CArBiC,EAyBzC,CAAI,CAAG,QAAQ,CAAC,cAAT,CAAwB,aAAxB,CAzBkC,CA0BrC,CA1BqC,GA2BjC,CAAK,GAAK,SA3BuB,CA4BjC,CAAI,CAAC,SAAL,CAAe,GAAf,CAAmB,MAAnB,CA5BiC,CA8BjC,CAAI,CAAC,SAAL,CAAe,MAAf,CAAsB,MAAtB,CA9BiC,CAiC5C,CAED,QAAS,CAAA,UAAT,CAAoB,CAApB,CAAgC,MACtB,CAAA,CAAM,CAAG,CAAI,CAAG,GADM,CAEtB,CAAE,CAAG,QAAQ,CAAC,MAAT,CAAgB,KAAhB,CAAsB,GAAtB,CAFiB,CAG5B,IAAK,GAAI,CAAA,CAAT,GAAc,CAAA,CAAd,CAAkB,MACS,GAAhB,GAAA,CAAC,CAAC,MAAF,CAAS,CAAT,CADO,EAEV,CAAC,CAAG,CAAC,CAAC,SAAF,CAAY,CAAZ,CAAe,CAAC,CAAC,MAAjB,CAAJ,CAGJ,GAA0B,CAAtB,GAAA,CAAC,CAAC,OAAF,CAAU,CAAV,CAAJ,CACI,MAAO,CAAA,CAAC,CAAC,SAAF,CAAY,CAAM,CAAC,MAAnB,CAA2B,CAAC,CAAC,MAA7B,CAEd,CACD,MAAO,KACV,CAED,QAAS,CAAA,iBAAT,EAA0B,CACtB,GAAI,MAAM,CAAC,UAAP,CAAkB,8BAAlB,EAAkD,OAAtD,CACI,MAAO,CAAA,SAAP,CAFkB,MAGX,CAAA,MAAM,CAAC,UAAP,CAAkB,+BAAlB,EAAmD,OAHxC,CAIX,UAJW,CAMf,IACV,CAED,GAAI,CAAA,WAAW,CAAG,UAAU,CAAC,WAAD,CAA5B,CACoB,IAAhB,GAAA,W,GACA,WAAW,CAAG,iBAAiB,E,EAEnC,eAAe,CAAC,WAAD,C","file":"themes_init.min.js","sourcesContent":["// Copyright 2019 Istio Authors\r//\r// Licensed under the Apache License, Version 2.0 (the \"License\");\r// you may not use this file except in compliance with the License.\r// You may obtain a copy of the License at\r//\r// http://www.apache.org/licenses/LICENSE-2.0\r//\r// Unless required by applicable law or agreed to in writing, software\r// distributed under the License is distributed on an \"AS IS\" BASIS,\r// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r// See the License for the specific language governing permissions and\r// limitations under the License.\r\rconst darkThemeClass = \"dark-theme\";\rconst darkTheme = \"Dark Theme\";\rconst darkThemeItem = \"dark-theme-item\";\rconst lightTheme = \"Light Theme\";\rconst lightThemeItem = \"light-theme-item\";\rconst styleCookie = \"style\";\r\rfunction applyStyleSheet(theme: string | null): void {\r // convert legacy cookie values\r if (theme === \"dark\") {\r theme = darkTheme;\r } else if (theme === \"light\") {\r theme = lightTheme;\r }\r\r if (theme === darkTheme) {\r document.documentElement.classList.add(darkThemeClass);\r } else {\r document.documentElement.classList.remove(darkThemeClass);\r }\r\r // set the active theme menu item\r\r let item = document.getElementById(lightThemeItem);\r if (item) {\r if (theme === darkTheme) {\r item.classList.remove(active);\r } else {\r item.classList.add(active);\r }\r }\r\r item = document.getElementById(darkThemeItem);\r if (item) {\r if (theme === darkTheme) {\r item.classList.add(active);\r } else {\r item.classList.remove(active);\r }\r }\r}\r\rfunction readCookie(name: string): string | null {\r const nameEQ = name + \"=\";\r const ca = document.cookie.split(\";\");\r for (let c of ca) {\r while (c.charAt(0) === \" \") {\r c = c.substring(1, c.length);\r }\r\r if (c.indexOf(nameEQ) === 0) {\r return c.substring(nameEQ.length, c.length);\r }\r }\r return null;\r}\r\rfunction readSystemDefault(): string | null {\r if (window.matchMedia(\"(prefers-color-scheme: dark)\").matches) {\r return darkTheme;\r } else if (window.matchMedia(\"(prefers-color-scheme: light)\").matches) {\r return lightTheme;\r }\r return null;\r}\r\rlet cookieValue = readCookie(styleCookie);\rif (cookieValue === null) {\r cookieValue = readSystemDefault();\r}\rapplyStyleSheet(cookieValue);\r"]}
|
||||
|
|
@ -1 +1 @@
|
|||
// Copyright 2019 Istio Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
const darkThemeClass = "dark-theme";
const darkTheme = "Dark Theme";
const darkThemeItem = "dark-theme-item";
const lightTheme = "Light Theme";
const lightThemeItem = "light-theme-item";
const styleCookie = "style";
function applyStyleSheet(theme: string | null): void {
// convert legacy cookie values
if (theme === "dark") {
theme = darkTheme;
} else if (theme === "light") {
theme = lightTheme;
}
if (theme === darkTheme) {
document.documentElement.classList.add(darkThemeClass);
} else {
document.documentElement.classList.remove(darkThemeClass);
}
// set the active theme menu item
let item = document.getElementById(lightThemeItem);
if (item) {
if (theme === darkTheme) {
item.classList.remove(active);
} else {
item.classList.add(active);
}
}
item = document.getElementById(darkThemeItem);
if (item) {
if (theme === darkTheme) {
item.classList.add(active);
} else {
item.classList.remove(active);
}
}
}
function readCookie(name: string): string | null {
const nameEQ = name + "=";
const ca = document.cookie.split(";");
for (let c of ca) {
while (c.charAt(0) === " ") {
c = c.substring(1, c.length);
}
if (c.indexOf(nameEQ) === 0) {
return c.substring(nameEQ.length, c.length);
}
}
return null;
}
function readSystemDefault(): string | null {
if (window.matchMedia("(prefers-color-scheme: dark)").matches) {
return darkTheme;
} else if (window.matchMedia("(prefers-color-scheme: light)").matches) {
return lightTheme;
}
return null;
}
let cookieValue = readCookie(styleCookie);
if (cookieValue === null) {
cookieValue = readSystemDefault();
}
applyStyleSheet(cookieValue);
|
||||
// Copyright 2019 Istio Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
const darkThemeClass = "dark-theme";
const darkTheme = "Dark Theme";
const darkThemeItem = "dark-theme-item";
const lightTheme = "Light Theme";
const lightThemeItem = "light-theme-item";
const styleCookie = "style";
function applyStyleSheet(theme: string | null): void {
// convert legacy cookie values
if (theme === "dark") {
theme = darkTheme;
} else if (theme === "light") {
theme = lightTheme;
}
if (theme === darkTheme) {
document.documentElement.classList.add(darkThemeClass);
} else {
document.documentElement.classList.remove(darkThemeClass);
}
// set the active theme menu item
let item = document.getElementById(lightThemeItem);
if (item) {
if (theme === darkTheme) {
item.classList.remove(active);
} else {
item.classList.add(active);
}
}
item = document.getElementById(darkThemeItem);
if (item) {
if (theme === darkTheme) {
item.classList.add(active);
} else {
item.classList.remove(active);
}
}
}
function readCookie(name: string): string | null {
const nameEQ = name + "=";
const ca = document.cookie.split(";");
for (let c of ca) {
while (c.charAt(0) === " ") {
c = c.substring(1, c.length);
}
if (c.indexOf(nameEQ) === 0) {
return c.substring(nameEQ.length, c.length);
}
}
return null;
}
function readSystemDefault(): string | null {
if (window.matchMedia("(prefers-color-scheme: dark)").matches) {
return darkTheme;
} else if (window.matchMedia("(prefers-color-scheme: light)").matches) {
return lightTheme;
}
return null;
}
let cookieValue = readCookie(styleCookie);
if (cookieValue === null) {
cookieValue = readSystemDefault();
}
applyStyleSheet(cookieValue);
|
||||
Loading…
Reference in New Issue