* Update istio test reference
* Run make gen
* Fix ambient test ztunnel node selector
* try replacing niode selector with wildcard
* More test changes
* remove wildcarding on node
* Add new output line
* Re-enable processing of gateway-api version in `make gen`
* Update gateway-api to be the publicly released base version
* remove script and add awk in Makefile
* rebase and make gen
* Bump gateway api version used in examples
* Use gateway version var
Signed-off-by: Keith Mattix II <keithmattix@microsoft.com>
---------
Signed-off-by: Keith Mattix II <keithmattix@microsoft.com>
* Change Istio Classic terminology to Istio APIs
Signed-off-by: Keith Mattix II <keithmattix@microsoft.com>
* Fix stutter
Signed-off-by: Keith Mattix II <keithmattix@microsoft.com>
* Change back parallel structure formation
Signed-off-by: Keith Mattix II <keithmattix@microsoft.com>
---------
Signed-off-by: Keith Mattix II <keithmattix@microsoft.com>
* add doc for third party ingress
* fix mermaid maybe
* Fix spell checker
* na
* Apply suggestions from code review
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
Co-authored-by: Eric Van Norman <ericvn@us.ibm.com>
---------
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
Co-authored-by: Eric Van Norman <ericvn@us.ibm.com>
* single network services/endpoints can not have duplicate address
* Update content/en/docs/ops/deployment/deployment-models/index.md
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
---------
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
* [WIP] add doc tests for ambient getting started guide
Signed-off-by: Faseela K <faseela.k@est.tech>
* fix cleanup
Signed-off-by: Faseela K <faseela.k@est.tech>
* fix test
Signed-off-by: Faseela K <faseela.k@est.tech>
---------
Signed-off-by: Faseela K <faseela.k@est.tech>
* Update feature status for Experimental/Alpha
Based off of the feature status in features.yaml, update the
corresponding doc page.
Update navigation_level.html to only flag Experimental and Alpha
features with an asterisk '*', rather than all docs with _any_ status
set.
Add new 'alpha.md' boilerplate, similar to 'experimental.md', with a
link to https://github.com/istio/community/blob/master/FEATURE-LIFECYCLE.md
Add either 'boilerplate alpha' or 'boilerplate experimental' to all
pages which have Alpha or Experimental status set.
Tidy up pages which already had
'boilerplate experimental-feature-warning' and be consistent with
'boilerplate experimental'
Update tasks/observability/distributed-tracing/mesh-and-proxy-config
status from 'Beta/Experimental' to 'Beta', to match what's in
features.yaml (all others only have a single value here)
* Add content/zh/boilerplates/alpha.md
* Update content/en/boilerplates/alpha.md
Suggested change
Co-authored-by: Faseela K <k.faseela@gmail.com>
* Update the zh 'alpha' boilerplate to match
---------
Co-authored-by: Faseela K <k.faseela@gmail.com>
* Update Istio/SPIRE integration demo to use SPIRE Controller
Manager instead of k8s workload registration.
Signed-off-by: jaellio <jaellio@microsoft.com>
* Adds test for automatic workload registration via the SPIRE
controller manager. During cleanup, removes generated istio.yaml
and chaim.pem files. Updates label to
spiffe.io/spire-managed-identity.
Signed-off-by: jaellio <jaellio@microsoft.com>
* Adds missing newline
Signed-off-by: jaellio <jaellio@microsoft.com>
* Fix spelling error
Signed-off-by: jaellio <jaellio@microsoft.com>
* Add missing ns flag on role and rolebinding resource commands
Signed-off-by: jaellio <jaellio@microsoft.com>
* Delete sleep resources and uninstall before SPIRE
Signed-off-by: jaellio <jaellio@microsoft.com>
* Reconfigures demo so istio install is not expected to fail.
Created ClusterSPIFFEID before install istio. Previously install
would fail because the ingress gateway wasn't registered/
Signed-off-by: jaellio <jaellio@microsoft.com>
* Remove references to v1.14 and update required version to 1.14+
Signed-off-by: jaellio <jaellio@microsoft.com>
* Fix lint errors
Signed-off-by: jaellio <jaellio@microsoft.com>
---------
Signed-off-by: jaellio <jaellio@microsoft.com>
* Gloss refs and other small improvemetents in ambient docs
* Update content/en/docs/ops/ambient/architecture/index.md
Co-authored-by: John Howard <howardjohn@google.com>
---------
Co-authored-by: John Howard <howardjohn@google.com>
* Make ambient warning more extreme
* Update content/en/docs/ops/ambient/getting-started/index.md
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
---------
Co-authored-by: Lin Sun <lin.sun@solo.io>
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
* ambient: add traffic routing docs
This fills in part of the architecture doc for ambient.
Note this is intentionally low-level. This attempts to mirror
https://istio.io/latest/docs/ops/configuration/traffic-management/traffic-routing/
but for ambient.
* Address Frank's comments
* Update content/en/docs/ops/ambient/architecture/index.md
Co-authored-by: Lin Sun <lin.sun@solo.io>
* Update content/en/docs/ops/ambient/architecture/index.md
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
---------
Co-authored-by: Lin Sun <lin.sun@solo.io>
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
* doc-global-downstream-max-conn-helm
* Add instructions to set global_downstream_max_connections with Helm
* Fix https://github.com/istio/istio/issues/37443
* Fix linting errors
* Address comments
* Remove global_downstream_max_connections from .spelling and add backticks where missing
* Simplify instructions on how to set global_downstream_max_connections
* build an archive of v1.16 in master
* update data/versions.yml and archive index page
* advance master to release-1.18
* Fix lint by moving back to older files - Note automated job will fail lint.
* Temporarily disable the istioctl-analyze test
* Termporarily remove the Performance page from the website
* Update preformance links to point to doc's relese version or latest existing page.
* Fixup another link
* Add more context
* Update content/en/docs/ops/configuration/traffic-management/network-topologies/index.md
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
* Update content/en/docs/ops/configuration/traffic-management/network-topologies/index.md
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
* Update content/en/docs/ops/configuration/traffic-management/network-topologies/index.md
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
* Update content/en/docs/ops/configuration/traffic-management/network-topologies/index.md
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
* As per discuss in https://github.com/istio/istio/pull/42962#issuecomment-1402236303
* Lint fix
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
* fix: envoy statistics config documentation
* chore: make gen
* feat: sync from istio/api
* Update content/zh/docs/ops/configuration/telemetry/envoy-stats/index.md
Co-authored-by: Michael <haifeng.yao@daocloud.io>
Co-authored-by: Michael <haifeng.yao@daocloud.io>
* Add documentations for SkyWalking integration and task
* Add script to undeploy skywalking
* Clean up istio namespace
* Update index.md
* Address review comments
* Apply suggestions from code review
Co-authored-by: Eric Van Norman <ericvn@us.ibm.com>
Co-authored-by: Eric Van Norman <ericvn@us.ibm.com>
* build an archive of v1.14 in master
* update data/versions.yml and archive index page
* advance master to release-1.16
* Rerun `make update_ref_docs
* Update to commit on main branch to fix tests
* Disable failing test (temporary)
* Update for Wasm contents
* Fix the wrong cleanup code
* Fix the description of `extensibility` folder's description
* Apply suggestions from code review
Co-authored-by: craigbox <craigbox@google.com>
* Update _index.md
* Regenerate snips
* Add old URL path as an alias
* Update content/en/docs/tasks/extensibility/_index.md
* Add description for the wasm pull policy
Signed-off-by: Ingwon Song <igsong@google.com>
* Apply suggestions from code review
Co-authored-by: Douglas Reid <douglas-reid@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: craigbox <craigbox@google.com>
* Applying the comment from @dgn
Co-authored-by: craigbox <craigbox@google.com>
Co-authored-by: Douglas Reid <douglas-reid@users.noreply.github.com>
* Update to use the master branch of istio.io/istio for test refs
* go.* changes
* Update test and go.*
* Update to use `master` branch for make targets
* One final go mod tidy
* REmove vm test for now.
* Remove istioctl-analyze test
* Also remove using-istio-dashboard
Fixes some broken suggested recording rules that treated
`istio_tcp_sent_bytes_total` and `istio_tcp_sent_received_total` as if
they were distribution type metrics rather than counters.
I have also reordered the metrics to more closely align with the order
on the "Istio Standard Metrics" page.
Fixes#10311
* Add document on "Understanding DNS"
This is a follow-on to the recent docs "Understanding traffic routing"
and "Understanding TLS" where I attempt to give in depth explainations
of some of the implementation details of some commonly misunderstood
parts of Istio.
In particular, this aims to clear up how app DNS, DNS proxying, and
Envoy DNS resolution interact.
* Apply suggestions from code review
Co-authored-by: Eric Van Norman <ericvn@us.ibm.com>
* Add non-success info
* Update content/en/docs/ops/configuration/traffic-management/dns/index.md
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
* tie in dns proxy
* Apply suggestions from code review
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
Co-authored-by: Eric Van Norman <ericvn@us.ibm.com>
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
* Add note about gateways to protocol selection
* Apply suggestions from code review
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
* Information about holdApplicationUntilProxyStarts
This is a very extended topic about networking issues with pods with the istio-proxy sidecar container and is not spread or well documented.
Many people using solutions as "curl -fsI http://localhost:15021/healthz/ready", or post start hooks, even changing logics in scripts etc.
Adding this in this related documentation can help people find this feature easily.
* Fix letfover d
Remove leftover d in added
* Apply suggestions from craigbox
Co-authored-by: craigbox <craigbox@google.com>
* Update index.md
Remove trailing space in line 245.
Co-authored-by: Adrian Rico <aseguirico@gmail.com>
Co-authored-by: craigbox <craigbox@google.com>
* Added a small section on common errors while accessing headless services
* Fixed lint errors
* Removed unnecessary config details
* Few corrections and restructuring
* Updated commands for easier copying
* build an archive of v1.11 in master
* update data/versions.yml and archive index page
* advance master to release-1.13
* ANother script update
* go get remaing istio repos to satisfy linter
* Temporarily fix link broken by istio/api #2148
* Temporarily disable istioctl analyze test.
* add authz limitation
* Apply suggestions from code review
Co-authored-by: Eric Van Norman <ericvn@us.ibm.com>
Co-authored-by: Eric Van Norman <ericvn@us.ibm.com>
* Update to latest istio/istio commit for istio.io tests
* Update to latest istio commit
* Additional istioctl analyze output
* Fix istioctl-analyze test
* Fix gateway doc
* Fix setting of INGRESS_HOST and more cleanup
* Fixes for unbound INGRESS_HOST
* lint fix
Co-authored-by: John Howard <howardjohn@google.com>
* Improve DestinationRule Security Best Practices
* Add instructions for improving security using subjectAltNames which is
not checked by default.
* Add instructions to turn on VERIFY_CERTIFICATE_AT_CLIENT to decrease
friction of checking certificates against a CA.
* Escalate certificate validation that is not being done to a warning to
increase visibility.
* Add Clarification to certificate validation.
* Add explanation of using system to enable OS CA certificate usage.
* Clarify subjectAltName usage and why it is important
* Fix linter error
* Clarify CA cert used and user need for an sni value
* build an archive of v1.10 in master
* update data/versions.yml and archive index page
* advance master to release-1.12
* Update istio test reference to pick up 1.12 in istioctl messages
* Fix lint and IMAGE_VERSION
* MOre changes for lint
* Use correct IMAGE_VERSION
* Skip virtual machines test - Release Blocker issue created
* add best practice to restart proxies after applying network policy
* Update content/en/docs/ops/best-practices/security/index.md
Co-authored-by: craigbox <craigbox@google.com>
Co-authored-by: craigbox <craigbox@google.com>
* Document rewriting of TCP based probes (see istio 33734)
https://github.com/istio/istio/pull/33734
Co-authored-by: Philipp Stehle <philipp.stehle@sap.com>
* run make gen
* make it obvious that the same rewrite action is done on both HTTP and TCP probes
Co-authored-by: craigbox <craigbox@google.com>
* fix typo
* apply more review comments
Co-authored-by: Philipp Stehle <philipp.stehle@sap.com>
Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>
Co-authored-by: craigbox <craigbox@google.com>
Co-authored-by: Johannes Dillmann <j.dillmann@sap.com>
Now that the Kiali addon has been upgraded to v1.36, there is no longer the monitoring dashboard CRD that we have to worry about. This is what caused that timing error (the CRD would fail to be established in time before the dashboards themselves started to get created).
Since this timing error won't happen, we can remove this warning in the docs.
* add normalization guideline in security best practice
* Apply suggestions from code review
Co-authored-by: Justin Pettit <jdpettit@google.com>
* add link
* Apply suggestions from code review
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
Co-authored-by: Justin Pettit <jdpettit@google.com>
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
* add mitigation for unsupported normalization in security best practice
* address comments
* address comments
* Apply suggestions from code review
Co-authored-by: Justin Pettit <jdpettit@google.com>
* Apply suggestions from code review
Co-authored-by: Eric Van Norman <ericvn@us.ibm.com>
* address comments
Co-authored-by: Justin Pettit <jdpettit@google.com>
Co-authored-by: Eric Van Norman <ericvn@us.ibm.com>
* Flag experimental pages with dagger
* Use dagger symbol in title
* Dagger in navigation titles for experimental status
* Experimental asterisk note
* Asterisk with space
* Spacing between title and asterisk
* Flag experimental and alpha status
* add direct pod IP troubleshooting guide for multicluster
* wording
* fix text blocks
* you instead of we
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
* close text block
* spelling
* lint
* wording
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
* update the auto mtls troubleshooting guide.
* address first round cmd, eds, grep.
* update the limitation on peer authn wording.
* lint fix.
* address comments for EDS, clarification.
* upload content
* update to be brief.
* Update content/en/docs/ops/common-problems/security-issues/index.md
Co-authored-by: Eric Van Norman <ericvn@us.ibm.com>
Co-authored-by: Eric Van Norman <ericvn@us.ibm.com>
* build an archive of v1.9 in master
* update data/versions.yml and archive index page
* advance master to release-1.11
* Update the istio test reference to master
* Remove failing deny test
* Remove another test
* Remove a third test
Eric Van Norman
Keith Mattix II
Michael
Kuat
Ric Hincapie
Istio Automation
NisheekaNynan1
John Howard
Xiaopeng Han
Faseela K
Frank Budinsky
Daneyon Hansen
Kevin Park
Zhonghu Xu
Lin Sun
Paddy Doyle
Jackie Elliott
SRodi
zirain
Peter Jausovec
Ben Leggett
Steve Zhang
Alan Wang
Max Lambrecht
Aryan Gupta
Mariam John
kezhenxu94
Darnele Pierre-Louis
Tong Li
stewartbutler
abasitt
Jacek Ewertowski
Ingwon Song
Jason Wang
Yossi Mesika
rotimiawani
Oliver Liu
yanrongshi
merusso
Alexandre Alves Alvino
Dennis Effing
Pengyuan Bian
nickgooding
keyolk
Edgar Hernández
sha-rath
Steven Landow
Daniel Gospodinow
Yangmin Zhu
Andrii
Kenan O'Neal
Philipp Stehle
jacob-delgado
John Mazzitelli
Costin Manolache
ChristinaMak
Cynthia Lopes do Sacramento
Shamsher Ansari
Jianfei Hu
Suchith J N
Jake Sanders
craigbox