Commit Graph

115 Commits

Author SHA1 Message Date
Frank Budinsky 412f03105c
Kubernetes Ingress Test + fixes (#7662)
* Kubernetes Ingress Test + fixes

* cleanup

* fix circuit-breaking test

* fix lint

* remove -it
2020-07-06 07:54:35 -07:00
Frank Budinsky eadc0629dc
Authz TD migration test (#7653)
* Authz TD migration tests

* cleanup

* remove samples source
2020-06-30 20:23:20 -07:00
Frank Budinsky 01c4cce951
Add proper wait for config calls to tests (#7620)
* Add wait for config calls to tests

* two more
2020-06-24 09:48:29 -07:00
Frank Budinsky 25c3be4772
Some random poor quality doc fixes (#7589)
* Some random poor quality doc fixes

* change profiles
2020-06-19 11:25:02 -07:00
Hongyi Zhang 5fbb14bedc
Convert all old tests to new tests (#7522)
* add an example task to test

* main test function: save progress

* a working example: routing request

* improve log info and error handling

* introduce makefile

* run each test as a subtest; remove common setup from test.sh

* add another test.sh: fault-injection

* improve error handling

* check test environment

* add two more test.sh files

* fix make command for istio setup

* update two test.sh files from upstream

* add comments and update README.md

* update test.sh files from upstream

* support multiple test names

* update README

* update README.md for new framework

* remove documentation of migration steps

* undo format changes

* change separation line to '# @cleanup'

* move go code and makefile from content/ to tests/

* change package name

* make for loop more readable

* change the set of auto-sourced scripts

* add docs for all functions

* approach to deal with folders with the same name

* minor fixes to ensure everything still runs

* fix make gen error

* add a TIMEOUT argument

* make sure util/debug.sh works with new framework

* make lint-go happy

* [BIG CHANGE] allow different istio setup configs

* make linters happy

* make linters happier

* changed wording and function orders

* make error return as the 2nd argument

* add TODOs

* Update content/en/docs/tasks/traffic-management/traffic-shifting/test.sh

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* Update tests/README.md

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* Update tests/README.md

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* Update tests/README.md

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* Update tests/README.md

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* Update tests/README.md

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* Update tests/README.md

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* only test english docs

* Update tests/README.md

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* allow test.sh as suffix

* move adding setup configs to tests/setup

* recommend full paths

* Update tests/README.md

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* require full test paths

* converting old tests to new tests: traffic-management and misc

* converting old tests to new tests: security

* remove old tests

* Update content/en/docs/tasks/security/cert-management/dns-cert/test.sh

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* simplify setup configs

* Update content/en/docs/tasks/security/authentication/authn-policy/test.sh

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* Update content/en/docs/tasks/security/authentication/mtls-migration/test.sh

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* Update content/en/docs/tasks/security/authorization/authz-http/test.sh

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* do not let istioctl prompt y/n

* Update content/en/docs/tasks/traffic-management/ingress/ingress-sni-passthrough/test.sh

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* Update content/en/docs/tasks/traffic-management/ingress/secure-ingress/test.sh

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* Update content/en/docs/tasks/security/cert-management/plugin-ca-cert/test.sh

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* simplify stuff

* rename dns-cert test.sh to test_broken.sh

* fix dns-cert doc and test

* remove egress=disabled

* fix test

* Update content/en/docs/tasks/observability/logs/access-log/test.sh

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* Update content/en/docs/tasks/security/authentication/authn-policy/test.sh

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
2020-06-11 11:15:48 -07:00
Navraj Singh Chhina e7616b2ac0
Disable ShellChecking for SC2164 (#7507)
* add missing cleanup for vs nginx

* disable SC2164 which checks safe cd

* make gen
2020-06-08 13:56:32 -07:00
Shamsher Ansari 9fe272272b
update doc to use istioctl install (#7396) 2020-06-01 11:02:27 -07:00
Justin Pettit 877b438829
Authn policy (#7433)
* authn-policy: Point users to Istio installation guide.

Have users install Istio through the installation guide instead of
explicitly instructing them to run "istioctl manifest apply" in the
task.  This will make it easier to automate the task later.

* authn-policy: Make steps and expected response clear for testing.

* Add authn-policy user guide test.
2020-05-29 12:11:47 -07:00
Frank Budinsky e11cf24f0d
Add test: attribute to all md files (#7413) 2020-05-27 09:11:26 -07:00
Justin Pettit 21e03db9d9
Add authz-ingress user guide test. (#7407) 2020-05-27 06:40:06 -07:00
Justin Pettit 46607a1c43
authz-td-migration: Don't error when deleting non-existent items. (#7361) 2020-05-19 18:20:20 -07:00
Justin Pettit 7782eb1d0a
Authz jwt (#7338)
* snip.py: Replace github file token with release-specific URL.

* verify.sh: Show the expected output as well as the actual output.

* snip.py: Update the githubfile regex to not include email addresses.

When generating snip scripts, pairs of "@" signs indicate a link to
GitHub repo content.  However, JWT attribute values contained pairs of
email addresses such as:

    `testing@secure.istio.io/testing@secure.istio.io`

which would be treated as an email address and mangled.  This commit
rewrites the regex to not match on email addresses.

* Add authz-jwt user guide test.
2020-05-17 13:51:45 -04:00
Justin Pettit 8cacec48de
Authz deny (#7315)
* Add authz-tcp user guide test.

* Add run and verify functions for user doc tests.
2020-05-14 16:10:20 -07:00
Justin Pettit e77f3e8e2d
Add authz-tcp user guide test. (#7176)
Force merge because of netlify flake
2020-05-11 10:25:00 -04:00
Frank Budinsky f45bc9e1a8
Remove obsolete '# ' uses from all tests (#7233) 2020-05-06 19:17:11 -04:00
Eric Van Norman 392a2bee14
Update test framework to use 1.6.0-beta.0 (#7214)
* Update test framework to use 1.6.0-beta.0

* Go back to copies from env var

* Add more test targets, fix mtls test (new PA added)

* Update to use Istio SHA from go.mod (convert to long SHA)

* Try and remove TAG from prow

* Debug TAG not being set

* Fix paralization issue

* Remove some extra output

* Review comments
2020-05-06 10:49:27 -07:00
Oliver Liu 1e73594260
Restructure the cert management tasks. (#7209)
* Restructure the cert management tasks.

* Small fix.

* Fix references.

* Fix links

* Small fix.

* Update content/en/docs/tasks/security/cert-management/plugin-ca-cert/index.md

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

* Small fix.

* Change the weights.

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
2020-05-04 14:57:29 -04:00
jacob-delgado 7cf02b617d
Update Authentication page (#7198)
Fixes https://github.com/istio/istio.io/issues/7194
2020-04-30 10:58:57 -07:00
Frank Budinsky 1fe7056ffa
Partial convert mirror test to new model (#7153)
Reverted the actual mirror test script, because mirror test seems to have some subtle failure when running with what seems to be the exact same commands via snips. Will investigate further in followup PR. Merging this one to get the generator changes.
2020-04-25 12:34:24 -04:00
Mitch Connors e1b4de48f0
Fix cleanup to delete authorization policy (#7142)
Fixes https://github.com/istio/istio/issues/23190
2020-04-23 11:18:12 -07:00
Frank Budinsky a7107678f5
Convert TCP traffic shifting test (#7131)
* Convert TCP traffic shifting test

* lint errors

* regen

* test disable spellcheck

* temporary disable gen-check

* disable inappropriate bash lint errors

* disable gen check

* one more regen

* reenable gen check

* remove -it options

* revert commands

* fix app health check outdated
2020-04-22 18:26:27 -07:00
Istio Automation 9071b1f385
Fix code in 'Authorization for TCP traffic' (#7117)
The pod of tcp-echo which is asked its podIP is in `foo` namespace, so  the `kubectl get` should specify the namespace as `foo`.

Co-authored-by: Koki Tomoshige <36136133+tomocy@users.noreply.github.com>
2020-04-21 16:00:16 -04:00
lei-tang f8fd68c04b
User guide tests for DNS certificate management (#7103)
* User guide tests for DNS certificate management

- Add user guide tests for DNS certificate management
- Remove user guide's dependency on jq

* Use _verify_contains function
2020-04-21 07:32:39 -07:00
lei-tang 96073364ea
User guide tests and remove manual steps for plugging in CA cert (#7085)
* User guide tests and remove manual steps for plugging in CA cert

- Add user guide tests for plugging in CA cert
- Remove the manual steps in the user guide of plugging in CA cert
to make it easier for an user to try the guide.

* Fix SC2046 lint error and the trafficmanagement test errors
2020-04-17 09:16:56 -07:00
Frank Budinsky f2cf780bfb
Update doc test README (#7080)
* Update doc test README

* add sh

* tweaks

* formatting

* format

* fix comment

* wording

* convert mtls migration task

* Update tests/README.md

Co-Authored-By: Eric Van Norman <ericvn@us.ibm.com>

* Update tests/README.md

Co-Authored-By: Eric Van Norman <ericvn@us.ibm.com>

Co-authored-by: Eric Van Norman <ericvn@us.ibm.com>
2020-04-15 08:44:18 -07:00
Frank Budinsky 3b59501872
Generate test snippets from md files POC (#7044)
* Generate test snippets from md POC

* fixes

* fix python lint

* fix snip source

* improvements

* update snip calls

* add copyright header

* lint errors

* lint error in md instructions

* better default snip_id

* run test without snippet gen

* gofmt

* fixes

* fix path

* fixes

* fix verify
2020-04-14 07:13:44 -07:00
Eric Van Norman 55accd83b4
Update base64 -d to --decode (#7039)
* Update base64 -d to --decode

* Fix additional -d to --decode change
2020-04-09 06:41:44 -07:00
Eric Van Norman 1290482b63
Fix privildeged (#6997) 2020-04-02 08:12:33 -07:00
Jianfei Hu 8dc367d9fd
Add a tcpdump verification FAQ entry for mutual TLS effect proof. (#6922)
* add a tcpdump verification for mtls

* add period

* move to the migration doc.

* lint fixing

* address cmt.

* Apply suggestions from code review

Co-Authored-By: Frank Budinsky <frankb@ca.ibm.com>

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
2020-03-24 13:30:11 -04:00
John Pape 8ecc8fc10c
Add istiod to the glossary page (#6899)
* Add istiod to the glossary page

* Updated istio learning link.

* adding gloss links to first term usage in page

* Updated gloss links per review
2020-03-18 12:01:53 -04:00
Frank Budinsky 64d2c26267
Remove links to deleted istio_ca reference doc (#6895)
* Remove links to deleted istio_ca reference doc

* cacert->cacerts
2020-03-17 07:46:37 -07:00
lei-tang 2463045315
Update Istio DNS certificate document for Istio 1.5 (#6871)
* Update Istio DNS certificate document for Istio 1.5

* Revise overview based on review comments
2020-03-16 12:39:11 -07:00
tigran-a e8466022bd
Revert "cacerts secret to replace with istio-ca-secret (#6829)" (#6836)
This reverts commit d4eba6eb52.
2020-03-10 07:25:50 -07:00
tigran-a d4eba6eb52
cacerts secret to replace with istio-ca-secret (#6829)
Currently, 1.5.0 istiod is looking for istio-ca-secret, while in 1.4.x it was cacerts.
2020-03-09 13:21:37 -07:00
Istio Automation 0114e09f65
replace Citadel with Istio CA (#6825)
Since Citadel is now built in into istiod, the certificate authority should be called Istio CA

Co-authored-by: tigran-a <avanesovt@gmail.com>
2020-03-09 13:25:29 -04:00
Yangmin Zhu 686f3b7967
authz: update TCP task to use tcp-echo (#6754) 2020-03-06 11:33:38 -08:00
Diem Vu 055f5e480c
[Release-1.5] Delete auto-mTLS task (#6591)
* Delete auto-mTLS task

* Fix links

* Fix links

* Fix links on 1.5

* Fix links
2020-03-05 18:01:06 -08:00
Istio Automation 5f6d0712b8
Add a guide of plugging in CA cert to istiod and update CA documents (#6644)
Co-authored-by: lei-tang <lei-tang@users.noreply.github.com>
2020-03-05 10:42:54 -08:00
Istio Automation 2edbaeaf4b
Remove deep dive mtls taks. (#6706)
* remove deep dive

* update links

* lint fixing egs gw

* more removal

* link 1.0.3 lint
2020-03-04 13:15:26 -08:00
Istio Automation b5a4efb064
Another clean up for global.mtls.enable (#6611)
* Another clean up for global.mtl.enable

* Update text

* Lint

* Use --set values.grafana.enabled=true as overriding operator value example

* Revert change in content/en/docs/reference/commands/istioctl/index.html

* Change example istioctl command to override grafana settings

* Lint

* Change to --set addonComponents.grafana.enabled=true

* Remove global.mtls.enable in authn task

* Update content/en/docs/setup/install/istioctl/index.md

Co-Authored-By: Rigs Caballero <grca@google.com>

* Update content/en/docs/setup/install/multicluster/shared-vpn/index.md

Co-Authored-By: Rigs Caballero <grca@google.com>

* Update content/en/docs/tasks/security/authentication/authn-policy/index.md

Co-Authored-By: Rigs Caballero <grca@google.com>

* Update content/en/docs/tasks/security/citadel-config/plugin-ca-cert/index.md

Co-Authored-By: Rigs Caballero <grca@google.com>

* Update content/en/docs/setup/install/multicluster/shared-vpn/index.md

Co-Authored-By: Rigs Caballero <grca@google.com>

* Update content/en/docs/tasks/security/citadel-config/plugin-ca-cert/index.md

Co-Authored-By: Rigs Caballero <grca@google.com>

Co-authored-by: Rigs Caballero <grca@google.com>
2020-03-04 13:15:19 -08:00
Yangmin Zhu fa8a1f5da1
authz: update authz JWT task (#6693)
* authz: update authz JWT task

* address comments

* Update content/en/docs/tasks/security/authorization/authz-jwt/index.md

Co-Authored-By: Frank Budinsky <frankb@ca.ibm.com>

* Update content/en/docs/tasks/security/authorization/authz-jwt/index.md

Co-Authored-By: Frank Budinsky <frankb@ca.ibm.com>

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
2020-03-03 17:42:11 -08:00
Yangmin Zhu cba7f0fdfc
authz: add task for IP allow list and black list on ingress gateway (#6692)
* authz: add task for IP whitelist/blacklist on ingress gateway

* allow list and deny list

* Small grammar adjustments

* address comments

* Update content/en/docs/tasks/security/authorization/authz-ingress/index.md

Co-Authored-By: Frank Budinsky <frankb@ca.ibm.com>

* Update content/en/docs/tasks/security/authorization/authz-ingress/index.md

Co-Authored-By: Frank Budinsky <frankb@ca.ibm.com>

* Update content/en/docs/tasks/security/authorization/authz-ingress/index.md

Co-Authored-By: Frank Budinsky <frankb@ca.ibm.com>

Co-authored-by: Adam Miller <1402860+adammil2000@users.noreply.github.com>
Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
2020-03-03 17:42:03 -08:00
Jimmy Chen ca72d2997d
Updated guide for Authorization Policy Trust Domain Migration (#6694)
Remove an outdated step from the guide.
2020-03-03 16:27:45 -08:00
Diem Vu dde9ed9258
Fix per-port peer authentication command (#6682)
* Fix command

* Correct commands for mtls migration tasks

* Lint

* Lint
2020-03-02 14:43:03 -08:00
Jianfei Hu 6fb12b9c8e
Rewrite mtls migration instructions. (#6589)
* rewrite mtls migration doc.

* migrate out the comment out ones

* more service/wl swap, one level title up

* Update content/en/docs/tasks/security/authentication/mtls-migration/index.md

Co-Authored-By: Frank Budinsky <frankb@ca.ibm.com>

* lint fix, lockdown

* refer ns in lckdown

* reworded beginnig  sec

* remove the global.mtls.enabled.

* lint fix

* Apply suggestions from code review

Co-Authored-By: Frank Budinsky <frankb@ca.ibm.com>

* suggestion batch2.

Co-Authored-By: Frank Budinsky <frankb@ca.ibm.com>

* address turn3

Co-Authored-By: Frank Budinsky <frankb@ca.ibm.com>

* ns create separtae.

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>
2020-02-27 07:20:59 -08:00
Diem Vu bfb8eb0fb3
Remove https overlay task (#6596)
* Remove https overlay

* Remove ref
2020-02-26 13:22:59 -08:00
Adam Miller f387200b5c
Typo fixes for issue #6487 (#6526)
* Typo fixes

* Fix linter error

* Typo

* Clarification
2020-02-25 14:58:45 -08:00
Diem Vu e59a1998bf
Modernize authn tasks for 1.5 API and auto-mTLS by default (#6546)
* Modernize authn tasks for 1.5 API and auto-mTLS by default

* Also remove auto-mtls task as merge with the main task, as this mode is by default and having separate task is uneccessary

* Lint

* Update content/en/docs/tasks/security/authentication/authn-policy/index.md

Co-Authored-By: Rigs Caballero <grca@google.com>

* Update content/en/docs/tasks/security/authentication/authn-policy/index.md

Co-Authored-By: Rigs Caballero <grca@google.com>

* Update content/en/docs/tasks/security/authentication/authn-policy/index.md

Co-Authored-By: Rigs Caballero <grca@google.com>

* Address first round comments

* Lint

* Lint

* Address more review comments

* Lint

* Update content/en/docs/tasks/security/authentication/authn-policy/index.md

Co-Authored-By: Rigs Caballero <grca@google.com>

* Update content/en/docs/tasks/security/authentication/authn-policy/index.md

Co-Authored-By: Rigs Caballero <grca@google.com>

* Address comments and revert delete files to fix lint. Will remove in another PR

* Fix links

* More review

* Update content/en/faq/security/accessing-non-istio-services.md

Co-Authored-By: Rigs Caballero <grca@google.com>

* Update content/en/docs/tasks/security/authentication/authn-policy/index.md

Co-Authored-By: Rigs Caballero <grca@google.com>

Co-authored-by: Rigs Caballero <grca@google.com>
2020-02-25 10:13:25 -08:00
Yangmin Zhu c399db1761
authz: add task for deny policy (#6552)
* authz: add task for deny policy

* fix lint
2020-02-25 06:16:27 -08:00
lei-tang d0e36ce175
Update the document of DNS certificate management for Istio 1.5 (#6541) 2020-02-24 09:08:29 -08:00