As with version v1.4.0, Experimental multi-cluster setup has been added to istioctl
The following command also provides istio-multicluster-destinationrule and host information
kubectl get destinationrule --all-namespaces
The banner now points to the current release's announcement page, which is really
the 'dashboard' for a new release, and has all the right links for the user.
`istioctl manifest apply --set profile=demo --set cni.enabled=true --set values.cni.cniBinDir=/home/kubernetes/bin` by default put the `istio-cni-node` daemonset in istio-system namespace. The cni pod fails to create.
According to the helm command here 3fc0e65d94/README.md (usage) `istio manifest` should set cni.namespace to kube-system on gke
Signed-off-by: Yuchen Dai <silentdai@gmail.com>
These fix problems encountered when switching to the new Hugo which has
a completely different markdown engine. I went through diffs of the generated
HTML and made required adjustments.
- We don't need cookies for istio.io, the few settings we do have should be
managed with browser-local storage instead. This is a better privacy posture,
and avoids sending needless data to the server for every request.
- Move some info to front-matter in the different security bulletins
such that it can be used when building the security bulleting index page.
- Update the security bulletin index page to show affected relesses and
impact score.
- Make it so table headers are vertically centered, which looks a lot nicer
when there are a combination of single-line and multi-line headers in the
same table.
- Add a few checks to correctly hide draft mode documents from sight
in more cases.
- Remove a stale document that's been in draft mode since first being
created in 2017.
- Clean up a bit of text in some release notes.
* Add note about annotations to control traffic
Fixes https://github.com/istio/istio/issues/19258
* Update content/en/docs/tasks/traffic-management/egress/egress-control/index.md
Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>
* use a subset in the destination rule for TLS origination
this way the TLS origination will only be applied for the traffic directed by the
virtual service for TLS origination. TLS origination will not be applied for the original TLS traffic
* add a check that the original TLS traffic works as before
- Remove some stray characters at the top of the page.
- Fix scrolling behavior such that the selected letter stays on the
screen. This broke due to a bug fix on the istioctl page which had
an unexpected side effect,
- Remove extraneous alias that could lead to infinite redirect loops.
* update istioctl download instruction
```
$ curl -L https://istio.io/downloadIstioctl | ISTIO_VERSION=1.4.0 sh -
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 101 100 101 0 0 261 0 --:--:-- --:--:-- --:--:-- 260
100 2339 100 2339 0 0 4524 0 --:--:-- --:--:-- --:--:-- 4524
Downloading istioctl-1.4.0-osx.tar.gz from https://github.com/istio/istio/releases/download/1.4.0/istioctl-1.4.0-osx.tar.gz ...
istioctl-1.4.0-osx.tar.gz download complete!
Add the istioctl to your path with:
export PATH=$PATH:$HOME/.istioctl/bin
Begin the Istio pre-installation verification check by running:
istioctl verify-install
Need more information? Visit https://istio.io/docs/reference/commands/istioctl/
```
* Update content/en/docs/ops/diagnostic-tools/istioctl/index.md
Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>
* [kiali] add viewing and editing Istio configuration YAML to the task
* The linter is failing this because it considered "Config" a spelling error. However, the actual GUI menu item is literally called "Istio Config".
Because of this, I cannot format "Istio Config" in simply bold letters (which is the Istio doc standard for denoting GUI elements).
Thus, even though its a GUI element, I have to surround with backticks to avoid this being considered a spelling error.
* Incorporate review suggestion.
Fix some other things I noticed.
* Added the Best Practices section with general principles.
This is the beginning of the new Best Practices section.
Our goal is to provide a section for all the best practices and recommendations
for Istio deployments. The best practices are based on the identified and
recommended deployment models.
Signed-off-by: rcaballeromx <grca@google.com>
* Change headings for clarity.
Adds clarity to some passages based on feedback.
Removes a list of recommendations that was causing some confusion.
Adds a glossary entry for failure domains and how they relate to a
platform's availability zones.
Signed-off-by: rcaballeromx <grca@google.com>
* Move Best Practices to Ops Guide
Signed-off-by: rcaballeromx <grca@google.com>
* Moved Deployment Best Practices to a new "Prepare Your Deployment" section.
Moved all deployment preparation content into a new section under "Setup".
For now the content includes the following sections:
- Deployment models
- Deployment best practices
- Pod requirements
Merged the two existing pages containing pod requirements into one single page.
Signed-off-by: rcaballeromx <grca@google.com>
* Replace example with better guidance around namespace tenancy.
Signed-off-by: Rigs Caballero <grca@google.com>
* Add links and language pointing to the Prepare section
Signed-off-by: Rigs Caballero <grca@google.com>
* Fix minor typos and broken links.
Signed-off-by: Rigs Caballero <grca@google.com>
* Move from Setup to Operations
Signed-off-by: Rigs Caballero <grca@google.com>
* Fix broken links
Signed-off-by: Rigs Caballero <grca@google.com>
* Fix rebasing issues.
Signed-off-by: Rigs Caballero <grca@google.com>
* Fix multicluster install link.
Signed-off-by: Rigs Caballero <grca@google.com>
* [kiali] add a new section that creates a weighted route to show kiali is more than just a pretty graph.
* spell checker failed, I assume "dropdown" and "checkbox" and "popup" must not be compound words.
(I can't get the linter to run locally on my box, so I have to commit this and see what travis says)
* address suggestions.
* Alot of the Istio community does not know that Kiali is more than just a graph.
We want to get that across. This Task can't cover it all, so this commit
adds a link to the "Features" page of the kiali website
which lists the non-graph features as well so people can at least
learn about those other features.
* add a task to show kiali validation
* Update multicluster shared-vpn doc
Update docs for the multicluster installation for Shared control plane (single-network) to make it work with `istioctl manifest`.
* Update index.md
* Apply suggestions from code review
Co-Authored-By: Frank Budinsky <frankb@ca.ibm.com>
* Added Verify Istio CNI to observability-issues.md
If using the Istio CNI to avoid granting `NET_ADMIN` to pods, the CNI
node pods must be running for metrics to be collected. The helm charts
don't include a PodSecurityPolicy, so the documentation guides users to
a non-working setup if the cluster has PodSecurityPolicy enabled.
* Markup changes to PodSecurityPolicy and NET_ADMIN
* Added backticks to `PodSecurityPolicy`
* Added backticks and link to NET_ADMIN capability requirement
* Removed trailing whitespace on line 39
* Added backticks to `istio-init`
* Use 'istioctl dashboard' instead of port-forward
* bold references to UI elements
* Cleanup dashboards
* Address comments
* Mention control-c, which is easier way to stop dashboard
Let's make additional changes in a followup PR.
* Replace "Mesh Expansion" with "VM Support" and related edits.
To avoid confusion and improve the visibility of the VM-related content, these
changes align with terminology used by our users.
Signed-off-by: rcaballeromx <grca@google.com>
* Fix descriptions, titles and link texts.
Addressed the feedback given around the link text still containing "mesh
expansion". Also addressed the feedback around the accuracy of the
titles and descriptions used.
Signed-off-by: rcaballeromx <grca@google.com>
* Fix bullets and descriptions.
Signed-off-by: rcaballeromx <grca@google.com>
* Return content to examples.
Signed-off-by: rcaballeromx <grca@google.com>
* Fix broken links.
Signed-off-by: rcaballeromx <grca@google.com>
* Fix title for accuracy.
Signed-off-by: rcaballeromx <grca@google.com>
* Fix links for ZH content.
Signed-off-by: rcaballeromx <grca@google.com>
* Fix language for clarity.
Signed-off-by: rcaballeromx <grca@google.com>
* Fix broken link to SDS task.
Signed-off-by: rcaballeromx <grca@google.com>
* Fix merge conflicts.
Signed-off-by: Rigs Caballero <grca@google.com>
* Update istioctl analyze ops doc to not recommend using master
* Apply suggestions from code review
Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>
* fix link
* update telemetry v2 to use istio/istio test data
* Update content/en/docs/ops/telemetry/in-proxy-service-telemetry/index.md
Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>
* Update content/en/docs/ops/telemetry/in-proxy-service-telemetry/index.md
Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>
- Improved look of the call to action buttons
- Removed redundant attributions on all news items, those were
leftovers from when the relesse notes were in the blog section.
- Used consistent subtitles and descriptions for all news items.
* Improve root transition doc.
* Small fix.
* Small fix.
* Small fix.
* Small fix.
* Update index.md
* Update index.md
* Small fix.
* Small fix.
* Small fix.
* Fix auth installation and its references.
* Apply suggestions from code review
Fix according to the feedback.
Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>
* User guide for istioctl managing webhooks
* Generate the webhook configurations
* Skip long config
* Move the task to be under setup/install directory
* Add jq as a prerequisite
* Decouple installation from the user guide
* Add explanations to config
* Change the weight
* Revisions on cleanup
* Revise headings
* Revise the search instructions
* Revise the wordings
* Revise install instructions and location
* Skip --validation
* Use istioctl to generate webhook configurations
* Use istioctl to install
* Revise the commands
* Revise the wording
* Remove two comment lines
* User guide for Istio DNS certificates
A guide of how to provision and manage DNS certificates in Istio.
* Explain why uses this feature
* Use the boilerplate command
* Unindent a text block
* Add jq as a prerequisite
* Decouple installation step from the user guide
* Wording revisions
* Wording revisions and change weight
* Follow the same installation approach of CNI
* Revise the writing
* Merge the javascript functions
* Fix the lint error
- ./public/docs/tasks/security/dns-cert/index.html
* linking to /docs/setup/install/helm/#dnscerts, but dnscerts does not exist (line 58176)
<a href="/docs/setup/install/helm/#dnscerts">Customizable Install with Helm</a>
htmlproofer 3.12.0 | Error: HTML-Proofer found 1 failure!
* Use istioctl to install Istio
* Revisions according to review comments
* Add an explanation
* Revise based on review comments
* Remove the referrence to a file
* first rewrite of the DR removal till global mTLS section.
* remove all destinationrule for authn policy doc.
* lint fix
* add separate page for automtls
* restore the original authn policy
* new page with auto mtls separately.
* fix the lint
* fix lint and using istioctl manifest.
* complete the instructions for auto mlts
* finish and verify with install
* more delta before and after in strict
* header with certificate identity.
* no more helm
* apply the suggestion.
- Fix a bunch of heading capitalization.
- Remove words that shouldn't be in the dictionary
and update the text accordingly.
- Added a few @@ sequences to reference content files from text blocks.
- Used a few {{< source_branch_name >}} sequences to refer to the proper
branch in GitHub rather than master.
* remove completed pods
as they aren't shown any more, not seeing them in the generated manifest via `istioctl manifest generate --set profile=demo`
* remove sidecars
We also recently removed sidecars for policy telemetry and pilot for demo profile.
* Draft of upgrade docs
* Fixed PR comments
* More PR review comments addressed
* Added note about -f and --set flag support
* Further PR comments
* shortcode added for istioctl
* rebase and typo fixes
* Typo fixes
* fix the certificate and private key generation for the first section
* rewrite the second section
* fix the third section
* fix the troubleshooting section
* remove a reference to generating certificates and keys in the ingress passthru task
* a certificates -> a certificate, Generate a certificate -> Create a certificate
* add a cleanup subsection to set desired outbound traffic policy mode
the title: "Set the `global.outboundTrafficPolicy.mode` to your desired mode"
* remove a redundant empty line
* rename the subsection to be "Set the outbound traffic policy mode to your desired value"
* remove a semicolon at the end of the subsection's title
* add `uniq` so the output of the current outbound traffic policy mode will appear once
- Support snippets that specify the body syntax and output
syntax of the snippet.
- Snippets with bash syntax triggered an incorrect error message.
- No error message was produced for a misnamed snippet
- Convert a security task to use snippets to populate its
many preformatted blocks.
* modify watch namespace to only Istio-operator
also start the eval with demo profile first.
* use demo as the first starting point
* update grab script
* add watch ns
* fix lint
In release this is changed to below:
```yaml
global:
# Default hub for Istio images.
# Releases are published to docker hub under 'istio' project.
# Daily builds from prow are on gcr.io
hub: docker.io/istio
# Default tag for Istio images.
tag: 1.3.2
```
Not sure how to fix, but having the dev defaults here may be misleading.
Yan Xue
youmoo
Jianfei Hu
Martin Taillefer
Frank Budinsky
Xinnan Wen
Chris Wilson
Joe Selman
Johannes Scheuermann
Shamsher Ansari
chentanjun
Kuat
Yuchen Dai
jbounds83
Istio Automation
Jonas Lomholdt
Hongzhi
Venil Noronha
John Howard
Adam Miller
David Ebbo
imgbot[bot]
Vadim Eisenberg
Eric Van Norman
Jonh Wendell
Neeraj Poddar
Phillip Quy Le
Iris
Steven Dake
Lin Sun
John Mazzitelli
mtail
Rigs Caballero
John Zheng
Tao HE
Martin Ostrowski
Arun Fung
Kevin Kunkel
carolynhu
Ed Snible
Eric Buehl
Jimmy Chen
Jason Parraga
Diem Vu
lei-tang
Pengyuan Bian
Oliver Liu
Yangmin Zhu
leo
Dirk Jablonski
Morven Cao
Brian Avery
Naoki Oketani
Gary Brown
Jesse Lumme
craigbox
Zhonghu Xu