Add options in CLI for setting proxy CPU and memory limits
- Deprecated `proxy-cpu` and `proxy-memory` in favor of `proxy-cpu-limit` and `proxy-memory-limit`
- Updated validations and tests to reflect new options
Signed-off-by: TwinProduction <twin@twinnation.org>
All Grafana graphs use shared tooltips (display all series in the
tooltip rather than the one currently moused-over), except for 3 graphs
in the Linkerd Health dashboard.
This change ensures all tooltips are shared.
Signed-off-by: Andrew Seigner <siggy@buoyant.io>
The httpbin responses recently started returning `url` fields starting
with `https`, regardless of the protocol used in the request.
This change modifies the egress integration test to always expect
`https` in the `url` response field.
This is a workaround until #2316 is implemented.
Signed-off-by: Andrew Seigner <siggy@buoyant.io>
Currently, we use request_total for the variable query to determine the names in
the grafana dropdowns. We should use a non-http-based metric instead, so that if
there is only TCP traffic, the dropdowns will still be populated.
This branch uses process_start_time_seconds instead of the http-based
request_total to query for grafana variables
When changing templates, it's can be pretty time-intensive to
repair all test fixtures.
This change instruments CLI tests with two flags, `-update` and
`-pretty-diff` that control how test fixtures are diffed. When the
`-update` flag is set, the tests fixtures are overwritten as tests
execute. The `-pretty-diff` flag causes the full text of the fixture
to be printed on mismatch.
Define the global and proxy configs protobuf types that will be used by CLI install, inject and the proxy-injector.
Signed-off-by: Ivan Sim <ivan@buoyant.io>
chart/templates/base.yaml is nearly 800 lines and contains the
kubernetes configurations for the marjority of the control plane.
Furthermore, its contents are not particularly organized (for example,
the prometheus RBAC bindings are in the middle of the controller's
configuration).
The size and complexity of this file makes it especially daunting to
introduce new functionality.
In order to make the situation easier to understand and change, this
splits base.yaml into several new template files: namespace, controller,
serviceprofile, and prometheus, and grafana. The `tls.yaml` template has
been renamed `ca.yaml`, since it installs the `linkerd-ca` resources.
This change also makes the comments uniform, adding a "header" to each
logical component.
Fixes#2154
66070c26 introduced an invalid glob, causing tools like rg(1) to emit
warnings like:
./.gitignore: line 17: error parsing glob '**.gogen*': invalid use of **; must be one path component
The control-plane's clients, specifically the Kubernetes clients, did
not provide telemetry information.
Introduce a `prometheus.ClientWithTelemetry` wrapper to instrument
arbitrary clients. Apply this wrapper to Kubernetes clients.
Fixes#2183
Signed-off-by: Andrew Seigner <siggy@buoyant.io>
Up until now, the proxy-api controller service has been the sole service
that the proxy communicates with, implementing the majoriry of the API
defined in the `linkerd2-proxy-api` repo. But this is about to change:
linkerd/linkerd2-proxy-api#25 introduces a new Identity service; and
this service must be served outside of the existing proxy-api service
in the linkerd-controller deployment (so that it may run under a
distinct service account).
With this change, the "proxy-api" name becomes less descriptive. It's no
longer "the service that serves the API for the proxy," it's "the
service that serves the Destination API to the proxy." Therefore, it
seems best to bite the bullet and rename this to be the "destination"
service (i.e. because it only serves the
`io.linkerd.proxy.destination.Destination` service).
Co-authored-by: Kevin Lingerfelt <kl@buoyant.io>
Signed-off-by: Kevin Lingerfelt <kl@buoyant.io>
# Problem
When a route does not specify a timeout, the proxy-api defaults to the default
timeout and logs an error:
```
time="2019-02-13T16:29:12Z" level=error msg="failed to parse duration for route POST /io.linkerd.proxy.destination.Destination/GetProfile: time: invalid duration"
```
# Solution
We now check if a route timeout is blank. If it is not set, it is set to
`DefaultRouteTimeout`. If it is set, we try to parse it into a `Duration`.
A request was made to improve logging to include the service profile and
namespace as well.
# Validation
With valid service profiles installed, edit the `.yaml` to include an invalid
`timeout`:
```
...
name: GET /
timeout: foo
```
We should now see the following errors:
```
proxy-api time="2019-02-13T22:27:32Z" level=error msg="failed to parse duration for route 'GET /' in service profile 'webapp.default.svc.cluster.local' in namespace 'default': time: invalid duration foo"
```
This error does not show up when `timeout` is blank.
Fixes#2276
Signed-off-by: Kevin Leimkuhler <kevinl@buoyant.io>
golangci-lint disables some checks for golint, including checks for
well-formed comments on all exported symbols
This change disables the golangci-lint's `exclude-use-default` setting,
to run golint with default settings.
Also introduce a `.golangci.yml` file to centralize config.
Signed-off-by: Andrew Seigner <siggy@buoyant.io>
The way these tests compare the hard-coded base64-encoded JSON
patches with those generated by the proxy injector, is extremely
brittle. Changing any of the proxy configuration causes these tests
to break, even though the proxy injector itself isn't affected.
Also, the AdmissionRequest and AdmissionResponse types are "boundary
objects" that are largely irrelevant to our code.
Fixes#2201
Signed-off-by: Ivan Sim <ivan@buoyant.io>
`Dockerfile-proxy` executes several commands following
`bin/fetch-proxy`, but the subsequent commands were separated by
semicolon, so the overall RUN command would succeed regardless of what
`bin/fetch-proxy` returned. This meant that if `bin/docker-build-proxy`
was run on a proxy SHA prior to it being available, it would fail the
build, but cache the unsuccessful `fetch-proxy` command, and continue to
fail after the proxy becomes available.
This change concatenates `fetch-proxy` and subsequent commands using
ampersands, failing the build if `fetch-proxy` fails.
Signed-off-by: Andrew Seigner <siggy@buoyant.io>
Add a `-cover` param to the Go tests in ci, along with instructions in
`TEST.md` for manually evaluating test coverage.
Signed-off-by: Andrew Seigner <siggy@buoyant.io>
`golangci-lint` performs numerous checks on Go code, including golint,
ineffassign, govet, and gofmt.
This change modifies `bin/lint` to use `golangci-lint`, and replaces
usage of golint and govet.
Also perform a one-time gofmt cleanup:
- `gofmt -s -w controller/`
- `gofmt -s -w pkg/`
Part of #217
Signed-off-by: Andrew Seigner <siggy@buoyant.io>
Fixes#2255.
When Kubernetes periodically pinged booksapp to perform a health check, the
lack of namespace violated the `TapLink` component's propTypes requirement.
This triggered a warning in the browser console when on the web UI Top view.
Working with @rmars, I removed the namespace requirement from propTypes and
moved the check for an empty namespace to the top of the component to avoid an
unnecessary queryString construction.
edge-19.2.1 included a breaking change related to the namespace where
`ServiceProfile`s are defined.
This change updates the release notes for that release to indicate the
breaking change.
Relates to linkerd/website#156
Signed-off-by: Andrew Seigner <siggy@buoyant.io>
Fixes#2232
The Linkerd logo on the top left of the web UI is now wrapped in a
`react-router-dom` Link component so that clicking it redirects to `/overview`.
commit 59d00f69653730353ec246b8cb2eb39d80a54d3e
Author: Oliver Gould <ver@buoyant.io>
Date: Mon Feb 11 10:51:37 2019 -0800
Log canonicalization warnings on only the first error (#189)
When a canonicalization task fails to resolve a name, our logging is not
particularly clear about the current state of the stack. Specifically,
it's difficult to know whether the stack has resolved the name
successfully before.
With this change, canonicalization failures are logged (at warning, not
error) only when the task has not previously resolved a name.
Subsequent errors are now logged at the debug level (instead of
warning).
The existing hint URLs printing by `linkerd check` pointed to locations
that would change if the linkerd.io website was reorganized.
linkerd/website#148 introduces an alias for hint URLs at
https://linkerd.io/checks/. This is the corresponding change to update
`linkerd check` output.
Depends on linkerd/website#148, relates to linkerd/website#146.
Signed-off-by: Andrew Seigner <siggy@buoyant.io>
Fixes#2220
The service profile validation which is part of `linkerd check` only validates service profiles in the Linkerd namespace. Due to a recent change, service profiles now can exist in any namespace.
Update the logic so that service profiles in all namespaces are validated.
Additionally:
* Relax validation of service profile names to support external names
Signed-off-by: Alex Leong <alex@buoyant.io>
@rmars and I set out to replace all instances of lodash filter with native
filter in order to prevent the additional import. However, there was only one
use of _filter that could be easily replaced, since our other uses depend on
lodash's ability to handle empty variables, and the ability to filter both
objects and arrays (JS's native filter is only for arrays). Switching to native
filter in those cases would have required us to manually check the value of the
variable, set it to an empty array and/or convert it from an object to an array.
Signed-off-by: Carol Scott <carol@buoyant.io>
Kevin Lingerfelt
Alejandro Pedraza
TwiN
Nguyen Quang Huy
Andrew Seigner
Risha Mars
Oliver Gould
Ivan Sim
Tarun Pothulapati
Thomas Rampelberg
Carol A. Scott
Kevin Leimkuhler
William Morgan
Alex Leong