Add support for 1.6 with RBAC and change install to use one file. #150
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Jenkins job istio/presubmit passed |
|
Updated the change to avoid breaking non-RBAC, instead a script will modify the configs and append the The generated file should be checked in - to allow easy installation (using kubectl -f https://... ) |
|
Jenkins job istio/presubmit passed |
|
Few more comments:
|
|
Jenkins job istio/presubmit passed |
|
Can you make sure that manager tests pass with RBAC? The manager test suite is more comprehensive. |
|
Jenkins job istio/presubmit passed |
|
Talked with sebastienvas and andraxylia. Jenkins is actually testing with a 1.6 cluster - which likely ignores (or doesn't enforce) the RBAC configs. There is already a script to update version in the yaml file - the plan is to merge my script with that For naming - it'll not use 'rbac', but 1.6, because the merged file is intended for 1.6+. Will also |
|
Jenkins job istio/presubmit passed |
lookuptable
reviewed
Apr 21, 2017
| namespace: default | ||
| roleRef: | ||
| kind: ClusterRole | ||
| name: cluster-admin |
There was a problem hiding this comment.
I'm worrying that we are giving it cluster-admin role. This is against the principal of least privilege. We should find out a minimum set of permissions required to run manager.
There was a problem hiding this comment.
Agreed, I'm testing with admin for the namespace only - and using separate accounts for
proxy and manager.
Ideally ingress will only have read access, plus restricted access to secrets, and manager
may need read/write access - I don't know if it can be narrowed to specific resources.
I think most important is restricting ingress - since it's exposed to outside access, and
second priority to make sure the sensitive ingress TLS certs are only visible to the ingress
server (since access to them allows intercepting all ingress traffic)
andraxylia
approved these changes
Apr 21, 2017
|
Can you please change the script so that istio-ca is not concatenated to the main istio file. The latest decision is to enable auth separately. |
sebastienvas
approved these changes
Apr 22, 2017
|
Andra: removed istio-ca. I'm still generating a 3rd file with authPolicy:MUTUAL_TLS and the auth included, Current blocker is getting the narrower permission - manager is using TPR, which is a cluster-wide resource - and I can't find the magic mapping of apiGroups/resources. Worse case: we can use cluster-admin, it's not worse than what we have if RBAC is off. I confirmed |
|
cluster-admin removed, finer grained access - can be refined further but should be good enough for alpha. Not tested: auth and secrets access. PTAL. |
|
Jenkins job istio/presubmit passed |
|
Solved for now by granting the default user permissions to read istio config. Long term we'll need a better way to split sidecar permissions - but more design/implementation is needed. Tested the change with 1.6 with and without rbac and on GKE with 1.5. |
sebastienvas
added a commit
that referenced
this pull request
Apr 27, 2017
* update version for testing (#147) Also update quota descriptors * Update copyright. * use lowercase zipkin trace headers (#152) * Add support for 1.6 with RBAC and change install to use one file. (#150) * Added RBAC roles and bindings * Script to generate merged configs for 1.5 and 1.6 - the 1.6 works wit rbac on or off. To avoid confusion, auth will be added in separate PR * Update the tag for manager/proxy containers * Port forward manager service and enable istio manager env var Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Run service port-forward in the background and tidy it up Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add yaml template for manager into istio-16.yaml * Remove errant local Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver to istio manager deploy Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * added egress proxy to istio install folder to be referenced by istio.io docs * bug fix * Remove apiserver address Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver and egress * Small doc updates. (#163)
sebastienvas
pushed a commit
that referenced
this pull request
May 3, 2017
…etup istioctl (#175) * update version for testing (#147) Also update quota descriptors * Update copyright. * use lowercase zipkin trace headers (#152) * Add support for 1.6 with RBAC and change install to use one file. (#150) * Added RBAC roles and bindings * Script to generate merged configs for 1.5 and 1.6 - the 1.6 works wit rbac on or off. To avoid confusion, auth will be added in separate PR * Update the tag for manager/proxy containers * Port forward manager service and enable istio manager env var Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Run service port-forward in the background and tidy it up Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add yaml template for manager into istio-16.yaml * Remove errant local Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver to istio manager deploy Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * added egress proxy to istio install folder to be referenced by istio.io docs * bug fix * Separate Istio CA installation from default. Istio CA should not be installed by default. Created istio-cluster-ca.yaml and istio-namespace-ca.yaml for deploying the per-cluster and per-namespace CAs, so that users do not need to modify the files for different use cases. * Remove apiserver address Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver and egress * Fix Istio CA files to create namespace. * Update one-off auth yaml files. * Small doc updates. (#163) * Improve Istio one-off yaml files for Istio auth. * Fix links. * Up the blanked rl to 5000, so it does not interfere with tests (#167) * Rename istio-ingress-controller to istio-ingress * Changed labels for ingress and ingress * update to rule schema to reflect switch from double to duration (#168) * update to rule schema to reflect switch from double to duration * pointed to my dockerhub * Updating istio version * Regenerate * Change in scripts * Install istio from istio-install, add os x support and add setupIstioctl * fix lineter * Get rule files from demos/apps, istioctl cleanable and comments fix * small change * appManager cleanablization
sebastienvas
added a commit
that referenced
this pull request
May 3, 2017
* update version for testing (#147) Also update quota descriptors * Update copyright. * use lowercase zipkin trace headers (#152) * Add support for 1.6 with RBAC and change install to use one file. (#150) * Added RBAC roles and bindings * Script to generate merged configs for 1.5 and 1.6 - the 1.6 works wit rbac on or off. To avoid confusion, auth will be added in separate PR * Update the tag for manager/proxy containers * Port forward manager service and enable istio manager env var Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Run service port-forward in the background and tidy it up Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add yaml template for manager into istio-16.yaml * Remove errant local Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver to istio manager deploy Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * added egress proxy to istio install folder to be referenced by istio.io docs * bug fix * Separate Istio CA installation from default. Istio CA should not be installed by default. Created istio-cluster-ca.yaml and istio-namespace-ca.yaml for deploying the per-cluster and per-namespace CAs, so that users do not need to modify the files for different use cases. * Remove apiserver address Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver and egress * Fix Istio CA files to create namespace. * Update one-off auth yaml files. * Small doc updates. (#163) * Improve Istio one-off yaml files for Istio auth. * Fix links. * Up the blanked rl to 5000, so it does not interfere with tests (#167) * Rename istio-ingress-controller to istio-ingress * Changed labels for ingress and ingress * update to rule schema to reflect switch from double to duration (#168) * update to rule schema to reflect switch from double to duration * pointed to my dockerhub * Updating istio version * Regenerate * Change in scripts * update to gcr.io/istio-testing versions (#170) 1. Update mixer, manager, proxy versions to include rate limit fixes 2. Remove mixer configmap. The default config is now baked inside mixer. 3. expose mixer metrics and configapi ports thru port forwarding. 4. Add "wrk" for testing. drive traffic and fetch metrics as a setup for full 5. ratelimit integration test. That PR will follow. * Add ingress service for correct status IP * Support for istio-ca in tests/updateVersion.sh (#180) * Update updateVersion.sh to take into account istio-ca * Updates with updateVersion.sh
sebastienvas
added a commit
that referenced
this pull request
May 4, 2017
* Initial version * Refactor for better testing * Update framework for testing and added test * Bazelify istio * Simplified interfaces * Refactor code to use Cleanable interface * go formating (#140) * go formating * Updated Jenkinsfile to run tests * Separate TestInfo to another module (#144) * Separete TestInfo to another module Implemented status file creation Implemented log upload to cloud storage Rename SetUp to Setup and TearDown to Teardown * Add more info in TestStatus * Rename InitLogging to InitGlog * Resolving comments * Return skipDir error on err * Adding Code Checks + Fix them (#151) * Not uploading logs_bucket_path flag is unset * Added code checks * Fix linter errors * Update Jenkins to use a goBuildNode * e2e test: Create namespace and deploy istio core and test app (#145) * Create namespace and deploy namespace * Get runtime source path * Correct pr comments, add GetGateWay() * Add default route test * Add version routing tests, fix linter and fix comments on pr * Add fault delay test and fix comments * Add version migration test * Add Hop App + testing (#162) * Implemented echo App * Adding test + refactoring * Added more tests * Resolved review comments * Use slices instead of pointers to slices * Fix formatting * Merge master to e2e (#165) * update version for testing (#147) Also update quota descriptors * Update copyright. * use lowercase zipkin trace headers (#152) * Add support for 1.6 with RBAC and change install to use one file. (#150) * Added RBAC roles and bindings * Script to generate merged configs for 1.5 and 1.6 - the 1.6 works wit rbac on or off. To avoid confusion, auth will be added in separate PR * Update the tag for manager/proxy containers * Port forward manager service and enable istio manager env var Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Run service port-forward in the background and tidy it up Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add yaml template for manager into istio-16.yaml * Remove errant local Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver to istio manager deploy Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * added egress proxy to istio install folder to be referenced by istio.io docs * bug fix * Remove apiserver address Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver and egress * Small doc updates. (#163) * Demo test update + Docker file creation for Hop App (#172) * Renamed default env const * Added support for server update for version * Added a binary for Hop + Docker Image * WIP * Modified kubernetes setup + demo test * Fixed Jenkinsfile * Fix comments * Fix format * Removing app_flag as set directly in template * Fixed resp.close() was called on empty resp * Moved test to their own folder * Fixes e2e.sh * Make e2e.sh more verbose * Merge from istio:master, change install source to istio-install and setup istioctl (#175) * update version for testing (#147) Also update quota descriptors * Update copyright. * use lowercase zipkin trace headers (#152) * Add support for 1.6 with RBAC and change install to use one file. (#150) * Added RBAC roles and bindings * Script to generate merged configs for 1.5 and 1.6 - the 1.6 works wit rbac on or off. To avoid confusion, auth will be added in separate PR * Update the tag for manager/proxy containers * Port forward manager service and enable istio manager env var Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Run service port-forward in the background and tidy it up Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add yaml template for manager into istio-16.yaml * Remove errant local Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver to istio manager deploy Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * added egress proxy to istio install folder to be referenced by istio.io docs * bug fix * Separate Istio CA installation from default. Istio CA should not be installed by default. Created istio-cluster-ca.yaml and istio-namespace-ca.yaml for deploying the per-cluster and per-namespace CAs, so that users do not need to modify the files for different use cases. * Remove apiserver address Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver and egress * Fix Istio CA files to create namespace. * Update one-off auth yaml files. * Small doc updates. (#163) * Improve Istio one-off yaml files for Istio auth. * Fix links. * Up the blanked rl to 5000, so it does not interfere with tests (#167) * Rename istio-ingress-controller to istio-ingress * Changed labels for ingress and ingress * update to rule schema to reflect switch from double to duration (#168) * update to rule schema to reflect switch from double to duration * pointed to my dockerhub * Updating istio version * Regenerate * Change in scripts * Install istio from istio-install, add os x support and add setupIstioctl * fix lineter * Get rule files from demos/apps, istioctl cleanable and comments fix * small change * appManager cleanablization * Merge master to e2e (#181) * update version for testing (#147) Also update quota descriptors * Update copyright. * use lowercase zipkin trace headers (#152) * Add support for 1.6 with RBAC and change install to use one file. (#150) * Added RBAC roles and bindings * Script to generate merged configs for 1.5 and 1.6 - the 1.6 works wit rbac on or off. To avoid confusion, auth will be added in separate PR * Update the tag for manager/proxy containers * Port forward manager service and enable istio manager env var Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Run service port-forward in the background and tidy it up Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add yaml template for manager into istio-16.yaml * Remove errant local Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver to istio manager deploy Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * added egress proxy to istio install folder to be referenced by istio.io docs * bug fix * Separate Istio CA installation from default. Istio CA should not be installed by default. Created istio-cluster-ca.yaml and istio-namespace-ca.yaml for deploying the per-cluster and per-namespace CAs, so that users do not need to modify the files for different use cases. * Remove apiserver address Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver and egress * Fix Istio CA files to create namespace. * Update one-off auth yaml files. * Small doc updates. (#163) * Improve Istio one-off yaml files for Istio auth. * Fix links. * Up the blanked rl to 5000, so it does not interfere with tests (#167) * Rename istio-ingress-controller to istio-ingress * Changed labels for ingress and ingress * update to rule schema to reflect switch from double to duration (#168) * update to rule schema to reflect switch from double to duration * pointed to my dockerhub * Updating istio version * Regenerate * Change in scripts * update to gcr.io/istio-testing versions (#170) 1. Update mixer, manager, proxy versions to include rate limit fixes 2. Remove mixer configmap. The default config is now baked inside mixer. 3. expose mixer metrics and configapi ports thru port forwarding. 4. Add "wrk" for testing. drive traffic and fetch metrics as a setup for full 5. ratelimit integration test. That PR will follow. * Add ingress service for correct status IP * Support for istio-ca in tests/updateVersion.sh (#180) * Update updateVersion.sh to take into account istio-ca * Updates with updateVersion.sh * Create README.md for e2e test framework (#182) * Create README.md for e2e test framework * small change
zenlint
pushed a commit
to zenlint/istio
that referenced
this pull request
Aug 30, 2017
* First draft getting started * Added istio-installation and changed bookinfo * Fix display issue * Addressed code review comments * Address more review comments, istio-ca not part of the install * Use local files instead of raw github files * Addressed more review comments * Added note about istioctl and renamed istio-ingress-controller to istio-ingress * Fix the verb tense * Rename istio-ingress-controller to istio-ingress * Fixed installation instructions * Remove fault injection * Fix uninstall * Fix link * Correct path * Rbac clarification for alpha and beta versions * Add more clarity * Add a dot * Fix display error * Fix display error * Add clarification for Ingress * Update installation to point to latest release
mandarjog
added a commit
to mandarjog/istio
that referenced
this pull request
Oct 30, 2017
* Add local pre-commit hook Run bin/pre-commit to install the pre-commit hook It will run fmt tests before allowing the commit * Add linters as part of pre-commit hook * Update doc Former-commit-id: 27e79e4ea2681e12ed8312add418a869ee41c2f9
rshriram
pushed a commit
that referenced
this pull request
Oct 30, 2017
* Added RBAC roles and bindings * Script to generate merged configs for 1.5 and 1.6 - the 1.6 works wit rbac on or off. To avoid confusion, auth will be added in separate PR Former-commit-id: a2049c9
rshriram
pushed a commit
that referenced
this pull request
Oct 30, 2017
* Initial version * Refactor for better testing * Update framework for testing and added test * Bazelify istio * Simplified interfaces * Refactor code to use Cleanable interface * go formating (#140) * go formating * Updated Jenkinsfile to run tests * Separate TestInfo to another module (#144) * Separete TestInfo to another module Implemented status file creation Implemented log upload to cloud storage Rename SetUp to Setup and TearDown to Teardown * Add more info in TestStatus * Rename InitLogging to InitGlog * Resolving comments * Return skipDir error on err * Adding Code Checks + Fix them (#151) * Not uploading logs_bucket_path flag is unset * Added code checks * Fix linter errors * Update Jenkins to use a goBuildNode * e2e test: Create namespace and deploy istio core and test app (#145) * Create namespace and deploy namespace * Get runtime source path * Correct pr comments, add GetGateWay() * Add default route test * Add version routing tests, fix linter and fix comments on pr * Add fault delay test and fix comments * Add version migration test * Add Hop App + testing (#162) * Implemented echo App * Adding test + refactoring * Added more tests * Resolved review comments * Use slices instead of pointers to slices * Fix formatting * Merge master to e2e (#165) * update version for testing (#147) Also update quota descriptors * Update copyright. * use lowercase zipkin trace headers (#152) * Add support for 1.6 with RBAC and change install to use one file. (#150) * Added RBAC roles and bindings * Script to generate merged configs for 1.5 and 1.6 - the 1.6 works wit rbac on or off. To avoid confusion, auth will be added in separate PR * Update the tag for manager/proxy containers * Port forward manager service and enable istio manager env var Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Run service port-forward in the background and tidy it up Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add yaml template for manager into istio-16.yaml * Remove errant local Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver to istio manager deploy Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * added egress proxy to istio install folder to be referenced by istio.io docs * bug fix * Remove apiserver address Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver and egress * Small doc updates. (#163) * Demo test update + Docker file creation for Hop App (#172) * Renamed default env const * Added support for server update for version * Added a binary for Hop + Docker Image * WIP * Modified kubernetes setup + demo test * Fixed Jenkinsfile * Fix comments * Fix format * Removing app_flag as set directly in template * Fixed resp.close() was called on empty resp * Moved test to their own folder * Fixes e2e.sh * Make e2e.sh more verbose * Merge from istio:master, change install source to istio-install and setup istioctl (#175) * update version for testing (#147) Also update quota descriptors * Update copyright. * use lowercase zipkin trace headers (#152) * Add support for 1.6 with RBAC and change install to use one file. (#150) * Added RBAC roles and bindings * Script to generate merged configs for 1.5 and 1.6 - the 1.6 works wit rbac on or off. To avoid confusion, auth will be added in separate PR * Update the tag for manager/proxy containers * Port forward manager service and enable istio manager env var Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Run service port-forward in the background and tidy it up Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add yaml template for manager into istio-16.yaml * Remove errant local Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver to istio manager deploy Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * added egress proxy to istio install folder to be referenced by istio.io docs * bug fix * Separate Istio CA installation from default. Istio CA should not be installed by default. Created istio-cluster-ca.yaml and istio-namespace-ca.yaml for deploying the per-cluster and per-namespace CAs, so that users do not need to modify the files for different use cases. * Remove apiserver address Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver and egress * Fix Istio CA files to create namespace. * Update one-off auth yaml files. * Small doc updates. (#163) * Improve Istio one-off yaml files for Istio auth. * Fix links. * Up the blanked rl to 5000, so it does not interfere with tests (#167) * Rename istio-ingress-controller to istio-ingress * Changed labels for ingress and ingress * update to rule schema to reflect switch from double to duration (#168) * update to rule schema to reflect switch from double to duration * pointed to my dockerhub * Updating istio version * Regenerate * Change in scripts * Install istio from istio-install, add os x support and add setupIstioctl * fix lineter * Get rule files from demos/apps, istioctl cleanable and comments fix * small change * appManager cleanablization * Merge master to e2e (#181) * update version for testing (#147) Also update quota descriptors * Update copyright. * use lowercase zipkin trace headers (#152) * Add support for 1.6 with RBAC and change install to use one file. (#150) * Added RBAC roles and bindings * Script to generate merged configs for 1.5 and 1.6 - the 1.6 works wit rbac on or off. To avoid confusion, auth will be added in separate PR * Update the tag for manager/proxy containers * Port forward manager service and enable istio manager env var Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Run service port-forward in the background and tidy it up Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add yaml template for manager into istio-16.yaml * Remove errant local Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver to istio manager deploy Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * added egress proxy to istio install folder to be referenced by istio.io docs * bug fix * Separate Istio CA installation from default. Istio CA should not be installed by default. Created istio-cluster-ca.yaml and istio-namespace-ca.yaml for deploying the per-cluster and per-namespace CAs, so that users do not need to modify the files for different use cases. * Remove apiserver address Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver and egress * Fix Istio CA files to create namespace. * Update one-off auth yaml files. * Small doc updates. (#163) * Improve Istio one-off yaml files for Istio auth. * Fix links. * Up the blanked rl to 5000, so it does not interfere with tests (#167) * Rename istio-ingress-controller to istio-ingress * Changed labels for ingress and ingress * update to rule schema to reflect switch from double to duration (#168) * update to rule schema to reflect switch from double to duration * pointed to my dockerhub * Updating istio version * Regenerate * Change in scripts * update to gcr.io/istio-testing versions (#170) 1. Update mixer, manager, proxy versions to include rate limit fixes 2. Remove mixer configmap. The default config is now baked inside mixer. 3. expose mixer metrics and configapi ports thru port forwarding. 4. Add "wrk" for testing. drive traffic and fetch metrics as a setup for full 5. ratelimit integration test. That PR will follow. * Add ingress service for correct status IP * Support for istio-ca in tests/updateVersion.sh (#180) * Update updateVersion.sh to take into account istio-ca * Updates with updateVersion.sh * Create README.md for e2e test framework (#182) * Create README.md for e2e test framework * small change Former-commit-id: 0adf4c4
mandarjog
added a commit
that referenced
this pull request
Oct 31, 2017
* Add local pre-commit hook Run bin/pre-commit to install the pre-commit hook It will run fmt tests before allowing the commit * Add linters as part of pre-commit hook * Update doc Former-commit-id: a7e4171ffdb86cfdc463866b7f1c2c5082b48a28
mandarjog
pushed a commit
that referenced
this pull request
Nov 2, 2017
* Added RBAC roles and bindings * Script to generate merged configs for 1.5 and 1.6 - the 1.6 works wit rbac on or off. To avoid confusion, auth will be added in separate PR Former-commit-id: a2049c9
mandarjog
pushed a commit
that referenced
this pull request
Nov 2, 2017
* Initial version * Refactor for better testing * Update framework for testing and added test * Bazelify istio * Simplified interfaces * Refactor code to use Cleanable interface * go formating (#140) * go formating * Updated Jenkinsfile to run tests * Separate TestInfo to another module (#144) * Separete TestInfo to another module Implemented status file creation Implemented log upload to cloud storage Rename SetUp to Setup and TearDown to Teardown * Add more info in TestStatus * Rename InitLogging to InitGlog * Resolving comments * Return skipDir error on err * Adding Code Checks + Fix them (#151) * Not uploading logs_bucket_path flag is unset * Added code checks * Fix linter errors * Update Jenkins to use a goBuildNode * e2e test: Create namespace and deploy istio core and test app (#145) * Create namespace and deploy namespace * Get runtime source path * Correct pr comments, add GetGateWay() * Add default route test * Add version routing tests, fix linter and fix comments on pr * Add fault delay test and fix comments * Add version migration test * Add Hop App + testing (#162) * Implemented echo App * Adding test + refactoring * Added more tests * Resolved review comments * Use slices instead of pointers to slices * Fix formatting * Merge master to e2e (#165) * update version for testing (#147) Also update quota descriptors * Update copyright. * use lowercase zipkin trace headers (#152) * Add support for 1.6 with RBAC and change install to use one file. (#150) * Added RBAC roles and bindings * Script to generate merged configs for 1.5 and 1.6 - the 1.6 works wit rbac on or off. To avoid confusion, auth will be added in separate PR * Update the tag for manager/proxy containers * Port forward manager service and enable istio manager env var Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Run service port-forward in the background and tidy it up Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add yaml template for manager into istio-16.yaml * Remove errant local Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver to istio manager deploy Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * added egress proxy to istio install folder to be referenced by istio.io docs * bug fix * Remove apiserver address Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver and egress * Small doc updates. (#163) * Demo test update + Docker file creation for Hop App (#172) * Renamed default env const * Added support for server update for version * Added a binary for Hop + Docker Image * WIP * Modified kubernetes setup + demo test * Fixed Jenkinsfile * Fix comments * Fix format * Removing app_flag as set directly in template * Fixed resp.close() was called on empty resp * Moved test to their own folder * Fixes e2e.sh * Make e2e.sh more verbose * Merge from istio:master, change install source to istio-install and setup istioctl (#175) * update version for testing (#147) Also update quota descriptors * Update copyright. * use lowercase zipkin trace headers (#152) * Add support for 1.6 with RBAC and change install to use one file. (#150) * Added RBAC roles and bindings * Script to generate merged configs for 1.5 and 1.6 - the 1.6 works wit rbac on or off. To avoid confusion, auth will be added in separate PR * Update the tag for manager/proxy containers * Port forward manager service and enable istio manager env var Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Run service port-forward in the background and tidy it up Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add yaml template for manager into istio-16.yaml * Remove errant local Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver to istio manager deploy Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * added egress proxy to istio install folder to be referenced by istio.io docs * bug fix * Separate Istio CA installation from default. Istio CA should not be installed by default. Created istio-cluster-ca.yaml and istio-namespace-ca.yaml for deploying the per-cluster and per-namespace CAs, so that users do not need to modify the files for different use cases. * Remove apiserver address Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver and egress * Fix Istio CA files to create namespace. * Update one-off auth yaml files. * Small doc updates. (#163) * Improve Istio one-off yaml files for Istio auth. * Fix links. * Up the blanked rl to 5000, so it does not interfere with tests (#167) * Rename istio-ingress-controller to istio-ingress * Changed labels for ingress and ingress * update to rule schema to reflect switch from double to duration (#168) * update to rule schema to reflect switch from double to duration * pointed to my dockerhub * Updating istio version * Regenerate * Change in scripts * Install istio from istio-install, add os x support and add setupIstioctl * fix lineter * Get rule files from demos/apps, istioctl cleanable and comments fix * small change * appManager cleanablization * Merge master to e2e (#181) * update version for testing (#147) Also update quota descriptors * Update copyright. * use lowercase zipkin trace headers (#152) * Add support for 1.6 with RBAC and change install to use one file. (#150) * Added RBAC roles and bindings * Script to generate merged configs for 1.5 and 1.6 - the 1.6 works wit rbac on or off. To avoid confusion, auth will be added in separate PR * Update the tag for manager/proxy containers * Port forward manager service and enable istio manager env var Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Run service port-forward in the background and tidy it up Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add yaml template for manager into istio-16.yaml * Remove errant local Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver to istio manager deploy Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * added egress proxy to istio install folder to be referenced by istio.io docs * bug fix * Separate Istio CA installation from default. Istio CA should not be installed by default. Created istio-cluster-ca.yaml and istio-namespace-ca.yaml for deploying the per-cluster and per-namespace CAs, so that users do not need to modify the files for different use cases. * Remove apiserver address Signed-off-by: LIAM White <liamwhite@uk.ibm.com> * Add apiserver and egress * Fix Istio CA files to create namespace. * Update one-off auth yaml files. * Small doc updates. (#163) * Improve Istio one-off yaml files for Istio auth. * Fix links. * Up the blanked rl to 5000, so it does not interfere with tests (#167) * Rename istio-ingress-controller to istio-ingress * Changed labels for ingress and ingress * update to rule schema to reflect switch from double to duration (#168) * update to rule schema to reflect switch from double to duration * pointed to my dockerhub * Updating istio version * Regenerate * Change in scripts * update to gcr.io/istio-testing versions (#170) 1. Update mixer, manager, proxy versions to include rate limit fixes 2. Remove mixer configmap. The default config is now baked inside mixer. 3. expose mixer metrics and configapi ports thru port forwarding. 4. Add "wrk" for testing. drive traffic and fetch metrics as a setup for full 5. ratelimit integration test. That PR will follow. * Add ingress service for correct status IP * Support for istio-ca in tests/updateVersion.sh (#180) * Update updateVersion.sh to take into account istio-ca * Updates with updateVersion.sh * Create README.md for e2e test framework (#182) * Create README.md for e2e test framework * small change Former-commit-id: 0adf4c4
rajusharma
pushed a commit
to rajusharma/istio
that referenced
this pull request
Jul 2, 2019
howardjohn
pushed a commit
to howardjohn/istio
that referenced
this pull request
Jan 12, 2020
vikaschoudhary16
pushed a commit
to vikaschoudhary16/istio
that referenced
this pull request
Feb 12, 2021
…nt from `Proxy.IPAddresses` (istio#150) Signed-off-by: Yaroslav Skopets <yaroslav@tetrate.io>
vikaschoudhary16
pushed a commit
to vikaschoudhary16/istio
that referenced
this pull request
May 3, 2022
l8huang
pushed a commit
to l8huang/istio
that referenced
this pull request
Jun 16, 2022
aniketsingh03
pushed a commit
to aniketsingh03/istio-1
that referenced
this pull request
Oct 4, 2022
antonioberben
pushed a commit
to antonioberben/istio
that referenced
this pull request
Jan 29, 2024
Use bitnami chart for kafka
luksa
pushed a commit
to luksa/istio
that referenced
this pull request
Oct 14, 2024
…ter-merge_upstream_istio_master-6253864e Automator: merge upstream changes to openshift-service-mesh/istio@master
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The change seems to allow manager and ingress to start if RBAC is enabled, see
istio/old_pilot_repo#561
I haven't tested if the change breaks non-RBAC yet :-), and most likely a more restricted
scope should be used. Also not sure in which file to define the service account, it is
used by manager in both istio-manager and istio-ingress. Or maybe 2 service accounts
should be used, for more granularity ? I'm new to this...