Skip to content

gateway: skip duplicate VirtualService matches #30354

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jan 26, 2021
Merged

gateway: skip duplicate VirtualService matches #30354

merged 1 commit into from
Jan 26, 2021

Conversation

kailun-qin
Copy link
Member

@kailun-qin kailun-qin commented Jan 25, 2021 •
edited
Loading

Duplicate HTTPS virtual services bound to a gateway will lead to envoy
rejections - "multiple filter chains with the same matching rules are defined".

This patch changes the current behavior of no duplication checking on such case
that will eventually fail with a NACK and instead picks only the first one of
the duplicated match rules.

Fixes #30321

Signed-off-by: Kailun Qin kailun.qin@intel.com

[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[x] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

Pull Request Attributes

Please check any characteristics that apply to this pull request.

[ ] Does not have any changes that may affect Istio users.

@kailun-qin kailun-qin requested a review from a team as a code owner January 25, 2021 06:22
@google-cla google-cla bot added the cla: yes Set by the Google CLA bot to indicate the author of a PR has signed the Google CLA. label Jan 25, 2021
@istio-testing istio-testing added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. needs-ok-to-test labels Jan 25, 2021
@istio-testing
Copy link
Collaborator

Hi @kailun-qin. Thanks for your PR.

I'm waiting for a istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hzxuzhonghu
Copy link
Member

/ok-to-test

@istio-testing istio-testing added ok-to-test Set this label allow normal testing to take place for a PR not submitted by an Istio org member. and removed needs-ok-to-test labels Jan 25, 2021
howardjohn
howardjohn reviewed Jan 25, 2021
View reviewed changes
pilot/pkg/networking/core/v1alpha3/gateway_simulation_test.go
"call",
simulation.Call{Port: 443, Protocol: simulation.HTTP, TLS: simulation.TLS, HostHeader: "mysite.example.com"},
simulation.Result{Error: simulation.ErrMultipleFilterChain},
simulation.Result{
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you remove L446 to skipValidation?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! Removed.

@howardjohn
Copy link
Member

We should make sure we get resolution on #30321 (comment) before merging

cc @esnible - if we merge this the analyzer is still useful, as it would detect that we are dropping a VS rather than NACKing

@howardjohn
Copy link
Member

This LGTM, I want to give @stevenctl a chance to look though since he was looking into this possibly

stevenctl
stevenctl approved these changes Jan 25, 2021
View reviewed changes
Copy link
Contributor

@stevenctl stevenctl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@kailun-qin
gateway: skip duplicate VirtualService matches
9516d58 
Duplicate HTTPS virtual services bound to a gateway will lead to envoy
rejections - "multiple filter chains with the same matching rules are defined".

This patch changes the current behavior of no duplication checking on such case
that will eventually fail with a NACK and instead picks only the first one of
the duplicated match rules.

Fixes istio#30321

Signed-off-by: Kailun Qin <kailun.qin@intel.com>
@kailun-qin
Copy link
Member Author

@howardjohn Can we move forward this one? Thanks!

@howardjohn howardjohn added the release-notes-none Indicates a PR that does not require release notes. label Jan 26, 2021
@howardjohn
Copy link
Member

/retest

@istio-testing istio-testing merged commit f78b449 into istio:master Jan 26, 2021
@kailun-qin kailun-qin mentioned this pull request Jan 27, 2021
Merged
5 tasks
domcyrus pushed a commit to domcyrus/istio that referenced this pull request Feb 4, 2021
@kailun-qin @domcyrus
gateway: skip duplicate VirtualService matches (istio#30354)
0d3a1b4 
Duplicate HTTPS virtual services bound to a gateway will lead to envoy
rejections - "multiple filter chains with the same matching rules are defined".

This patch changes the current behavior of no duplication checking on such case
that will eventually fail with a NACK and instead picks only the first one of
the duplicated match rules.

Fixes istio#30321

Signed-off-by: Kailun Qin <kailun.qin@intel.com>
@kailun-qin kailun-qin deleted the skip-dup-match branch February 18, 2021 06:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@howardjohn howardjohn howardjohn left review comments

@stevenctl stevenctl stevenctl approved these changes

Assignees
No one assigned
Labels
cla: yes Set by the Google CLA bot to indicate the author of a PR has signed the Google CLA. ok-to-test Set this label allow normal testing to take place for a PR not submitted by an Istio org member. release-notes-none Indicates a PR that does not require release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Duplicate HTTPS virtual services leads to "multiple filter chains with the same matching rules are defined"
5 participants
@kailun-qin @istio-testing @hzxuzhonghu @howardjohn @stevenctl