Skip to content

Commit 9e5a917

Browse files
yangminzhumandarjog
yangminzhu
authored and
mandarjog
committed
Add mesh config to allow setting network policy fail open (#670)
1 parent 3f8c1a7 commit 9e5a917

File tree

4 files changed

+146
-76
lines changed

4 files changed

+146
-76
lines changed

‎mesh/v1alpha1/config.pb.go‎

Lines changed: 100 additions & 52 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎mesh/v1alpha1/config.proto‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,11 @@ message MeshConfig {
5656
// is false, i.e. mixer policy check is enabled by default.
5757
bool disable_policy_checks = 3;
5858

59+
// Allow all traffic in cases when the mixer policy service cannot be reached.
60+
// Default is false which means the traffic is denied when the client is unable
61+
// to connect to Mixer.
62+
bool policy_check_fail_open = 25;
63+
5964
// Port on which Envoy should listen for incoming connections from
6065
// other services.
6166
int32 proxy_listen_port = 4;
@@ -153,7 +158,7 @@ message MeshConfig {
153158
bool enable_sds_token_mount = 23;
154159

155160
// $hide_from_docs
156-
// Next available field number: 25
161+
// Next available field number: 26
157162
}
158163

159164
// ConfigSource describes information about a configuration store inside a

‎mesh/v1alpha1/istio.mesh.v1alpha1.pb.html‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,16 @@ <h2 id="MeshConfig">MeshConfig</h2>
136136
<p>Disable policy checks by the mixer service. Default
137137
is false, i.e. mixer policy check is enabled by default.</p>
138138

139+
</td>
140+
</tr>
141+
<tr id="MeshConfig-policy_check_fail_open">
142+
<td><code>policyCheckFailOpen</code></td>
143+
<td><code>bool</code></td>
144+
<td>
145+
<p>Allow all traffic in cases when the mixer policy service cannot be reached.
146+
Default is false which means the traffic is denied when the client is unable
147+
to connect to Mixer.</p>
148+
139149
</td>
140150
</tr>
141151
<tr id="MeshConfig-proxy_listen_port">

0 commit comments

Comments
 (0)