Support for resources opting-out of tap#2807
Conversation
Fixes #2778 Signed-off-by: Alejandro Pedraza <[email protected]>
|
Integration test results for ecd598f: success 🎉 |
siggy
left a comment
siggy
left a comment
There was a problem hiding this comment.
looks good! left a couple tioli comments. 🚢 👍
| flags.BoolVar( | ||
| &options.disableTap, "disable-tap", options.disableTap, | ||
| "Disables resources from from being tapped", | ||
| ) |
There was a problem hiding this comment.
until the proxy supports it, should we do flags.MarkHidden("disable-tap") ? maybe reference a Github issue in a comment for the proxy change? or, since the control-plane is also filtering, maybe this is ok?
related: does this mean both the control-plane and the proxy will independently guard against tapping?
There was a problem hiding this comment.
As is, tapping gets disabled through the control plane API, but that doesn't disallow someone hitting directly the proxy. I think it makes sense to mark the flag hidden in the meantime.
…tappable Signed-off-by: Alejandro Pedraza <[email protected]>
Signed-off-by: Alejandro Pedraza <[email protected]>
|
Integration test results for a6d3528: success 🎉 |
4 participants
Fixes #2778
This one is just for the control-plane side of things.
The env var injected into the sidecar proxy was labeled
LINKERD2_PROXY_TAP_DISABLED.