Skip to content

Commit a81eacb

Browse files
author
Jianfei Hu
committed
2 parents af1a679 + f6b0ddc commit a81eacb

File tree

184 files changed

+8651
-5680
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

184 files changed

+8651
-5680
lines changed

‎.circleci/config.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,7 @@ jobs:
236236
# Should only happen when re-running a job, and the workspace is gone
237237
time make build test-bins
238238
fi
239-
make docker.all generate_yaml
239+
make docker.all generate_e2e_test_yaml
240240
- run: bin/testEnvRootMinikube.sh wait
241241
- run: docker images
242242
- run:
@@ -272,7 +272,7 @@ jobs:
272272
# Should only happen when re-running a job, and the workspace is gone
273273
time make build test-bins
274274
fi
275-
make docker.all generate_yaml
275+
make docker.all generate_e2e_test_yaml
276276
- run: bin/testEnvRootMinikube.sh wait
277277
- run: docker images
278278
- run:
@@ -485,7 +485,7 @@ jobs:
485485
export PATH=$GOPATH/bin:$PATH
486486
make localTestEnv
487487
set -o pipefail
488-
make test.integration T=-v | tee -a /go/out/tests/build-log.txt
488+
make test.integration.local T=-v | tee -a /go/out/tests/build-log.txt
489489
- <<: *recordZeroExitCodeIfTestPassed
490490
- <<: *recordNonzeroExitCodeIfTestFailed
491491
- <<: *markJobFinishesOnGCS

‎.codecov.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ coverage:
33
round: up
44
range: 60..99
55
ignore:
6+
- "mixer/test"
7+
- "mixer/template"
68
- "**/*.pb.go" # Auto-generated proto files
79
- "tests/" # Test infrastructure coverage does not affect core coverage
810
- "**/test/*.go"

‎codecov.skip‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ istio.io/istio/mixer/pkg/mockapi
44
istio.io/istio/mixer/pkg/perf
55
istio.io/istio/mixer/pkg/runtime/testing
66
istio.io/istio/mixer/template/sample
7-
istio.io/istio/mixer/test
87
istio.io/istio/mixer/tools/codegen
98
istio.io/istio/pilot/test
109
istio.io/istio/pkg/mcp/testing

‎galley/pkg/crd/validation/endpoint.go‎

Lines changed: 21 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,10 @@ func endpointReady(store cache.KeyGetter, queue workqueue.RateLimitingInterface,
3939
if err != nil || !exists {
4040
return endpointCheckNotReady
4141
}
42-
endpoints := item.(*v1.Endpoints)
42+
endpoints, ok := item.(*v1.Endpoints)
43+
if !ok {
44+
return endpointCheckNotReady
45+
}
4346
if len(endpoints.Subsets) == 0 {
4447
scope.Warnf("%s/%v endpoint not ready: no subsets", namespace, name)
4548
return endpointCheckNotReady
@@ -65,9 +68,6 @@ func (wh *Webhook) waitForEndpointReady(stopCh <-chan struct{}) (shutdown bool)
6568
}
6669
}()
6770

68-
controllerStopCh := make(chan struct{})
69-
defer close(controllerStopCh)
70-
7171
queue := workqueue.NewRateLimitingQueue(workqueue.DefaultControllerRateLimiter())
7272
defer queue.ShutDown()
7373

@@ -97,21 +97,30 @@ func (wh *Webhook) waitForEndpointReady(stopCh <-chan struct{}) (shutdown bool)
9797
},
9898
},
9999
)
100-
go controller.Run(stopCh)
100+
101+
controllerStopCh := make(chan struct{})
102+
defer close(controllerStopCh)
103+
go controller.Run(controllerStopCh)
101104

102105
if !cache.WaitForCacheSync(stopCh, controller.HasSynced) {
106+
scope.Errorf("wait for cache sync failed")
103107
return true
104108
}
105109

106110
for {
107-
ready := endpointReady(store, queue, wh.deploymentAndServiceNamespace, wh.serviceName)
108-
switch ready {
109-
case endpointCheckShutdown:
111+
select {
112+
case <-stopCh:
110113
return true
111-
case endpointCheckReady:
112-
return false
113-
case endpointCheckNotReady:
114-
// continue waiting for endpoint to be ready
114+
default:
115+
ready := endpointReady(store, queue, wh.deploymentAndServiceNamespace, wh.serviceName)
116+
switch ready {
117+
case endpointCheckShutdown:
118+
return true
119+
case endpointCheckReady:
120+
return false
121+
case endpointCheckNotReady:
122+
// continue waiting for endpoint to be ready
123+
}
115124
}
116125
}
117126
}

‎galley/pkg/crd/validation/validation.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ func createMixerValidator() store.BackendValidator {
7070
func webhookHTTPSHandlerReady(client httpClient, vc *WebhookParameters) error {
7171
readinessURL := &url.URL{
7272
Scheme: "https",
73-
Host: fmt.Sprintf("localhost:%v", vc.Port),
73+
Host: fmt.Sprintf("127.0.0.1:%v", vc.Port),
7474
Path: httpsHandlerReadyPath,
7575
}
7676

‎install/kubernetes/helm/istio-remote/templates/sidecar-injector-configmap.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ metadata:
1313
data:
1414
config: |-
1515
policy: {{ .Values.global.proxy.autoInject }}
16+
rewriteAppHTTPProbe: {{ .Values.sidecarInjectorWebhook.rewriteAppHTTPProbe }}
1617
template: |-
1718
{{- if or (not .Values.istio_cni.enabled) .Values.global.proxy.enableCoreDump }}
1819
initContainers:
@@ -170,7 +171,7 @@ data:
170171
- NET_ADMIN
171172
runAsGroup: 1337
172173
{{ "[[ else -]]" }}
173-
{{ if and .Values.global.sds.enabled .Values.global.sds.enableTokenMount }}
174+
{{ if and .Values.global.sds.enabled .Values.global.sds.useTrustworthyJwt }}
174175
runAsGroup: 1337
175176
{{- end }}
176177
runAsUser: 1337
@@ -194,7 +195,7 @@ data:
194195
{{- if .Values.global.sds.enabled }}
195196
- mountPath: /var/run/sds
196197
name: sds-uds-path
197-
{{- if .Values.global.sds.enableTokenMount }}
198+
{{- if .Values.global.sds.useTrustworthyJwt }}
198199
- mountPath: /var/run/secrets/tokens
199200
name: istio-token
200201
{{- end }}
@@ -204,7 +205,7 @@ data:
204205
- name: sds-uds-path
205206
hostPath:
206207
path: /var/run/sds
207-
{{- if .Values.global.sds.enableTokenMount }}
208+
{{- if .Values.global.sds.useTrustworthyJwt }}
208209
- name: istio-token
209210
projected:
210211
sources:

‎install/kubernetes/helm/istio-remote/values.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,8 @@ global:
258258
sds:
259259
enabled: false
260260
udsPath: ""
261-
enableTokenMount: false
261+
useTrustworthyJwt: false
262+
useNormalJwt: false
262263

263264
# Sets an identifier for the remote network to be used for Split Horizon EDS. The network will be sent
264265
# to the Pilot when connected by the sidecar and will affect the results returned in EDS requests.

‎install/kubernetes/helm/istio/templates/configmap.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,15 @@ data:
6060
# If set to true(prerequisite: https://kubernetes.io/docs/concepts/storage/volumes/#projected), Istio will inject volumes mount
6161
# for k8s service account JWT, so that K8s API server mounts k8s service account JWT to envoy container, which
6262
# will be used to generate key/cert eventually. This isn't supported for non-k8s case.
63-
enableSdsTokenMount: {{ .Values.global.sds.enableTokenMount }}
63+
enableSdsTokenMount: {{ .Values.global.sds.useTrustworthyJwt }}
64+
65+
# This flag is used by secret discovery service(SDS).
66+
# If set to true, envoy will fetch normal k8s service account JWT from '/var/run/secrets/kubernetes.io/serviceaccount/token'
67+
# (https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/#accessing-the-api-from-a-pod)
68+
# and pass to sds server, which will be used to request key/cert eventually.
69+
# this flag is ignored if enableSdsTokenMount is set.
70+
# This isn't supported for non-k8s case.
71+
sdsUseK8sSaJwt: {{ .Values.global.sds.useNormalJwt }}
6472
6573
# The trust domain corresponds to the trust root of a system.
6674
# Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain

‎install/kubernetes/helm/istio/templates/sidecar-injector-configmap.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ data:
1414
config: |-
1515
policy: {{ .Values.global.proxy.autoInject }}
1616
template: |-
17+
rewriteAppHTTPProbe: {{ .Values.sidecarInjectorWebhook.rewriteAppHTTPProbe }}
1718
{{- if or (not .Values.istio_cni.enabled) .Values.global.proxy.enableCoreDump }}
1819
initContainers:
1920
{{- if not .Values.istio_cni.enabled }}
@@ -202,7 +203,7 @@ data:
202203
- NET_ADMIN
203204
runAsGroup: 1337
204205
{{ "[[ else -]]" }}
205-
{{ if and .Values.global.sds.enabled .Values.global.sds.enableTokenMount }}
206+
{{ if and .Values.global.sds.enabled .Values.global.sds.useTrustworthyJwt }}
206207
runAsGroup: 1337
207208
{{- end }}
208209
runAsUser: 1337
@@ -226,7 +227,7 @@ data:
226227
{{- if .Values.global.sds.enabled }}
227228
- mountPath: /var/run/sds
228229
name: sds-uds-path
229-
{{- if .Values.global.sds.enableTokenMount }}
230+
{{- if .Values.global.sds.useTrustworthyJwt }}
230231
- mountPath: /var/run/secrets/tokens
231232
name: istio-token
232233
{{- end }}
@@ -241,7 +242,7 @@ data:
241242
- name: sds-uds-path
242243
hostPath:
243244
path: /var/run/sds
244-
{{- if .Values.global.sds.enableTokenMount }}
245+
{{- if .Values.global.sds.useTrustworthyJwt }}
245246
- name: istio-token
246247
projected:
247248
sources:

‎install/kubernetes/helm/istio/values.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ gateways:
1111
#
1212
sidecarInjectorWebhook:
1313
enabled: true
14+
rewriteAppHTTPProbe: false
1415

1516
#
1617
# galley configuration, refer to charts/galley/values.yaml
@@ -348,7 +349,8 @@ global:
348349
# distributed through the SecretDiscoveryService instead of using K8S secrets to mount the certificates.
349350
enabled: false
350351
udsPath: ""
351-
enableTokenMount: false
352+
useTrustworthyJwt: false
353+
useNormalJwt: false
352354

353355
# Configure the mesh networks to be used by the Split Horizon EDS.
354356
#

0 commit comments

Comments
 (0)