Skip to content

Sidecar config resource #742

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
istio-testing merged 17 commits into from
Jan 7, 2019
Merged

Sidecar config resource #742

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
bb0ba22
renaming
Dec 14, 2018
77cb835
Sidecar
Dec 27, 2018
75ee50a
Merge branch 'release-1.1' of https://github.com/istio/api into sidecars
Dec 27, 2018
b64a035
gateway updates
Dec 27, 2018
1d8cef6
tweaks
Dec 29, 2018
a5f1334
Merge branch 'release-1.1' of https://github.com/istio/api into sidecars
Dec 29, 2018
c87f872
Merge branch 'release-1.1' of https://github.com/istio/api into sidecars
Jan 1, 2019
2686d00
update protolock
Jan 1, 2019
174c828
add workloadSelector to EnvoyFilter
Jan 3, 2019
e2ab7c6
update comments
Jan 3, 2019
112c895
feedback
Jan 4, 2019
e26a894
Merge branch 'release-1.1' of https://github.com/istio/api into sidecars
Jan 4, 2019
de8e68b
tweaks
Jan 4, 2019
1816063
Merge branch 'release-1.1' of https://github.com/istio/api into sidecars
Jan 4, 2019
671193c
capture mode
Jan 5, 2019
221821e
Merge branch 'release-1.1' of https://github.com/istio/api into sidecars
Jan 7, 2019
c96c2ce
nits
Jan 7, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
494 changes: 104 additions & 390 deletions mesh/v1alpha1/config.pb.go
View file
Open in desktop

Large diffs are not rendered by default.

65 changes: 18 additions & 47 deletions mesh/v1alpha1/config.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ message MeshConfig {

// Enable session affinity for envoy mixer reports so that calls from a proxy will
// always target the same mixer instance.
bool sidecar_to_telemetry_session_affinity = 31;
bool sidecar_to_telemetry_session_affinity = 30;

// Port on which Envoy should listen for incoming connections from
// other services.
Expand Down Expand Up @@ -155,23 +155,27 @@ message MeshConfig {

message OutboundTrafficPolicy {
enum Mode {
// outbound traffic will be restricted to services defined in the service registry as well as those defined
// through ServiceEntries
// outbound traffic will be restricted to services defined in the
// service registry as well as those defined through ServiceEntries
REGISTRY_ONLY = 0;
// outbound traffic to unknown destinations will be allowed, in case there are no services or ServiceEntries for the destination port
// outbound traffic to unknown destinations will be allowed, in case
// there are no services or ServiceEntries for the destination port
ALLOW_ANY = 1;
// not implemented. outbound traffic will be restricted to destinations defined in VirtualServices only
VIRTUAL_SERVICE_ONLY = 2 [deprecated=true];

reserved 2;
reserved "VIRTUAL_SERVICE_ONLY";
}
Mode mode = 1;
}

// Set the default behavior of the sidecar for handling outbound traffic from the application.
// While the default mode should work out of the box, if your application uses one or more external services that
// are not known apriori, setting the policy to ALLOW_ANY will cause the sidecars to route traffic to the any
// requested destination.
// Users are strongly encouraged to use ServiceEntries to explicitly declare any external dependencies,
// instead of using allow_any.
// Set the default behavior of the sidecar for handling outbound traffic
// from the application. If your application uses one or more external
// services that are not known apriori, setting the policy to ALLOW_ANY
// will cause the sidecars to route any unknown traffic originating from
// the application to its requested destination. Users are strongly
// encouraged to use ServiceEntries to explicitly declare any external
// dependencies, instead of using allow_any, so that traffic to these
// services can be monitored.
OutboundTrafficPolicy outbound_traffic_policy = 17;

reserved 18;
Expand Down Expand Up @@ -206,48 +210,15 @@ message MeshConfig {
// and pass to sds server, which will be used to request key/cert eventually.
// If both enable_sds_token_mount and sds_use_k8s_sa_jwt are set to true, enable_sds_token_mount(trustworthy jwt) takes precedence.
// This isn't supported for non-k8s case.
bool sds_use_k8s_sa_jwt = 30;
bool sds_use_k8s_sa_jwt = 29;

// The trust domain corresponds to the trust root of a system.
// Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
// Fallback to old identity format(without trust domain) if not set.
string trust_domain = 26;

// Default service dependency settings for each workload in the
// mesh. ServiceDependencycontrols the reachability of workloads to other
// services in the mesh.
message DefaultServiceDependency {
enum Mode {
// Configure routes to services in all namespaces, i.e. import
// services from all namespaces.
ALL_NAMESPACES = 0;

// Only configure routes to services that are in the same namespace
// as the workload as well as services in namespaces specified in
// importNamespaces.
SAME_NAMESPACE = 1;
}

// REQUIRED: The default import setting for every workload in the mesh.
Mode import_mode = 1;

// Specifies one or more namespaces that should be imported by default
// in all user defined ServiceDependency resources in addition to the
// namespaces explicitly specified by the end user. Use this setting to
// automatically import services/resources from namespaces such as
// istio-system that all workloads in the mesh depend upon.
repeated string import_namespaces = 2;
}

// The default service dependency setting associated with every workload
// in the mesh. Pilot will program the routes in the sidecars and
// gateways accordingly. If omitted, sidecars will be configured to reach
// every service in the mesh. The default scope can be overridden by
// supplying a ServiceDependency resource per namespace.
DefaultServiceDependency default_service_dependency = 29;

// $hide_from_docs
// Next available field number: 32
// Next available field number: 31
}

// ConfigSource describes information about a configuration store inside a
Expand Down
110 changes: 13 additions & 97 deletions mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
generator: protoc-gen-docs
aliases:
- /docs/reference/config/service-mesh.html
number_of_entries: 18
number_of_entries: 16
---
<h2 id="AuthenticationPolicy">AuthenticationPolicy</h2>
<section>
Expand Down Expand Up @@ -268,12 +268,14 @@ <h2 id="MeshConfig">MeshConfig</h2>
<td><code>outboundTrafficPolicy</code></td>
<td><code><a href="#MeshConfig-OutboundTrafficPolicy">MeshConfig.OutboundTrafficPolicy</a></code></td>
<td>
<p>Set the default behavior of the sidecar for handling outbound traffic from the application.
While the default mode should work out of the box, if your application uses one or more external services that
are not known apriori, setting the policy to ALLOW<em>ANY will cause the sidecars to route traffic to the any
requested destination.
Users are strongly encouraged to use ServiceEntries to explicitly declare any external dependencies,
instead of using allow</em>any.</p>
<p>Set the default behavior of the sidecar for handling outbound traffic
from the application. If your application uses one or more external
services that are not known apriori, setting the policy to ALLOW<em>ANY
will cause the sidecars to route any unknown traffic originating from
the application to its requested destination. Users are strongly
encouraged to use ServiceEntries to explicitly declare any external
dependencies, instead of using allow</em>any, so that traffic to these
services can be monitored.</p>

</td>
</tr>
Expand Down Expand Up @@ -312,18 +314,6 @@ <h2 id="MeshConfig">MeshConfig</h2>
Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
Fallback to old identity format(without trust domain) if not set.</p>

</td>
</tr>
<tr id="MeshConfig-default_service_dependency">
<td><code>defaultServiceDependency</code></td>
<td><code><a href="#MeshConfig-DefaultServiceDependency">MeshConfig.DefaultServiceDependency</a></code></td>
<td>
<p>The default service dependency setting associated with every workload
in the mesh. Pilot will program the routes in the sidecars and
gateways accordingly. If omitted, sidecars will be configured to reach
every service in the mesh. The default scope can be overridden by
supplying a ServiceDependency resource per namespace.</p>

</td>
</tr>
</tbody>
Expand All @@ -347,74 +337,6 @@ <h2 id="MeshConfig-AccessLogEncoding">MeshConfig.AccessLogEncoding</h2>
<tr id="MeshConfig-AccessLogEncoding-JSON">
<td><code>JSON</code></td>
<td>
</td>
</tr>
</tbody>
</table>
</section>
<h2 id="MeshConfig-DefaultServiceDependency">MeshConfig.DefaultServiceDependency</h2>
<section>
<p>Default service dependency settings for each workload in the
mesh. ServiceDependencycontrols the reachability of workloads to other
services in the mesh.</p>

<table class="message-fields">
<thead>
<tr>
<th>Field</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr id="MeshConfig-DefaultServiceDependency-import_mode">
<td><code>importMode</code></td>
<td><code><a href="#MeshConfig-DefaultServiceDependency-Mode">MeshConfig.DefaultServiceDependency.Mode</a></code></td>
<td>
<p>REQUIRED: The default import setting for every workload in the mesh.</p>

</td>
</tr>
<tr id="MeshConfig-DefaultServiceDependency-import_namespaces">
<td><code>importNamespaces</code></td>
<td><code>string[]</code></td>
<td>
<p>Specifies one or more namespaces that should be imported by default
in all user defined ServiceDependency resources in addition to the
namespaces explicitly specified by the end user. Use this setting to
automatically import services/resources from namespaces such as
istio-system that all workloads in the mesh depend upon.</p>

</td>
</tr>
</tbody>
</table>
</section>
<h2 id="MeshConfig-DefaultServiceDependency-Mode">MeshConfig.DefaultServiceDependency.Mode</h2>
<section>
<table class="enum-values">
<thead>
<tr>
<th>Name</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr id="MeshConfig-DefaultServiceDependency-Mode-ALL_NAMESPACES">
<td><code>ALL_NAMESPACES</code></td>
<td>
<p>Configure routes to services in all namespaces, i.e. import
services from all namespaces.</p>

</td>
</tr>
<tr id="MeshConfig-DefaultServiceDependency-Mode-SAME_NAMESPACE">
<td><code>SAME_NAMESPACE</code></td>
<td>
<p>Only configure routes to services that are in the same namespace
as the workload as well as services in namespaces specified in
importNamespaces.</p>

</td>
</tr>
</tbody>
Expand Down Expand Up @@ -495,22 +417,16 @@ <h2 id="MeshConfig-OutboundTrafficPolicy-Mode">MeshConfig.OutboundTrafficPolicy.
<tr id="MeshConfig-OutboundTrafficPolicy-Mode-REGISTRY_ONLY">
<td><code>REGISTRY_ONLY</code></td>
<td>
<p>outbound traffic will be restricted to services defined in the service registry as well as those defined
through ServiceEntries</p>
<p>outbound traffic will be restricted to services defined in the
service registry as well as those defined through ServiceEntries</p>

</td>
</tr>
<tr id="MeshConfig-OutboundTrafficPolicy-Mode-ALLOW_ANY">
<td><code>ALLOW_ANY</code></td>
<td>
<p>outbound traffic to unknown destinations will be allowed, in case there are no services or ServiceEntries for the destination port</p>

</td>
</tr>
<tr id="MeshConfig-OutboundTrafficPolicy-Mode-VIRTUAL_SERVICE_ONLY" class="deprecated ">
<td><code>VIRTUAL_SERVICE_ONLY</code></td>
<td>
<p>not implemented. outbound traffic will be restricted to destinations defined in VirtualServices only</p>
<p>outbound traffic to unknown destinations will be allowed, in case
there are no services or ServiceEntries for the destination port</p>

</td>
</tr>
Expand Down
Loading