text:
How do you get "registered": false in the response of op=stat operation on data-objects endpoint?

Bug Report
iRODS Version, OS and Version
4.3.1, almalinux8
What did you try to do?
I tried to see "registered": false in the response of the stat operation. For this I tried to unregister.
Expected behavior
Always expected to see <"registered": true> because the operation runs for an logical path.
Observed behavior (including steps to reproduce, if applicable)
[irods@dev-u0137480 go-http-client]$ curl -H "Authorization: Bearer $token" 'http://localhost:9000/irods-http-api/0.1.0/data-objects' --data-urlencode 'op=stat' --data-urlencode 'lpath=/u0137480/home/rods/myfile.txt' -G
{"checksum":"sha2:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=","irods_response":{"status_code":0},"modified_at":1703013347,"permissions":[{"name":"rods","perm":"own","type":"rodsadmin","zone":"u0137480"}],"registered":true,"size":0,"type":"data_object"}

[irods@dev-u0137480 go-http-client]$ iunreg myfile.txt
[irods@dev-u0137480 go-http-client]$ curl -H "Authorization: Bearer $token" 'http://localhost:9000/irods-http-api/0.1.0/data-objects' --data-urlencode 'op=stat' --data-urlencode 'lpath=/u0137480/home/rods/myfile.txt' -G
{"irods_response":{"status_code":-171000}}
[irods@dev-u0137480 go-http-client]$ ierror -171000
irods error: -171000 NOT_A_DATA_OBJECT

A bit confused with what exists here.

A data object must be registered in order to exist by definition, so... not sure what the field means in this case. It may exist for some other reason that I'm not aware of. @korydraughn will definitely know more.

The reason registered exists is due to special collections.
See https://github.com/irods/irods/issues/5133.
If you're not working with archive files, then you may be able to ignore that property. Its value depends on whether GenQuery finds a row for the path in the catalog.

Expected to see "Registered":true for all data objects uploaded (registered in catalogue) or only registered. The question was for in which circumstances should we expect to see false. If it is false, I think this means that the object is not known by irods, so the api cannot return anything in that case. a bit confused with seeing registered:false in docs.

Perhaps that property doesn't serve a good purpose for data objects. Renaming or removing it is certainly a possibility.
We'll investigate.

Circling back to this, "registered" would be false for situations involving imcoll (i.e. special collections). The reason being that the objects handled through imcoll will not have rows in the catalog. See the example below:
$ imkdir test.tar.imcoll
$ imcoll -m tar /tempZone/home/kory/test.tar /tempZone/home/kory/test.tar.imcoll
$ ils test.tar.imcoll
/tempZone/home/kory/test.tar.imcoll:
  C- /tempZone/home/kory/test.tar.imcoll/test
$ ils test.tar.imcoll/test
/tempZone/home/kory/test.tar.imcoll/test:
  185kb.bin
  101kb.bin
  f1
  f3
  109kb.bin
  f2
  1074kb.bin
  C- /tempZone/home/kory/test.tar.imcoll/test/asdfasdfasdf
  C- /tempZone/home/kory/test.tar.imcoll/test/y
  C- /tempZone/home/kory/test.tar.imcoll/test/b
  C- /tempZone/home/kory/test.tar.imcoll/test/dx
$ ils test.tar.imcoll/test -l
/tempZone/home/kory/test.tar.imcoll/test:
  kory         tarStr demoResc       189440 2024-04-23.16:55 & 185kb.bin
  kory         tarStr demoResc       103424 2024-04-23.16:55 & 101kb.bin
  kory         tarStr demoResc            0 2023-10-31.09:58 & f1
  kory         tarStr demoResc            0 2023-10-31.09:58 & f3
  kory         tarStr demoResc       111616 2024-04-23.16:55 & 109kb.bin
  kory         tarStr demoResc            0 2023-10-31.09:58 & f2
  kory         tarStr demoResc      1099776 2024-04-23.16:55 & 1074kb.bin
  C- /tempZone/home/kory/test.tar.imcoll/test/asdfasdfasdf  tarStructFile
  C- /tempZone/home/kory/test.tar.imcoll/test/y  tarStructFile
  C- /tempZone/home/kory/test.tar.imcoll/test/b  tarStructFile
  C- /tempZone/home/kory/test.tar.imcoll/test/dx  tarStructFile
$ iquest "select COLL_NAME, DATA_NAME where COLL_NAME = '/tempZone/home/kory/test.tar.imcoll/test'"
CAT_NO_ROWS_FOUND: Nothing was found matching your query

With that said, users will never see a value of false when using stat because the HTTP API will always execute the following code block.
https://github.com/irods/irods_client_http_api/blob/f524cec80187a003bf2956d7890b26b68b1d86c8/endpoints/data_objects/src/main.cpp#L1384-L1388
This means we can safely remove the registered property from the JSON response.

authors: alanking korydraughn mstfdkmn


text:
NPM registry publish for 0.2.4?

@sunloverz Can you publish 0.2.4? I see it here, but NPM says:
vagrant@Geoffreys-Mac-Pro:/vagrant/node_modules/iron_clad/node_modules/iron_mq_node$ npm install
npm ERR! notarget No compatible version found: iron_core@'>=0.2.4'

Published.

source: gharchive/issue

authors: GeoffreyPlitt featalion

license_type: permissive

license_source: bigquery


text:
Parity for build scripts and GOPATH build

I want to be able to build via a build script (hack/build-go.sh) instead of doing a GOPATH build.  If my script prints output from the go compiler, I should be able to go to lines, etc, just as I would if I was running the go compiler directly.

I wonder if this could result in confusing effects with gocode, oracle, or any other GOPATH based tool. If the build worked relative to some other GOPATH not matching the GoTools setting, the tools results could be incorrect.

Hrm, good point.  Maybe there is some way to do both or reconcile the two.

@ironcladlou I had an idea:

Allow an optional build script to be specified and working dir to run it from.
Run the GOPATH build first, if it succeeds, run the build script.

I think I've decided I don't want to introduce this right now, and am going to just stick with integrating with the Go tooling. I wouldn't be opposed to a new proposal in the form of a PR for review. I'm going to close the issue since I personally have no intention of implementing.

authors: ironcladlou pmorie

repo: ironcladlou/GoTools

license: mit


text:
Add Levels compatibility

It would be great if this worked with the Levels mod so that I could put difficult terrain on a floor without affecting the floors above and below it.
Example usage: Trapdoor opens into a room full of spikes.  The spikes are difficult to move through, but the floor above isn't.

It should already support levels.  You can set the elevation of a Terrain Layer.  And using a ruler like Drag Ruler will calculate based on Token elevation.
The Levels mod might need to be updated to take into account elevation of the Terrain when determining what to show/hide.

After some further experimentation, I'm not quite sure what I was running into yesterday.  I can confirm that this works more-or-less as expected in conjunction with Levels.  (Min/max height means something very different than it does for that, but it's logical for this mod.)
That said, there is still one incompatibility, and I'm not sure which side the fix would be on.  Even though difficult terrain doesn't hinder movement when it's on a different level, the indicator area does still show up, regardless of the relative height of everything.  So an upper floor looks like difficult terrain, even if it doesn't act like it until the token goes down.

Should be fixed in the latest release.

Thanks!

license: MIT

license_source: github-api


text:
Custom element doesn't exist: rpi-monitor-card.

Hi,
I just installed lovelace-rpi-monitor-card and restarted home assistant but there is no way to use it:
If I go to dashboard->edit->add card->manual and I paste:
type: 'custom:rpi-monitor-card' entity: sensor.mirpisensor
I get Custom element doesn't exist: rpi-monitor-card.
I don't know what I'm missing.
RPI4-2GB, HA 2022.10.5- Supervisor 2022.10.0 - Frontend 20221010.0 - latest

Did you figure out how to do this?

authors: fesamper pwd-github

repo: ironsheep/lovelace-rpi-monitor-card


text:
Not finding URL working with sub locales on production

Describe the bug
You must provide a clear and concise description of what the bug is.
not able to load the urls for the sub locales on production
Occurs in next-i18next version
You must provide the npm module version, git tag, or even better the explict commit causing the issue.
"next-i18next": "^4.2.1",
Steps to reproduce
You must provide a reproducible repository, or copy/paste blocks of code which are sufficient to reproduce the bug.
Code I am using on production with npm run build && npm run export of similar repo
https://github.com/jatsgit/multi-doable-form
Expected behaviour
You must provide a clear and concise description of what you expected to happen.
Page should load find with url hit with sub locales, means to
http://localhost:8080/id/ or http://localhost:8080/en/
Screenshots
If applicable, add screenshots or a GIF to help explain your problem.

OS (please complete the following information)

Device: Mac OS Mojovave 10.14.6
Browser: Chrome Version 80.0.3987.149 (Official Build) (64-bit)

Additional context
Add any other context about the problem here.

It's port 3000, not 8080.

Its not related to port buddy 3000 I tried running with port still same.

Well then, I cannot reproduce. Because if I clone your repo, and do npm i && npm run build && npm start, I can see your web app at http://localhost:3000/en/.

First, thanks for replying. Its works that way even on my local, but if we
try building app using,  npm run build && npm run export and then I run
out folder using serve command, then issue comes what I mentioned and
same on Production environment i have deployed code from out folder and
running using port serve -l 8080, so its not working, sub locales, I am not
sure what i missed!
On Wed, 1 Apr 2020 at 22:53, Isaac Hinman notifications@github.com wrote:

Well then, I cannot reproduce. Because if I clone your repo, and do npm i
&& npm run build && npm start, I can see your web app at
http://localhost:3000/en/.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/isaachinman/next-i18next/issues/674#issuecomment-607333131,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAJ4DK2CV267TGFV2GY6TNLRKNPQJANCNFSM4LZACQPQ
.

Oh, I see what you mean. Of course locale subpaths will not work with a static deployment - they depend upon an Express middleware. If you have any further questions please feel free to post on StackOverflow. Good luck!

Quick questions, I should deploy full code base how I run the app locally i
should run it same on prod too instead of deploying a static will it work
or i have remove serverless from target and rebuild the app and deploy?
On Wed, 1 Apr 2020 at 23:04, Isaac Hinman notifications@github.com wrote:

Oh, I see what you mean. Of course locale subpaths will not work with a
static deployment - they depend upon an Express middleware. If you have any
further questions please feel free to post on StackOverflow. Good luck!
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/isaachinman/next-i18next/issues/674#issuecomment-607339215,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAJ4DK3562VTJOWTLYOQHADRKNQW5ANCNFSM4LZACQPQ
.

authors: isaachinman jatsgit jsbimra


text:
Presedency by using lowercase package-name on publish

I published an app called "Todo" a while back, that I am still developing. Unfortunately, someone has since that published an app called "todo". That app gets all the attention now, as it is not possible to reach my app anymore with querying npm.

Module names should be lowercase, ideally.  If you would like to dispute this with the author, please follow the steps outlined in http://npmjs.org/doc/disputes.html

authors: hkjels isaacs

repo: isaacs/npm


text:
IsarError in release mode ios

Help!
I have been dealing with this problem for a few days now.
In ios, The app is stuck on a white screen when opening in
release mode and testflight in app store connect. (Debug is well)
Exception: IsarError: Could not initialize IsarCore library for processor architecture "ios_arm64". If you create a Flutter app, make sure to add isar_flutter_libs to your
dependencies
Invalid argument(s): Failed to lookup symbol 'isar_version': dlsym(RTLD_DEFAULT, isar_version): symbol not found

Platform: iPhone 13
ios 16.2
Xcode: 14.2
Flutter version: 3.7.0

dependencies:
Isar version: 3.5.0
Isar_flutter_lib: 3.5.0

--
example https://github.com/isar/isar/issues/519#issue-1316611758

Hi,
could you delete the podfile.lock file in your ios repository and then refetched the pods with this command 'pod update'. I think I remember having the same error and that helped. What I wonder is why it runs in the debug build.

thanks i will try "pod update".
From a search I did on this error message it seemed that it was a problem that was fixed in the new versions.  But I still got it in the new version. In ios and release mode

I get this error from a multitude of devices, though not locally for quite a few time. It seems to be a random problem.

I solved the problem at the end with the highlighted lines in Podfile

Interestingly I see this error (in Sentry) exclusively on Android devices only. iOS is not an issue.

There is a similar issue here. If you have the following line in your Podfile which is required by some frameworks you will also get the "grey screen of death" in release mode only:
target 'Runner' do
  use_frameworks! :linkage => :static
  use_modular_headers!

  flutter_install_all_ios_pods File.dirname(File.realpath(__FILE__))
end

One of the frameworks in question: https://developers.is.com/ironsource-mobile/flutter/integration-helper-flutter/

can try with 3.0.6-dev.0?

If your project enables Dead Code Stripping, cause isar_flutter_libs is the static library, it strips unused codes which are not directly referenced, you have two ways to solve the problems.

The first way, I am using in my project, turn isar_flutter_libs to the dynamic framework, open your podfile, and add:

dynamic_framework = ['isar_flutter_libs']

pre_install do |installer|
    Pod::Installer::Xcode::TargetValidator.send(:define_method, :verify_no_static_framework_transitive_dependencies) {}
    installer.pod_targets.each {| pod |
      if dynamic_framework.include?(pod.name)
        puts "turn to dynamic framework name:" + pod.name
        def pod.dynamic_framework;
          true
        end
        def pod.build_type;
          Pod::BuildType.dynamic_framework
        end
      end
    }
  end

or disable Dead Code Stripping in your target Build Settings.

authors: JaonFanwt Sadmansamee bobekos chezki1235467 ekimia morhi

repo: isar/isar


text:
🛑 Truyol is down

In 526fe58, Truyol (https://truyol.com/) was down:

HTTP code: 0
Response time: 0 ms

Resolved: Truyol is back up in 5670d99.

repo: iscrdh/upptime


text:
Ex. 0.4.3

I think I made the code work(almost), although there is this weird issue with assigning i = i+1, which should be the simplest of all cases...

Hi,
Start out by checking the following: How many instances of [ do you have relative to ] in the fourth line? This should always be the same.
Best,
Joachim

Now that's sorted out and a few things fixed, but now my loop just won't fill in the rows, and I don't understand why, can I ask for help with this matter?

I found out. I was using the wrong concatenating function/method for dataframes:

authors: joachimkrasmussen miksozz


text:
FEATURE: Safety council contact form

New contact form for safety rep!
This is the old contact form for the safety representative that is to be moved to the new website

Content
Wall of text
Four info expandables
Contact form
Name - optional
Contact method radio buttons (Mail, Phone, Physically, Do not want to be contacted) Not working on iare.nu

Email or phonenumber - optional
Message textfield
Captcha
Send button

mockup for inspo

in src/views/Contact/Slug.tsx
Added alert and radio group from chakra

repo: isektionen/iare-se


text:
Feature/tests

Simple webdriver tests implementation - chrome only

Any reason why this is closed @dcchuck?

source: gharchive/pull-request

authors: dcchuck ismailhabib

repo: ismailhabib/custom-protocol-detection


text:
🛑 Cooptenjo.isolucion.co is down

In e671409, Cooptenjo.isolucion.co (https://Cooptenjo.isolucion.co) was down:

HTTP code: 0
Response time: 0 ms

Resolved: Cooptenjo.isolucion.co is back up in 1c64cad.

repo: isolucionco/EstadoIsolucionHosting


text:
Ng-model undefined

Is there anyone still struggling to get the selected value?
Ng-model is undefined when trying to catch in the controller.

I am struggling with this too. Did you figure it out?

Hey @xiaofanwu. Still no answer...

Try this: http://stackoverflow.com/a/22768720/2276198

authors: ahaverty thomasvbe xiaofanwu

repo: israelidanny/ion-google-place


text:
Routes

Rutas y controllers termianados, ya estan revisados.

Finalizada con exito!

Estoy de acuerdo

Listo! a darle

repo: isravazquez/Escuela-de-artes


text:
Need help with formatting international phone numbers

Hi!
Thx for cool idea of input formatters. But I need help with understanding, how can I implement international phone numbers.
The main idea, is to help users:

When types some number, we need to add "+7" at start of the input. Like, type "9", in input shows "+7 9"
When paste number in format "79876543210", need to format and display "+7 987 654-32-10"
When paste number in format "9876543210", need to display same "+7 987 654-32-10".

2nd and 3rd point I solved, but with typing from scratch, cursor won't forward to end of input.
See example:
https://codesandbox.io/embed/istarkovrifm-phone-format-qw8c3

If type from scratch manually "+ 7" it's good.
If type from scratch "9" and then put cursor at the end of input and continue typing, it's good, too.

Maybe I need to use not only this library, but make some third-party solutions?

Hey, currently all that +7 like reolacements should be done via replace property, btw now replace is strict now and supports same size replacements as its preserves cursor position, btw week ago we decided to not make it so strict - and allow replacements as in your case. We will add that in next version soon (soon depends on weather conditions in Russia as u know summer here is short ;-))

I believe the new append prop solves this :-)

authors: DTupalov antiold istarkov

repo: istarkov/rifm


text:
Not clear how VirtualService is supposed to work

Bug description
When using VirtualService in conjunction with the mesh gateway, it is not clear what the resulting semantics should be. In particular, how hosts declared in VritualService overlap with hosts owned by K8s Services (or rather, Istio ServiceEntries?) seems to affect what hosts and ports Envoy listens on, but the result doesn't make much sense. Eg. I get listeners on port 80 which comes out of nowhere, sometimes domain expansion is performed, sometimes only FQDN is used. Port filters in HTTPMatchRequest.port seem to get ignored.
My best (empirical) understanding of the current algorithm is:

VirtualService generates one set of rules that gets appended to multiple virtual hosts (existing or new)
For each host, create an Envoy virtual host on port 80 (no domain expansion)
For each host matching a ServiceEntry, append rules to its existing Envoy virtual host (those do have expansion and usually listen on non-80 ports)
Also create virtual hosts for hosts not matching ServiceEntries, but on ports of ServiceEntries matched by other hosts of the VirtualService

Or something like that. Feels messy.
We should document what the precise behavior should be (such that it is possible to write code based on that) and then fix the current implementation to conform to it.
See the doc for a more concrete example.
Affected product area (please put an X in all that apply)
[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[x ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

FYI @howardjohn @andraxylia @duderino

FYI @louiscryan

There is nothing unclear in the API, just a bug in Pilot. Under no circumstance with the given config, should Pilot generate outbound clusters to reach svc A on port 80. My only hope is those clusters ("cluster": "outbound|80||svc-a.default.svc.cluster.local") have zero endpoints, otherwise we have bigger troubles.

cc @costinm

VirtualService behavior for traffic matching should be as follows:

if the hosts points to an existing service from the service registry (native or ServiceEntry), the ports for matching can be inferred and Pilot should generate Envoy virtual_hosts for host+port, for each port of the service
for BYON (bring your own name) hosts aliases, the port cannot be inferred. If the VS is attached to a Gateway, we can infer the ports from the Gateway. If the VS is attached to the "mesh", there is currently no way to infer the port. Current code assumes port 80, so BYON for mesh services on port 80 will still work. Any services not using port 80 become inaccessible. The workaround is to include the port in the hosts field, ex: "byon.com:9083". We need an VirtualService API change where the port either becomes part of the hosts field, or a field on its own.

For all VirtualServices applied to mesh config, there is determinism if the port is explicitly configured in the match rule. This can function in the absence of the API or semantic changes I was suggesting, albeit it requires more configuration.
For VirtualServices applied to the Gateway, the traffic can only come via one of the Gateway ports. An explicit port configuration on a VS, in the match rule or elsewhere, makes it not portable on both mesh gateways and ingress gateways.

authors: andraxylia qfel

repo: istio/istio


text:
Pods with sidecar injection stuck in ContainerCreating status

(NOTE: This is used to report product bugs:
To report a security vulnerability, please visit https://istio.io/about/security-vulnerabilities/
To ask questions about how to use Istio, please visit https://discuss.istio.io
)
Bug description
My pods with side car injection is not starting:
Pod logs shows following error
 Warning  FailedCreatePodSandBox  61s (x4 over 2m32s)  kubelet, lxappstrldev0001  (combined from similar events): Failed create pod sandbox: rpc error: code = Unknown desc = failed to set up sandbox container "a7d47adab4560c602c0e491b9e4a2f2ebd89cd2a3cc61232842c94ad02dc9a2a" network for pod "httpbin-6cbc6f986f-kh52h": NetworkPlugin cni failed to set up pod "httpbin-6cbc6f986f-kh52h_default" network: exit status 3
Here is the status of istio pods:
kube-system    istio-cni-node-4kfl4                               1/1     Running             0          2d15h   172.29.172.188   lxappomsdev002   <none>           <none> kube-system    istio-cni-node-9tmt2                               1/1     Running             0          2d15h   172.29.162.36    lxappomsdev007             <none>           <none> kube-system    istio-cni-node-l48kp                               1/1     Running             0          2d15h   172.29.162.35    lxappomsdev006             <none>           <none> kube-system    istio-cni-node-lt277                               1/1     Running             0          2d15h   172.29.172.189   lxappomsdev003.lowes.com   <none>           <none> kube-system    istio-cni-node-n5nmn                               1/1     Running             0          2d15h   172.29.162.110   lxappstrldev0001           <none>           <none> kube-system    istio-cni-node-pqnnj                               1/1     Running             0          2d15h   172.29.162.111   lxappstrldev0002           <none>           <none> kube-system    istio-cni-node-wk9kh                               1/1     Running             0          2d15h   172.29.172.187   lxappomsdev001.lowes.com   <none>           <none>
istio-system   istio-galley-5b984f89b-n74xp                       1/1     Running             0          2d15h   10.244.3.7       lxappomsdev006             <none>           <none>
Affected product area (please put an X in all that apply)
[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[X ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
Expected behavior
I have followed the documentation for enabling the istio CNI. Galley and CNI pods are in running state with no error.
Steps to reproduce the bug

Install istio with side car injection on a single control plane cluster created with "kubeadm"
deploy the pod with side car injection

kubectl apply -f <(istioctl kube-inject -f samples/httpbin/httpbin.yaml)
Version (include the output of istioctl version --remote and kubectl version)
client version: 1.2.2 citadel version: 1.2.2 galley version: 1.2.2 ingressgateway version: 1.2.2 pilot version: 1.2.2 policy version: 1.2.2 sidecar-injector version: 1.2.2 telemetry version: 1.2.2
Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.1", GitCommit:"4485c6f18cee9a5d3c3b4e523bd27972b1b53892", GitTreeState:"clean", BuildDate:"2019-07-18T14:25:20Z", GoVersion:"go1.12.7", Compiler:"gc", Platform:"darwin/amd64"} Server Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.0", GitCommit:"e8462b5b5dc2584fdcd18e6bcfe9f1e4d970a529", GitTreeState:"clean", BuildDate:"2019-06-19T16:32:14Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64"}
How was Istio installed?
 helm install install/kubernetes/helm/istio --name istio --namespace istio-system --set istio_cni.enabled=true
Environment where bug was observed (cloud vendor, OS, etc)
On prem Kubernetes
Additionally, please consider attaching a cluster state archive by attaching
the dump file to this issue.

Istio CNI logs into journalctl on the node. Can you grep for  "nsenter" in journalctl logs?

@mishaque more specifically look for a log containing "nsenter failed".

@mishaque Also can you give more details about the kernel on your worker nodes? What version? Does it support iptables? nftables?

@rlenglet here is the logs for nsenter:
Jul 29 11:21:24 lxappstrldev0001 kubelet[12441]: 2019-07-29 11:21:24.695 [ERROR][24692] redirect.go 264: nsenter failed: exit status 3 err=exit status 3 out="Environment:\n------------\nENVOY_PORT=\nISTIO_INBOUND_INTERCEPTION_MODE=\nISTIO_INBOUND_TPROXY_MARK=\nISTIO_INBOUND_TPROXY_ROUTE_TABLE=\nISTIO_INBOUND_PORTS=\nISTIO_LOCAL_EXCLUDE_PORTS=\nISTIO_SERVICE_CIDR=\nISTIO_SERVICE_EXCLUDE_CIDR=\n\nVariables:\n----------\nPROXY_PORT=15001\nINBOUND_CAPTURE_PORT=15001\nPROXY_UID=1337\nINBOUND_INTERCEPTION_MODE=REDIRECT\nINBOUND_TPROXY_MARK=1337\nINBOUND_TPROXY_ROUTE_TABLE=133\nINBOUND_PORTS_INCLUDE=80\nINBOUND_PORTS_EXCLUDE=15020\nOUTBOUND_IP_RANGES_INCLUDE=*\nOUTBOUND_IP_RANGES_EXCLUDE=\nOUTBOUND_PORTS_EXCLUDE=15020\nKUBEVIRT_INTERFACES=\nENABLE_INBOUND_IPV6=\n\n+ IPTABLES_RETRY=true\n+ iptables -t nat -N ISTIO_REDIRECT\n+ iptables_retry /usr/sbin/iptables -t nat -N ISTIO_REDIRECT\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -N ISTIO_REDIRECT\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ iptables -t nat -A ISTIO_REDIRECT -p tcp -j REDIRECT --to-port 15001\n+ iptables_retry /usr/sbin/iptables -t nat -A ISTIO_REDIRECT -p tcp -j REDIRECT --to-port 15001\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -A ISTIO_REDIRECT -p tcp -j REDIRECT --to-port 15001\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ iptables -t nat -N ISTIO_IN_REDIRECT\n+ iptables_retry /usr/sbin/iptables -t nat -N ISTIO_IN_REDIRECT\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -N ISTIO_IN_REDIRECT\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ iptables -t nat -A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-port 15001\n+ iptables_retry /usr/sbin/iptables -t nat -A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-port 15001\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-port 15001\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ '[' -n 80 ']'\n+ '[' REDIRECT = TPROXY ']'\n+ table=nat\n+ iptables -t nat -N ISTIO_INBOUND\n+ iptables_retry /usr/sbin/iptables -t nat -N ISTIO_INBOUND\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -N ISTIO_INBOUND\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ iptables -t nat -A PREROUTING -p tcp -j ISTIO_INBOUND\n+ iptables_retry /usr/sbin/iptables -t nat -A PREROUTING -p tcp -j ISTIO_INBOUND\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -A PREROUTING -p tcp -j ISTIO_INBOUND\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ '[' 80 == '*' ']'\n+ for port in '${INBOUND_PORTS_INCLUDE}'\n+ '[' REDIRECT = TPROXY ']'\n+ iptables -t nat -A ISTIO_INBOUND -p tcp --dport 80 -j ISTIO_IN_REDIRECT\n+ iptables_retry /usr/sbin/iptables -t nat -A ISTIO_INBOUND -p tcp --dport 80 -j ISTIO_IN_REDIRECT\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -A ISTIO_INBOUND -p tcp --dport 80 -j ISTIO_IN_REDIRECT\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ iptables -t nat -N ISTIO_OUTPUT\n+ iptables_retry /usr/sbin/iptables -t nat -N ISTIO_OUTPUT\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -N ISTIO_OUTPUT\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ iptables -t nat -A OUTPUT -p tcp -j ISTIO_OUTPUT\n+ iptables_retry /usr/sbin/iptables -t nat -A OUTPUT -p tcp -j ISTIO_OUTPUT\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -A OUTPUT -p tcp -j ISTIO_OUTPUT\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ '[' -n 15020 ']'\n+ for port in '${OUTBOUND_PORTS_EXCLUDE}'\n+ iptables -t nat -A ISTIO_OUTPUT -p tcp --dport 15020 -j RETURN\n+ iptables_retry /usr/sbin/iptables -t nat -A ISTIO_OUTPUT -p tcp --dport 15020 -j RETURN\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -A ISTIO_OUTPUT -p tcp --dport 15020 -j RETURN\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ '[' -z '' ']'\n+ iptables -t nat -A ISTIO_OUTPUT -o lo '!' -d 127.0.0.1/32 -j ISTIO_REDIRECT\n+ iptables_retry /usr/sbin/iptables -t nat -A ISTIO_OUTPUT -o lo '!' -d 127.0.0.1/32 -j ISTIO_REDIRECT\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -A ISTIO_OUTPUT -o lo '!' -d 127.0.0.1/32 -j ISTIO_REDIRECT\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ for uid in '${PROXY_UID}'\n+ iptables -t nat -A ISTIO_OUTPUT -m owner --uid-owner 1337 -j RETURN\n+ iptables_retry /usr/sbin/iptables -t nat -A ISTIO_OUTPUT -m owner --uid-owner 1337 -j RETURN\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -A ISTIO_OUTPUT -m owner --uid-owner 1337 -j RETURN\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ for gid in '${PROXY_GID}'\n+ iptables -t nat -A ISTIO_OUTPUT -m owner --gid-owner 1337 -j RETURN\n+ iptables_retry /usr/sbin/iptables -t nat -A ISTIO_OUTPUT -m owner --gid-owner 1337 -j RETURN\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -A ISTIO_OUTPUT -m owner --gid-owner 1337 -j RETURN\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ iptables -t nat -A ISTIO_OUTPUT -d 127.0.0.1/32 -j RETURN\n+ iptables_retry /usr/sbin/iptables -t nat -A ISTIO_OUTPUT -d 127.0.0.1/32 -j RETURN\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -A ISTIO_OUTPUT -d 127.0.0.1/32 -j RETURN\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ '[' 0 -gt 0 ']'\n+ '[' 1 -gt 0 ']'\n+ '[' '*' == '*' ']'\n+ iptables -t nat -A ISTIO_OUTPUT -j ISTIO_REDIRECT\n+ iptables_retry /usr/sbin/iptables -t nat -A ISTIO_OUTPUT -j ISTIO_REDIRECT\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/iptables -t nat -A ISTIO_OUTPUT -j ISTIO_REDIRECT\n+ local err_code=0\n+ [[ 0 == 0 ]]\n+ break\n+ set -o errexit\n+ return 0\n+ set +o nounset\n+ '[' -n '' ']'\n+ ip6tables -F INPUT\n+ iptables_retry /usr/sbin/ip6tables -F INPUT\n+ '[' true '!=' true ']'\n+ local iptables_wait=30\n+ set +o errexit\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=29\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=28\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=27\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=26\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=25\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=24\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=23\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=22\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=21\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=20\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=19\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=18\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=17\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=16\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=15\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=14\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=13\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=12\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=11\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=10\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=9\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=8\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=7\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=6\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=5\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=4\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=3\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=2\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=1\n+ ((  iptables_wait > 0  ))\n+ sleep 1\n+ true\n+ /usr/sbin/ip6tables -F INPUT\nip6tables v1.4.21: can't initialize ip6tables table filter': Address family not supported by protocol\nPerhaps ip6tables or your kernel needs to be upgraded.\n+ local err_code=3\n+ [[ 3 == 0 ]]\n+ iptables_wait=0\n+ ((  iptables_wait > 0  ))\n+ exit 3\n+ dump\n+ iptables-save\n# Generated by iptables-save v1.4.21 on Mon Jul 29 11:21:24 2019\n*mangle\n:PREROUTING ACCEPT [2:286]\n:INPUT ACCEPT [2:286]\n:FORWARD ACCEPT [0:0]\n:OUTPUT ACCEPT [2:144]\n:POSTROUTING ACCEPT [2:144]\nCOMMIT\n# Completed on Mon Jul 29 11:21:24 2019\n# Generated by iptables-save v1.4.21 on Mon Jul 29 11:21:24 2019\n*nat\n:PREROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:ISTIO_INBOUND - [0:0]\n:ISTIO_IN_REDIRECT - [0:0]\n:ISTIO_OUTPUT - [0:0]\n:ISTIO_REDIRECT - [0:0]\n-A PREROUTING -p tcp -j ISTIO_INBOUND\n-A OUTPUT -p tcp -j ISTIO_OUTPUT\n-A ISTIO_INBOUND -p tcp -m tcp --dport 80 -j ISTIO_IN_REDIRECT\n-A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15001\n-A ISTIO_OUTPUT -p tcp -m tcp --dport 15020 -j RETURN\n-A ISTIO_OUTPUT ! -d 127.0.0.1/32 -o lo -j ISTIO_REDIRECT\n-A ISTIO_OUTPUT -m owner --uid-owner 1337 -j RETURN\n-A ISTIO_OUTPUT -m owner --gid-owner 1337 -j RETURN\n-A ISTIO_OUTPUT -d 127.0.0.1/32 -j RETURN\n-A ISTIO_OUTPUT -j ISTIO_REDIRECT\n-A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001\nCOMMIT\n# Completed on Mon Jul 29 11:21:24 2019\n# Generated by iptables-save v1.4.21 on Mon Jul 29 11:21:24 2019\n*filter\n:INPUT ACCEPT [2:286]\n:FORWARD ACCEPT [0:0]\n:OUTPUT ACCEPT [2:144]\nCOMMIT\n# Completed on Mon Jul 29 11:21:24 2019\n+ ip6tables-save\n"
We are using RHEL 7 Kernel version is : 3.10.0-957.21.3.el7.x86_64

Ok so IPv6 is disabled in your kernel?

That is weird because the script attempts to setup ip6tables chains only if the pod has an IPv6 address.
@mishaque could you please run "ip addr" inside a pod (without injection)?

Here is the output from ifconfig for the same "httpbin" pod without the injection:
`eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1450
inet 10.244.5.6  netmask 255.255.255.0  broadcast 0.0.0.0
ether 7a:c8:a5:a6:f9:0b  txqueuelen 0  (Ethernet)
RX packets 110  bytes 202824 (202.8 KB)
RX errors 0  dropped 0  overruns 0  frame 0
TX packets 80  bytes 5572 (5.5 KB)
TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
inet 127.0.0.1  netmask 255.0.0.0
loop  txqueuelen 1000  (Local Loopback)
RX packets 0  bytes 0 (0.0 B)
RX errors 0  dropped 0  overruns 0  frame 0
TX packets 0  bytes 0 (0.0 B)
TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
`

Thanks! So that means that the isIPv6 function in the istio-iptables.sh script is buggy. I'll fix that.

@rlenglet is there a workaround for time being?

@rlenglet, thanks for including this in the 1.3 milestone. I will try enabling the IPV6 on the Node as a workaround; I am not sure if this would solve the issue. Please let me know your recommendation/workaround.

The ENABLE_INBOUND_IPV6 variable is not set in your logs:
ENABLE_INBOUND_IPV6=\n

So there is no mis-detection of IPv6. That part is correct.
The commands that are failing are those executed in case IPv6 is not detected:
https://github.com/istio/cni/blob/master/tools/packaging/common/istio-iptables.sh#L665-L668
  ip6tables -F INPUT || true
  ip6tables -A INPUT -m state --state ESTABLISHED -j ACCEPT || true
  ip6tables -A INPUT -i lo -d ::1 -j ACCEPT || true
  ip6tables -A INPUT -j REJECT || true

These commands are failing because of the retrying of the commands in this script.
I need to disable retries for those in case IPv6 is disabled.
This bug is specific to Istio CNI's version of the istio-iptables.sh script.
So @mishaque you could try using normal injection instead of Istio CNI. It won't have this problem.

authors: mishaque rlenglet


text:
MeshNetworks docs is wrong - networks is a map not an array

Bug description
Look at the docs here: https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/#MeshNetworks
and notice the dash (-) before endpoints in the example:
networks:
  network1:
  - endpoints:   <<<<----- LOOK HERE!
    - fromRegistry: registry1 #must match kubeconfig name in Kubernetes secret
    - fromCidr: 192.168.100.0/22 #a VM network for example
    gateways:
    - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
      port: 15443
      locality: us-east-1a
    - address: 192.168.100.1
      port: 15443
      locality: us-east-1a

When you follow this example, the istiod pod will log the following (side note: this should NOT be an "info" level message - it should at minimum be "warn" if not "error"):
info	failed to read mesh networks configuration from "/etc/istio/config/meshNetworks": failed to convert to proto. json: cannot unmarshal array into Go value of type map[string]json.RawMessage

I happen to notice another example for this section of the config here in this issue comment. And this is what it shows:
data:
  meshNetworks: |-
   networks:
     network1:
       endpoints:  <<<<---- LOOK HERE! Not array (no dash)
         - fromRegistry: cluster1
       gateways:
         - address: 1.2.3.4
           port: 15443

Notice the difference.
When I changed my config to match that, things parsed successfully and the istiod pod shows the parsed json.
SOLUTION:

The documentation needs to change - that single "dash" effectively wasted a few hours of my time :)

The log message should not be at "info" level - that will clearly cause istiod to misbehave since it effectively is missing configuration - it should at minimum be a "warn" message (I would think it should be "error" since the behavior of the istiod pod will be broken).

[x] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Extensions and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
[ ] Upgrade
Version
1.9.2

+1

This is a good point. I will call out though, that meshNetworks is deprecated.
Using address in mesh networks can be accomplished by setting .spec.externalIP on a Service annotated with topology.istio.io/network.
Using registryServiceName simply requires the annotation, and will automatically use the LoadBalancer IP(s).

Looks like both areas are fixed in master. I just opened PRs to fix the docs in previous versions:
https://github.com/istio/api/pull/1961
https://github.com/istio/api/pull/1960

authors: boeboe jmazzitelli stevenctl


text:
proposal: support zone aware routing

Describe the feature request
Support Envoy's native Zone Aware Routing in Istio.
Istio currently only supports Locallity Failover and Locality Weighted Load Balacing, which allows to fallback traffic to other zones if local zone is unhealthy or to manually specify zone weights to distribute traffic. This however, requires manual configuration and doesn't cover cases that Zone Aware Routing does, for example if services are not perfectly balanced between zones, then traffic will not be balanced and could cause greater load on some zones.
Describe alternatives you've considered
For Zone Aware Routing to happen Envoy needs to know it's local zone (--service-zone) and cluster_name for which it will request EDS to know the distribution of VMs in Zones for his own cluster.
The only thing preventing Istio to implement Zone Aware Routing is that Envoy needs to request resources for it's local_cluster_name and that needs to be static, currently Istio Clusters Names are Dynamic and change according to configurations.
To support this i propose the following:

Make Istiod generate a "fake" cluster which is only visible to each Envoy as it's own local_cluster and doesn't really exist. This would be generated in-memory and contextually for each sidecar connected to Istiod
The name for this cluster could be:

something static for all clusters (eg: local_cluster), since the name of the cluster doesn't really matter
be something semi-static containing the application/subset which could be defined by convention
be something semi-static containing the application/subset which is sent to Istiod as metadata

We need only to add this fake cluster to EDS: it would be populated with targets from the Application/Subset or WorkloadGroup
Add Local Cluster as a static cluster in envoy configuration.
Endpoint Localities should be configured in EDS for all clusters, including local.
Add required Istio configurations to enable Zone Aware Routing for each cluster, the most important configuration is probably min_cluster_size. Is there any case where we eventually wouldn't want Zone Aware Routing enabled by default?
Zone Aware Routing and Locality Weighted Load Balancing are mutually exclusive.
Zone Aware Routing can work with Priorities, but only works on p=0, this has the following consequences:

Istio has to configure p=0 with all the endpoints for the local region of the calling cluster. (currently p=0 contains only the local zone targets)
Priority Failover probably only makes sense to fallback to other regions, since p=0 would always contain all targets from the local region and fallback to other zones would be automatic.

Add Istio support for per service zone metrics

Affected product area (please put an X in all that apply)
[ ] Docs
[ ] Installation
[ ] Networking
[x] Performance and Scalability
[ ] Extensions and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
Affected features (please put an X in all that apply)
[ ] Multi Cluster
[ ] Virtual Machine
[ ] Multi Control Plane
Additional context
Re-Opening https://github.com/istio/istio/issues/18500

My understanding of zone aware may be inaccurate, but my understanding is "local_cluster" is used to group a list of endpoint sthat are in the same logical "group", where group == "some outbound cluster"?
For example, if I am bookinfo-3, I set local_cluster to include bookinfo-{0..10}. Then on other pods, I have a clsuter like outbound|80||bookinfo with all of those pods?
The problem that I see is that any given pod may have many different clusters its a part of, as it will have one for every port * service * subset. So its not clear what we would put in the local_cluster?

@howardjohn yes, that is exactly the case.
It could be tricky, but probably for most cases it would work. In normal scenarios a pod should only be part of a single subset or application entirely.
If it were necessary we could expose a way to customize how istio chooses which pods are part of the same cluster.

Istio currently only supports Locallity Failover and Locality Weighted Load Balacing, which allows to fallback traffic to other zones if local zone is unhealthy or to manually specify zone weights to distribute traffic. This however, requires manual configuration and doesn't cover cases that Zone Aware Routing does, for example if services are not perfectly balanced between zones, then traffic will not be balanced and could cause greater load on some zones.

For this discussion, let's put locality weighted LB aside, since it's a somewhat different use case.
For locality failover, it's a known issue that we need to be smarter about taking into account the number of endpoints. We've just started some discussion on how to fix this, since we want to make a better default for LB in general. I suspect if we fix that and make it the default, we wouldn't need zone aware routing? Or are there other issues with locality failover as well?

if services are not perfectly balanced between zones, then traffic will not be balanced and could cause greater load on some zones.

How does envoy support this?  The originating cluster local zone percentage is greater than the one in the upstream cluster.

I was trying to enable zone based routing config via EnvoyFilter on Istio mesh with following configuration
patch:
operation: MERGE
value: # cluster specification
common_lb_config:
zone_aware_lb_config:
routing_enabled:
value: 100.0
min_cluster_size: 2
The config is getting applied, can see the envoy config getting reflected, but I don't see any affect on the load-balancing/traffic distribution. So this would not be possible until #35102 is implemented?

There seems good amount of interest from community for this. This proposal has lot of details and has not been invalidated hence re-opening it.

authors: Purushotham233 howardjohn hzxuzhonghu laxmiprasanna-gunna nmittler sschepens


text:
Telemetry: configure tracing to remove certain default tags

Describe the feature request
The zipkin traces emitted via the Istio Sidecars by default have many tags. According to https://istio.io/latest/docs/reference/config/telemetry/#Tracing, currently there is an option to add more custom tags, but no option to customize/remove certain default ones. We are wondering if it's possible to add this functionality?
Describe alternatives you've considered
We have tracing disabled globally with only a couple of services overriding this. Still, we are seeing that having all of the default tags can really load our ElasticSearch backend. This is a real blocker for us from onboarding the rest of our k8s apps onto the mesh since we would like to support global tracing by default.
Affected product area (please put an X in all that apply)
[ ] Ambient
[X] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[X] Extensions and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
Affected features (please put an X in all that apply)
[ ] Multi Cluster
[ ] Virtual Machine
[ ] Multi Control Plane
Additional context

@RaiAnandKr is that the issue is going to be fixed in the Envoy where it generates those tags. In istio we have a feature https://istio.io/latest/docs/reference/config/telemetry/#Tracing-CustomTag but only for adding. So, this is not an existing feature in Telemetry API
can we close this issue if not relevant

Hi @imnmo, you may close it, thanks.

authors: imnmo zohar-arista


text:
Failed to use portName in EnvoyFilter.RouteConfigurationMatch

Is this the right place to submit this?

[X] This is not a security vulnerability or a crashing bug
[X] This is not a question about how to use Istio

Bug Description
Hi all,
I deployed the BookInfo application in the bookinfo namespace and created the associated BookInfo Gateway following this guide https://istio.io/latest/docs/examples/bookinfo/
Command I used
kubectl create ns bookinfo
kubectl label namespace bookinfo istio-injection=enabled
kubectl apply -n bookinfo -f samples/bookinfo/platform/kube/bookinfo.yaml
kubectl apply -n bookinfo -f samples/bookinfo/networking/bookinfo-gateway.yaml

So far so good, all functions worked as expected. Then, I tried to create an EnvoyFilter only applies to the bookinfo-gateway with the following yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: bookinfo-gateway-metadata
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: HTTP_ROUTE
    match:
      context: GATEWAY
      routeConfiguration:
        portNumber: 80
        portName: "http" # L11 of https://raw.githubusercontent.com/istio/istio/release-1.16/samples/bookinfo/networking/bookinfo-gateway.yaml
    patch:
      operation: MERGE
      value:
        metadata:
          filter_metadata:
            envoy.filters.http.lua:
              foo: "bar"

I searched the foo value from the generated proxy config via istioctl proxy-config route -n istio-system istio-ingressgateway-566c5fc9cd-vmtks -o yaml | grep foo but found nothing.
I also tried to add a routeConfiguration.gateway with following yaml
...
    match:
      context: GATEWAY
      routeConfiguration:
        portNumber: 80
        portName: "http"
        gateway: "bookinfo/bookinfo-gateway"
    patch:
...

But didn't work either. The only way to have the foo value in the generated proxy configuration is to keep only the portNumber value in the routeConfiguration, like
...
    match:
      context: GATEWAY
      routeConfiguration:
        portNumber: 80
    patch:
...

Any kind of help is greatly appreciated.
Version
$ istioctl version
client version: 1.16.7
control plane version: 1.16.7
data plane version: 1.16.7 (8 proxies)
$ kubectl version --short
Flag --short has been deprecated, and will be removed in the future. The --short output will become the default.
Client Version: v1.24.6
Kustomize Version: v4.5.4
Server Version: v1.24.6-aliyun.1

Additional Information
Target cluster context: 297960165566421595-ccc069e51d05640d2bef0572291e7c085
Running with the following config:
istio-namespace: istio-system
full-secrets: false
timeout (mins): 30
include: {  }
exclude: { Namespaces: kube-node-lease,kube-public,kube-system,local-path-storage }
end-time: 2023-08-10 20:50:20.918276858 +0800 CST
Cluster endpoint: https://172.16.131.152:6443
CLI version:
version.BuildInfo{Version:"1.16.7", GitRevision:"00136097767eec680da8749837a8d79adf110b1a", GolangVersion:"go1.19.11", BuildStatus:"Clean", GitTag:"1.16.7"}
The following Istio control plane revisions/versions were found in the cluster:
Revision default:
&version.MeshInfo{
{
Component: "pilot",
Info:      version.BuildInfo{Version:"1.16.7", GitRevision:"00136097767eec680da8749837a8d79adf110b1a", GolangVersion:"", BuildStatus:"Clean", GitTag:"1.16.7"},
},
}
The following proxy revisions/versions were found in the cluster:
Revision default: Versions {1.16.7}
Fetching proxy logs for the following containers:
bookinfo/details-v1/details-v1-7d4d9d5fcb-r94kv/details
bookinfo/details-v1/details-v1-7d4d9d5fcb-r94kv/istio-proxy
bookinfo/productpage-v1/productpage-v1-66756cddfd-45qvh/istio-proxy
bookinfo/productpage-v1/productpage-v1-66756cddfd-45qvh/productpage
bookinfo/ratings-v1/ratings-v1-85cc46b6d4-2wzh2/istio-proxy
bookinfo/ratings-v1/ratings-v1-85cc46b6d4-2wzh2/ratings
bookinfo/reviews-v1/reviews-v1-777df99c6d-pkpmn/istio-proxy
bookinfo/reviews-v1/reviews-v1-777df99c6d-pkpmn/reviews
bookinfo/reviews-v2/reviews-v2-cdd8fb88b-ldsj6/istio-proxy
bookinfo/reviews-v2/reviews-v2-cdd8fb88b-ldsj6/reviews
bookinfo/reviews-v3/reviews-v3-58b6479b-rmmq7/istio-proxy
bookinfo/reviews-v3/reviews-v3-58b6479b-rmmq7/reviews
istio-system/istio-egressgateway/istio-egressgateway-6796d654d8-s2bd4/istio-proxy
istio-system/istio-ingressgateway/istio-ingressgateway-566c5fc9cd-vmtks/istio-proxy
istio-system/istiod/istiod-549db5fd75-zxqxx/discovery
istio-system/kiali/kiali-64df7bf7cc-ctgl4/kiali
Fetching Istio control plane information from cluster.
Running istio analyze on all namespaces and report as below:
Analysis Report:
Info [IST0102] (Namespace default) The namespace is not enabled for Istio injection. Run 'kubectl label namespace default istio-injection=enabled' to enable it, or 'kubectl label namespace default istio-injection=disabled' to explicitly mark it as not needing injection.
Creating an archive at /root/bug-report.tar.gz.
Cleaning up temporary files in /tmp/bug-report.
Done.
Affected product area

[ ] Ambient
[ ] Docs
[ ] Installation
[X] Networking
[ ] Performance and Scalability
[ ] Extensions and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
[ ] Upgrade
[ ] Multi Cluster
[ ] Virtual Machine
[ ] Control Plane Revisions

Portname only works for HTTPS. Probably need to update the doc to explain that

@howardjohn Thanks for your explanation. In our usage scenario, we expect to use gateway, portName and portNumber to accurately select the Envoy route configuration to enable or disable the Lua filter for the route individually. I wonder why portName and gateway were originally designed to only work with HTTPS.

It's because in http all them are merged together into one route
On Thu, Aug 10, 2023, 7:59 PM Blaise Wang @.***> wrote:

Portname only works for HTTPS. Probably need to update the doc to explain
that
@howardjohn https://github.com/howardjohn Thanks for your explanation.
In our usage scenario, we expect to use gateway, portName and portNumber to
accurately select the Envoy route configuration to enable or disable the
Lua filter for the route individually. I wonder why portName and gateway
were originally designed to only work with HTTPS.
—
Reply to this email directly, view it on GitHub
https://github.com/istio/istio/issues/46459#issuecomment-1674157185, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAEYGXMQBFJ3XBAIADO7QZ3XUWN2DANCNFSM6AAAAAA3LPWRRU
.
You are receiving this because you were mentioned.Message ID:
@.***>

authors: blaisewang howardjohn


text:
add requirements.lock to git ignore file.

requirements.lock will be generated after the command helm dep update... to track istio chart dependencies.
Let's add requirements.lock to .gitignore file.

[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by: morvencao
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: linsun
If they are not already assigned, you can assign the PR to them by writing /assign @linsun in a comment when ready.
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@morvencao: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow//e2e-simpleTests-minProfile.sh
e4fd93f3e96db843d0c52ad31d8355260ef2a75e
link
/test e2e-simpleTestsMinProfile

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@morvencao: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow//e2e-simpleTests-minProfile.sh
e4fd93f3e96db843d0c52ad31d8355260ef2a75e
link
/test e2e-simpleTestsMinProfile

prow/e2e-mixer-no_auth.sh
e4fd93f3e96db843d0c52ad31d8355260ef2a75e
link
/test e2e-mixer-no_auth

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by: morvencao, sdake
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: linsun
If they are not already assigned, you can assign the PR to them by writing /assign @linsun in a comment when ready.
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@morvencao note, I'd recommend using helm package -u rather then helm dep update but this pr is beneficial nonetheless so recommend to TLD OWNERS to merge.
Cheers
-steve

/assign @linsun

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: linsun, morvencao, sdake
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS [linsun]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@morvencao: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/e2e-mixer-no_auth.sh
e4fd93f3e96db843d0c52ad31d8355260ef2a75e
link
/test e2e-mixer-no_auth

prow//e2e-simpleTests-minProfile.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-simpleTestsMinProfile

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@morvencao: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow//e2e-simpleTests-minProfile.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-simpleTestsMinProfile

prow/istio-pilot-multicluster-e2e.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test istio-pilot-multicluster-e2e

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@morvencao: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow//e2e-simpleTests-minProfile.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-simpleTestsMinProfile

prow/istio-pilot-multicluster-e2e.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test istio-pilot-multicluster-e2e

prow/e2e-bookInfoTests-v1alpha3.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-bookInfoTests-envoyv2-v1alpha3

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@morvencao: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow//e2e-simpleTests-minProfile.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-simpleTestsMinProfile

prow/istio-pilot-multicluster-e2e.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test istio-pilot-multicluster-e2e

prow/e2e-bookInfoTests-v1alpha3.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-bookInfoTests-envoyv2-v1alpha3

prow/e2e-dashboard.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-dashboard

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@morvencao: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow//e2e-simpleTests-minProfile.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-simpleTestsMinProfile

prow/istio-pilot-multicluster-e2e.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test istio-pilot-multicluster-e2e

prow/e2e-bookInfoTests-v1alpha3.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-bookInfoTests-envoyv2-v1alpha3

prow/e2e-dashboard.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-dashboard

prow/e2e-simpleTests.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-simpleTests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@morvencao: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow//e2e-simpleTests-minProfile.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-simpleTestsMinProfile

prow/istio-pilot-multicluster-e2e.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test istio-pilot-multicluster-e2e

prow/e2e-bookInfoTests-v1alpha3.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-bookInfoTests-envoyv2-v1alpha3

prow/e2e-dashboard.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-dashboard

prow/e2e-simpleTests.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-simpleTests

prow/istio-pilot-e2e-envoyv2-v1alpha3.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test istio-pilot-e2e-envoyv2-v1alpha3

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@morvencao: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow//e2e-simpleTests-minProfile.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-simpleTestsMinProfile

prow/e2e-bookInfoTests-v1alpha3.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-bookInfoTests-envoyv2-v1alpha3

prow/istio-pilot-e2e-envoyv2-v1alpha3.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test istio-pilot-e2e-envoyv2-v1alpha3

prow/istio-pilot-multicluster-e2e.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test istio-pilot-multicluster-e2e

prow/e2e-dashboard.sh
b37f028635af0e31671fbed7bd56c3d0652eed51
link
/test e2e-dashboard

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/retest
This bot automatically retries jobs that failed/flaked on approved PRs.
Review the full test history for this PR.
/lgtm cancel will stop retrying.

@morvencao: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow//e2e-simpleTests-minProfile.sh
e567468afaaf2e312e8f8e3aadf1db464a87dcfb
link
/test e2e-simpleTestsMinProfile

prow/istio-pilot-multicluster-e2e.sh
d2c46c9468744833df8b28b22c353d5ec6521bf5
link
/test istio-pilot-multicluster-e2e

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

authors: istio-testing morvencao sdake


text:
[WIP] Fix ingress sds memory leak

When ingress agent starts serving SDS but k8s secret does not exist, instead of sending error message back, wait until k8s secret is ready, and sends SDS response with the key/cert. This change follows the xDS protocol. The management server may reply either immediately or when the requested resources are available with a DiscoveryResponse
When k8s secret is deleted by operator, ingress gateway agent will close the stream and force the gateway to send another SDS request. On receiving the new SDS request, the ingress gateway agent will wait until a new k8s secret is added. When that k8s secret is added, the ingress gateway agent will notify the gateway by pushing new resource in SDS response. This change follows the xDS protocol. The management server should only send updates to the Envoy client when the resources in the DiscoveryResponse have changed. Envoy replies to any DiscoveryResponse with a DiscoveryRequest containing the ACK/NACK immediately after it has been either accepted or rejected. If the management server provides the same set of resources rather than waiting for a change to occur, it will cause Envoy and the management server to spin and have a severe performance impact.
Fixes #13197

[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by: JimmyCYJ
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: diemtvu
If they are not already assigned, you can assign the PR to them by writing /assign @diemtvu in a comment when ready.
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

security/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

I am adding tests for this change.

@JimmyCYJ: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-unit-tests.sh
7f5ab82239bf06a2de317d7e5e83cb3d6caa3899
link
/test istio-unit-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@JimmyCYJ: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-unit-tests.sh
7f5ab82239bf06a2de317d7e5e83cb3d6caa3899
link
/test istio-unit-tests

prow/istio-pilot-multicluster-e2e.sh
7f5ab82239bf06a2de317d7e5e83cb3d6caa3899
link
/test istio-pilot-multicluster-e2e

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@JimmyCYJ: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-pilot-multicluster-e2e.sh
7f5ab82239bf06a2de317d7e5e83cb3d6caa3899
link
/test istio-pilot-multicluster-e2e

prow/istio-integ-k8s-tests.sh
b43c5a1704164aa5d3a72f7bc67f0df6bdf9f28e
link
/test istio-integ-k8s-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@JimmyCYJ: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-integ-k8s-tests.sh
b43c5a1704164aa5d3a72f7bc67f0df6bdf9f28e
link
/test istio-integ-k8s-tests

prow/istio-pilot-multicluster-e2e.sh
b43c5a1704164aa5d3a72f7bc67f0df6bdf9f28e
link
/test istio-pilot-multicluster-e2e

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: JimmyCYJ, quanjielin
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

security/OWNERS [quanjielin]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

From the issue:
touch empty.cert.pem
kubectl create -n istio-system secret generic httpbin-credential \
--from-file=key=httpbin.example.com/3_application/private/httpbin.example.com.key.pem \
--from-file=cert=empty.cert.pem

This creates a secret, but with an empty cert. This change seems to only handle the case when there is no secret.
Following the above command I saw 50k SDS pushes/second.
Will this change fix this as well or will we need another change?

This creates a secret, but with an empty cert. This change seems to only handle the case when there is no secret.

If the secret has an empty cert, the gateway agent does not add that secret into its local storage. Therefore it will not return any secret to the ingress gateway, and the SDS request is still pending. Once the operator deletes the invalid secret and create a valid secret, the ingress gateway agent will add the valid secret into its local storage, and notify the gateway by pushing the new secret.

Is this still a wip?

@JimmyCYJ: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-pilot-multicluster-e2e.sh
b43c5a1704164aa5d3a72f7bc67f0df6bdf9f28e
link
/test istio-pilot-multicluster-e2e

prow/istio-integ-k8s-tests.sh
5a4b13d95e7b8b2212d4b1b79cc284ed0b87c611
link
/test istio-integ-k8s-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@JimmyCYJ: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-integ-k8s-tests.sh
5a4b13d95e7b8b2212d4b1b79cc284ed0b87c611
link
/test istio-integ-k8s-tests

prow/istio-pilot-multicluster-e2e.sh
5a4b13d95e7b8b2212d4b1b79cc284ed0b87c611
link
/test istio-pilot-multicluster-e2e

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

I built a docker image docker.io/jimmycyj/node-agent-k8s:b43c5a1704164aa5d3a72f7bc67f0df6bdf9f28e with this fix. I create 70 gateways with 70 credentials but no k8s secret is created, this forces ingress gateway to send SDS request but does not get any response. The ingress-sds does not send error message now, and I am watching the memory usage.

@duderino could you please help to merge this PR?

Here is the memory usage, I add 70 gateway around 23:15, the memory consumption is 7M. Previously this is over 200M

authors: JimmyCYJ howardjohn istio-testing