text:
Deprecate Istio K8s Service Dashboard

#28288
[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
Pull Request Attributes
Please check any characteristics that apply to this pull request.
[ ] Does not have any changes that may affect Istio users.

@carolynhu: PR needs rebase.

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@carolynhu: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

integ-pilot-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

integ-pilot-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-k8s-tests_istio

integ-multicluster-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-multicluster-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

integ-pilot-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-k8s-tests_istio

integ-multicluster-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-multicluster-k8s-tests_istio

integ-telemetry-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

integ-pilot-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-k8s-tests_istio

integ-multicluster-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-multicluster-k8s-tests_istio

integ-telemetry-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-multicluster-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

integ-pilot-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-k8s-tests_istio

integ-multicluster-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-multicluster-k8s-tests_istio

integ-telemetry-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-multicluster-tests_istio

analyze-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test analyze-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

integ-pilot-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-k8s-tests_istio

integ-multicluster-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-multicluster-k8s-tests_istio

integ-telemetry-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-multicluster-tests_istio

analyze-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test analyze-tests_istio

integ-operator-controller-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-operator-controller-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

integ-pilot-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-k8s-tests_istio

integ-multicluster-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-multicluster-k8s-tests_istio

integ-telemetry-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-multicluster-tests_istio

analyze-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test analyze-tests_istio

integ-operator-controller-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-operator-controller-tests_istio

integ-security-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-multicluster-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

integ-pilot-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-k8s-tests_istio

integ-multicluster-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-multicluster-k8s-tests_istio

integ-telemetry-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-multicluster-tests_istio

analyze-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test analyze-tests_istio

integ-operator-controller-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-operator-controller-tests_istio

integ-security-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-multicluster-tests_istio

integ-telemetry-mc-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-mc-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

integ-pilot-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-k8s-tests_istio

integ-multicluster-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-multicluster-k8s-tests_istio

integ-telemetry-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-multicluster-tests_istio

analyze-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test analyze-tests_istio

integ-operator-controller-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-operator-controller-tests_istio

integ-security-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-multicluster-tests_istio

integ-telemetry-mc-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-mc-k8s-tests_istio

unit-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test unit-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

integ-pilot-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-k8s-tests_istio

integ-multicluster-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-multicluster-k8s-tests_istio

integ-telemetry-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-multicluster-tests_istio

analyze-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test analyze-tests_istio

integ-operator-controller-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-operator-controller-tests_istio

integ-security-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-multicluster-tests_istio

integ-telemetry-mc-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-mc-k8s-tests_istio

unit-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test unit-tests_istio

integ-distroless-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-distroless-k8s-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

integ-pilot-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-k8s-tests_istio

integ-multicluster-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-multicluster-k8s-tests_istio

integ-telemetry-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-multicluster-tests_istio

analyze-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test analyze-tests_istio

integ-operator-controller-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-operator-controller-tests_istio

integ-security-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-multicluster-tests_istio

integ-telemetry-mc-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-mc-k8s-tests_istio

unit-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test unit-tests_istio

integ-distroless-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-distroless-k8s-tests_istio

release-notes_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-notes_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

integ-pilot-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-k8s-tests_istio

integ-multicluster-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-multicluster-k8s-tests_istio

integ-telemetry-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-multicluster-tests_istio

analyze-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test analyze-tests_istio

integ-operator-controller-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-operator-controller-tests_istio

integ-security-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-multicluster-tests_istio

integ-telemetry-mc-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-mc-k8s-tests_istio

unit-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test unit-tests_istio

integ-distroless-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-distroless-k8s-tests_istio

release-notes_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-notes_istio

integ-helm-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-helm-tests_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

integ-pilot-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-k8s-tests_istio

integ-multicluster-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-multicluster-k8s-tests_istio

integ-telemetry-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-multicluster-tests_istio

analyze-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test analyze-tests_istio

integ-operator-controller-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-operator-controller-tests_istio

integ-security-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-multicluster-tests_istio

integ-telemetry-mc-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-mc-k8s-tests_istio

unit-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test unit-tests_istio

integ-distroless-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-distroless-k8s-tests_istio

release-notes_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-notes_istio

integ-helm-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-helm-tests_istio

gencheck_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test gencheck_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@carolynhu: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

integ-ipv6-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-ipv6-k8s-tests_istio

release-test_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-test_istio

integ-security-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-k8s-tests_istio

integ-pilot-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-k8s-tests_istio

integ-multicluster-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-multicluster-k8s-tests_istio

integ-telemetry-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-k8s-tests_istio

integ-pilot-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-pilot-multicluster-tests_istio

analyze-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test analyze-tests_istio

integ-operator-controller-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-operator-controller-tests_istio

integ-security-multicluster-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-security-multicluster-tests_istio

integ-telemetry-mc-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-telemetry-mc-k8s-tests_istio

unit-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test unit-tests_istio

integ-distroless-k8s-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-distroless-k8s-tests_istio

release-notes_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test release-notes_istio

integ-helm-tests_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test integ-helm-tests_istio

gencheck_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test gencheck_istio

lint_istio
f1ee24d78bcc0e9830448b332705c15676c95615
link
/test lint_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

https://snapshot.raintank.io/dashboard/snapshot/4SF1vxUyvxMUaXwRn0mg7BuyOobGXuZ5

I am a bit concerned about the user churn this will cause. Do we need to remove this one and create a new one? Can we just change the existing one to do what we want?

I am a bit concerned about the user churn this will cause. Do we need to remove this one and create a new one? Can we just change the existing one to do what we want?

related comments are in https://github.com/istio/istio/pull/29690
I'd prefer, we deprecate this one. and Add a new one, not modifying things based on the old service dashboard. Since those are actually not the same thing, which may make things even more confused.

I am a bit concerned about the user churn this will cause. Do we need to remove this one and create a new one? Can we just change the existing one to do what we want?

We could. Would you prefer a PR that changed this to be canonical services-based content and then added a new separate dashboard for the old content?  That might be a bit more surprising in some cases.

I am a bit concerned about the user churn this will cause. Do we need to remove this one and create a new one? Can we just change the existing one to do what we want?

We could. Would you prefer a PR that changed this to be canonical services-based content and then added a new separate dashboard for the old content?  That might be a bit more surprising in some cases.

We could. Would you prefer a PR that changed this to be canonical services-based content and then added a new separate dashboard for the old content? That might be a bit more surprising in some cases.

Why do we need both?
I bet users already are confused by workload vs service dashboard. I bet most developer will be confused if we have workload, service, and canonical service dashboards

We could. Would you prefer a PR that changed this to be canonical services-based content and then added a new separate dashboard for the old content? That might be a bit more surprising in some cases.

Why do we need both?
I bet users already are confused by workload vs service dashboard. I bet most developer will be confused if we have workload, service, and canonical service dashboards

Why do we need both?

We don't, really. K8s services are not necessarily 1:1 with canonical services and the proposed new canonical service dashboard is missing details on breakdown by k8s service, etc., but absent the few details, there isn't a known need for multiple dashboards in this space. One issue may be that we don't have a great deal of feedback on the new dashboard yet.
In the design doc, there was a mention of needing to follow proper deprecation policies. I'm not sure that the internals of a dashboard are necessarily bound by that policy, but that was the idea.
I guess we could say that if you want the old dashboard, you can still go get it from grafana.org. Would that be acceptable?
@mandarjog thoughts?

Why do we need both?

We don't, really. K8s services are not necessarily 1:1 with canonical services and the proposed new canonical service dashboard is missing details on breakdown by k8s service, etc., but absent the few details, there isn't a known need for multiple dashboards in this space. One issue may be that we don't have a great deal of feedback on the new dashboard yet.
In the design doc, there was a mention of needing to follow proper deprecation policies. I'm not sure that the internals of a dashboard are necessarily bound by that policy, but that was the idea.
I guess we could say that if you want the old dashboard, you can still go get it from grafana.org. Would that be acceptable?
@mandarjog thoughts?

authors: carolynhu douglas-reid howardjohn istio-testing


text:
Add Traffic Verification to Helm Install Test

The current helm install verification test was not checking network traffic after installation.
And to help us figure out who should review this PR, please
put an X in all the areas that this PR affects.
[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[X] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
Pull Request Attributes
Please check any characteristics that apply to this pull request.
[X] Does not have any changes that may affect Istio users.

Hi @Kmoneal. Thanks for your PR.
I'm waiting for a istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.
Once the patch is verified, the new status will be reflected by the ok-to-test label.
I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

/ok-to-test

/cherry-pick release-1.10

@Kmoneal: only istio org members may request cherry-picks. You can still do the cherry-pick manually.

In response to this:

/cherry-pick release-1.10

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

/cherry-pick release-1.9

@jacob-delgado: once the present PR merges, I will cherry-pick it on top of release-1.9 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.9

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

/cherry-pick release-1.10

@jacob-delgado: once the present PR merges, I will cherry-pick it on top of release-1.10 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.10

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@googlebot I signed it!

@jacob-delgado: new pull request created: #31969

In response to this:

/cherry-pick release-1.9

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@jacob-delgado: new pull request created: #31970

In response to this:

/cherry-pick release-1.10

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

source: gharchive/pull-request

authors: Kmoneal istio-testing jacob-delgado

repo: istio/istio

license_type: permissive

license_source: github-api


text:
update addCACertsFileWatcher log

Please provide a description of this PR:

/cc @jaellio

@zirain: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

integ-security-multicluster_istio
fbe8e584515607737561af71a1dca5e8e05d1ed5
link
true
/test integ-security-multicluster

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@zirain: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

integ-security-multicluster_istio
fbe8e584515607737561af71a1dca5e8e05d1ed5
link
true
/test integ-security-multicluster

integ-security-istiodremote_istio
fbe8e584515607737561af71a1dca5e8e05d1ed5
link
true
/test integ-security-istiodremote

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/retest

authors: istio-testing keithmattix zirain


text:
Ambient - propagate IPV6 config correctly to CNI agent

Please provide a description of this PR:
This should fix https://github.com/istio/istio/issues/50162 and other related issues around IPV6 and our use of ipsets, namely

Actually propagate the config from the pod manifest to the ambient CNI node agent (we have ipv6 rules, but they never got used due to this)
Properly handle IPv4/V6 ipsets (Ideally we should be using list:set type ipsets for this, but vishvananda/netlink doesn't fully support those yet, so did it manually)

@bleggett: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

release-notes_istio
46ccba0f66059959691c3b56a8402c6659aca038
link
true
/test release-notes

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@bleggett: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

release-notes_istio
46ccba0f66059959691c3b56a8402c6659aca038
link
true
/test release-notes

unit-tests-arm64_istio
46ccba0f66059959691c3b56a8402c6659aca038
link
true
/test unit-tests-arm64

gencheck_istio
46ccba0f66059959691c3b56a8402c6659aca038
link
true
/test gencheck

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@bleggett: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

release-notes_istio
46ccba0f66059959691c3b56a8402c6659aca038
link
true
/test release-notes

unit-tests-arm64_istio
46ccba0f66059959691c3b56a8402c6659aca038
link
true
/test unit-tests-arm64

gencheck_istio
46ccba0f66059959691c3b56a8402c6659aca038
link
true
/test gencheck

unit-tests_istio
46ccba0f66059959691c3b56a8402c6659aca038
link
true
/test unit-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@bleggett: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

unit-tests-arm64_istio
46ccba0f66059959691c3b56a8402c6659aca038
link
true
/test unit-tests-arm64

gencheck_istio
46ccba0f66059959691c3b56a8402c6659aca038
link
true
/test gencheck

unit-tests_istio
46ccba0f66059959691c3b56a8402c6659aca038
link
true
/test unit-tests

release-notes_istio
a945d252f3a4a36fa6e168c9fb275396c2f21d87
link
true
/test release-notes

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@bleggett: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

unit-tests-arm64_istio
46ccba0f66059959691c3b56a8402c6659aca038
link
true
/test unit-tests-arm64

gencheck_istio
46ccba0f66059959691c3b56a8402c6659aca038
link
true
/test gencheck

unit-tests_istio
46ccba0f66059959691c3b56a8402c6659aca038
link
true
/test unit-tests

release-notes_istio
7b70687dff37bc7b2902a09f256bb22ff7ac68ef
link
true
/test release-notes

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@bleggett: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

integ-ambient_istio
536b0c631feff6987552b4321a209fce93ac6bbe
link
unknown
/test integ-ambient

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@bleggett: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:
Test name 	Commit 	Details 	Required 	Rerun command
integ-ambient_istio 	536b0c6 link 	unknown 	/test integ-ambient

This was either a flake, or I was missing something from master since only the waypoint tests failed, they just passed, and they don't fail for me locally - assuming the latter.

authors: bleggett istio-testing


text:
ambient: stash hbone peer principal in endpoint metadata

Please provide a description of this PR:
If envoyproxy/envoy#33857 merges, we'll be able to use io.istio.upstream_peer_principal to grab the destination principal in telemetry

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

This is ready for review now; we decided to stash the identity in metadata due to complexity

@keithmattix: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

lint_istio
06aa6921adb154912369f295c97f5e7a0cd87439
link
true
/test lint

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@keithmattix: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name
Commit
Details
Required
Rerun command

lint_istio
06aa6921adb154912369f295c97f5e7a0cd87439
link
true
/test lint

gencheck_istio
06aa6921adb154912369f295c97f5e7a0cd87439
link
true
/test gencheck

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

I really don't understand the overall design. We mostly stopped using io.istio.upstream_peer_principal or other custom Istio states for standard sidecar xDS, so this is going back to that solution on the upstream? You already have WDS in waypoints - why do you need to change xDS if you can look up all telemetry there?

I really don't understand the overall design. We mostly stopped using io.istio.upstream_peer_principal or other custom Istio states for standard sidecar xDS, so this is going back to that solution on the upstream? You already have WDS in waypoints - why do you need to change xDS if you can look up all telemetry there?

I didn't realize waypoints were requesting info via WDS; which filter is doing that? Metadata exchange via discovery?

@keithmattix It's done in the metadata exchange extension, but the code is just a lookup so you can do the same directly in the stats filter. This will hurt our ability to upstream the stats filter because WDS is non-standard.

@kyessenov I found it, but the implementation required me to edit the flatbuffer so there's a spot for the identity. It's probably way too heavy for what we need, but I'll push it up once I confirm it works for you to take a look

@keithmattix I'd prefer keeping ambient stuff to ambient code, so if we can avoid changing EDS for ambient, that's better. Adding another field to flatbuffer is not a problem, we have to refactor it anyways to support Otel telemetry.

@keithmattix I'd prefer keeping ambient stuff to ambient code, so if we can avoid changing EDS for ambient, that's better. Adding another field to flatbuffer is not a problem, we have to refactor it anyways to support Otel telemetry.

Ack - I just pushed up my stash. Serializing to the WorkloadObject is returning an empty string for some reason, and when I try to access the flat buffer directly, it looks corrupted.

Converting back to draft as I'm still testing and trying to get it to work e2e

Agree with Kuat, WDS is the right approach. We may need to iterate on what
is exposed - but identity is not controversial.
I think sidecars and regular gateways should use this as well - not only
ambient.
We are discussing the Istio sidecar and gateway behavior if mTLS is off
(for any reasons) - getting peer info from
MDS is the best option.
On Thu, May 2, 2024 at 2:59 PM Keith Mattix II @.***>
wrote:

Converting back to draft as I'm still testing and trying to get it to work
e2e
—
Reply to this email directly, view it on GitHub
https://github.com/istio/istio/pull/50753#issuecomment-2091815759, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAAUR2WVV3AXSIOJQV5XVZDZAKZNRAVCNFSM6AAAAABG7JPIU2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAOJRHAYTKNZVHE
.
You are receiving this because your review was requested.Message ID:
@.***>

WDS works well for ztunnel because its the source of truth for things. Its IMO a poor choice when its decoupled from the rest of the routing flow (reminds me of authz and HTTPRoute :slightly_smiling_face: ).
For example, what happens when the IP we send to is the east-west GW IP? We want metadata for the underlying destination, not the EW GW.
This information is already in EDS, we already put 4 pieces of metadata there -- and it correctly handles these cases. Why put a 5th in a different location?

This information is already in EDS, we already put 4 pieces of metadata there -- and it correctly handles these cases. Why put a 5th in a different location?

Because we know that was not a good solution. Not every endpoint is in a cluster to start with, you have to support pass-through cases just the same way. There's no reason why WDS/MDS can't support gateway IPs.

Because we know that was not a good solution. Not every endpoint is in a cluster to start with, you have to support pass-through cases just the same way.

Ok but we don't do mTLS for those either, so the identity information doesn't matter.
Having a disjoint source of information isn't really acceptable on the authorization path

Because we know that was not a good solution. Not every endpoint is in a cluster to start with, you have to support pass-through cases just the same way.

Ok but we don't do mTLS for those either, so the identity information doesn't matter.
Having a disjoint source of information isn't really acceptable on the authorization path

Waypoint absolutely relies on WDS for all source telemetry right now. We can just as well rely on it for destination telemetry, instead of trying to make it a hybrid of EDS on the destination side. I would agree if we didn't use WDS already, but it's heavily used at this point on Waypoints.

TBH I am a bit confused by the position here. In the past, hadn't you advocated for deriving more metadata from trusted attributes? I.e. get the namespace, identity, etc from the TLS handshake. Using WDS seems further from that. What am I missing?

@howardjohn Yes, when Envoy performs L4 functions as in the sidecar we should use the trusted attributes. But with Ambient, L4 is intentionally walled from L7 so L7 ultimately has to trust something else to provide those attributes. Whether you trust ztunnel on the destination side, Cilium/kernel, or istiod, doesn't really matter - you simply look up identity wherever you can.
Costin points out to a valid model of a sidecar also dropping L4 functions, where we'd need to do this lookup as well, but that's a separate topic.

Even in the case where you have ztunnel, the model we (or, I) am pushing for is to have an exchange of information between these two layers. Blindly trusting is not a good model IMO. And we are blurring the layers by needing to look up the information out of band instead of just asking the layer.

Even in the case where you have ztunnel, the model we (or, I) am pushing for is to have an exchange of information between these two layers. Blindly trusting is not a good model IMO. And we are blurring the layers by needing to look up the information out of band instead of just asking the layer.

I don't think it's a problem. istiod is just a skip-level manager that you can ask instead of going to the direct manager :) There's a general consistency problem that can be improved if you do it on the wire - you can absolutely do the same with an internal protocol between HCM and tcp_proxy instead of raw TCP that read/write principals. But that requires custom filters for a relatively minor feature right now.

I agree communication between the layers is more work and maybe not worth it, but I don't see how EDS vs WDS is more or less work. Both seem to be just plugging 1 new field into existing mechanisms. Then we will want to use that in SAN match, but probably that work is similar across both methods

EDS is not meant for policy - it's a load assignment, not even config. Putting a policy for SAN into EDS feels like an abuse of xDS data model.

Where else would you put per-endpoint policies? If we are talking about abusing XDS data model that does not include WDS either

The intent (from me, maybe not Keith -- I will let him say) is to use this for telemetry and authz. Our current SAN match is trust-domain/* which is obviously unacceptable long term.

At least with the current Istio mode, authz should only be based on the peer certificate.

I am talking about how to verify the cert

On Thu, May 2, 2024 at 5:07 PM John Howard @.***> wrote:

TBH I am a bit confused by the position here. In the past, hadn't you
advocated for deriving more metadata from trusted attributes? I.e. get the
namespace, identity, etc from the TLS handshake. Using WDS seems further
from that. What am I missing?

If we can get signed info - from TLS peer cert, or some JWT - that's
absolutely best.
If we can't get it from a peer cert - the next best source of trust is WDS.
Istiod is also the one handling secure naming
and all ztunnel and sidecar trust decisions are based on info about
captured IP address and the same source of data
as WDS. Not as good as a signed cert or JWT - but still as secure as the
rest of Istio.
Least secure is the header (TCP or http) that peer is sending. Even for
telemetry it's pretty bad, but we have a history.

Ok - I am confused... Is this in context of the previous WG meeting and getting principal for telemetry ? Or for some authentication feature that I'm not aware of ( normally CDS has secure naming ) ?
John - I don't mind if ztunnel can pass the data ( PROXY or other mean)- but ztunnel gets it from Istiod as well.
Waypoint, sidecar or ztunnel trust Istiod to provide the correct info about an IP - including its service account -
both for cluster IPs ( secure naming ) and endpoints, and I don't see why a lookup directly with WDS would be
less trusted then getting the data from ztunnel ( less efficient - yes, that's clear)

The intent (from me, maybe not Keith -- I will let him say) is to use this for telemetry and authz. Our current SAN match is trust-domain/* which is obviously unacceptable long term.

I would suggest not mixing (again) telemetry and authz. They have very different requirements, and I agree current SAN match is really bad and needs to be fixed.

At least with the current Istio mode, authz should only be based on the peer certificate.

I am talking about how to verify the cert

I have been thinking about telemetry - and not sure I have full context on the authz issue.
It can't be about waypoint verifying the client cert - that would be covered by authz policy matches, and
I assume HA-PROXY discussion for sandwitches.
Is it about 'secure naming' for waypoints ? That would be covered by CDS for services - and there is no EDS
for pods that are not in a service.
Keith - can you add some comments to the PR description to make the use case(s) more clear, and if it is
security related - it would really, really help to have a doc that can be security reviewed by people who
focus on this area.

Yes it's securing naming in CDS doesn't work in waypoints due to the
internal listener hop.
If we are already giving a per-endpoint identity in don't see why we would
then aggregate that into a cluster match
On Thu, May 2, 2024, 5:54 PM Costin Manolache @.***>
wrote:

The intent (from me, maybe not Keith -- I will let him say) is to use this
for telemetry and authz. Our current SAN match is trust-domain/* which is
obviously unacceptable long term.
I would suggest not mixing (again) telemetry and authz. They have very
different requirements, and I agree current SAN match is really bad and
needs to be fixed.
At least with the current Istio mode, authz should only be based on the
peer certificate.
I am talking about how to verify the cert
I have been thinking about telemetry - and not sure I have full context on
the authz issue.
It can't be about waypoint verifying the client cert - that would be
covered by authz policy matches, and
I assume HA-PROXY discussion for sandwitches.
Is it about 'secure naming' for waypoints ? That would be covered by CDS
for services - and there is no EDS
for pods that are not in a service.
Keith - can you add some comments to the PR description to make the use
case(s) more clear, and if it is
security related - it would really, really help to have a doc that can be
security reviewed by people who
focus on this area.
—
Reply to this email directly, view it on GitHub
https://github.com/istio/istio/pull/50753#issuecomment-2091967931, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAEYGXN4POYFN6G23Q4QYL3ZALN3DAVCNFSM6AAAAABG7JPIU2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAOJRHE3DOOJTGE
.
You are receiving this because you were mentioned.Message ID:
@.***>

~medium term we definitely need to validate the SAN of the upstream endpoint, otherwise the telemetry on the wire could be false without us knowing. The immediate fix is to try and make sure telemetry is fixed, but I don't see why we shouldn't do SAN validation as well

We should certainly do SAN validation - but not confuse the security and trust model used in authz with the one used
for telemetry. If we end up with trusted telemetry data - it's great, but not all telemetry can be signed and authenticated
and we would get (again) distracted.  Istio telemetry has not been trust-worthy - and perhaps we can live few more releases with this, since using WDS for telemetry data is far more secure than the current headers and metadata exchange.
I still don't know what 'upstream endpoint' you're validating and where. For clusters - I assume we still use
CDS and normal process. When the upstream is a pod without CDS - there is no EDS either, so not clear how adding
peer info in EDS would help. To be honest I don't really understand the security model for 'to workload' very
well and I don't think the docs we have are detailed enough ( but I'm not an expert in security - hope someone
does understand the actual details in this area ). But unless something dramatic changed in EDS - a pod that
is not part of a service should not be there.

Yes it's securing naming in CDS doesn't work in waypoints due to the internal listener hop. If we are already giving a per-endpoint identity in don't see why we would then aggregate that into a cluster match

So this is a HTTP request for "example.ns" that hits waypoint, gets routed to "example-v1" cluster - which has a bunch of
endpoints. What does the internal hop do ? If Envoy is initiating mTLS - it should have all the info. If it's sandwitch - ztunnel should have the peer info, based on the pod IP.
Why we aggregate all pod identities in the cluster is a controversial issue, but the current approved design for
secure naming and 'client validating server identity' is what we have. Not perfect - but a change in security
model requires very serious review. Regardless - not aggregating doesn't do much - we still rely on what
the pod happens to run as instead of what user intends ( I.e. "only example service account can be used for the example service, if any pod with wrong label happens to be deployed - reject" ). At least that's the controversial part
in the secure naming AFAIK - and I believe the Gateway design as I understand it is moving into explicit user
intent instead of aggregation/guessing.
If the request is NOT for a cluster/service - but directly to an endpoint ( workload to workload ) - that's a whole different
discussion.

@keithmattix I'd prefer keeping ambient stuff to ambient code, so if we can avoid changing EDS for ambient, that's better. Adding another field to flatbuffer is not a problem, we have to refactor it anyways to support Otel telemetry.

Ack - I just pushed up my stash. Serializing to the WorkloadMetadataObject is returning an empty string for some reason, and when I try to access the flat buffer directly, it looks corrupted. I've never worked with flat buffers, so any advice would be appreciated

I haven't seen the code - how did we end up with flatbuffers ? Didn't we have enough protobuffers and Json and yaml ? Is it something required by envoy ?
Nothing wrong with flatbuffers - I like them - but seems one more complexity.

Nothing wrong with flatbuffers - I like them - but seems one more complexity.

We had flatbuffers since version 1.5 or so :D They were forced by Wasm, there's no good reason to use them now, so it just remains a tech debt.

Closing because I was able to get this working with WDS

authors: costinm howardjohn istio-testing keithmattix kyessenov


text:
Implement per-resource version and creation time to MCP resources

The latest version of MCP resource metadata supports per-resource version and create_time. This PR sets those new fields based on the source custom resource's resourceVersion and creation_time metadata.

[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by:
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: douglas-reid
If they are not already assigned, you can assign the PR to them by writing /assign @douglas-reid in a comment when ready.
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by:
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: douglas-reid
If they are not already assigned, you can assign the PR to them by writing /assign @douglas-reid in a comment when ready.
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ayj: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-unit-tests.sh
25b5ee47182f46986b08278cb849396ff81c1dde
link
/test istio-unit-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ayj: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-unit-tests.sh
4eecc66cdf5fde0882abb2f8e1eb86c71e09099b
link
/test istio-unit-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ayj: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-unit-tests.sh
4eecc66cdf5fde0882abb2f8e1eb86c71e09099b
link
/test istio-unit-tests

prow/istio-pilot-e2e-envoyv2-v1alpha3.sh
4eecc66cdf5fde0882abb2f8e1eb86c71e09099b
link
/test istio-pilot-e2e-envoyv2-v1alpha3

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ayj: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-unit-tests.sh
4eecc66cdf5fde0882abb2f8e1eb86c71e09099b
link
/test istio-unit-tests

prow/istio-pilot-e2e-envoyv2-v1alpha3.sh
4eecc66cdf5fde0882abb2f8e1eb86c71e09099b
link
/test istio-pilot-e2e-envoyv2-v1alpha3

prow/istio-pilot-multicluster-e2e.sh
4eecc66cdf5fde0882abb2f8e1eb86c71e09099b
link
/test istio-pilot-multicluster-e2e

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ayj: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-pilot-e2e-envoyv2-v1alpha3.sh
4eecc66cdf5fde0882abb2f8e1eb86c71e09099b
link
/test istio-pilot-e2e-envoyv2-v1alpha3

prow/istio-pilot-multicluster-e2e.sh
4eecc66cdf5fde0882abb2f8e1eb86c71e09099b
link
/test istio-pilot-multicluster-e2e

prow/istio-unit-tests.sh
f4e3cc87cf3891b05e7684fb8541fb2539630044
link
/test istio-unit-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ayj: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-unit-tests.sh
f5219ec7df4f4c06d276f8de20b2374102cc0b02
link
/test istio-unit-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ayj: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-unit-tests.sh
1be96a7a9ad62a8181c18f919597bcef87e6f333
link
/test istio-unit-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ayj: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-unit-tests.sh
98f11583715feb741ceebbc3092b2a3b17dd93bd
link
/test istio-unit-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test istio-unit-tests

@ayj: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-unit-tests.sh
65c6c4151d47de19331f10b451d87047362b6db5
link
/test istio-unit-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/approve

[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by: andraxylia
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: douglas-reid
If they are not already assigned, you can assign the PR to them by writing /assign @douglas-reid in a comment when ready.
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

/assign @douglas-reid

/approve

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: andraxylia, douglas-reid
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS [douglas-reid]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ayj: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-unit-tests.sh
65c6c4151d47de19331f10b451d87047362b6db5
link
/test istio-unit-tests

prow/istio-pilot-multicluster-e2e.sh
65c6c4151d47de19331f10b451d87047362b6db5
link
/test istio-pilot-multicluster-e2e

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ayj: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-unit-tests.sh
65c6c4151d47de19331f10b451d87047362b6db5
link
/test istio-unit-tests

prow/istio-pilot-multicluster-e2e.sh
65c6c4151d47de19331f10b451d87047362b6db5
link
/test istio-pilot-multicluster-e2e

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

authors: andraxylia ayj douglas-reid istio-testing


text:
deprecate istioctl gen-deploy

istioctl gen-deploy is currently broken and not tested
anymore. helm template is the preferred and supported mechanism for
customizing istio installs.
fixes https://github.com/istio/istio/issues/5968

[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by:
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: ayj
If they are not already assigned, you can assign the PR to them by writing /assign @ayj in a comment when ready.
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

istioctl/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ayj: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-integ-local-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-local-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ayj: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-integ-local-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-local-tests

prow/istio-integ-k8s-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-k8s-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ayj: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-integ-local-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-local-tests

prow/istio-integ-k8s-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-k8s-tests

prow/build-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test build-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ayj: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-integ-local-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-local-tests

prow/istio-integ-k8s-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-k8s-tests

prow/build-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test build-tests

prow/e2e-mixer-no_auth-mcp.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test e2e-mixer-no_auth-mcp

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ayj: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-integ-local-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-local-tests

prow/istio-integ-k8s-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-k8s-tests

prow/build-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test build-tests

prow/e2e-mixer-no_auth-mcp.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test e2e-mixer-no_auth-mcp

prow/e2e-mixer-no_auth.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test e2e-mixer-no_auth

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/retest

@ayj: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/istio-integ-k8s-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-k8s-tests

prow/build-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test build-tests

prow/e2e-mixer-no_auth-mcp.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test e2e-mixer-no_auth-mcp

prow/e2e-mixer-no_auth.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test e2e-mixer-no_auth

prow/istio-integ-local-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-local-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ayj: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/build-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test build-tests

prow/e2e-mixer-no_auth-mcp.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test e2e-mixer-no_auth-mcp

prow/e2e-mixer-no_auth.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test e2e-mixer-no_auth

prow/istio-integ-local-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-local-tests

prow/istio-integ-k8s-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-k8s-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test e2e-mixer-no_auth

/lgtm

@ayj: you cannot LGTM your own PR.

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: ayj, kyessenov
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

istioctl/OWNERS [ayj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

/test e2e-mixer-no_auth

@ayj: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/build-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test build-tests

prow/e2e-mixer-no_auth-mcp.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test e2e-mixer-no_auth-mcp

prow/istio-integ-local-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-local-tests

prow/istio-integ-k8s-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-k8s-tests

prow/e2e-mixer-no_auth.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test e2e-mixer-no_auth

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

New changes are detected. LGTM label has been removed.

@ayj: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/build-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test build-tests

prow/e2e-mixer-no_auth-mcp.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test e2e-mixer-no_auth-mcp

prow/istio-integ-local-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test istio-integ-local-tests

prow/e2e-mixer-no_auth.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test e2e-mixer-no_auth

prow/istio-integ-k8s-tests.sh
373c6e08c17b21ba8826e603f79daf0021434e57
link
/test istio-integ-k8s-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@ayj: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/build-tests.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test build-tests

prow/e2e-mixer-no_auth-mcp.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test e2e-mixer-no_auth-mcp

prow/e2e-mixer-no_auth.sh
f5449876c8b387d250ff57118ce5e38d1098fb7d
link
/test e2e-mixer-no_auth

prow/istio-integ-k8s-tests.sh
373c6e08c17b21ba8826e603f79daf0021434e57
link
/test istio-integ-k8s-tests

prow/istio-integ-local-tests.sh
373c6e08c17b21ba8826e603f79daf0021434e57
link
/test istio-integ-local-tests

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/lgtm

@ayj: you cannot LGTM your own PR.

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: ayj, kyessenov
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

istioctl/OWNERS [ayj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: ayj, kyessenov, nmittler
The full list of commands accepted by this bot can be found here.
The pull request process is described here

Needs approval from an approver in each of these files:

istioctl/OWNERS [ayj,nmittler]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

authors: ayj istio-testing


text:
Add OWNERS and pr template for mungegithub

Add required files for Mungegithub.
OWNERS file defines who can approve prs in this repo and who are recommended reviewer.
PR template helps people add release-note when creating prs. Simply add release-note or "NONE" between ```, then mungegithub will add proper release-note label. More details at https://github.com/istio/istio/pull/525
More details about Mungegithub

This change is

Jenkins job mixer/presubmit passed

Jenkins job mixer/pilot-regression passed

Jenkins job mixer/presubmit passed

Jenkins job mixer/pilot-regression passed

Jenkins job mixer/presubmit passed

Jenkins job mixer/pilot-regression passed

@yutongz: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

prow/mixer-e2e-smoketest.sh
37348816bbaf0759b6122a5720d7db44bbc80919
link
@istio-testing smoke test this

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Jenkins job mixer/presubmit passed

Jenkins job mixer/pilot-regression passed

Jenkins job mixer/e2e-smoketest passed

Jenkins job mixer/presubmit passed

Jenkins job mixer/pilot-regression passed

Jenkins job mixer/e2e-smoketest passed

Can anyone help me merge this?

authors: istio-testing yutongz

repo: istio/mixer


text:
hana同步到mysql语法错误

Branch name (分支名)
main
Bug description (缺陷描述)
hana不支持  , 需要替换成双引号 Caused by: com.sap.db.jdbc.exceptions.JDBCDriverException: SAP DBTech JDBC: [257]: sql syntax error: incorrect syntax near "": line 1 col 59 (at pos 59)

spark  jdbc连接器问题

source: gharchive/issue

repo: isxcode/spark-yun


text:
Englische Labels bei Objekt-Listen

Describe the bug
Für Objekt-Listen sind nicht alle Übersetzungstexte richtig gesetzt, sodass teilweise englische Labels auftauchen. Das verwirrt etwas und ist inkonsistent
To Reproduce
See internal Issue
Expected behavior
Alle Labels auf Deutsch
Screenshots
See internal
Additional context
https://git.muenchen.de/digitalisierung/digiwf-support/-/issues/390

https://github.com/it-at-m/vuetify-jsonschema-form/pull/11

Ich übersetze noch weitere Labels.

Bitte das Review durchführen: https://github.com/it-at-m/vuetify-jsonschema-form/pull/11

Ist approved, muss dann nur noch in die Tasklist im digiwf-core eingebaut werden, wenn das released wurde.

authors: darenegade markostreich simonhir

repo: it-at-m/digiwf-core

license: MIT


text:
[Preferences] The menu bar goes up with the keyboard

Environment:  Samsung S10e, Android 1
Reproducible: always for all textboxes
Build found:  1.0
Preconditions
The "Car" app is opened
The "My Profile" page is opened
Steps to reproduce

Go to  the 'Preferences' page
Click on the "Comment" text box
Pay attention to the result

Actual result
The menu bar goes up with the keyboard
Expected result
The menu bar is fixed at the bottom of the app.
Labels to be added
"Bug" ("bug"), Priority ("pri: ")

https://user-images.githubusercontent.com/71496479/110029915-bc444580-7d3d-11eb-934b-f23f17a6006c.mp4

repo: ita-social-projects/Car-Back-End


text:
Refactor open api spec

At the moment open api spec has too much code duplication and it has to be refactored to follow the DRY principle.
Description
Use open API documentation to extract query parameters, path parameters, request bodies, response bodies.
Acceptance Criteria

Path definitions don't contain inlined query parameters, path parameters, request bodies, response bodies but refer to extracted ones.
extracted query parameters, path parameters, request bodies, response bodies don't contain duplications

Example: https://github.com/Home-Project-Engineering/home-project-blog/commit/80ca4028ac29a44a2ab65bd0b57d35d1abe1efc6

repo: ita-social-projects/Home


text:
時刻表示をJSTにして整形

各一覧ページとコンテナ詳細画面では時刻の表記が異なるので注意。
すべて同じ表記になるようにする。
標準時はJST固定ではなく可能であれば自動で取得する。少なくとも指定できるようにする。

コンテナ内のタイムゾーンをホスト側と合わせるには以下のようにできる。
$ docker run -d -v /etc/localtime:/etc/localtime:ro DOCKER_IMAGE

ホスト側の/etc/localtimeをread-onlyで参照するようになる。

license: mit

license_source: bigquery


text:
Consultazione Anagrafe Tributaria via Web Service

Buon pomeriggio.
Per rispondere all'esigenza di un Comune nostro cliente, desideriamo sapere se è già disponibile (o se è previsto che lo sia) un web service ANPR per la consultazione dell'Anagrafe Tributaria.
Grazie.
Gianluca Manzin - Stesei Torino

Non è disponibile un WS di consultazione del CF presso l'Agenzia delle Entrate e non sono previsti aggiornamenti in tal senso

La issue viene chiusa. Nel caso fosse necessario,  si prega di riaprirne una nuova facendo riferimento a questa stessa.

repo: italia/anpr


text:
DATI ELETTORALI - POPOLAMENTO INIZIALE

Buongiorno, sono Giuseppe Scioscia della Publisys SpA.
Ambiente di Test Satriano di Lucania.
In data 21/02/2023, protocollo 94029408, abbiamo provato a fare il popolamento iniziale dei dati elettorali, ma durante l'upload potevamo scegliere solo la tipologia: 'caricamento iniziale dei dati elettorali'.
Per fare dei test, abbiamo caricato pochi soggetti, potendo sfruttare la possibilità di effettuare diversi invii.
Invece, viene visualizzato "I file elettorali sono stati già caricati" non permettondoci di fare altro.
Come dobbiamo procedere?
L'opzione "Richiesta cancellazione subentro" nel menu "Liste elettorali" cosa fa?
Grazie

Con la funzione di upload è possibile soltanto un caricamento, sia dei dati elettorali che dei dati delle sezioni, pertanto se il caricamento iniziale delle sezioni è già stato effettuato, è possibile il solo caricamento dei dati elettorali;
anche la sola presenza di una sezione caricata con WS, impedisce il caricamento delle sezioni con la funzione di upload.
Per effettuare più invii, dovete procedere con la richiesta di cancellazione subentro: i dati elettorali dei cittadini acquisiti con il subentro verranno cancellati per darvi la possibilità di effettuare un nuovo subentro e quindi nuovi test.

authors: frmariani pscioscia


text:
java.io.FileNotFoundException on application start

After deployment of release 3.5.0 the application fails to start with an file not found exception (Default_CSI_Mappings.csv). The catalina.out log part is attached at the end of this post.
How to reproduce:

Download and unzip release 3.5.0
build with ./gradlew assemble
copy OpenSpeedMonitor-config.yml and OpenSpeedMonitor-config.groovy to .grails dir in tomcat dir; modify files s.t. production db settings
deploy on standalone tomcat 8 with oracle java (1.8.0_102)
db schema is setup by the application, but then the application fails  with

java.io.FileNotFoundException: class path resource [WEB-INF/classes/Default_CSI_Mappings.csv] cannot be opened because it does not exist 	at org.springframework.core.io.ClassPathResource.getInputStream(ClassPathResource.java:172) 	at org.springframework.core.io.InputStreamSource$getInputStream.call(Unknown Source) 	at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:48) 	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:113) 	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:117) 	at BootStrap.createDefaultTimeToCsiMappingIfMissing(BootStrap.groovy:345) 	at BootStrap$createDefaultTimeToCsiMappingIfMissing$1.callCurrent(Unknown Source) 	at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallCurrent(CallSiteArray.java:52) 	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:154) 	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:158) 	at BootStrap.initCsiData(BootStrap.groovy:315) 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 	at java.lang.reflect.Method.invoke(Method.java:498) 	at org.codehaus.groovy.reflection.CachedMethod.invoke(CachedMethod.java:93) 	at groovy.lang.MetaMethod.doMethodInvoke(MetaMethod.java:325) 	at org.codehaus.groovy.runtime.metaclass.ClosureMetaClass.invokeMethod(ClosureMetaClass.java:384) 	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1021) 	at org.codehaus.groovy.runtime.callsite.PogoMetaClassSite.callCurrent(PogoMetaClassSite.java:69) 	at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallCurrent(CallSiteArray.java:52) 	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:154) 	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:158) 	at BootStrap$_closure3.doCall(BootStrap.groovy:96) 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 	at java.lang.reflect.Method.invoke(Method.java:498) 	at org.codehaus.groovy.reflection.CachedMethod.invoke(CachedMethod.java:93) 	at groovy.lang.MetaMethod.doMethodInvoke(MetaMethod.java:325) 	at org.codehaus.groovy.runtime.metaclass.ClosureMetaClass.invokeMethod(ClosureMetaClass.java:294) 	at groovy.lang.MetaClassImpl.invokePropertyOrMissing(MetaClassImpl.java:1251) 	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1214) 	at groovy.lang.ExpandoMetaClass.invokeMethod(ExpandoMetaClass.java:1125) 	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1021) 	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:812) 	at BootStrap.invokeMethod(BootStrap.groovy) 	at org.codehaus.groovy.runtime.metaclass.ClosureMetaClass.invokeOnDelegationObjects(ClosureMetaClass.java:430) 	at org.codehaus.groovy.runtime.metaclass.ClosureMetaClass.invokeMethod(ClosureMetaClass.java:369) 	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1021) 	at org.codehaus.groovy.runtime.callsite.PogoMetaClassSite.callCurrent(PogoMetaClassSite.java:69) 	at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallCurrent(CallSiteArray.java:52) 	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:154) 	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:166) 	at BootStrap$_closure1.doCall(BootStrap.groovy:79) 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 	at java.lang.reflect.Method.invoke(Method.java:498) 	at org.codehaus.groovy.reflection.CachedMethod.invoke(CachedMethod.java:93) 	at groovy.lang.MetaMethod.doMethodInvoke(MetaMethod.java:325) 	at org.codehaus.groovy.runtime.metaclass.ClosureMetaClass.invokeMethod(ClosureMetaClass.java:294) 	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1021) 	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1086) 	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1021) 	at groovy.lang.Closure.call(Closure.java:426) 	at groovy.lang.Closure.call(Closure.java:420) 	at grails.util.Environment.evaluateEnvironmentSpecificBlock(Environment.java:437) 	at grails.util.Environment.executeForEnvironment(Environment.java:430) 	at grails.util.Environment.executeForCurrentEnvironment(Environment.java:406) 	at org.grails.web.servlet.boostrap.DefaultGrailsBootstrapClass.callInit(DefaultGrailsBootstrapClass.java:62) 	at org.grails.web.servlet.context.GrailsConfigUtils.executeGrailsBootstraps(GrailsConfigUtils.java:65) 	at org.grails.plugins.web.servlet.context.BootStrapClassRunner.onStartup(BootStrapClassRunner.groovy:53) 	at grails.boot.config.GrailsApplicationPostProcessor.onApplicationEvent(GrailsApplicationPostProcessor.groovy:240) 	at grails.boot.config.GrailsApplicationPostProcessor.onApplicationEvent(GrailsApplicationPostProcessor.groovy) 	at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:163) 	at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:136) 	at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:381) 	at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:335) 	at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:855) 	at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.finishRefresh(EmbeddedWebApplicationContext.java:140) 	at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:541) 	at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:118) 	at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:766) 	at org.springframework.boot.SpringApplication.createAndRefreshContext(SpringApplication.java:361) 	at org.springframework.boot.SpringApplication.run(SpringApplication.java:307) 	at grails.boot.GrailsApp.run(GrailsApp.groovy:55) 	at org.springframework.boot.context.web.SpringBootServletInitializer.run(SpringBootServletInitializer.java:149) 	at org.grails.boot.context.web.GrailsAppServletInitializer.createRootApplicationContext(GrailsAppServletInitializer.groovy:57) 	at org.springframework.boot.context.web.SpringBootServletInitializer.onStartup(SpringBootServletInitializer.java:85) 	at org.springframework.web.SpringServletContainerInitializer.onStartup(SpringServletContainerInitializer.java:175) 	at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5292) 	at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) 	at org.apache.catalina.manager.ManagerServlet.start(ManagerServlet.java:1284) 	at org.apache.catalina.manager.HTMLManagerServlet.start(HTMLManagerServlet.java:666) 	at org.apache.catalina.manager.HTMLManagerServlet.doPost(HTMLManagerServlet.java:217) 	at javax.servlet.http.HttpServlet.service(HttpServlet.java:648) 	at javax.servlet.http.HttpServlet.service(HttpServlet.java:729) 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:292) 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) 	at org.apache.catalina.filters.CsrfPreventionFilter.doFilter(CsrfPreventionFilter.java:136) 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) 	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) 	at org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:108) 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) 	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212) 	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106) 	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:614) 	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141) 	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) 	at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:616) 	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) 	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:528) 	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1099) 	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:670) 	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1520) 	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1476) 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) 	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) 	at java.lang.Thread.run(Thread.java:745)

We fixed this in master branch.
Please try with HEAD.
We plan to package a new release with support for the actual WebPagetest version soon.

authors: dschuldt nilskuhn

repo: iteratec/OpenSpeedMonitor


text:
s3 performance is slow

Bug Report
s3 performance is slow
Description
Ticket is based on topic in discord (“need-help” channel).
The problem is that I tried to use DVC with miniO (s3 compatible storage) and noticed that its performance is very slow.
My env:

miniO storage location is on SSD (Intel Optane, high performance)
MiniO server <------ 1000Mbit/sec --------> DVC (s3 client)
Bucket 40Gb - 410k files (each file <= 400KB)

DVC version: 2.0.17 (deb)
---------------------------------
Platform: Python 3.8.8 on Linux-5.4.0-70-generic-x86_64-with-glibc2.4
Supports: All remotes
Cache types: hardlink, symlink
Cache directory: ext4 on /dev/sda
Caches: local
Remotes: s3
Workspace directory: ext4 on /dev/sda
Repo: dvc, git

When I did dvc pull -j 20 maximum speed was 80 mbit/sec but average was about 40. I download the bucket for 220 minutes.
What I tried else:
dvc pull -j 80 - no improvements.
awscli - aws tool can maximum 160 Mbit/sec downloading speed. I tried different settings, but I couldn't exceed the limit.
s4cmd - maximum I got is about 130 Mbit/sec, 64minutes to get the bucket.
s5cmd - maximum 960 Mbit/sec and less than 10 minutes to download the whole bucket (GoLang)
So you can see that storage performance is okay but the download speed of tools written on python can not  reach maximum.
Reproduce
Profiler stat: https://disk.yandex.ru/d/XNajwHgWYlPSHA

FYI I'm seeing very slow transfer speeds to S3 when doing a dvc push. In comparison, when doing a aws s3 cp, I'm seeing throughput that is about 10-100x faster from the same machine.
Here's the output from dvc doctor on my machine.
DVC version: 2.45.0 (brew)
--------------------------
Platform: Python 3.11.2 on macOS-12.6.3-x86_64-i386-64bit
Subprojects:
	dvc_data = 0.40.1
	dvc_objects = 0.19.3
	dvc_render = 0.1.2
	dvc_task = 0.1.11
	dvclive = 2.0.2
	scmrepo = 0.1.9
Supports:
	azure (adlfs = 2023.1.0, knack = 0.10.1, azure-identity = 1.12.0),
	gdrive (pydrive2 = 1.15.0),
	gs (gcsfs = 2023.1.0),
	http (aiohttp = 3.8.4, aiohttp-retry = 2.8.3),
	https (aiohttp = 3.8.4, aiohttp-retry = 2.8.3),
	oss (ossfs = 2021.8.0),
	s3 (s3fs = 2023.1.0, boto3 = 1.24.59),
	ssh (sshfs = 2023.1.0),
	webdav (webdav4 = 0.9.8),
	webdavs (webdav4 = 0.9.8),
	webhdfs (fsspec = 2023.1.0)
Cache types: reflink, hardlink, symlink
Cache directory: apfs on /dev/disk3s1s1
Caches: local
Remotes: s3
Workspace directory: apfs on /dev/disk3s1s1
Repo: dvc, git

@diehl Are you also using minio?

@efiop I'm not. I don't know what minio is.

@diehl So real aws s3 then, right?

@efiop that is correct. using the AWS CLI.

Chatted with @diehl privately. For the record, there are two directories, one 5G total with 224 files and the other is 14G total with 63 files. Inside there are misc files, with 5G being the biggest one in the second dataset. So likely we need to look at a scenario of transferring individual large files.
Need to reproduce locally and see if there is anything on the surface.

This is probably an s3fs issue similar to the adlfs one we had recently.
s3fs _put_file()/_get_file() do support chunked (multipart) upload/downloads, but chunks within a single file are always done in sequence rather than in parallel. s3fs should probably be using asyncio.gather() or fsspecs run_coros_in_chunks() to batch the chunk transfers, and then reassemble them at the end as needed. I'm guessing this hasn't been addressed because doing the chunk transfers in parallel requires balancing those batched tasks with the file-level batching.

@pmrowla Do you think we should prioritize it and solve it? What would be your estimation there?

Handling it the same way we did with adlfs (where we only optimize the worst-case single large file upload/download scenario) should be relatively quick to do in s3fs, but I should note that it looks like they have tried to do concurrent multipart uploads before in some of the s3fs calls but ran into problems that made them revert to only sequential operations: https://github.com/fsspec/s3fs/blob/b1d98806952485be86379f0f4574ee4de24568a1/s3fs/core.py#L1768C31-L1769

It looks like it multipart upload requires a minimum size of 5 MiB for all but the last part: https://docs.aws.amazon.com/AmazonS3/latest/userguide/qfacts.html
Also, to set expectations, the azure approach currently will only help when doing dvc push on a single file right @pmrowla?

Also, to set expectations, the azure approach currently will only help when doing dvc push on a single file right @pmrowla?

Yes that's correct

Should be resolved by https://github.com/fsspec/s3fs/pull/848

This is merged upstream and will be available in the next s3fs release

@pmrowla do you have an ETA for the next s3fs release by chance?

I don't have an ETA but generally the fsspec/s3fs maintainers are fairly quick about doing releases for work we've contributed upstream
cc @efiop

Roger that - thanks @pmrowla

authors: dberenbaum diehl efiop pmrowla tyommik


text:
Broken links in documentation

I found a section in documentation which seems to be broken.

https://dvc.org/doc/dvc-philosophy/.

should be changed to https://dvc.org/doc/understanding-dvc/

@shcheklein I think it only came as suggestions when searched. So only the API needed an update. Hence closing this :)


text:
Upgrade theme to 0.1.23 to fix Plausible

https://github.com/iterative/dvc.org/pull/4112 = https://github.com/iterative/iterative.ai/pull/686 = https://github.com/iterative/mlem.ai/pull/221 = https://github.com/iterative/cml.dev/pull/373
This PR consumes the maintenance version of gatsby-theme-iterative, which includes specifically the plausible fixes without the recent breaking changes. This will allow us to get this plausible fix without blocking it behind other changes needed to upgrade to the new breaking version.

https://github.com/iterative/mlem.ai/blob/08c95baa70888bc126a3e8d9e659c2ff619eeb50/src/components/Layout/index.tsx#L2
Using SEO component available from gatsby-theme-script would fix multiple script load.

https://github.com/iterative/mlem.ai/blob/08c95baa70888bc126a3e8d9e659c2ff619eeb50/src/components/Layout/index.tsx#L2
Using SEO component available from gatsby-theme-script would fix multiple script load.

Turns out the hard-coded elements of the theme cause problems with the SEO. This will have to do, particularly for a maintenance release.

I don't see the current solution having a double tag, but ideally it would use the theme's SEO element.

I commented exactly the same time, you did the last commit 😄. Yes, we would want to use theme's SEO element here.
We can move ahead and continue using the current SEO component.
I see the source of the problem is we have hardcoded values in the DefaultSEO component.
https://github.com/iterative/gatsby-theme-iterative/blob/bc8ccef4109ae9ce994045b5518bd0dba0055336/packages/gatsby-theme-iterative/src/components/MainLayout/DefaultSEO/index.tsx#L102
I think we will want to merge SEO component and DefaultSEO component. I will creat a ticket for that and it can also cover the hardcoded values.

authors: rogermparent yathomasi