text:
Keyboard Accessory Keys : Ability to customize them

Describe the bug
thx for answer in the App Store!
I follow you’re instructions change the settings but nothing help. I take some screenshots to understand what I mean. The new arrow a too small and that is why the old 4 separate arrows was perfect ...
thx for help.
pleas bring it back
Informations

Device : [iPhone 8]
OS : [iOS 14.4]
WebSSH Pro version : [last one for iOS ]

Screenshots

Hello @frenschman 👋
I understand you need the old "Virtual Arrow Keys" for iPhone and not the "Use old special keys".
You need to define "Virtual Arrow Keys" to "Pad" and you will have the top left pad appearing.
The down / up / left / right keys above the virtual keyboard is only on the iPadOS.
Could you check?

Hi thx for answer so quick.
I don’t want the Virtual Arrow
I send you a new Foto how it was in the pass

Am 01.03.2021 um 13:25 schrieb Arnaud Mengus notifications@github.com:

Hello @frenschman 👋
I understand you need the old "Virtual Arrow Keys" for iPhone and not the "Use old special keys".
You need to define "Virtual Arrow Keys" to "Pad" and you will have the top left pad appearing.
The down / up / left / right keys above the virtual keyboard is only on the iPadOS.
Could you check?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.

I’m sorry I don’t understand what is the old arrows you want :/
Have you send me a new screenshot through GitHub?

Hi I send here a new foto !
You get that not ?

Am 01.03.2021 um 18:23 schrieb Arnaud Mengus notifications@github.com:

I’m sorry I don’t understand what is the old arrows you want :/
Have you send me a new screenshot through GitHub?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.

Attachments should be uploaded through GitHub website and not through email, I think.

Sorry that you get the Foto not :(
I don’t want the Virtual Arrow :(
I send you a new Foto how it was in the pass

Ps: at the iPad it’s posibel
Why no more at the iphone

In my memory, please excuse me if I don’t remember, pad keys have « never » been upside the keyboard on the iPhone, only on the iPad.
I’m searching in the history if I’m true or wrong

Here is the WebSSH version as of September 2020 :

You can see that arrows are only on iPad and not on iPhone, so that's why I didn't understand your request.
As the iPhone as so little width space I "can't" add up / down / left / right keys

@frenschman Are you sure that arrows keys was upside the keyboard on iPhone OS ?

Good morning
Yes I was sure !
That is why I buy it the app!
That was the deferent to other app in the store! Better for the using
Wen you turn the phone at the Site the Keyboard gehts bigger
Nice greats

Am 02.03.2021 um 20:26 schrieb Arnaud Mengus notifications@github.com:

@frenschman Are you sure that arrows keys was upside the keyboard on iPhone OS ?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.

Are you OK with these statements ?

you would like ◀▶🔼🔽 buttons above the keyboard as the iPadOS ones
you will lose four buttons * / | - in order to have the space needed for the arrows

Hi looks not bad :)
Wen you turn the iphone in the Horizont Position dann the Keyboard it’s much biger and more Space a free at the Screen !
We can use that option whit out lose any buttons !
Mit freundlichen Grüßen
Rößler

Am 03.03.2021 um 06:34 schrieb Arnaud Mengus notifications@github.com:

Are you OK with these statements ?
you would like ◀▶🔼🔽 buttons above the keyboard as the iPadOS ones
you will lose four buttons * / | - in order to have the space needed for the arrows
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.

If you want a quick fix this arrow buttons I can't implement different buttons layouts.
In the few days I can only develop an option to replace buttons "* / | -" by the arrows ones.
Do you agree with this first attempt of fix?

Hi thx for work !!
Wil that be a fix for all or just for me ?
I don’t what that oder use get miss a button there need
It’s a bad situation ..
I need arrows
Some one other need the /*
I thing we wait that you find a better option .!
A double button line ?

Am 03.03.2021 um 07:47 schrieb Arnaud Mengus notifications@github.com:

If you want a quick fix this arrow buttons I can't implement different buttons layouts.
In the few days I can only develop an option to replace buttons "* / | -" by the arrows ones.
Do you agree with this first attempt of fix?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.

You're Welcome!
No a double lines we will loose precious rows.
I will implement one of these two options :

Add an WebSSH settings that will allow to switch between arrow keys and /* keys
Add the ability to slide between keys with the finger

Good morning
I like the slide option !!
So we have not to go always back in the settings !
Thx thx

Am 03.03.2021 um 22:02 schrieb Arnaud Mengus notifications@github.com:

You're Welcome!
No a double lines we will loose precious rows.
I will implement one of these two options :
Add an WebSSH settings that will allow to switch between arrow keys and /* keys
Add the ability to slide between keys with the finger
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.

Perhaps it's time to let users choose their own keys above the keyboard

@isontheline Ability to enable a setting which allow to show a submenu (with directional keys) when pressing the "arrows key" (like F1..F12)

For @isontheline work :
=> Keyboard Customization : Using SSH Config

Now available inside the latest beta release : https://testflight.apple.com/join/QSrBK59z

authors: frenschman isontheline


text:
Improvement to help visibility

Any chance <empty> and -h could be made to show the same as --help ?
 $ racon
[racon::] error: missing input file(s)!

 $ racon -h
racon: invalid option -- 'h'

$ racon --help
usage: racon [options ...] <sequences> <overlaps> <target sequences>

    <sequences>
        input file in FASTA/FASTQ format containing sequences used for

Sure, will add it soon.

Done!

Thanks Robert!

source: gharchive/issue

authors: rvaser tseemann

repo: isovic/racon

license: mit

license_type: permissive

license_source: bigquery


text:
Update to 9.0.0.4

Update to 9.0.0.4

Closing this, as the changes correspond to older versions of the js library.

source: gharchive/pull-request

repo: ispyropoulos/intl-tel-input-rails


text:
Maquetado

En esta rama desarrollamos las vistas (maquetado y estilos) de nuestra aplicación. Cada integrante se encargo de una vista diferente, pero con la guia del mockup y los colores elegidos.

En general todo se ve muy bien!

Me agradó mucho como quedaron ya las vistas con colores y la distribución de elementos. Ahora enfoquémonos en las dos siguientes tareas que sería el pasar la información entre vistas y manipular los datos recuperados

license: MIT

license_source: github-api


text:
What is the formula nyc is using to calculate the code coverage

What is the formula nyc is using to calculate the code coverage?
Will you please let us know how nyc framework is calculating the code coverage, statements covered, etc.

The simple answer is that the function I linked calculates the percentage.  The longer answer is that everything in https://github.com/istanbuljs/istanbuljs/ contributes to this (this is a monorepo so see inside the packages directory).

istanbul-lib-coverage merges coverage data from multiple runs
istanbul-lib-source-maps repoints the coverage data to original source locations
istanbul-lib-instrument alters source code so it generates coverage data

authors: coreyfarrell vishalbiradar

repo: istanbuljs/nyc

license: isc


text:
Validate Latitude

I just spent a long time tracking down a bug in a React application that ultimately resulted from a latitude of -110 being passed as a prop to one of the child elements of this component. The only indicator was a deprecation warning about mutating the style object - which led me to start debugging very, very far away from the actual problem.
Adding a validation that throws an exception for any latitude that isn't > -90 and < 90 might save someone else a lot of time and frustration.

In my coding style I prefer to validate user input only in situations which can cause serious errors.
Current situation does not cause any serious error.
Incorrect lat causes that marker placed at top left corner as I think.
IMHO it's on user to validate his data.

authors: istarkov lustrousgorilla

repo: istarkov/google-map-react


text:
Fetch .wasm from remote URI without depending on Listener.

Signed-off-by: John Plevyak jplevyak@gmail.com

Native question: what is the listener in title? There is no listener either in red or green diff

@jplevyak: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

test-tsan_envoy
bb74f2af225be9482e11baa48abf4e1cc4e2dbdb
link
/test test-tsan_envoy

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/test test-tsan_envoy

/retest

It seems that there is a real data race, so retesting won't make it go away:
SUMMARY: ThreadSanitizer: data race /build/tmp/_bazel_bazel/004a6f22074b0cbbac00100c854c36fb/sandbox/linux-sandbox/6/execroot/envoy/external/com_github_libevent_libevent/signal.c:404:17 in evsig_handler
==================
[2020-05-02 19:54:29.719][46][info][main] [source/server/server.cc:527] caught SIGUSR1. Reopening access logs.
==================
WARNING: ThreadSanitizer: data race (pid=46)
  Read of size 4 at 0x55883c2bf7d0 by thread T1:
    #0 evsig_handler /build/tmp/_bazel_bazel/004a6f22074b0cbbac00100c854c36fb/sandbox/linux-sandbox/6/execroot/envoy/external/com_github_libevent_libevent/signal.c:404:17 (envoy-static+0x9cd90b7)
    #1 __tsan::CallUserSignalHandler(__tsan::ThreadState*, bool, bool, bool, int, __sanitizer::__sanitizer_siginfo*, void*) /local/mnt/workspace/bcain_clang_bcain-ubuntu_23113/llvm/utils/release/final/llvm.src/projects/compiler-rt/lib/tsan/rtl/tsan_interceptors.cc:1914:7 (envoy-static+0x3c0152e)
    #2 gpr_cv_wait /proc/self/cwd/external/com_github_grpc_grpc/src/core/lib/gpr/sync_posix.cc:128:11 (envoy-static+0x8f82915)
    #3 grpc_core::Executor::ThreadMain(void*) /proc/self/cwd/external/com_github_grpc_grpc/src/core/lib/iomgr/executor.cc:246:7 (envoy-static+0x8ee4a88)
    #4 grpc_core::(anonymous namespace)::ThreadInternalsPosix::ThreadInternalsPosix(char const*, void (*)(void*), void*, bool*, grpc_core::Thread::Options const&)::'lambda'(void*)::operator()(void*) const /proc/self/cwd/external/com_github_grpc_grpc/src/core/lib/gprpp/thd_posix.cc:139:27 (envoy-static+0x8f895a8)
    #5 grpc_core::(anonymous namespace)::ThreadInternalsPosix::ThreadInternalsPosix(char const*, void (*)(void*), void*, bool*, grpc_core::Thread::Options const&)::'lambda'(void*)::__invoke(void*) /proc/self/cwd/external/com_github_grpc_grpc/src/core/lib/gprpp/thd_posix.cc:109:25 (envoy-static+0x8f893c8)

  Previous write of size 4 at 0x55883c2bf7d0 by main thread:
    [failed to restore the stack]

  Location is global 'evsig_base_fd' of size 4 at 0x55883c2bf7d0 (envoy-static+0x00000ba8a7d0)

  Thread T1 'default-executo' (tid=54, running) created by main thread at:
    #0 pthread_create /local/mnt/workspace/bcain_clang_bcain-ubuntu_23113/llvm/utils/release/final/llvm.src/projects/compiler-rt/lib/tsan/rtl/tsan_interceptors.cc:967:3 (envoy-static+0x3bfa7ab)
    #1 grpc_core::(anonymous namespace)::ThreadInternalsPosix::ThreadInternalsPosix(char const*, void (*)(void*), void*, bool*, grpc_core::Thread::Options const&) /proc/self/cwd/external/com_github_grpc_grpc/src/core/lib/gprpp/thd_posix.cc:108:10 (envoy-static+0x8f88f50)
    #2 grpc_core::(anonymous namespace)::ThreadInternalsPosix* grpc_core::New<grpc_core::(anonymous namespace)::ThreadInternalsPosix, char const*&, void (*&)(void*), void*&, bool*, grpc_core::Thread::Options const&>(char const*&, void (*&)(void*), void*&, bool*&&, grpc_core::Thread::Options const&) /proc/self/cwd/external/com_github_grpc_grpc/src/core/lib/gprpp/memory.h:37:18 (envoy-static+0x8f88948)
    #3 grpc_core::Thread::Thread(char const*, void (*)(void*), void*, bool*, grpc_core::Thread::Options const&) /proc/self/cwd/external/com_github_grpc_grpc/src/core/lib/gprpp/thd_posix.cc:185:11 (envoy-static+0x8f886bf)
    #4 grpc_core::Executor::SetThreading(bool) /proc/self/cwd/external/com_github_grpc_grpc/src/core/lib/iomgr/executor.cc:180:9 (envoy-static+0x8ee3c01)
    #5 grpc_core::Executor::Init() /proc/self/cwd/external/com_github_grpc_grpc/src/core/lib/iomgr/executor.cc:113:25 (envoy-static+0x8ee365d)
    #6 grpc_core::Executor::InitAll() /proc/self/cwd/external/com_github_grpc_grpc/src/core/lib/iomgr/executor.cc:415:58 (envoy-static+0x8ee5d44)
    #7 grpc_iomgr_init() /proc/self/cwd/external/com_github_grpc_grpc/src/core/lib/iomgr/iomgr.cc:60:3 (envoy-static+0x8ee71b8)
    #8 grpc_init /proc/self/cwd/external/com_github_grpc_grpc/src/core/lib/surface/init.cc:146:5 (envoy-static+0x8c472c0)
    #9 Envoy::Grpc::GoogleGrpcContext::GoogleGrpcContext() /proc/self/cwd/source/common/grpc/google_grpc_context.cc:21:5 (envoy-static+0x8bec891)
    #10 Envoy::MainCommonBase::MainCommonBase(Envoy::OptionsImpl const&, Envoy::Event::TimeSystem&, Envoy::ListenerHooks&, Envoy::Server::ComponentFactory&, std::__1::unique_ptr<Envoy::Runtime::RandomGenerator, std::__1::default_delete<Envoy::Runtime::RandomGenerator> >&&, Envoy::Thread::ThreadFactory&, Envoy::Filesystem::Instance&, std::__1::unique_ptr<Envoy::ProcessContext, std::__1::default_delete<Envoy::ProcessContext> >) /proc/self/cwd/source/exe/main_common.cc:43:17 (envoy-static+0x3cf0250)
    #11 Envoy::MainCommon::MainCommon(int, char const* const*) /proc/self/cwd/source/exe/main_common.cc:140:7 (envoy-static+0x3cf1b76)
    #12 std::__1::__unique_if<Envoy::MainCommon>::__unique_single std::__1::make_unique<Envoy::MainCommon, int&, char**&>(int&, char**&) /opt/llvm/bin/../include/c++/v1/memory:3003:32 (envoy-static+0x3c6a222)
    #13 main /proc/self/cwd/source/exe/main.cc:26:19 (envoy-static+0x3c6932f)

Well that is going to be a bit problematic: https://github.com/libevent/libevent/issues/779

Looks good now.

authors: PiotrSikora istio-testing jplevyak lambdai

repo: istio/envoy


text:
support multiple app namespaces.

Context: support watching multiple namespaces for pilot
This is a followup PR for https://github.com/istio/istio/pull/13635

As in the other PR implementing this:

please not comma separate, use proper yaml ( i.e. a list )
I'm not sure it's pilot only - mixer and all other components may need to follow the same list consistently. I suspect injector in particular.

I'm not sure there is a use case for each component watching/using different namespaces.

You can still use the env variable in pilot for now - until we move this to mesh config and pilot gets it from there, but as API it should be exposed as a list, not comma separate string.
We need to be very careful with all new fields and changes in values.yaml - and treat it as a highly visible API.

@costinm Not sure if this is OK, but if we want to use the env variable, then we need to transform the list to string.

authors: costinm morvencao

repo: istio/istio-installer


text:
Need sub-navs in Installation sections

With introduction of Consul, we now have two Control Plane installs.
With introduction of initializers, Consul, and VM extensions, we have several ways of sidecar install.
It would be nice to have sub-navs in the two install sections so that we can separate the content into different files, while still retaining the same main nav item.

stupid q.. we have examples of this in concepts. Thanks @ryangrahamnc !


text:
Process run as root

I see the process is running as root in galley pilot citadel and mixer pod while the process is running as user istio-proxy for envoy.
is it must running as root for galley pilot citadel and mixer? why? Thanks.

Is there any movement on this?  It's such low hanging fruit and just basic old school security. Everything needs to run as least privilege.

/assign
I will do it next week.

this pr was merged. we can close this one.

@clyang82 I think its unclear what's the current state of running istio with non-root privileges (except CNI of course):

This issue is tagged for milestone 1.3
PR 16014 is merged into master
Commits of the PR have been reverted afterwards?
Istio core components can be run as non-root in 1.4.2 when patching the deployment, e.g. with:

  configManagement:
    components:
      galley:
        k8s:
          overlays:
          - apiVersion: apps/v1
            kind: Deployment
            name: istio-galley
            patches:
            - path: spec.template.spec.containers.[name:galley].securityContext
              value:
                runAsUser: 1337
            - path: spec.template.spec.containers.[name:istio-proxy].securityContext
              value:
                runAsUser: 1337
            - path: spec.template.spec.containers.[name:istio-proxy].args
              value:
              - proxy
              - --serviceCluster
              - istio-galley
              - --templateFile
              - /var/lib/istio/galley/envoy/envoy.yaml.tmpl
              - --controlPlaneAuthPolicy
              - MUTUAL_TLS
              - --trust-domain=cluster.local
              - --configPath # Added
              - /tmp # Added

repo: istio/istio


text:
istioctl kube-inject: unhelpful error message

I accidentally executed
istioctl kube-inject -f bookinfo.yaml

in the wrong directory (the yaml in subject doesn't exist here). Got error:
Error: specify --hub or define MANAGER_HUB

It's cryptic and not particularly helpful.

I have the yaml in the directory, but get the same error

Can you please source the file istio.VERSION ?

@andraxylia It's not clear in BookInfo Tutorial (https://istio.io/docs/samples/bookinfo.html) (or anywhere else) that the istio.VERSION file should be sourced in the shell at all times.
If this is a requirement, please document it.

Fixed the doc in istio/istio.github.io#151

authors: ahmetb andraxylia mukundha


text:
Istio operator fails to install demo from docs on 1.6-alpha.2 and beta.0

Bug description
Istio failed to be installed.
Using instructions from https://preliminary.istio.io/docs/setup/install/standalone-operator/
Running the first snippet to install demo profile.
Nothing is created in the istio-system namespace.
Logs have:
2020-04-24T14:41:18.010069Z	info	Detecting third-party JWT support
2020-04-24T14:41:18.488008Z	error	reconciling err: failed to create Istio control plane with spec:
profile:"demo" hub:"docker.io/istio" tag:1.6.0-alpha.2 components:<base:<enabled:<BoolValue:<value:true > > > pilot:<enabled:<BoolValue:<value:true > > tag:<nil> spec:<nil> k8s:<env:<name:"POD_NAME" valueFrom:<fieldRef:<apiVersion:"v1" fieldPath:"metadata.name" > > > env:<name:"POD_NAMESPACE" valueFrom:<fieldRef:<apiVersion:"v1" fieldPath:"metadata.namespace" > > > env:<name:"GODEBUG" value:"gctrace=1" > env:<name:"PILOT_TRACE_SAMPLING" value:"100" > env:<name:"CONFIG_NAMESPACE" value:"istio-config" > readiness_probe:<httpGet:<path:"/ready" port:8080 > initialDelaySeconds:1 timeoutSeconds:5 periodSeconds:3 > resources:<requests:<key:"cpu" value:"10m" > requests:<key:"memory" value:"100Mi" > > strategy:<rollingUpdate:<maxUnavailable:25% maxSurge:100% > > > > policy:<enabled:<BoolValue:<> > tag:<nil> spec:<nil> k8s:<env:<name:"POD_NAMESPACE" valueFrom:<fieldRef:<apiVersion:"v1" fieldPath:"metadata.namespace" > > > hpa_spec:<scaleTargetRef:<kind:"Deployment" name:"istio-policy" apiVersion:"apps/v1" > minReplicas:1 maxReplicas:5 metrics:<type:"Resource" resource:<name:"cpu" targetAverageUtilization:80 > > > resources:<requests:<key:"cpu" value:"10m" > requests:<key:"memory" value:"100Mi" > > strategy:<rollingUpdate:<maxUnavailable:25% maxSurge:100% > > > > telemetry:<enabled:<BoolValue:<> > tag:<nil> spec:<nil> k8s:<env:<name:"POD_NAMESPACE" valueFrom:<fieldRef:<apiVersion:"v1" fieldPath:"metadata.namespace" > > > env:<name:"GOMAXPROCS" value:"6" > hpa_spec:<scaleTargetRef:<kind:"Deployment" name:"istio-telemetry" apiVersion:"apps/v1" > minReplicas:1 maxReplicas:5 metrics:<type:"Resource" resource:<name:"cpu" targetAverageUtilization:80 > > > replica_count:1 resources:<limits:<key:"cpu" value:"4800m" > limits:<key:"memory" value:"4G" > requests:<key:"cpu" value:"50m" > requests:<key:"memory" value:"100Mi" > > strategy:<rollingUpdate:<maxUnavailable:25% maxSurge:100% > > > > citadel:<enabled:<BoolValue:<> > tag:<nil> spec:<nil> k8s:<strategy:<rollingUpdate:<maxUnavailable:25% maxSurge:100% > > > > cni:<enabled:<BoolValue:<> > tag:<nil> spec:<nil> > ingress_gateways:<enabled:<BoolValue:<value:true > > name:"istio-ingressgateway" tag:<nil> k8s:<resources:<requests:<key:"cpu" value:"10m" > requests:<key:"memory" value:"40Mi" > > service:<ports:<name:"status-port" port:15020 targetPort:15020 > ports:<name:"http2" port:80 targetPort:8080 > ports:<name:"https" port:443 targetPort:8443 > ports:<name:"kiali" port:15029 targetPort:15029 > ports:<name:"prometheus" port:15030 targetPort:15030 > ports:<name:"grafana" port:15031 targetPort:15031 > ports:<name:"tracing" port:15032 targetPort:15032 > ports:<name:"tcp" port:31400 targetPort:31400 > ports:<name:"tls" port:15443 targetPort:15443 > > > > egress_gateways:<enabled:<BoolValue:<value:true > > name:"istio-egressgateway" tag:<nil> k8s:<resources:<requests:<key:"cpu" value:"10m" > requests:<key:"memory" value:"40Mi" > > > > > addon_components:<key:"grafana" value:<enabled:<BoolValue:<value:true > > spec:<nil> k8s:<replica_count:1 > > > addon_components:<key:"istiocoredns" value:<enabled:<BoolValue:<> > spec:<nil> > > addon_components:<key:"kiali" value:<enabled:<BoolValue:<value:true > > spec:<nil> k8s:<replica_count:1 > > > addon_components:<key:"prometheus" value:<enabled:<BoolValue:<value:true > > spec:<nil> k8s:<replica_count:1 > > > addon_components:<key:"tracing" value:<enabled:<BoolValue:<value:true > > spec:<nil> > > values:<key:"clusterResources" value:true > values:<key:"gateways" value:map[istio-egressgateway:map[autoscaleEnabled:false name:istio-egressgateway secretVolumes:[map[mountPath:/etc/istio/egressgateway-certs name:egressgateway-certs secretName:istio-egressgateway-certs] map[mountPath:/etc/istio/egressgateway-ca-certs name:egressgateway-ca-certs secretName:istio-egressgateway-ca-certs]] type:ClusterIP] istio-ingressgateway:map[applicationPorts: autoscaleEnabled:false debug:info domain: meshExpansionPorts:[map[name:tcp-pilot-grpc-tls port:15011 targetPort:15011] map[name:tcp-istiod port:15012 targetPort:15012] map[name:tcp-citadel-grpc-tls port:8060 targetPort:8060] map[name:tcp-dns-tls port:853 targetPort:8853]] name:istio-ingressgateway secretVolumes:[map[mountPath:/etc/istio/ingressgateway-certs name:ingressgateway-certs secretName:istio-ingressgateway-certs] map[mountPath:/etc/istio/ingressgateway-ca-certs name:ingressgateway-ca-certs secretName:istio-ingressgateway-ca-certs]] type:LoadBalancer]] > values:<key:"global" value:map[arch:map[amd64:2 ppc64le:2 s390x:2] configValidation:true controlPlaneSecurityEnabled:true defaultNodeSelector:map[] defaultPodDisruptionBudget:map[enabled:true] defaultResources:map[requests:map[cpu:10m]] disablePolicyChecks:false enableHelmTest:false enableTracing:true imagePullPolicy: imagePullSecrets:[] istioNamespace:istio-system istiod:map[enableAnalysis:false enabled:true] jwtPolicy:third-party-jwt localityLbSetting:map[enabled:true] logAsJson:false logging:map[level:default:info] meshExpansion:map[enabled:false useILB:false] meshNetworks:map[] mountMtlsCerts:false mtls:map[auto:true] multiCluster:map[clusterName: enabled:false] network: omitSidecarInjectorConfigMap:false oneNamespace:false operatorManageWebhooks:false outboundTrafficPolicy:map[mode:ALLOW_ANY] pilotCertProvider:istiod policyCheckFailOpen:false priorityClassName: proxy:map[accessLogFile:/dev/stdout autoInject:enabled clusterDomain:cluster.local componentLogLevel:misc:error enableCoreDump:false envoyStatsd:map[enabled:false host:<nil> port:<nil>] excludeIPRanges: excludeInboundPorts: excludeOutboundPorts: image:proxyv2 includeIPRanges:* logLevel:warning privileged:false readinessFailureThreshold:30 readinessInitialDelaySeconds:1 readinessPeriodSeconds:2 resources:map[limits:map[cpu:2000m memory:1024Mi] requests:map[cpu:10m memory:40Mi]] statusPort:15020 tracer:zipkin] proxy_init:map[image:proxyv2 resources:map[limits:map[cpu:100m memory:50Mi] requests:map[cpu:10m memory:10Mi]]] sds:map[token:map[aud:istio-ca]] sts:map[servicePort:0] tracer:map[datadog:map[address:$(HOST_IP):8126] lightstep:map[accessToken: address: cacertPath: secure:true] stackdriver:map[debug:false maxNumberOfAnnotations:200 maxNumberOfAttributes:200 maxNumberOfMessageEvents:200] zipkin:map[address:]] trustDomain:cluster.local useMCP:false] > values:<key:"grafana" value:map[accessMode:ReadWriteMany contextPath:/grafana dashboardProviders:map[dashboardproviders.yaml:map[apiVersion:1 providers:[map[disableDeletion:false folder:istio name:istio options:map[path:/var/lib/grafana/dashboards/istio] orgId:1 type:file]]]] datasources:map[datasources.yaml:map[apiVersion:1 datasources:<nil>]] env:map[] envSecrets:map[] image:map[repository:grafana/grafana tag:6.5.2] nodeSelector:map[] persist:false podAntiAffinityLabelSelector:[] podAntiAffinityTermLabelSelector:[] security:map[enabled:false passphraseKey:passphrase secretName:grafana usernameKey:username] service:map[annotations:map[] externalPort:3000 loadBalancerIP:<nil> loadBalancerSourceRanges:<nil> name:http type:ClusterIP] storageClassName: tolerations:[]] > values:<key:"istiocoredns" value:map[coreDNSImage:coredns/coredns coreDNSPluginImage:istio/coredns-plugin:0.2-istio-1.1 coreDNSTag:1.6.2] > values:<key:"kiali" value:map[contextPath:/kiali createDemoSecret:true dashboard:map[grafanaInClusterURL:http://grafana:3000 grafanaURL:<nil> jaegerInClusterURL:http://tracing/jaeger jaegerURL:<nil> passphraseKey:passphrase secretName:kiali usernameKey:username viewOnlyMode:false] hub:quay.io/kiali nodeSelector:map[] podAntiAffinityLabelSelector:[] podAntiAffinityTermLabelSelector:[] prometheusNamespace:<nil> security:map[cert_file:/kiali-cert/cert-chain.pem enabled:false private_key_file:/kiali-cert/key.pem] tag:v1.15] > values:<key:"meshConfig" value:map[] > values:<key:"mixer" value:map[adapters:map[kubernetesenv:map[enabled:true] prometheus:map[enabled:true metricsExpiryDuration:10m] stackdriver:map[auth:map[apiKey: appCredentials:false serviceAccountPath:] enabled:false tracer:map[enabled:false sampleProbability:1]] stdio:map[enabled:true outputAsJson:false] useAdapterCRDs:false] policy:map[adapters:map[kubernetesenv:map[enabled:true] useAdapterCRDs:false] autoscaleEnabled:false image:mixer sessionAffinityEnabled:false] telemetry:map[autoscaleEnabled:false env:map[GOMAXPROCS:6] image:mixer loadshedding:map[latencyThreshold:100ms mode:enforce] nodeSelector:map[] podAntiAffinityLabelSelector:[] podAntiAffinityTermLabelSelector:[] replicaCount:1 sessionAffinityEnabled:false tolerations:[]]] > values:<key:"pilot" value:map[appNamespaces:[] autoscaleEnabled:false autoscaleMax:5 autoscaleMin:1 configMap:true configNamespace:istio-config cpu:map[targetAverageUtilization:80] deploymentLabels:<nil> enableProtocolSniffingForInbound:true enableProtocolSniffingForOutbound:true env:map[] image:pilot keepaliveMaxServerConnectionAge:30m nodeSelector:map[] podAntiAffinityLabelSelector:[] podAntiAffinityTermLabelSelector:[] policy:map[enabled:false] replicaCount:1 tolerations:[] traceSampling:1] > values:<key:"prometheus" value:map[contextPath:/prometheus hub:docker.io/prom nodeSelector:map[] podAntiAffinityLabelSelector:[] podAntiAffinityTermLabelSelector:[] provisionPrometheusCert:true retention:6h scrapeInterval:15s security:map[enabled:true] tag:v2.15.1 tolerations:[]] > values:<key:"sidecarInjectorWebhook" value:map[enableNamespacesByDefault:false injectLabel:istio-injection objectSelector:map[autoInject:true enabled:false] rewriteAppHTTPProbe:true] > values:<key:"telemetry" value:map[enabled:true v1:map[enabled:false] v2:map[enabled:true prometheus:map[enabled:true] stackdriver:map[configOverride:map[] enabled:false logging:false monitoring:false topology:false]]] > values:<key:"tracing" value:map[jaeger:map[accessMode:ReadWriteMany hub:docker.io/jaegertracing memory:map[max_traces:50000] persist:false spanStorageType:badger storageClassName: tag:1.16] nodeSelector:map[] opencensus:map[exporters:map[stackdriver:map[enable_tracing:true]] hub:docker.io/omnition resources:map[limits:map[cpu:1 memory:2Gi] requests:map[cpu:200m memory:400Mi]] tag:0.1.9] podAntiAffinityLabelSelector:[] podAntiAffinityTermLabelSelector:[] provider:jaeger service:map[annotations:map[] externalPort:9411 name:http-query type:ClusterIP] zipkin:map[hub:docker.io/openzipkin javaOptsHeap:700 maxSpans:500000 node:map[cpus:2] probeStartupDelay:10 queryPort:9411 resources:map[limits:map[cpu:1000m memory:2048Mi] requests:map[cpu:150m memory:900Mi]] tag:2.20.0]] > values:<key:"version" value: >
error: compiled in charts not found in this development build, use --charts with local charts instead or run make gen-charts
2020-04-24T14:41:19.519431Z	info	Reconciling IstioOperator
2020-04-24T14:41:19.519847Z	info	Updating IstioOperator
2020-04-24T14:41:19.519871Z	info	installer	ReadProfileYAML for profile name: demo
2020-04-24T14:41:19.519881Z	info	installer	Loading values from compiled in VFS at path profiles/demo.yaml
2020-04-24T14:41:19.519892Z	info	installer	ReadProfileYAML for profile name: default
2020-04-24T14:41:19.519898Z	info	installer	Loading values from compiled in VFS at path profiles/default.yaml

Expected behavior
Steps to reproduce the bug
Version (include the output of istioctl version --remote and kubectl version and helm version if you used Helm)
How was Istio installed?
Environment where bug was observed (cloud vendor, OS, etc)

I tried again with istio-1.6.0-beta.0. Still fails to deploy.
Logs:
2020-04-28T14:28:37.933005Z	info	ControlZ available at 127.0.0.1:9876
2020-04-28T14:28:38.394099Z	info	Registering Components.
2020-04-28T14:28:38.394314Z	info	Adding controller for IstioOperator
2020-04-28T14:28:38.394461Z	info	Controller added
2020-04-28T14:28:38.394506Z	info	Starting the Cmd.
2020-04-28T14:28:38.394722Z	info	attempting to acquire leader lease  istio-operator/istio-operator-lock...
2020-04-28T14:28:38.426736Z	info	successfully acquired lease istio-operator/istio-operator-lock
2020-04-28T14:28:47.298851Z	info	Reconciling IstioOperator
2020-04-28T14:28:47.299244Z	info	Adding finalizer istio-finalizer.install.istio.io to istio-system/example-istiocontrolplane
2020-04-28T14:28:47.316226Z	info	Updating IstioOperator
2020-04-28T14:28:47.316310Z	info	installer	ReadProfileYAML for profile name: demo
2020-04-28T14:28:47.316321Z	info	installer	Loading values from compiled in VFS at path profiles/demo.yaml
2020-04-28T14:28:47.316332Z	info	installer	ReadProfileYAML for profile name: default
2020-04-28T14:28:47.316337Z	info	installer	Loading values from compiled in VFS at path profiles/default.yaml
2020-04-28T14:28:47.393805Z	info	proto: tag has too few fields: "-"
2020-04-28T14:28:47.894105Z	info	Detecting third-party JWT support
2020-04-28T14:28:48.394652Z	error	reconciling err: failed to create Istio control plane with spec:
profile:"demo" hub:"docker.io/istio" tag:1.6.0-beta.0 components:<base:<enabled:<BoolValue:<value:true > > > pilot:<enabled:<BoolValue:<value:true > > tag:<nil> spec:<nil> k8s:<env:<name:"POD_NAME" valueFrom:<fieldRef:<apiVersion:"v1" fieldPath:"metadata.name" > > > env:<name:"POD_NAMESPACE" valueFrom:<fieldRef:<apiVersion:"v1" fieldPath:"metadata.namespace" > > > env:<name:"GODEBUG" value:"gctrace=1" > env:<name:"PILOT_TRACE_SAMPLING" value:"100" > env:<name:"CONFIG_NAMESPACE" value:"istio-config" > readiness_probe:<httpGet:<path:"/ready" port:8080 > initialDelaySeconds:1 timeoutSeconds:5 periodSeconds:3 > resources:<requests:<key:"cpu" value:"10m" > requests:<key:"memory" value:"100Mi" > > strategy:<rollingUpdate:<maxUnavailable:25% maxSurge:100% > > > > policy:<enabled:<BoolValue:<> > tag:<nil> spec:<nil> k8s:<env:<name:"POD_NAMESPACE" valueFrom:<fieldRef:<apiVersion:"v1" fieldPath:"metadata.namespace" > > > hpa_spec:<scaleTargetRef:<kind:"Deployment" name:"istio-policy" apiVersion:"apps/v1" > minReplicas:1 maxReplicas:5 metrics:<type:"Resource" resource:<name:"cpu" targetAverageUtilization:80 > > > resources:<requests:<key:"cpu" value:"10m" > requests:<key:"memory" value:"100Mi" > > strategy:<rollingUpdate:<maxUnavailable:25% maxSurge:100% > > > > telemetry:<enabled:<BoolValue:<> > tag:<nil> spec:<nil> k8s:<env:<name:"POD_NAMESPACE" valueFrom:<fieldRef:<apiVersion:"v1" fieldPath:"metadata.namespace" > > > env:<name:"GOMAXPROCS" value:"6" > hpa_spec:<scaleTargetRef:<kind:"Deployment" name:"istio-telemetry" apiVersion:"apps/v1" > minReplicas:1 maxReplicas:5 metrics:<type:"Resource" resource:<name:"cpu" targetAverageUtilization:80 > > > replica_count:1 resources:<limits:<key:"cpu" value:"4800m" > limits:<key:"memory" value:"4G" > requests:<key:"cpu" value:"50m" > requests:<key:"memory" value:"100Mi" > > strategy:<rollingUpdate:<maxUnavailable:25% maxSurge:100% > > > > citadel:<enabled:<BoolValue:<> > tag:<nil> spec:<nil> k8s:<strategy:<rollingUpdate:<maxUnavailable:25% maxSurge:100% > > > > cni:<enabled:<BoolValue:<> > tag:<nil> spec:<nil> > ingress_gateways:<enabled:<BoolValue:<value:true > > name:"istio-ingressgateway" tag:<nil> k8s:<resources:<requests:<key:"cpu" value:"10m" > requests:<key:"memory" value:"40Mi" > > service:<ports:<name:"status-port" port:15020 targetPort:15020 > ports:<name:"http2" port:80 targetPort:8080 > ports:<name:"https" port:443 targetPort:8443 > ports:<name:"kiali" port:15029 targetPort:15029 > ports:<name:"prometheus" port:15030 targetPort:15030 > ports:<name:"grafana" port:15031 targetPort:15031 > ports:<name:"tracing" port:15032 targetPort:15032 > ports:<name:"tcp" port:31400 targetPort:31400 > ports:<name:"tls" port:15443 targetPort:15443 > > > > egress_gateways:<enabled:<BoolValue:<value:true > > name:"istio-egressgateway" tag:<nil> k8s:<resources:<requests:<key:"cpu" value:"10m" > requests:<key:"memory" value:"40Mi" > > > > > addon_components:<key:"grafana" value:<enabled:<BoolValue:<value:true > > spec:<nil> k8s:<replica_count:1 > > > addon_components:<key:"istiocoredns" value:<enabled:<BoolValue:<> > spec:<nil> > > addon_components:<key:"kiali" value:<enabled:<BoolValue:<value:true > > spec:<nil> k8s:<replica_count:1 > > > addon_components:<key:"prometheus" value:<enabled:<BoolValue:<value:true > > spec:<nil> k8s:<replica_count:1 > > > addon_components:<key:"tracing" value:<enabled:<BoolValue:<value:true > > spec:<nil> > > values:<key:"clusterResources" value:true > values:<key:"gateways" value:map[istio-egressgateway:map[autoscaleEnabled:false name:istio-egressgateway secretVolumes:[map[mountPath:/etc/istio/egressgateway-certs name:egressgateway-certs secretName:istio-egressgateway-certs] map[mountPath:/etc/istio/egressgateway-ca-certs name:egressgateway-ca-certs secretName:istio-egressgateway-ca-certs]] type:ClusterIP] istio-ingressgateway:map[applicationPorts: autoscaleEnabled:false debug:info domain: meshExpansionPorts:[map[name:tcp-pilot-grpc-tls port:15011 targetPort:15011] map[name:tcp-istiod port:15012 targetPort:15012] map[name:tcp-citadel-grpc-tls port:8060 targetPort:8060] map[name:tcp-dns-tls port:853 targetPort:8853]] name:istio-ingressgateway secretVolumes:[map[mountPath:/etc/istio/ingressgateway-certs name:ingressgateway-certs secretName:istio-ingressgateway-certs] map[mountPath:/etc/istio/ingressgateway-ca-certs name:ingressgateway-ca-certs secretName:istio-ingressgateway-ca-certs]] type:LoadBalancer]] > values:<key:"global" value:map[arch:map[amd64:2 ppc64le:2 s390x:2] configValidation:true controlPlaneSecurityEnabled:true defaultNodeSelector:map[] defaultPodDisruptionBudget:map[enabled:true] defaultResources:map[requests:map[cpu:10m]] disablePolicyChecks:false enableHelmTest:false enableTracing:true imagePullPolicy: imagePullSecrets:[] istioNamespace:istio-system istiod:map[enableAnalysis:false enabled:true] jwtPolicy:third-party-jwt localityLbSetting:map[enabled:true] logAsJson:false logging:map[level:default:info] meshExpansion:map[enabled:false useILB:false] meshNetworks:map[] mountMtlsCerts:false mtls:map[auto:true] multiCluster:map[clusterName: enabled:false] network: omitSidecarInjectorConfigMap:false oneNamespace:false operatorManageWebhooks:false outboundTrafficPolicy:map[mode:ALLOW_ANY] pilotCertProvider:istiod policyCheckFailOpen:false priorityClassName: proxy:map[accessLogFile:/dev/stdout autoInject:enabled clusterDomain:cluster.local componentLogLevel:misc:error enableCoreDump:false envoyStatsd:map[enabled:false host:<nil> port:<nil>] excludeIPRanges: excludeInboundPorts: excludeOutboundPorts: image:proxyv2 includeIPRanges:* logLevel:warning privileged:false readinessFailureThreshold:30 readinessInitialDelaySeconds:1 readinessPeriodSeconds:2 resources:map[limits:map[cpu:2000m memory:1024Mi] requests:map[cpu:10m memory:40Mi]] statusPort:15020 tracer:zipkin] proxy_init:map[image:proxyv2 resources:map[limits:map[cpu:100m memory:50Mi] requests:map[cpu:10m memory:10Mi]]] sds:map[token:map[aud:istio-ca]] sts:map[servicePort:0] tracer:map[datadog:map[address:$(HOST_IP):8126] lightstep:map[accessToken: address: cacertPath: secure:true] stackdriver:map[debug:false maxNumberOfAnnotations:200 maxNumberOfAttributes:200 maxNumberOfMessageEvents:200] zipkin:map[address:]] trustDomain:cluster.local useMCP:false] > values:<key:"grafana" value:map[accessMode:ReadWriteMany contextPath:/grafana dashboardProviders:map[dashboardproviders.yaml:map[apiVersion:1 providers:[map[disableDeletion:false folder:istio name:istio options:map[path:/var/lib/grafana/dashboards/istio] orgId:1 type:file]]]] datasources:map[datasources.yaml:map[apiVersion:1 datasources:<nil>]] env:map[] envSecrets:map[] image:map[repository:grafana/grafana tag:6.5.2] nodeSelector:map[] persist:false podAntiAffinityLabelSelector:[] podAntiAffinityTermLabelSelector:[] security:map[enabled:false passphraseKey:passphrase secretName:grafana usernameKey:username] service:map[annotations:map[] externalPort:3000 loadBalancerIP:<nil> loadBalancerSourceRanges:<nil> name:http type:ClusterIP] storageClassName: tolerations:[]] > values:<key:"istiocoredns" value:map[coreDNSImage:coredns/coredns coreDNSPluginImage:istio/coredns-plugin:0.2-istio-1.1 coreDNSTag:1.6.2] > values:<key:"kiali" value:map[contextPath:/kiali createDemoSecret:true dashboard:map[grafanaInClusterURL:http://grafana:3000 grafanaURL:<nil> jaegerInClusterURL:http://tracing/jaeger jaegerURL:<nil> passphraseKey:passphrase secretName:kiali usernameKey:username viewOnlyMode:false] hub:quay.io/kiali nodeSelector:map[] podAntiAffinityLabelSelector:[] podAntiAffinityTermLabelSelector:[] prometheusNamespace:<nil> security:map[cert_file:/kiali-cert/cert-chain.pem enabled:false private_key_file:/kiali-cert/key.pem] tag:v1.15] > values:<key:"meshConfig" value:map[] > values:<key:"mixer" value:map[adapters:map[kubernetesenv:map[enabled:true] prometheus:map[enabled:true metricsExpiryDuration:10m] stackdriver:map[auth:map[apiKey: appCredentials:false serviceAccountPath:] enabled:false tracer:map[enabled:false sampleProbability:1]] stdio:map[enabled:true outputAsJson:false] useAdapterCRDs:false] policy:map[adapters:map[kubernetesenv:map[enabled:true] useAdapterCRDs:false] autoscaleEnabled:false image:mixer sessionAffinityEnabled:false] telemetry:map[autoscaleEnabled:false env:map[GOMAXPROCS:6] image:mixer loadshedding:map[latencyThreshold:100ms mode:enforce] nodeSelector:map[] podAntiAffinityLabelSelector:[] podAntiAffinityTermLabelSelector:[] replicaCount:1 sessionAffinityEnabled:false tolerations:[]]] > values:<key:"pilot" value:map[appNamespaces:[] autoscaleEnabled:false autoscaleMax:5 autoscaleMin:1 configMap:true configNamespace:istio-config cpu:map[targetAverageUtilization:80] deploymentLabels:<nil> enableProtocolSniffingForInbound:true enableProtocolSniffingForOutbound:true env:map[] image:pilot keepaliveMaxServerConnectionAge:30m nodeSelector:map[] podAntiAffinityLabelSelector:[] podAntiAffinityTermLabelSelector:[] policy:map[enabled:false] replicaCount:1 tolerations:[] traceSampling:1] > values:<key:"prometheus" value:map[contextPath:/prometheus hub:docker.io/prom nodeSelector:map[] podAntiAffinityLabelSelector:[] podAntiAffinityTermLabelSelector:[] provisionPrometheusCert:true retention:6h scrapeInterval:15s security:map[enabled:true] tag:v2.15.1 tolerations:[]] > values:<key:"sidecarInjectorWebhook" value:map[enableNamespacesByDefault:false injectLabel:istio-injection objectSelector:map[autoInject:true enabled:false] rewriteAppHTTPProbe:true] > values:<key:"telemetry" value:map[enabled:true v1:map[enabled:false] v2:map[enabled:true prometheus:map[enabled:true] stackdriver:map[configOverride:map[] enabled:false logging:false monitoring:false topology:false]]] > values:<key:"tracing" value:map[jaeger:map[accessMode:ReadWriteMany hub:docker.io/jaegertracing memory:map[max_traces:50000] persist:false spanStorageType:badger storageClassName: tag:1.16] nodeSelector:map[] opencensus:map[exporters:map[stackdriver:map[enable_tracing:true]] hub:docker.io/omnition resources:map[limits:map[cpu:1 memory:2Gi] requests:map[cpu:200m memory:400Mi]] tag:0.1.9] podAntiAffinityLabelSelector:[] podAntiAffinityTermLabelSelector:[] provider:jaeger service:map[annotations:map[] externalPort:9411 name:http-query type:ClusterIP] zipkin:map[hub:docker.io/openzipkin javaOptsHeap:700 maxSpans:500000 node:map[cpus:2] probeStartupDelay:10 queryPort:9411 resources:map[limits:map[cpu:1000m memory:2048Mi] requests:map[cpu:150m memory:900Mi]] tag:2.20.0]] > values:<key:"version" value: >
error: compiled in charts not found in this development build, use --charts with local charts instead or run make gen-charts
2020-04-28T14:28:48.412045Z	info	Reconciling IstioOperator
2020-04-28T14:28:48.412188Z	info	Updating IstioOperator
2020-04-28T14:28:48.412199Z	info	installer	ReadProfileYAML for profile name: demo
2020-04-28T14:28:48.412218Z	info	installer	Loading values from compiled in VFS at path profiles/demo.yaml
2020-04-28T14:28:48.412229Z	info	installer	ReadProfileYAML for profile name: default
2020-04-28T14:28:48.412235Z	info	installer	Loading values from compiled in VFS at path profiles/default.yaml
2020-04-28T14:28:49.014577Z	info	Detecting third-party JWT support
...

Still fails on 1.6.0-beta.1

Should be fixed in https://github.com/istio/release-builder/pull/243.

Fixed in 1.6.0-rc.o

authors: ericvn ostromart


text:
Place to keep envoy-facing APIs

We need a place for Istio-specific envoy API (include those that are not planned for upstream). In the recent PR (https://github.com/istio/api/pull/415), we put it under envoy folder in API repo, but there are concerns that it might cause confusion. Before that, there are few others (mixer filter, jwt filter) that are kept in less obvious folder structure.
Alternative option is having this under proxy, but will need build infra and dependency changes in order to use it.

@diemtvu please label the areas for new issues.

So my stance on this is as follows: these protos should live beside their implementations for now, in istio/proxy. If/when they move upstream we can import them from envoyproxy/data-plane-api; till then all Envoy specific C++ code and its configuration should live together in istio/proxy.

@geeknoid @rshriram @louiscryan @frankbu as the main people maintaining the istio/api repo, opinions here w.r.t. where this type of config should live?

I agree with Zack. Stuff in istio/api is about programming Istio components and not about how Istio talks to with external components.
So let's put this kind of stuff in istio/proxy instead.

authors: ZackButcher andraxylia diemtvu geeknoid


text:
Misconfigured meshConfig fails silently

Is this the right place to submit this?

[X] This is not a security vulnerability or a crashing bug
[X] This is not a question about how to use Istio

Bug Description
A misconfigured meshConfig will fail (mostly) silently, making it hard to notice that the config won't be configured as it will fall back to the default config.
To reproduce:

Install Istio with meshConfig.defaultConfig.proxyMetadata.ISTIO_META_DNS_CAPTURE: true (note true is boolean, not string)
Deploy workloads
Send traffic
Notice that the flag above is not set, istio.* metrics are missing, etc.

This won't raise any warning/error in the workload's istio-proxy, but you can see this warn level log in istiod:
...
2024-01-25T11:14:27.754775Z	info	mesh networks configuration updated to: {

}
2024-01-25T11:14:27.755719Z	warn	failed to read mesh config from ConfigMap: failed reading MeshConfig config: failed to convert to proto. json: cannot unmarshal bool into Go value of type string. YAML:
accessLogFile: /dev/stdout
accessLogFormat: |
  [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %RESPONSE_CODE_DETAILS% %CONNECTION_TERMINATION_DETAILS% "%UPSTREAM_TRANSPORT_FAILURE_REASON%" %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%" %UPSTREAM_CLUSTER% %UPSTREAM_LOCAL_ADDRESS% %DOWNSTREAM_LOCAL_ADDRESS% %DOWNSTREAM_REMOTE_ADDRESS% %REQUESTED_SERVER_NAME% %ROUTE_NAME% traceID=%REQ(x-b3-traceid)% "%REQ(END-USER)%"
defaultConfig:
  discoveryAddress: istiod.istio-system.svc:15012
  proxyMetadata:
    ISTIO_META_DNS_CAPTURE: true
...

It would be nice to

surface this better, maybe at workload proxy level as well?
log it as error instead or warning

What do you think?
Version
Istio 1.20.2

$ kubectl version
Client Version: v1.25.3+k3s1
Kustomize Version: v4.5.7
Server Version: v1.28.5+k3s1

$ helm version --short
v3.10.3+gv3.10.3 via helmfile

Additional Information
No response

I don't think there is a reasonable way to expose this at the proxy level. Changin to error seems fine though

Maybe we can provide more information on the failure in the log message as well.

@krisztianfekete what kind of extra information? the error currently being printed is the one returned from the yaml parser package we user to parse it and it tells what and where the parsing failed.

I was thinking about showing where the parsing failed, as IIRC it was not trivial (I omitted the extra lines after the variable where I made the mistake) to notice it.

I see, it can indeed be helpful.
@howardjohn is it feasible? I can't see the unmarshaller being able to provide info about the problematic json field.

I doubt it.. its just the standard go/proto json parsing, notorious for useless errors.
If you do, it would benefit the entire ecosystem though

Given how hard it can be to notice that a misconfiguration is causing you to have the default configuration running, what do you all think about failing instead of just logging an error if someone is making this mistake?
One can argue that it's better to fail quickly than to have a Istio run with a config that is ~unknown to the users.
Checking the code, it looks like Istio can keep the last known config in case there's a misconfiguration issue, but there's also the case when someone is trying to spin Istio up the first time with a misconfiguration.

Falling back to a previous working configuration is what I would expect, similar thing that happens when you create a bad snapshot for the proxies, it is just rejected and the system is working with the previous configuration.
However, for a new installation where there is no previous config to fall back, I would expect an error and istiod crash, so there is no chance to ignore it.

@krisztianfekete should i reopen this?  I think there are some UX aspect of this ?

However, for a new installation where there is no previous config to fall back, I would expect an error and istiod crash, so there is no chance to ignore it.

FWIW this results in a very bad failure scenario where you make a change to mesh config, all looks fine... 3 days later the pod is evicted and never comes up, causing a cluster wide outage at 3am.
Not that the current state is great either.
https://github.com/istio/istio/issues/47593 would be ideal but I don't think its feasble

FWIW this results in a very bad failure scenario where you make a change to mesh config, all looks fine... 3 days later the pod is evicted and never comes up, causing a cluster wide outage at 3am.

Can't we fall back to the previous good configuration and just log an error if the new one would fail? Btw, how can you get a multi-day delay like the one you described? Wouldn't a meshConfig change require new pods so it would fail right away?

MeshConfig is updated dynamically. So if you apply a bad config, istiod will work fine... until it happens to restart, possibly days later, and never comes up

Here we can do two things:

in Bootstrap  stop loading the meshConfiguration if it is invalid, and using the default meshConfig.
Adding we validating webhook for meshConfig, and prevent updating invalid config.

With these two hurdles,  istio cannot flip from a valid meshconfig to an invalid mesh config

authors: howardjohn hzxuzhonghu jmunozro krisztianfekete linsun ymesika


text:
istio-ingressgateway  fails to be scaled

Describe the bug
In order to serve more endpoints and HA,  istio-ingressgateway needs to be scaled to more replicas, but unfortunately, which fails to be scaled, and always keeps the replica as 1.
Expected behavior
istio-ingressgateway can to be can be scaled.
Steps to reproduce the bug

kubectl -n istio-system scale --replicas=3 deploy istio-ingressgateway

# kubectl -n istio-system scale --replicas=3 deploy istio-ingressgateway
deployment.extensions/istio-ingressgateway scaled

kubectl get deploy -n istio-system

# kubectl get deploy -n istio-system
NAME                       DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
grafana                    1         1         1            1           2h
istio-citadel              1         1         1            1           2h
istio-egressgateway        1         1         1            1           2h
istio-ingressgateway       3         3         3            3           2h
istio-pilot                1         1         1            1           2h
istio-policy               1         1         1            1           2h
istio-sidecar-injector     1         1         1            1           2h
istio-statsd-prom-bridge   1         1         1            1           2h
istio-telemetry            1         1         1            1           2h
istio-tracing              1         1         1            1           2h
prometheus                 1         1         1            1           2h
servicegraph               1         1         1            1           2h

kubectl get po -n istio-system

NAME                                        READY     STATUS        RESTARTS   AGE
grafana-74c69dc7f7-njrgw                    1/1       Running       0          2h
istio-citadel-745ffd8564-dwqt7              1/1       Running       0          2h
istio-cleanup-old-ca-2nrdh                  0/1       Completed     0          2h
istio-egressgateway-7d88dcf4c4-pgt57        1/1       Running       0          2h
istio-ingressgateway-7784859f98-56p27       1/1       Running       0          2h
istio-ingressgateway-7784859f98-8jt85       0/1       Terminating   0          9s
istio-ingressgateway-7784859f98-qn2j4       0/1       Terminating   0          9s
istio-mixer-post-install-gjgkt              0/1       Completed     0          2h
istio-mixer-post-install-njlx8              0/1       Error         0          2h
istio-mixer-post-install-t46wj              0/1       Error         0          2h
istio-pilot-6c4dd699b4-g6zxt                2/2       Running       0          2h
istio-policy-7b96677cdd-gh4tt               2/2       Running       0          2h
istio-sidecar-injector-67b4d886c-wtltg      1/1       Running       0          2h
istio-statsd-prom-bridge-5b65fcf47f-qbfxw   1/1       Running       1          2h
istio-telemetry-6db7fd78f8-kb68q            2/2       Running       2          2h
istio-tracing-6bcf4b6469-s8nvz              1/1       Running       0          2h
prometheus-5d6d7b75bd-8m2vn                 1/1       Running       0          2h
servicegraph-669897c747-m7k9d               1/1       Running       0          2h

And the pod istio-mixer-post-install-njlx8 "Error" status, the logs of which shown as below, but another pod istio-mixer-post-install-gjgkt "Completed" status, is it a bug or just ok?

kubectl logs istio-mixer-post-install-njlx8  -n istio-system
2018-07-18 08:12:13.568233 I | proto: duplicate proto type registered: google.protobuf.Any
2018-07-18 08:12:13.568377 I | proto: duplicate proto type registered: google.protobuf.Duration
2018-07-18 08:12:13.568388 I | proto: duplicate proto type registered: google.protobuf.Timestamp
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=attributemanifest
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=attributemanifest
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=stdio
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=logentry
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=rule
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=metric
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=metric
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=metric
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=metric
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=metric
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=metric
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=prometheus
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=rule
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=rule
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=kubernetesenv
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=rule
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=rule
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for config.istio.io/, Kind=kubernetes
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for networking.istio.io/, Kind=DestinationRule
unable to recognize "/tmp/mixer/custom-resources.yaml": no matches for networking.istio.io/, Kind=DestinationRule

At last, istio-ingressgateway instance number finally to be 1

# kubectl get po -n istio-system
NAME                                        READY     STATUS      RESTARTS   AGE
grafana-74c69dc7f7-njrgw                    1/1       Running     0          2h
istio-citadel-745ffd8564-dwqt7              1/1       Running     0          2h
istio-cleanup-old-ca-2nrdh                  0/1       Completed   0          2h
istio-egressgateway-7d88dcf4c4-pgt57        1/1       Running     0          2h
istio-ingressgateway-7784859f98-56p27       1/1       Running     0          2h
istio-mixer-post-install-gjgkt              0/1       Completed   0          2h
istio-mixer-post-install-njlx8              0/1       Error       0          2h
istio-mixer-post-install-t46wj              0/1       Error       0          2h
istio-pilot-6c4dd699b4-g6zxt                2/2       Running     0          2h
istio-policy-7b96677cdd-gh4tt               2/2       Running     0          2h
istio-sidecar-injector-67b4d886c-wtltg      1/1       Running     0          2h
istio-statsd-prom-bridge-5b65fcf47f-qbfxw   1/1       Running     1          2h
istio-telemetry-6db7fd78f8-kb68q            2/2       Running     2          2h
istio-tracing-6bcf4b6469-s8nvz              1/1       Running     0          2h
prometheus-5d6d7b75bd-8m2vn                 1/1       Running     0          2h
servicegraph-669897c747-m7k9d               1/1       Running     0          2h

Version
bin/istioctl version
Version: 0.8.0
GitRevision: 6f9f420f0c7119ff4fa6a1966a6f6d89b1b4db84
User: root@48d5ddfd72da
Hub: docker.io/istio
GolangVersion: go1.10.1
BuildStatus: Clean

kubectl version
Client Version: version.Info{Major:"1", Minor:"11", GitVersion:"v1.11.0", GitCommit:"91e7b4fd31fcd3d5f436da26c980becec37ceefe", GitTreeState:"clean", BuildDate:"2018-06-27T20:17:28Z", GoVersion:"go1.10.2", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"11", GitVersion:"v1.11.0", GitCommit:"91e7b4fd31fcd3d5f436da26c980becec37ceefe", GitTreeState:"clean", BuildDate:"2018-06-27T20:08:34Z", GoVersion:"go1.10.2", Compiler:"gc", Platform:"linux/amd64"}

Is Istio Auth enabled or not?
Installation steps:
Follow the guide: https://istio.io/docs/setup/kubernetes/quick-start/#installation-steps
$kubectl apply -f install/kubernetes/istio-demo.yaml

Environment
CentOS Linux release 7.4.1708 (Core)

The ingressgateway deploys with a spec for autoscaling: https://github.com/istio/istio/blob/master/install/kubernetes/helm/istio/charts/gateways/templates/autoscale.yaml. I don't know what happens when you try to scale around that configuration, but I suspect the autoscaler wins.

@douglas-reid  you're right, the autoscaler wins.  After deploy istio, we could see
kubectl get hpa -n istio-system
NAME                   REFERENCE                         TARGETS         MINPODS   MAXPODS   REPLICAS   AGE
istio-egressgateway    Deployment/istio-egressgateway    <unknown>/80%   1         1         1          18m
istio-ingressgateway   Deployment/istio-ingressgateway   <unknown>/80%   1         1         1          18m

and once we scale the istio-ingressgateway it will be scaled down directly which could be verified from the deploy describe log
  Normal  ScalingReplicaSet  15m   deployment-controller  Scaled up replica set istio-ingressgateway-6bc7c7c4bc to 3
  Normal  ScalingReplicaSet  15m   deployment-controller  Scaled down replica set istio-ingressgateway-6bc7c7c4bc to 1

I tried to change the maxReplicas from 1 to 10 in istio/charts/ingressgateway/templates/autoscale.yaml in istio.yaml and apply the new istio.yaml  file.  Rerun the scale command and the istio-ingress replicas turn to 3 successfully.
Meanwhile, I tried to scale deployment prometheus to replicas=3 which is not configured with horizontalpodautoscale, and it scaled quickly and correctly.  This experiment also shows the autoscale limits the scale replicas
Based on the above observation, I have a question about the hpa for istio-egresssgate and istio-ingressgate with minReplicas=1 and maxReplicas=1.  Could we set the maxReplicas larger, like 10.  And this could also be mentioned in the official doc to make users not try to scale it manually.

@douglas-reid ,thanks for your quick response and suggestion, i have tried HPA, it helps :)

@douglas-reid  the goodness is that the maxReplicas for istio-ingressgateway has been updated to 5 in the master branch. I make a PR to update the maxReplicas for istio-egressgateway here, please check:  https://github.com/istio/istio/pull/7238
As the ingress will be replaced with ingressgateway, I will leave the maxReplicas for ingress to 1 in master branch

authors: LillyWu douglas-reid xiajidexue


text:
agent: rewrite readiness probe

For filter chain based inbound virtual listener, pilot-agent only need to watch the active virtual inbound listener on port 15006
Previously we verify if there is a inbound listener collide with the application port.
[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[X] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

@silentdai: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

integ-pilot-local-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-pilot-local-presubmit-tests-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@silentdai: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

integ-pilot-local-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-pilot-local-presubmit-tests-master

integ-security-local-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-security-local-presubmit-tests-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@silentdai: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

integ-pilot-local-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-pilot-local-presubmit-tests-master

integ-security-local-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-security-local-presubmit-tests-master

istio-unit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test istio-unit-tests-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@silentdai: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

integ-pilot-local-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-pilot-local-presubmit-tests-master

integ-security-local-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-security-local-presubmit-tests-master

istio-unit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test istio-unit-tests-master

istio-racetest-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test istio-racetest-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@silentdai: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

integ-pilot-local-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-pilot-local-presubmit-tests-master

integ-security-local-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-security-local-presubmit-tests-master

istio-unit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test istio-unit-tests-master

istio-racetest-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test istio-racetest-master

integ-new-install-k8s-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-new-install-k8s-presubmit-tests-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@silentdai: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

integ-pilot-local-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-pilot-local-presubmit-tests-master

integ-security-local-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-security-local-presubmit-tests-master

istio-unit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test istio-unit-tests-master

istio-racetest-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test istio-racetest-master

integ-new-install-k8s-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-new-install-k8s-presubmit-tests-master

istio-codecov-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test istio-codecov-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@silentdai: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

integ-pilot-local-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-pilot-local-presubmit-tests-master

integ-security-local-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-security-local-presubmit-tests-master

istio-unit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test istio-unit-tests-master

istio-racetest-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test istio-racetest-master

integ-new-install-k8s-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-new-install-k8s-presubmit-tests-master

istio-codecov-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test istio-codecov-master

integ-pilot-k8s-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-pilot-k8s-presubmit-tests-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@silentdai: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

istio-unit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test istio-unit-tests-master

istio-racetest-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test istio-racetest-master

integ-new-install-k8s-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-new-install-k8s-presubmit-tests-master

istio-codecov-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test istio-codecov-master

integ-pilot-k8s-presubmit-tests-master
7031e7da0bf392bad413068f1cfdde8b9c29e953
link
/test integ-pilot-k8s-presubmit-tests-master

istio-lint-master
cfcf77c6451a30209fdba28b4b63b5e15eff1f8e
link
/test istio-lint-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@silentdai: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

integ-new-install-k8s-presubmit-tests-master
4792e1710d58ea71e52c2d76379c476945b26836
link
/test integ-new-install-k8s-presubmit-tests-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@silentdai: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

integ-new-install-k8s-presubmit-tests-master
4792e1710d58ea71e52c2d76379c476945b26836
link
/test integ-new-install-k8s-presubmit-tests-master

integ-mixer-k8s-presubmit-tests-master
4792e1710d58ea71e52c2d76379c476945b26836
link
/test integ-mixer-k8s-presubmit-tests-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@silentdai: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

integ-new-install-k8s-presubmit-tests-master
529c4f5aec031cf4dac953517474ee7a8a5bf2d8
link
/test integ-new-install-k8s-presubmit-tests-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@rshriram Since our discussion is that pilot could generate

" virtualInbound + all usual inbound listeners", or
"virtualInbound" only
We need the pilot-agent provide readiness probe to accommodate these two conditions.

The concern that pilot should not generate "virtual inbound with huge filter chains" + "all usual inbound listeners" for single pilot-agent will be addressed in the next PR.
And that PR depends on this one since "virtual inbound with huge filter chains" w/o "all usual inbound listeners" requests this new readiness probe

Pilot agent + envoy is one unit == istio-proxy container.
You either use new istio proxy container or the old container. We are not guaranteeing old istio proxy plus new agent, or old agent plus new proxy.

@rshriram  fixed. This PR should not backport to 1.2. I bet no one would :)

@howardjohn Replied in inline. I think the active 15006 listener involves more than a bumped counter.

I thought you said listeners will show up even if they are warming? we also
have a check that checks envoy status and makes sure it envoy I'd in the
"Ready" state already, isn't this redundant?
On Mon, Aug 19, 2019, 8:31 PM Yuchen Dai notifications@github.com wrote:

@lambdai commented on this pull request.
In pilot/cmd/pilot-agent/status/ready/probe.go
https://github.com/istio/istio/pull/16336#discussion_r315494032:

  return err

}
return p.checkServerInfo()
}
+func (p *Probe) checkInbound() error {

if !p.ProbeByVirtualInboundListener || p.NodeType != model.SidecarProxy {

return p.checkInboundConfigured()

}
return p.checkInboundVirtualListener()

+}
+
+func (p *Probe) checkInboundVirtualListener() error {

// Warning: this is not reliable at envoy start up.
// TODO(silentdai): switch to /configdump
err := util.HasListenerName(p.LocalHostAddr, p.AdminPort, networking.VirtualInboundListenerName)

@howardjohn https://github.com/howardjohn I don't get your point. The
readiness probe is checking if 15006 is active. With this check we expect

Envoy receives the LDS, expecting all the listener config is received
15006 inbound listener is active which means the dependencies of
are initialized. Notes the dependencies includes SDS which may be time
consuming at certain loads, which is more than CDS.

AFAIK, this is more than a LDS sent counter since I don't think LDS
succeed counter bump after the listener turned active.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/istio/istio/pull/16336?email_source=notifications&email_token=AAEYGXKVX2CAUPLQ3GTFT5DQFNQQTA5CNFSM4IMD63O2YY3PNVWWK3TUL52HS4DFWFIHK3DMKJSXC5LFON2FEZLWNFSXPKTDN5WW2ZLOORPWSZGOCCAWJGI#discussion_r315494032,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAEYGXKPBZU3TWZUL3WMWKTQFNQQTANCNFSM4IMD63OQ
.

I thought you said listeners will show up even if they are warming?

True. It should be a bug in envoy. We should expect the bug be fixed eventually.
This PR follow the interface of envoy. Luckily when envoy is doing wrong at this moment, this check doesn't make things worse.

@howardjohn I think you are right at this moment. If the readiness goal is guarantee envoy initialized while pilot should always provide 15006 listener, the checkInbound is dupilcated.
@costinm @ostromart  I happened to learn pieces of your discussion on the plan to enable the flow

set pilot-agent as not ready
update envoy
set pilot-agent as ready

This flow may includes disable pilotagent by remove the capture listener 15001 and 15006.
WDYT if we assume virtual listeners should be always in the listener list for now? Any other cases that virtual listener could be gone for some reason?
If virtual listener should be always there since the initialization, we could remove the duplicated listener check  in readiness probe

^ Also request comment from @nmittler

push a new commit to skip the inbound check for sidecar type

@lambdai: The following test failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

istio-lint-master
07051bea5045a384e5bde414856d9cd7e8c803d7
link
/test istio-lint-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@lambdai: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

istio-lint-master
07051bea5045a384e5bde414856d9cd7e8c803d7
link
/test istio-lint-master

istio-racetest-master
07051bea5045a384e5bde414856d9cd7e8c803d7
link
/test istio-racetest-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@lambdai: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

istio-lint-master
07051bea5045a384e5bde414856d9cd7e8c803d7
link
/test istio-lint-master

istio-racetest-master
07051bea5045a384e5bde414856d9cd7e8c803d7
link
/test istio-racetest-master

istio-pilot-e2e-envoyv2-v1alpha3-master
07051bea5045a384e5bde414856d9cd7e8c803d7
link
/test istio-pilot-e2e-envoyv2-v1alpha3-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@lambdai: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

istio-lint-master
07051bea5045a384e5bde414856d9cd7e8c803d7
link
/test istio-lint-master

istio-racetest-master
07051bea5045a384e5bde414856d9cd7e8c803d7
link
/test istio-racetest-master

istio-pilot-e2e-envoyv2-v1alpha3-master
07051bea5045a384e5bde414856d9cd7e8c803d7
link
/test istio-pilot-e2e-envoyv2-v1alpha3-master

integ-mixer-k8s-presubmit-tests-master
07051bea5045a384e5bde414856d9cd7e8c803d7
link
/test integ-mixer-k8s-presubmit-tests-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@costinm  and @howardjohn are drafting PRs to make sure the first listeners config upon pod start will contain all the services
The agreement is that the virtual inbound listener contains all the defined ports or nothing so that we don't need containerPorts involved in the readiness probe

@lambdai: The following tests failed, say /retest to rerun them all:

Test name
Commit
Details
Rerun command

istio-racetest-master
07051bea5045a384e5bde414856d9cd7e8c803d7
link
/test istio-racetest-master

istio-pilot-e2e-envoyv2-v1alpha3-master
07051bea5045a384e5bde414856d9cd7e8c803d7
link
/test istio-pilot-e2e-envoyv2-v1alpha3-master

integ-mixer-k8s-presubmit-tests-master
07051bea5045a384e5bde414856d9cd7e8c803d7
link
/test integ-mixer-k8s-presubmit-tests-master

istio-unit-tests-master
128bdd735d9c78dbfe1cc20af0b369f17a3cef45
link
/test istio-unit-tests-master

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

/cherrypick release-1.3
CC @rlenglet

@lambdai: #16336 failed to apply on top of branch "release-1.3":
Applying: apply and add test
Applying: lint
Applying: improve test
Applying: lint again
Applying: apply and add test
error: Failed to merge in the changes.
Using index info to reconstruct a base tree...
M	pilot/cmd/pilot-agent/main.go
M	pilot/pkg/features/pilot.go
Falling back to patching base and 3-way merge...
Auto-merging pilot/pkg/features/pilot.go
Auto-merging pilot/cmd/pilot-agent/main.go
CONFLICT (content): Merge conflict in pilot/cmd/pilot-agent/main.go
Patch failed at 0006 apply and add test

In response to this:

/cherrypick release-1.3
CC @rlenglet

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

authors: howardjohn istio-testing lambdai rshriram silentdai


text:
Add support for istioctl logging flags to 'manifest generate' and 'apply'

Resolves https://github.com/istio/istio/issues/22956 and https://github.com/istio/istio/issues/22904
The istioctl manifest generate and apply create their own logger which did not follow the usual istioctl logging flags (see istioctl options for a list).
This causes those commands to use the istioctl root logging config.
Not part of this: Remove the code that recreates the logger out of the subcommands so it doesn't re-do the work the istioctl root does.  Also not part: deprecating --logtostderr, which is the operator version of --log_target=stderr.

@esnible: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
cd7acccc6dc941623adb0740db23a5368ef6e70f
link
/test lint_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@esnible: The following tests failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

lint_istio
cd7acccc6dc941623adb0740db23a5368ef6e70f
link
/test lint_istio

gencheck_istio
cd7acccc6dc941623adb0740db23a5368ef6e70f
link
/test gencheck_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

authors: esnible istio-testing