From b3f5d5de82adc2185d56627f942764ca0d4fce23 Mon Sep 17 00:00:00 2001 From: Shriram Rajagopalan Date: Sun, 21 Oct 2018 09:40:26 -0400 Subject: [PATCH 1/5] Updating description of network definitions (#664) * clarity Signed-off-by: Shriram Rajagopalan * renaming * nits Signed-off-by: Shriram Rajagopalan --- mesh/v1alpha1/config.pb.go | 2 +- mesh/v1alpha1/istio.mesh.v1alpha1.pb.html | 71 ++- mesh/v1alpha1/{mesh.pb.go => network.pb.go} | 510 ++++++++++++++---- mesh/v1alpha1/{mesh.proto => network.proto} | 42 +- .../v1alpha1/{mesh_pb2.py => network_pb2.py} | 80 ++- 5 files changed, 582 insertions(+), 123 deletions(-) rename mesh/v1alpha1/{mesh.pb.go => network.pb.go} (53%) rename mesh/v1alpha1/{mesh.proto => network.proto} (56%) rename python/istio_api/mesh/v1alpha1/{mesh_pb2.py => network_pb2.py} (60%) diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go index f3a0c3eb12..be14e91672 100644 --- a/mesh/v1alpha1/config.pb.go +++ b/mesh/v1alpha1/config.pb.go @@ -6,7 +6,7 @@ It is generated from these files: mesh/v1alpha1/config.proto - mesh/v1alpha1/mesh.proto + mesh/v1alpha1/network.proto mesh/v1alpha1/proxy.proto It has these top-level messages: diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html index 392830e414..4ac382f0bc 100644 --- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html +++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html @@ -4,7 +4,7 @@ generator: protoc-gen-docs aliases: - /docs/reference/config/service-mesh.html -number_of_entries: 10 +number_of_entries: 11 ---

AuthenticationPolicy

@@ -285,13 +285,13 @@

Network

- -registries -string[] + +endpoints +Network.NetworkEndpoints[] -

One or more service registries that are in this network. Endpoints -from these registries will be directly reachable to one another. -The names of the registries should correspond to the data sources.

+

The list of endpoints in the network (obtained through the constituent +service registries or from CIDR ranges). All endpoints in the network +are directly accessible to one another.

@@ -355,6 +355,63 @@

Network.IstioNetworkGateway

The locality associated with an explicitly specified gateway (i.e. ip)

+ + + + +
+

Network.NetworkEndpoints

+
+

NetworkEndpoints describes how the network associated with an endpoint +should be inferred. An endpoint will be assigned to a network based on +the following rules:

+ +
    +

  1. Implicitly: If the registry explicitly provides information about +the network to which the endpoint belongs to. In some cases, its +possible to indicate the network associated with the endpoint by +adding ISTIOMETANETWORK environment variable to the sidecar.

    2. + +

  2. Explicitly:

    3. +
+ +

a. By matching the registry name with one of the “fromregistries” + in the mesh config. A “fromregistry” can only be assinged to a + single network.

+ +

b. By matching the IP against one of the CIDR ranges in a mesh + config network. The CIDR ranges must not overlap and be assigned to + a single network.

+ +

(2) will override (1) if both are present.

+ + + + + + + + + + + + + + + + + + + diff --git a/mesh/v1alpha1/mesh.pb.go b/mesh/v1alpha1/network.pb.go similarity index 53% rename from mesh/v1alpha1/mesh.pb.go rename to mesh/v1alpha1/network.pb.go index 8bc20cf406..9ac144c577 100644 --- a/mesh/v1alpha1/mesh.pb.go +++ b/mesh/v1alpha1/network.pb.go @@ -1,5 +1,5 @@ // Code generated by protoc-gen-gogo. DO NOT EDIT. -// source: mesh/v1alpha1/mesh.proto +// source: mesh/v1alpha1/network.proto package v1alpha1 @@ -22,17 +22,17 @@ var _ = math.Inf type Network struct { // A unique name assigned to the network. Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // One or more service registries that are in this network. Endpoints - // from these registries will be directly reachable to one another. - // The names of the registries should correspond to the data sources. - Registries []string `protobuf:"bytes,2,rep,name=registries" json:"registries,omitempty"` - Gateways []*Network_IstioNetworkGateway `protobuf:"bytes,3,rep,name=gateways" json:"gateways,omitempty"` + // The list of endpoints in the network (obtained through the constituent + // service registries or from CIDR ranges). All endpoints in the network + // are directly accessible to one another. + Endpoints []*Network_NetworkEndpoints `protobuf:"bytes,2,rep,name=endpoints" json:"endpoints,omitempty"` + Gateways []*Network_IstioNetworkGateway `protobuf:"bytes,3,rep,name=gateways" json:"gateways,omitempty"` } func (m *Network) Reset() { *m = Network{} } func (m *Network) String() string { return proto.CompactTextString(m) } func (*Network) ProtoMessage() {} -func (*Network) Descriptor() ([]byte, []int) { return fileDescriptorMesh, []int{0} } +func (*Network) Descriptor() ([]byte, []int) { return fileDescriptorNetwork, []int{0} } func (m *Network) GetName() string { if m != nil { @@ -41,9 +41,9 @@ func (m *Network) GetName() string { return "" } -func (m *Network) GetRegistries() []string { +func (m *Network) GetEndpoints() []*Network_NetworkEndpoints { if m != nil { - return m.Registries + return m.Endpoints } return nil } @@ -55,6 +55,143 @@ func (m *Network) GetGateways() []*Network_IstioNetworkGateway { return nil } +// NetworkEndpoints describes how the network associated with an endpoint +// should be inferred. An endpoint will be assigned to a network based on +// the following rules: +// +// 1. Implicitly: If the registry explicitly provides information about +// the network to which the endpoint belongs to. In some cases, its +// possible to indicate the network associated with the endpoint by +// adding ISTIO_META_NETWORK environment variable to the sidecar. +// +// 2. Explicitly: +// +// a. By matching the registry name with one of the "from_registries" +// in the mesh config. A "from_registry" can only be assinged to a +// single network. +// +// b. By matching the IP against one of the CIDR ranges in a mesh +// config network. The CIDR ranges must not overlap and be assigned to +// a single network. +// +// (2) will override (1) if both are present. +type Network_NetworkEndpoints struct { + // Types that are valid to be assigned to Ne: + // *Network_NetworkEndpoints_FromCidr + // *Network_NetworkEndpoints_FromRegistry + Ne isNetwork_NetworkEndpoints_Ne `protobuf_oneof:"ne"` +} + +func (m *Network_NetworkEndpoints) Reset() { *m = Network_NetworkEndpoints{} } +func (m *Network_NetworkEndpoints) String() string { return proto.CompactTextString(m) } +func (*Network_NetworkEndpoints) ProtoMessage() {} +func (*Network_NetworkEndpoints) Descriptor() ([]byte, []int) { + return fileDescriptorNetwork, []int{0, 0} +} + +type isNetwork_NetworkEndpoints_Ne interface { + isNetwork_NetworkEndpoints_Ne() + MarshalTo([]byte) (int, error) + Size() int +} + +type Network_NetworkEndpoints_FromCidr struct { + FromCidr string `protobuf:"bytes,1,opt,name=from_cidr,json=fromCidr,proto3,oneof"` +} +type Network_NetworkEndpoints_FromRegistry struct { + FromRegistry string `protobuf:"bytes,2,opt,name=from_registry,json=fromRegistry,proto3,oneof"` +} + +func (*Network_NetworkEndpoints_FromCidr) isNetwork_NetworkEndpoints_Ne() {} +func (*Network_NetworkEndpoints_FromRegistry) isNetwork_NetworkEndpoints_Ne() {} + +func (m *Network_NetworkEndpoints) GetNe() isNetwork_NetworkEndpoints_Ne { + if m != nil { + return m.Ne + } + return nil +} + +func (m *Network_NetworkEndpoints) GetFromCidr() string { + if x, ok := m.GetNe().(*Network_NetworkEndpoints_FromCidr); ok { + return x.FromCidr + } + return "" +} + +func (m *Network_NetworkEndpoints) GetFromRegistry() string { + if x, ok := m.GetNe().(*Network_NetworkEndpoints_FromRegistry); ok { + return x.FromRegistry + } + return "" +} + +// XXX_OneofFuncs is for the internal use of the proto package. +func (*Network_NetworkEndpoints) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) { + return _Network_NetworkEndpoints_OneofMarshaler, _Network_NetworkEndpoints_OneofUnmarshaler, _Network_NetworkEndpoints_OneofSizer, []interface{}{ + (*Network_NetworkEndpoints_FromCidr)(nil), + (*Network_NetworkEndpoints_FromRegistry)(nil), + } +} + +func _Network_NetworkEndpoints_OneofMarshaler(msg proto.Message, b *proto.Buffer) error { + m := msg.(*Network_NetworkEndpoints) + // ne + switch x := m.Ne.(type) { + case *Network_NetworkEndpoints_FromCidr: + _ = b.EncodeVarint(1<<3 | proto.WireBytes) + _ = b.EncodeStringBytes(x.FromCidr) + case *Network_NetworkEndpoints_FromRegistry: + _ = b.EncodeVarint(2<<3 | proto.WireBytes) + _ = b.EncodeStringBytes(x.FromRegistry) + case nil: + default: + return fmt.Errorf("Network_NetworkEndpoints.Ne has unexpected type %T", x) + } + return nil +} + +func _Network_NetworkEndpoints_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) { + m := msg.(*Network_NetworkEndpoints) + switch tag { + case 1: // ne.from_cidr + if wire != proto.WireBytes { + return true, proto.ErrInternalBadWireType + } + x, err := b.DecodeStringBytes() + m.Ne = &Network_NetworkEndpoints_FromCidr{x} + return true, err + case 2: // ne.from_registry + if wire != proto.WireBytes { + return true, proto.ErrInternalBadWireType + } + x, err := b.DecodeStringBytes() + m.Ne = &Network_NetworkEndpoints_FromRegistry{x} + return true, err + default: + return false, nil + } +} + +func _Network_NetworkEndpoints_OneofSizer(msg proto.Message) (n int) { + m := msg.(*Network_NetworkEndpoints) + // ne + switch x := m.Ne.(type) { + case *Network_NetworkEndpoints_FromCidr: + n += proto.SizeVarint(1<<3 | proto.WireBytes) + n += proto.SizeVarint(uint64(len(x.FromCidr))) + n += len(x.FromCidr) + case *Network_NetworkEndpoints_FromRegistry: + n += proto.SizeVarint(2<<3 | proto.WireBytes) + n += proto.SizeVarint(uint64(len(x.FromRegistry))) + n += len(x.FromRegistry) + case nil: + default: + panic(fmt.Sprintf("proto: unexpected type %T in oneof", x)) + } + return n +} + // The gateway associated with this network. Traffic from remote networks // will arrive at the specified gateway:port. All incoming traffic must // use mTLS. @@ -73,7 +210,7 @@ func (m *Network_IstioNetworkGateway) Reset() { *m = Network_IstioNetwor func (m *Network_IstioNetworkGateway) String() string { return proto.CompactTextString(m) } func (*Network_IstioNetworkGateway) ProtoMessage() {} func (*Network_IstioNetworkGateway) Descriptor() ([]byte, []int) { - return fileDescriptorMesh, []int{0, 0} + return fileDescriptorNetwork, []int{0, 1} } type isNetwork_IstioNetworkGateway_Gw interface { @@ -195,6 +332,7 @@ func _Network_IstioNetworkGateway_OneofSizer(msg proto.Message) (n int) { func init() { proto.RegisterType((*Network)(nil), "istio.mesh.v1alpha1.Network") + proto.RegisterType((*Network_NetworkEndpoints)(nil), "istio.mesh.v1alpha1.Network.NetworkEndpoints") proto.RegisterType((*Network_IstioNetworkGateway)(nil), "istio.mesh.v1alpha1.Network.IstioNetworkGateway") } func (m *Network) Marshal() (dAtA []byte, err error) { @@ -215,29 +353,26 @@ func (m *Network) MarshalTo(dAtA []byte) (int, error) { if len(m.Name) > 0 { dAtA[i] = 0xa i++ - i = encodeVarintMesh(dAtA, i, uint64(len(m.Name))) + i = encodeVarintNetwork(dAtA, i, uint64(len(m.Name))) i += copy(dAtA[i:], m.Name) } - if len(m.Registries) > 0 { - for _, s := range m.Registries { + if len(m.Endpoints) > 0 { + for _, msg := range m.Endpoints { dAtA[i] = 0x12 i++ - l = len(s) - for l >= 1<<7 { - dAtA[i] = uint8(uint64(l)&0x7f | 0x80) - l >>= 7 - i++ + i = encodeVarintNetwork(dAtA, i, uint64(msg.Size())) + n, err := msg.MarshalTo(dAtA[i:]) + if err != nil { + return 0, err } - dAtA[i] = uint8(l) - i++ - i += copy(dAtA[i:], s) + i += n } } if len(m.Gateways) > 0 { for _, msg := range m.Gateways { dAtA[i] = 0x1a i++ - i = encodeVarintMesh(dAtA, i, uint64(msg.Size())) + i = encodeVarintNetwork(dAtA, i, uint64(msg.Size())) n, err := msg.MarshalTo(dAtA[i:]) if err != nil { return 0, err @@ -248,6 +383,47 @@ func (m *Network) MarshalTo(dAtA []byte) (int, error) { return i, nil } +func (m *Network_NetworkEndpoints) Marshal() (dAtA []byte, err error) { + size := m.Size() + dAtA = make([]byte, size) + n, err := m.MarshalTo(dAtA) + if err != nil { + return nil, err + } + return dAtA[:n], nil +} + +func (m *Network_NetworkEndpoints) MarshalTo(dAtA []byte) (int, error) { + var i int + _ = i + var l int + _ = l + if m.Ne != nil { + nn1, err := m.Ne.MarshalTo(dAtA[i:]) + if err != nil { + return 0, err + } + i += nn1 + } + return i, nil +} + +func (m *Network_NetworkEndpoints_FromCidr) MarshalTo(dAtA []byte) (int, error) { + i := 0 + dAtA[i] = 0xa + i++ + i = encodeVarintNetwork(dAtA, i, uint64(len(m.FromCidr))) + i += copy(dAtA[i:], m.FromCidr) + return i, nil +} +func (m *Network_NetworkEndpoints_FromRegistry) MarshalTo(dAtA []byte) (int, error) { + i := 0 + dAtA[i] = 0x12 + i++ + i = encodeVarintNetwork(dAtA, i, uint64(len(m.FromRegistry))) + i += copy(dAtA[i:], m.FromRegistry) + return i, nil +} func (m *Network_IstioNetworkGateway) Marshal() (dAtA []byte, err error) { size := m.Size() dAtA = make([]byte, size) @@ -264,21 +440,21 @@ func (m *Network_IstioNetworkGateway) MarshalTo(dAtA []byte) (int, error) { var l int _ = l if m.Gw != nil { - nn1, err := m.Gw.MarshalTo(dAtA[i:]) + nn2, err := m.Gw.MarshalTo(dAtA[i:]) if err != nil { return 0, err } - i += nn1 + i += nn2 } if m.Port != 0 { dAtA[i] = 0x18 i++ - i = encodeVarintMesh(dAtA, i, uint64(m.Port)) + i = encodeVarintNetwork(dAtA, i, uint64(m.Port)) } if len(m.Locality) > 0 { dAtA[i] = 0x22 i++ - i = encodeVarintMesh(dAtA, i, uint64(len(m.Locality))) + i = encodeVarintNetwork(dAtA, i, uint64(len(m.Locality))) i += copy(dAtA[i:], m.Locality) } return i, nil @@ -288,7 +464,7 @@ func (m *Network_IstioNetworkGateway_RegistryServiceName) MarshalTo(dAtA []byte) i := 0 dAtA[i] = 0xa i++ - i = encodeVarintMesh(dAtA, i, uint64(len(m.RegistryServiceName))) + i = encodeVarintNetwork(dAtA, i, uint64(len(m.RegistryServiceName))) i += copy(dAtA[i:], m.RegistryServiceName) return i, nil } @@ -296,11 +472,11 @@ func (m *Network_IstioNetworkGateway_Address) MarshalTo(dAtA []byte) (int, error i := 0 dAtA[i] = 0x12 i++ - i = encodeVarintMesh(dAtA, i, uint64(len(m.Address))) + i = encodeVarintNetwork(dAtA, i, uint64(len(m.Address))) i += copy(dAtA[i:], m.Address) return i, nil } -func encodeVarintMesh(dAtA []byte, offset int, v uint64) int { +func encodeVarintNetwork(dAtA []byte, offset int, v uint64) int { for v >= 1<<7 { dAtA[offset] = uint8(v&0x7f | 0x80) v >>= 7 @@ -314,23 +490,46 @@ func (m *Network) Size() (n int) { _ = l l = len(m.Name) if l > 0 { - n += 1 + l + sovMesh(uint64(l)) + n += 1 + l + sovNetwork(uint64(l)) } - if len(m.Registries) > 0 { - for _, s := range m.Registries { - l = len(s) - n += 1 + l + sovMesh(uint64(l)) + if len(m.Endpoints) > 0 { + for _, e := range m.Endpoints { + l = e.Size() + n += 1 + l + sovNetwork(uint64(l)) } } if len(m.Gateways) > 0 { for _, e := range m.Gateways { l = e.Size() - n += 1 + l + sovMesh(uint64(l)) + n += 1 + l + sovNetwork(uint64(l)) } } return n } +func (m *Network_NetworkEndpoints) Size() (n int) { + var l int + _ = l + if m.Ne != nil { + n += m.Ne.Size() + } + return n +} + +func (m *Network_NetworkEndpoints_FromCidr) Size() (n int) { + var l int + _ = l + l = len(m.FromCidr) + n += 1 + l + sovNetwork(uint64(l)) + return n +} +func (m *Network_NetworkEndpoints_FromRegistry) Size() (n int) { + var l int + _ = l + l = len(m.FromRegistry) + n += 1 + l + sovNetwork(uint64(l)) + return n +} func (m *Network_IstioNetworkGateway) Size() (n int) { var l int _ = l @@ -338,11 +537,11 @@ func (m *Network_IstioNetworkGateway) Size() (n int) { n += m.Gw.Size() } if m.Port != 0 { - n += 1 + sovMesh(uint64(m.Port)) + n += 1 + sovNetwork(uint64(m.Port)) } l = len(m.Locality) if l > 0 { - n += 1 + l + sovMesh(uint64(l)) + n += 1 + l + sovNetwork(uint64(l)) } return n } @@ -351,18 +550,18 @@ func (m *Network_IstioNetworkGateway_RegistryServiceName) Size() (n int) { var l int _ = l l = len(m.RegistryServiceName) - n += 1 + l + sovMesh(uint64(l)) + n += 1 + l + sovNetwork(uint64(l)) return n } func (m *Network_IstioNetworkGateway_Address) Size() (n int) { var l int _ = l l = len(m.Address) - n += 1 + l + sovMesh(uint64(l)) + n += 1 + l + sovNetwork(uint64(l)) return n } -func sovMesh(x uint64) (n int) { +func sovNetwork(x uint64) (n int) { for { n++ x >>= 7 @@ -372,8 +571,8 @@ func sovMesh(x uint64) (n int) { } return n } -func sozMesh(x uint64) (n int) { - return sovMesh(uint64((x << 1) ^ uint64((int64(x) >> 63)))) +func sozNetwork(x uint64) (n int) { + return sovNetwork(uint64((x << 1) ^ uint64((int64(x) >> 63)))) } func (m *Network) Unmarshal(dAtA []byte) error { l := len(dAtA) @@ -383,7 +582,7 @@ func (m *Network) Unmarshal(dAtA []byte) error { var wire uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { - return ErrIntOverflowMesh + return ErrIntOverflowNetwork } if iNdEx >= l { return io.ErrUnexpectedEOF @@ -411,7 +610,7 @@ func (m *Network) Unmarshal(dAtA []byte) error { var stringLen uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { - return ErrIntOverflowMesh + return ErrIntOverflowNetwork } if iNdEx >= l { return io.ErrUnexpectedEOF @@ -425,7 +624,7 @@ func (m *Network) Unmarshal(dAtA []byte) error { } intStringLen := int(stringLen) if intStringLen < 0 { - return ErrInvalidLengthMesh + return ErrInvalidLengthNetwork } postIndex := iNdEx + intStringLen if postIndex > l { @@ -435,32 +634,34 @@ func (m *Network) Unmarshal(dAtA []byte) error { iNdEx = postIndex case 2: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Registries", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field Endpoints", wireType) } - var stringLen uint64 + var msglen int for shift := uint(0); ; shift += 7 { if shift >= 64 { - return ErrIntOverflowMesh + return ErrIntOverflowNetwork } if iNdEx >= l { return io.ErrUnexpectedEOF } b := dAtA[iNdEx] iNdEx++ - stringLen |= (uint64(b) & 0x7F) << shift + msglen |= (int(b) & 0x7F) << shift if b < 0x80 { break } } - intStringLen := int(stringLen) - if intStringLen < 0 { - return ErrInvalidLengthMesh + if msglen < 0 { + return ErrInvalidLengthNetwork } - postIndex := iNdEx + intStringLen + postIndex := iNdEx + msglen if postIndex > l { return io.ErrUnexpectedEOF } - m.Registries = append(m.Registries, string(dAtA[iNdEx:postIndex])) + m.Endpoints = append(m.Endpoints, &Network_NetworkEndpoints{}) + if err := m.Endpoints[len(m.Endpoints)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { + return err + } iNdEx = postIndex case 3: if wireType != 2 { @@ -469,7 +670,7 @@ func (m *Network) Unmarshal(dAtA []byte) error { var msglen int for shift := uint(0); ; shift += 7 { if shift >= 64 { - return ErrIntOverflowMesh + return ErrIntOverflowNetwork } if iNdEx >= l { return io.ErrUnexpectedEOF @@ -482,7 +683,7 @@ func (m *Network) Unmarshal(dAtA []byte) error { } } if msglen < 0 { - return ErrInvalidLengthMesh + return ErrInvalidLengthNetwork } postIndex := iNdEx + msglen if postIndex > l { @@ -495,12 +696,120 @@ func (m *Network) Unmarshal(dAtA []byte) error { iNdEx = postIndex default: iNdEx = preIndex - skippy, err := skipMesh(dAtA[iNdEx:]) + skippy, err := skipNetwork(dAtA[iNdEx:]) + if err != nil { + return err + } + if skippy < 0 { + return ErrInvalidLengthNetwork + } + if (iNdEx + skippy) > l { + return io.ErrUnexpectedEOF + } + iNdEx += skippy + } + } + + if iNdEx > l { + return io.ErrUnexpectedEOF + } + return nil +} +func (m *Network_NetworkEndpoints) Unmarshal(dAtA []byte) error { + l := len(dAtA) + iNdEx := 0 + for iNdEx < l { + preIndex := iNdEx + var wire uint64 + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowNetwork + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + wire |= (uint64(b) & 0x7F) << shift + if b < 0x80 { + break + } + } + fieldNum := int32(wire >> 3) + wireType := int(wire & 0x7) + if wireType == 4 { + return fmt.Errorf("proto: NetworkEndpoints: wiretype end group for non-group") + } + if fieldNum <= 0 { + return fmt.Errorf("proto: NetworkEndpoints: illegal tag %d (wire type %d)", fieldNum, wire) + } + switch fieldNum { + case 1: + if wireType != 2 { + return fmt.Errorf("proto: wrong wireType = %d for field FromCidr", wireType) + } + var stringLen uint64 + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowNetwork + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + stringLen |= (uint64(b) & 0x7F) << shift + if b < 0x80 { + break + } + } + intStringLen := int(stringLen) + if intStringLen < 0 { + return ErrInvalidLengthNetwork + } + postIndex := iNdEx + intStringLen + if postIndex > l { + return io.ErrUnexpectedEOF + } + m.Ne = &Network_NetworkEndpoints_FromCidr{string(dAtA[iNdEx:postIndex])} + iNdEx = postIndex + case 2: + if wireType != 2 { + return fmt.Errorf("proto: wrong wireType = %d for field FromRegistry", wireType) + } + var stringLen uint64 + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowNetwork + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + stringLen |= (uint64(b) & 0x7F) << shift + if b < 0x80 { + break + } + } + intStringLen := int(stringLen) + if intStringLen < 0 { + return ErrInvalidLengthNetwork + } + postIndex := iNdEx + intStringLen + if postIndex > l { + return io.ErrUnexpectedEOF + } + m.Ne = &Network_NetworkEndpoints_FromRegistry{string(dAtA[iNdEx:postIndex])} + iNdEx = postIndex + default: + iNdEx = preIndex + skippy, err := skipNetwork(dAtA[iNdEx:]) if err != nil { return err } if skippy < 0 { - return ErrInvalidLengthMesh + return ErrInvalidLengthNetwork } if (iNdEx + skippy) > l { return io.ErrUnexpectedEOF @@ -522,7 +831,7 @@ func (m *Network_IstioNetworkGateway) Unmarshal(dAtA []byte) error { var wire uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { - return ErrIntOverflowMesh + return ErrIntOverflowNetwork } if iNdEx >= l { return io.ErrUnexpectedEOF @@ -550,7 +859,7 @@ func (m *Network_IstioNetworkGateway) Unmarshal(dAtA []byte) error { var stringLen uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { - return ErrIntOverflowMesh + return ErrIntOverflowNetwork } if iNdEx >= l { return io.ErrUnexpectedEOF @@ -564,7 +873,7 @@ func (m *Network_IstioNetworkGateway) Unmarshal(dAtA []byte) error { } intStringLen := int(stringLen) if intStringLen < 0 { - return ErrInvalidLengthMesh + return ErrInvalidLengthNetwork } postIndex := iNdEx + intStringLen if postIndex > l { @@ -579,7 +888,7 @@ func (m *Network_IstioNetworkGateway) Unmarshal(dAtA []byte) error { var stringLen uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { - return ErrIntOverflowMesh + return ErrIntOverflowNetwork } if iNdEx >= l { return io.ErrUnexpectedEOF @@ -593,7 +902,7 @@ func (m *Network_IstioNetworkGateway) Unmarshal(dAtA []byte) error { } intStringLen := int(stringLen) if intStringLen < 0 { - return ErrInvalidLengthMesh + return ErrInvalidLengthNetwork } postIndex := iNdEx + intStringLen if postIndex > l { @@ -608,7 +917,7 @@ func (m *Network_IstioNetworkGateway) Unmarshal(dAtA []byte) error { m.Port = 0 for shift := uint(0); ; shift += 7 { if shift >= 64 { - return ErrIntOverflowMesh + return ErrIntOverflowNetwork } if iNdEx >= l { return io.ErrUnexpectedEOF @@ -627,7 +936,7 @@ func (m *Network_IstioNetworkGateway) Unmarshal(dAtA []byte) error { var stringLen uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { - return ErrIntOverflowMesh + return ErrIntOverflowNetwork } if iNdEx >= l { return io.ErrUnexpectedEOF @@ -641,7 +950,7 @@ func (m *Network_IstioNetworkGateway) Unmarshal(dAtA []byte) error { } intStringLen := int(stringLen) if intStringLen < 0 { - return ErrInvalidLengthMesh + return ErrInvalidLengthNetwork } postIndex := iNdEx + intStringLen if postIndex > l { @@ -651,12 +960,12 @@ func (m *Network_IstioNetworkGateway) Unmarshal(dAtA []byte) error { iNdEx = postIndex default: iNdEx = preIndex - skippy, err := skipMesh(dAtA[iNdEx:]) + skippy, err := skipNetwork(dAtA[iNdEx:]) if err != nil { return err } if skippy < 0 { - return ErrInvalidLengthMesh + return ErrInvalidLengthNetwork } if (iNdEx + skippy) > l { return io.ErrUnexpectedEOF @@ -670,14 +979,14 @@ func (m *Network_IstioNetworkGateway) Unmarshal(dAtA []byte) error { } return nil } -func skipMesh(dAtA []byte) (n int, err error) { +func skipNetwork(dAtA []byte) (n int, err error) { l := len(dAtA) iNdEx := 0 for iNdEx < l { var wire uint64 for shift := uint(0); ; shift += 7 { if shift >= 64 { - return 0, ErrIntOverflowMesh + return 0, ErrIntOverflowNetwork } if iNdEx >= l { return 0, io.ErrUnexpectedEOF @@ -694,7 +1003,7 @@ func skipMesh(dAtA []byte) (n int, err error) { case 0: for shift := uint(0); ; shift += 7 { if shift >= 64 { - return 0, ErrIntOverflowMesh + return 0, ErrIntOverflowNetwork } if iNdEx >= l { return 0, io.ErrUnexpectedEOF @@ -712,7 +1021,7 @@ func skipMesh(dAtA []byte) (n int, err error) { var length int for shift := uint(0); ; shift += 7 { if shift >= 64 { - return 0, ErrIntOverflowMesh + return 0, ErrIntOverflowNetwork } if iNdEx >= l { return 0, io.ErrUnexpectedEOF @@ -726,7 +1035,7 @@ func skipMesh(dAtA []byte) (n int, err error) { } iNdEx += length if length < 0 { - return 0, ErrInvalidLengthMesh + return 0, ErrInvalidLengthNetwork } return iNdEx, nil case 3: @@ -735,7 +1044,7 @@ func skipMesh(dAtA []byte) (n int, err error) { var start int = iNdEx for shift := uint(0); ; shift += 7 { if shift >= 64 { - return 0, ErrIntOverflowMesh + return 0, ErrIntOverflowNetwork } if iNdEx >= l { return 0, io.ErrUnexpectedEOF @@ -751,7 +1060,7 @@ func skipMesh(dAtA []byte) (n int, err error) { if innerWireType == 4 { break } - next, err := skipMesh(dAtA[start:]) + next, err := skipNetwork(dAtA[start:]) if err != nil { return 0, err } @@ -771,30 +1080,33 @@ func skipMesh(dAtA []byte) (n int, err error) { } var ( - ErrInvalidLengthMesh = fmt.Errorf("proto: negative length found during unmarshaling") - ErrIntOverflowMesh = fmt.Errorf("proto: integer overflow") + ErrInvalidLengthNetwork = fmt.Errorf("proto: negative length found during unmarshaling") + ErrIntOverflowNetwork = fmt.Errorf("proto: integer overflow") ) -func init() { proto.RegisterFile("mesh/v1alpha1/mesh.proto", fileDescriptorMesh) } - -var fileDescriptorMesh = []byte{ - // 275 bytes of a gzipped FileDescriptorProto - 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x6c, 0x50, 0x31, 0x4e, 0xc3, 0x30, - 0x14, 0xc5, 0x49, 0x44, 0xdb, 0x8f, 0x58, 0x1c, 0x21, 0x59, 0x19, 0xa2, 0x88, 0x29, 0x93, 0x43, - 0x81, 0x13, 0x74, 0x01, 0x24, 0xd4, 0xc1, 0x6c, 0x2c, 0x95, 0x69, 0xad, 0xd4, 0x22, 0xc5, 0x91, - 0x6d, 0x35, 0xca, 0x61, 0x38, 0x01, 0x17, 0x61, 0xe4, 0x08, 0x28, 0x27, 0x41, 0x76, 0x92, 0x02, - 0x52, 0xb7, 0xff, 0xde, 0xfb, 0xf6, 0x7b, 0xff, 0x01, 0xd9, 0x09, 0xb3, 0x2d, 0xf6, 0x73, 0x5e, - 0xd5, 0x5b, 0x3e, 0x2f, 0x1c, 0xa2, 0xb5, 0x56, 0x56, 0xe1, 0x58, 0x1a, 0x2b, 0x15, 0xf5, 0xcc, - 0xa8, 0x5f, 0x7e, 0x04, 0x30, 0x59, 0x0a, 0xdb, 0x28, 0xfd, 0x8a, 0x31, 0x44, 0x6f, 0x7c, 0x27, - 0x08, 0xca, 0x50, 0x3e, 0x63, 0x7e, 0xc6, 0x29, 0x80, 0x16, 0xa5, 0x34, 0x56, 0x4b, 0x61, 0x48, - 0x90, 0x85, 0xf9, 0x8c, 0xfd, 0x61, 0xf0, 0x23, 0x4c, 0x4b, 0x6e, 0x45, 0xc3, 0x5b, 0x43, 0xc2, - 0x2c, 0xcc, 0xcf, 0xae, 0xaf, 0xe8, 0x11, 0x1f, 0x3a, 0x78, 0xd0, 0x07, 0xa7, 0x0d, 0xe0, 0xae, - 0x7f, 0xc8, 0x0e, 0x3f, 0x24, 0xef, 0x08, 0xe2, 0x23, 0x1b, 0xf8, 0x16, 0x2e, 0x06, 0xcf, 0x76, - 0x65, 0x84, 0xde, 0xcb, 0xb5, 0x58, 0xfd, 0x46, 0xbd, 0x3f, 0x61, 0xf1, 0x28, 0x3f, 0xf5, 0xea, - 0xd2, 0x65, 0x4f, 0x60, 0xc2, 0x37, 0x1b, 0x2d, 0x8c, 0x0b, 0xde, 0xef, 0x8d, 0x84, 0xbb, 0xb5, - 0x56, 0xda, 0x92, 0x30, 0x43, 0xf9, 0x39, 0xf3, 0x33, 0x4e, 0x60, 0x5a, 0xa9, 0x35, 0xaf, 0xa4, - 0x6d, 0x49, 0xe4, 0x3b, 0x38, 0xe0, 0x45, 0x04, 0x41, 0xd9, 0x2c, 0xf2, 0xcf, 0x2e, 0x45, 0x5f, - 0x5d, 0x8a, 0xbe, 0xbb, 0x14, 0x3d, 0x27, 0xfd, 0xa1, 0x52, 0x15, 0xbc, 0x96, 0xc5, 0xbf, 0xde, - 0x5f, 0x4e, 0x7d, 0xe7, 0x37, 0x3f, 0x01, 0x00, 0x00, 0xff, 0xff, 0xe2, 0x49, 0xb6, 0xd4, 0x8f, - 0x01, 0x00, 0x00, +func init() { proto.RegisterFile("mesh/v1alpha1/network.proto", fileDescriptorNetwork) } + +var fileDescriptorNetwork = []byte{ + // 334 bytes of a gzipped FileDescriptorProto + 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x7c, 0x52, 0xdd, 0x4a, 0xf3, 0x30, + 0x18, 0x5e, 0xd6, 0xf1, 0x6d, 0x7b, 0x3f, 0x07, 0x92, 0x21, 0x84, 0x8a, 0x63, 0x08, 0x42, 0x4f, + 0x6c, 0x9d, 0x7a, 0x05, 0x13, 0x71, 0xa2, 0xec, 0x20, 0x9e, 0x79, 0xe0, 0x88, 0x6b, 0xdc, 0x82, + 0x5b, 0x53, 0x92, 0xb0, 0xb1, 0x8b, 0xf1, 0x3e, 0xbc, 0x04, 0x0f, 0xbd, 0x04, 0xd9, 0x95, 0x48, + 0xd2, 0x66, 0x43, 0x19, 0x1e, 0x35, 0x79, 0xfe, 0x92, 0x3e, 0x79, 0xe1, 0x70, 0xce, 0xf5, 0x34, + 0x59, 0xf4, 0xd8, 0x2c, 0x9f, 0xb2, 0x5e, 0x92, 0x71, 0xb3, 0x94, 0xea, 0x35, 0xce, 0x95, 0x34, + 0x12, 0xb7, 0x85, 0x36, 0x42, 0xc6, 0x56, 0x12, 0x7b, 0xc9, 0xf1, 0x7b, 0x00, 0xf5, 0x61, 0x21, + 0xc3, 0x18, 0x6a, 0x19, 0x9b, 0x73, 0x82, 0xba, 0x28, 0x6a, 0x52, 0xb7, 0xc6, 0x77, 0xd0, 0xe4, + 0x59, 0x9a, 0x4b, 0x91, 0x19, 0x4d, 0xaa, 0xdd, 0x20, 0xfa, 0x7f, 0x7e, 0x1a, 0xef, 0x08, 0x8a, + 0xcb, 0x10, 0xff, 0xbd, 0xf6, 0x26, 0xba, 0xf5, 0xe3, 0x7b, 0x68, 0x4c, 0x98, 0xe1, 0x4b, 0xb6, + 0xd2, 0x24, 0x70, 0x59, 0x67, 0x7f, 0x66, 0xdd, 0x5a, 0xae, 0xdc, 0xdc, 0x14, 0x46, 0xba, 0x49, + 0x08, 0x9f, 0x60, 0xff, 0xf7, 0x61, 0xf8, 0x08, 0x9a, 0x2f, 0x4a, 0xce, 0x47, 0x63, 0x91, 0xaa, + 0xe2, 0x3f, 0x06, 0x15, 0xda, 0xb0, 0xd0, 0x95, 0x48, 0x15, 0x3e, 0x81, 0x96, 0xa3, 0x15, 0x9f, + 0x08, 0x6d, 0xd4, 0x8a, 0x54, 0x4b, 0xc9, 0x9e, 0x85, 0x69, 0x89, 0xf6, 0x6b, 0x50, 0xcd, 0x78, + 0xf8, 0x86, 0xa0, 0xbd, 0xe3, 0x06, 0xf8, 0x12, 0x0e, 0xbc, 0x7f, 0xa4, 0xb9, 0x5a, 0x88, 0x31, + 0x1f, 0x6d, 0x7b, 0x1b, 0x54, 0x68, 0xdb, 0xd3, 0x0f, 0x05, 0x3b, 0xb4, 0x45, 0x86, 0x50, 0x67, + 0x69, 0xaa, 0xb8, 0xd6, 0x9b, 0x43, 0x3d, 0x60, 0x8b, 0xcf, 0xa5, 0x32, 0x24, 0xe8, 0xa2, 0xa8, + 0x45, 0xdd, 0x1a, 0x87, 0xd0, 0x98, 0xc9, 0x31, 0x9b, 0x09, 0xb3, 0x22, 0x35, 0xf7, 0x20, 0x9b, + 0xbd, 0xbd, 0xdf, 0x64, 0xd9, 0x8f, 0x3e, 0xd6, 0x1d, 0xf4, 0xb9, 0xee, 0xa0, 0xaf, 0x75, 0x07, + 0x3d, 0x86, 0x45, 0x91, 0x42, 0x26, 0x2c, 0x17, 0xc9, 0x8f, 0x39, 0x78, 0xfe, 0xe7, 0x06, 0xe0, + 0xe2, 0x3b, 0x00, 0x00, 0xff, 0xff, 0xf8, 0x20, 0x95, 0x94, 0x1f, 0x02, 0x00, 0x00, } diff --git a/mesh/v1alpha1/mesh.proto b/mesh/v1alpha1/network.proto similarity index 56% rename from mesh/v1alpha1/mesh.proto rename to mesh/v1alpha1/network.proto index 48e6730808..8fb6941f31 100644 --- a/mesh/v1alpha1/mesh.proto +++ b/mesh/v1alpha1/network.proto @@ -27,10 +27,44 @@ message Network { // A unique name assigned to the network. string name = 1; - // One or more service registries that are in this network. Endpoints - // from these registries will be directly reachable to one another. - // The names of the registries should correspond to the data sources. - repeated string registries = 2; + // NetworkEndpoints describes how the network associated with an endpoint + // should be inferred. An endpoint will be assigned to a network based on + // the following rules: + // + // 1. Implicitly: If the registry explicitly provides information about + // the network to which the endpoint belongs to. In some cases, its + // possible to indicate the network associated with the endpoint by + // adding ISTIO_META_NETWORK environment variable to the sidecar. + // + // 2. Explicitly: + // + // a. By matching the registry name with one of the "from_registries" + // in the mesh config. A "from_registry" can only be assinged to a + // single network. + // + // b. By matching the IP against one of the CIDR ranges in a mesh + // config network. The CIDR ranges must not overlap and be assigned to + // a single network. + // + // (2) will override (1) if both are present. + message NetworkEndpoints { + oneof ne { + // A CIDR range for the set of endpoints in this network. The CIDR + // ranges for endpoints from different networks must not overlap. + string from_cidr = 1; + + // Add all endpoints from the specified registry into this network. + // The names of the registries should correspond to the secret name + // that was used to configure the registry (kubernetes multicluster) or + // supplied by MCP server. + string from_registry = 2; + } + } + + // The list of endpoints in the network (obtained through the constituent + // service registries or from CIDR ranges). All endpoints in the network + // are directly accessible to one another. + repeated NetworkEndpoints endpoints = 2; // The gateway associated with this network. Traffic from remote networks // will arrive at the specified gateway:port. All incoming traffic must diff --git a/python/istio_api/mesh/v1alpha1/mesh_pb2.py b/python/istio_api/mesh/v1alpha1/network_pb2.py similarity index 60% rename from python/istio_api/mesh/v1alpha1/mesh_pb2.py rename to python/istio_api/mesh/v1alpha1/network_pb2.py index ab1d238ba7..65040c2a26 100644 --- a/python/istio_api/mesh/v1alpha1/mesh_pb2.py +++ b/python/istio_api/mesh/v1alpha1/network_pb2.py @@ -1,5 +1,5 @@ # Generated by the protocol buffer compiler. DO NOT EDIT! -# source: mesh/v1alpha1/mesh.proto +# source: mesh/v1alpha1/network.proto import sys _b=sys.version_info[0]<3 and (lambda x:x) or (lambda x:x.encode('latin1')) @@ -16,15 +16,55 @@ DESCRIPTOR = _descriptor.FileDescriptor( - name='mesh/v1alpha1/mesh.proto', + name='mesh/v1alpha1/network.proto', package='istio.mesh.v1alpha1', syntax='proto3', - serialized_pb=_b('\n\x18mesh/v1alpha1/mesh.proto\x12\x13istio.mesh.v1alpha1\"\xe0\x01\n\x07Network\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\nregistries\x18\x02 \x03(\t\x12\x42\n\x08gateways\x18\x03 \x03(\x0b\x32\x30.istio.mesh.v1alpha1.Network.IstioNetworkGateway\x1ao\n\x13IstioNetworkGateway\x12\x1f\n\x15registry_service_name\x18\x01 \x01(\tH\x00\x12\x11\n\x07\x61\x64\x64ress\x18\x02 \x01(\tH\x00\x12\x0c\n\x04port\x18\x03 \x01(\r\x12\x10\n\x08locality\x18\x04 \x01(\tB\x04\n\x02gwB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3') + serialized_pb=_b('\n\x1bmesh/v1alpha1/network.proto\x12\x13istio.mesh.v1alpha1\"\xd6\x02\n\x07Network\x12\x0c\n\x04name\x18\x01 \x01(\t\x12@\n\tendpoints\x18\x02 \x03(\x0b\x32-.istio.mesh.v1alpha1.Network.NetworkEndpoints\x12\x42\n\x08gateways\x18\x03 \x03(\x0b\x32\x30.istio.mesh.v1alpha1.Network.IstioNetworkGateway\x1a\x46\n\x10NetworkEndpoints\x12\x13\n\tfrom_cidr\x18\x01 \x01(\tH\x00\x12\x17\n\rfrom_registry\x18\x02 \x01(\tH\x00\x42\x04\n\x02ne\x1ao\n\x13IstioNetworkGateway\x12\x1f\n\x15registry_service_name\x18\x01 \x01(\tH\x00\x12\x11\n\x07\x61\x64\x64ress\x18\x02 \x01(\tH\x00\x12\x0c\n\x04port\x18\x03 \x01(\r\x12\x10\n\x08locality\x18\x04 \x01(\tB\x04\n\x02gwB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3') ) +_NETWORK_NETWORKENDPOINTS = _descriptor.Descriptor( + name='NetworkEndpoints', + full_name='istio.mesh.v1alpha1.Network.NetworkEndpoints', + filename=None, + file=DESCRIPTOR, + containing_type=None, + fields=[ + _descriptor.FieldDescriptor( + name='from_cidr', full_name='istio.mesh.v1alpha1.Network.NetworkEndpoints.from_cidr', index=0, + number=1, type=9, cpp_type=9, label=1, + has_default_value=False, default_value=_b("").decode('utf-8'), + message_type=None, enum_type=None, containing_type=None, + is_extension=False, extension_scope=None, + options=None, file=DESCRIPTOR), + _descriptor.FieldDescriptor( + name='from_registry', full_name='istio.mesh.v1alpha1.Network.NetworkEndpoints.from_registry', index=1, + number=2, type=9, cpp_type=9, label=1, + has_default_value=False, default_value=_b("").decode('utf-8'), + message_type=None, enum_type=None, containing_type=None, + is_extension=False, extension_scope=None, + options=None, file=DESCRIPTOR), + ], + extensions=[ + ], + nested_types=[], + enum_types=[ + ], + options=None, + is_extendable=False, + syntax='proto3', + extension_ranges=[], + oneofs=[ + _descriptor.OneofDescriptor( + name='ne', full_name='istio.mesh.v1alpha1.Network.NetworkEndpoints.ne', + index=0, containing_type=None, fields=[]), + ], + serialized_start=212, + serialized_end=282, +) + _NETWORK_ISTIONETWORKGATEWAY = _descriptor.Descriptor( name='IstioNetworkGateway', full_name='istio.mesh.v1alpha1.Network.IstioNetworkGateway', @@ -75,8 +115,8 @@ name='gw', full_name='istio.mesh.v1alpha1.Network.IstioNetworkGateway.gw', index=0, containing_type=None, fields=[]), ], - serialized_start=163, - serialized_end=274, + serialized_start=284, + serialized_end=395, ) _NETWORK = _descriptor.Descriptor( @@ -94,8 +134,8 @@ is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='registries', full_name='istio.mesh.v1alpha1.Network.registries', index=1, - number=2, type=9, cpp_type=9, label=3, + name='endpoints', full_name='istio.mesh.v1alpha1.Network.endpoints', index=1, + number=2, type=11, cpp_type=10, label=3, has_default_value=False, default_value=[], message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, @@ -110,7 +150,7 @@ ], extensions=[ ], - nested_types=[_NETWORK_ISTIONETWORKGATEWAY, ], + nested_types=[_NETWORK_NETWORKENDPOINTS, _NETWORK_ISTIONETWORKGATEWAY, ], enum_types=[ ], options=None, @@ -119,10 +159,17 @@ extension_ranges=[], oneofs=[ ], - serialized_start=50, - serialized_end=274, + serialized_start=53, + serialized_end=395, ) +_NETWORK_NETWORKENDPOINTS.containing_type = _NETWORK +_NETWORK_NETWORKENDPOINTS.oneofs_by_name['ne'].fields.append( + _NETWORK_NETWORKENDPOINTS.fields_by_name['from_cidr']) +_NETWORK_NETWORKENDPOINTS.fields_by_name['from_cidr'].containing_oneof = _NETWORK_NETWORKENDPOINTS.oneofs_by_name['ne'] +_NETWORK_NETWORKENDPOINTS.oneofs_by_name['ne'].fields.append( + _NETWORK_NETWORKENDPOINTS.fields_by_name['from_registry']) +_NETWORK_NETWORKENDPOINTS.fields_by_name['from_registry'].containing_oneof = _NETWORK_NETWORKENDPOINTS.oneofs_by_name['ne'] _NETWORK_ISTIONETWORKGATEWAY.containing_type = _NETWORK _NETWORK_ISTIONETWORKGATEWAY.oneofs_by_name['gw'].fields.append( _NETWORK_ISTIONETWORKGATEWAY.fields_by_name['registry_service_name']) @@ -130,23 +177,32 @@ _NETWORK_ISTIONETWORKGATEWAY.oneofs_by_name['gw'].fields.append( _NETWORK_ISTIONETWORKGATEWAY.fields_by_name['address']) _NETWORK_ISTIONETWORKGATEWAY.fields_by_name['address'].containing_oneof = _NETWORK_ISTIONETWORKGATEWAY.oneofs_by_name['gw'] +_NETWORK.fields_by_name['endpoints'].message_type = _NETWORK_NETWORKENDPOINTS _NETWORK.fields_by_name['gateways'].message_type = _NETWORK_ISTIONETWORKGATEWAY DESCRIPTOR.message_types_by_name['Network'] = _NETWORK _sym_db.RegisterFileDescriptor(DESCRIPTOR) Network = _reflection.GeneratedProtocolMessageType('Network', (_message.Message,), dict( + NetworkEndpoints = _reflection.GeneratedProtocolMessageType('NetworkEndpoints', (_message.Message,), dict( + DESCRIPTOR = _NETWORK_NETWORKENDPOINTS, + __module__ = 'mesh.v1alpha1.network_pb2' + # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.Network.NetworkEndpoints) + )) + , + IstioNetworkGateway = _reflection.GeneratedProtocolMessageType('IstioNetworkGateway', (_message.Message,), dict( DESCRIPTOR = _NETWORK_ISTIONETWORKGATEWAY, - __module__ = 'mesh.v1alpha1.mesh_pb2' + __module__ = 'mesh.v1alpha1.network_pb2' # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.Network.IstioNetworkGateway) )) , DESCRIPTOR = _NETWORK, - __module__ = 'mesh.v1alpha1.mesh_pb2' + __module__ = 'mesh.v1alpha1.network_pb2' # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.Network) )) _sym_db.RegisterMessage(Network) +_sym_db.RegisterMessage(Network.NetworkEndpoints) _sym_db.RegisterMessage(Network.IstioNetworkGateway) From 0b1e20cf240f80cb16c57740d01def60219bcff4 Mon Sep 17 00:00:00 2001 From: Yossi Mesika Date: Sun, 21 Oct 2018 17:57:43 +0300 Subject: [PATCH 2/5] Added MeshNetworks (#666) --- mesh/v1alpha1/config.pb.go | 1 + mesh/v1alpha1/istio.mesh.v1alpha1.pb.html | 58 ++- mesh/v1alpha1/network.pb.go | 380 ++++++++++++++---- mesh/v1alpha1/network.proto | 32 +- python/istio_api/mesh/v1alpha1/network_pb2.py | 110 ++++- 5 files changed, 471 insertions(+), 110 deletions(-) diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go index be14e91672..df48c35359 100644 --- a/mesh/v1alpha1/config.pb.go +++ b/mesh/v1alpha1/config.pb.go @@ -12,6 +12,7 @@ It has these top-level messages: MeshConfig Network + MeshNetworks Tracing ProxyConfig */ diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html index 4ac382f0bc..b91f5001c0 100644 --- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html +++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html @@ -4,7 +4,7 @@ generator: protoc-gen-docs aliases: - /docs/reference/config/service-mesh.html -number_of_entries: 11 +number_of_entries: 12 ---

AuthenticationPolicy

@@ -255,6 +255,44 @@

MeshConfig.IngressControllerMode

a secondary ingress controller (e.g., in addition to a cloud-provided ingress controller).

+ + + +
FieldTypeDescription
fromCidrstring (oneof) +

A CIDR range for the set of endpoints in this network. The CIDR +ranges for endpoints from different networks must not overlap.

+ +
fromRegistrystring (oneof) +

Add all endpoints from the specified registry into this network. +The names of the registries should correspond to the secret name +that was used to configure the registry (kubernetes multicluster) or +supplied by MCP server.

+
+
+

MeshNetworks

+
+

MeshNetworks (config map) provides information about the set of networks +inside a mesh and how to route to endpoints in each network. For example

+ +

MeshNetworks(file/config map): +networks: +- network1: + - endpoints: + - fromRegistry: registry1 #must match secret name in kubernetes + - fromCidr: 192.168.100.0/22 #a VM network for example + gateways: + - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local + port: 15443 + locality: us-east-1a

+ + + + + + + + + + + + + + @@ -277,21 +315,13 @@

Network

- - - - - @@ -299,6 +329,8 @@

Network

@@ -345,7 +377,7 @@

Network.IstioNetworkGateway

diff --git a/mesh/v1alpha1/network.pb.go b/mesh/v1alpha1/network.pb.go index 9ac144c577..05bafac843 100644 --- a/mesh/v1alpha1/network.pb.go +++ b/mesh/v1alpha1/network.pb.go @@ -20,13 +20,12 @@ var _ = math.Inf // endpoint. The endpoint locality will be obtained from the service // registry. type Network struct { - // A unique name assigned to the network. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // The list of endpoints in the network (obtained through the constituent - // service registries or from CIDR ranges). All endpoints in the network - // are directly accessible to one another. - Endpoints []*Network_NetworkEndpoints `protobuf:"bytes,2,rep,name=endpoints" json:"endpoints,omitempty"` - Gateways []*Network_IstioNetworkGateway `protobuf:"bytes,3,rep,name=gateways" json:"gateways,omitempty"` + // REQUIRED: The list of endpoints in the network (obtained through the + // constituent service registries or from CIDR ranges). All endpoints in + // the network are directly accessible to one another. + Endpoints []*Network_NetworkEndpoints `protobuf:"bytes,2,rep,name=endpoints" json:"endpoints,omitempty"` + // REQUIRED: Set of gateways associated with the network. + Gateways []*Network_IstioNetworkGateway `protobuf:"bytes,3,rep,name=gateways" json:"gateways,omitempty"` } func (m *Network) Reset() { *m = Network{} } @@ -34,13 +33,6 @@ func (m *Network) String() string { return proto.CompactTextString(m) func (*Network) ProtoMessage() {} func (*Network) Descriptor() ([]byte, []int) { return fileDescriptorNetwork, []int{0} } -func (m *Network) GetName() string { - if m != nil { - return m.Name - } - return "" -} - func (m *Network) GetEndpoints() []*Network_NetworkEndpoints { if m != nil { return m.Endpoints @@ -200,7 +192,7 @@ type Network_IstioNetworkGateway struct { // *Network_IstioNetworkGateway_RegistryServiceName // *Network_IstioNetworkGateway_Address Gw isNetwork_IstioNetworkGateway_Gw `protobuf_oneof:"gw"` - // The port associated with the gateway. + // REQUIRED: The port associated with the gateway. Port uint32 `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"` // The locality associated with an explicitly specified gateway (i.e. ip) Locality string `protobuf:"bytes,4,opt,name=locality,proto3" json:"locality,omitempty"` @@ -330,10 +322,43 @@ func _Network_IstioNetworkGateway_OneofSizer(msg proto.Message) (n int) { return n } +// MeshNetworks (config map) provides information about the set of networks +// inside a mesh and how to route to endpoints in each network. For example +// +// MeshNetworks(file/config map): +// networks: +// - network1: +// - endpoints: +// - fromRegistry: registry1 #must match secret name in kubernetes +// - fromCidr: 192.168.100.0/22 #a VM network for example +// gateways: +// - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local +// port: 15443 +// locality: us-east-1a +type MeshNetworks struct { + // REQUIRED: The set of networks inside this mesh. Each network should + // have a unique name and information about how to infer the endpoints in + // the network as well as the gateways associated with the network. + Networks map[string]*Network `protobuf:"bytes,1,rep,name=networks" json:"networks,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value"` +} + +func (m *MeshNetworks) Reset() { *m = MeshNetworks{} } +func (m *MeshNetworks) String() string { return proto.CompactTextString(m) } +func (*MeshNetworks) ProtoMessage() {} +func (*MeshNetworks) Descriptor() ([]byte, []int) { return fileDescriptorNetwork, []int{1} } + +func (m *MeshNetworks) GetNetworks() map[string]*Network { + if m != nil { + return m.Networks + } + return nil +} + func init() { proto.RegisterType((*Network)(nil), "istio.mesh.v1alpha1.Network") proto.RegisterType((*Network_NetworkEndpoints)(nil), "istio.mesh.v1alpha1.Network.NetworkEndpoints") proto.RegisterType((*Network_IstioNetworkGateway)(nil), "istio.mesh.v1alpha1.Network.IstioNetworkGateway") + proto.RegisterType((*MeshNetworks)(nil), "istio.mesh.v1alpha1.MeshNetworks") } func (m *Network) Marshal() (dAtA []byte, err error) { size := m.Size() @@ -350,12 +375,6 @@ func (m *Network) MarshalTo(dAtA []byte) (int, error) { _ = i var l int _ = l - if len(m.Name) > 0 { - dAtA[i] = 0xa - i++ - i = encodeVarintNetwork(dAtA, i, uint64(len(m.Name))) - i += copy(dAtA[i:], m.Name) - } if len(m.Endpoints) > 0 { for _, msg := range m.Endpoints { dAtA[i] = 0x12 @@ -476,6 +495,52 @@ func (m *Network_IstioNetworkGateway_Address) MarshalTo(dAtA []byte) (int, error i += copy(dAtA[i:], m.Address) return i, nil } +func (m *MeshNetworks) Marshal() (dAtA []byte, err error) { + size := m.Size() + dAtA = make([]byte, size) + n, err := m.MarshalTo(dAtA) + if err != nil { + return nil, err + } + return dAtA[:n], nil +} + +func (m *MeshNetworks) MarshalTo(dAtA []byte) (int, error) { + var i int + _ = i + var l int + _ = l + if len(m.Networks) > 0 { + for k, _ := range m.Networks { + dAtA[i] = 0xa + i++ + v := m.Networks[k] + msgSize := 0 + if v != nil { + msgSize = v.Size() + msgSize += 1 + sovNetwork(uint64(msgSize)) + } + mapSize := 1 + len(k) + sovNetwork(uint64(len(k))) + msgSize + i = encodeVarintNetwork(dAtA, i, uint64(mapSize)) + dAtA[i] = 0xa + i++ + i = encodeVarintNetwork(dAtA, i, uint64(len(k))) + i += copy(dAtA[i:], k) + if v != nil { + dAtA[i] = 0x12 + i++ + i = encodeVarintNetwork(dAtA, i, uint64(v.Size())) + n3, err := v.MarshalTo(dAtA[i:]) + if err != nil { + return 0, err + } + i += n3 + } + } + } + return i, nil +} + func encodeVarintNetwork(dAtA []byte, offset int, v uint64) int { for v >= 1<<7 { dAtA[offset] = uint8(v&0x7f | 0x80) @@ -488,10 +553,6 @@ func encodeVarintNetwork(dAtA []byte, offset int, v uint64) int { func (m *Network) Size() (n int) { var l int _ = l - l = len(m.Name) - if l > 0 { - n += 1 + l + sovNetwork(uint64(l)) - } if len(m.Endpoints) > 0 { for _, e := range m.Endpoints { l = e.Size() @@ -560,6 +621,24 @@ func (m *Network_IstioNetworkGateway_Address) Size() (n int) { n += 1 + l + sovNetwork(uint64(l)) return n } +func (m *MeshNetworks) Size() (n int) { + var l int + _ = l + if len(m.Networks) > 0 { + for k, v := range m.Networks { + _ = k + _ = v + l = 0 + if v != nil { + l = v.Size() + l += 1 + sovNetwork(uint64(l)) + } + mapEntrySize := 1 + len(k) + sovNetwork(uint64(len(k))) + l + n += mapEntrySize + 1 + sovNetwork(uint64(mapEntrySize)) + } + } + return n +} func sovNetwork(x uint64) (n int) { for { @@ -603,35 +682,6 @@ func (m *Network) Unmarshal(dAtA []byte) error { return fmt.Errorf("proto: Network: illegal tag %d (wire type %d)", fieldNum, wire) } switch fieldNum { - case 1: - if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType) - } - var stringLen uint64 - for shift := uint(0); ; shift += 7 { - if shift >= 64 { - return ErrIntOverflowNetwork - } - if iNdEx >= l { - return io.ErrUnexpectedEOF - } - b := dAtA[iNdEx] - iNdEx++ - stringLen |= (uint64(b) & 0x7F) << shift - if b < 0x80 { - break - } - } - intStringLen := int(stringLen) - if intStringLen < 0 { - return ErrInvalidLengthNetwork - } - postIndex := iNdEx + intStringLen - if postIndex > l { - return io.ErrUnexpectedEOF - } - m.Name = string(dAtA[iNdEx:postIndex]) - iNdEx = postIndex case 2: if wireType != 2 { return fmt.Errorf("proto: wrong wireType = %d for field Endpoints", wireType) @@ -979,6 +1029,179 @@ func (m *Network_IstioNetworkGateway) Unmarshal(dAtA []byte) error { } return nil } +func (m *MeshNetworks) Unmarshal(dAtA []byte) error { + l := len(dAtA) + iNdEx := 0 + for iNdEx < l { + preIndex := iNdEx + var wire uint64 + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowNetwork + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + wire |= (uint64(b) & 0x7F) << shift + if b < 0x80 { + break + } + } + fieldNum := int32(wire >> 3) + wireType := int(wire & 0x7) + if wireType == 4 { + return fmt.Errorf("proto: MeshNetworks: wiretype end group for non-group") + } + if fieldNum <= 0 { + return fmt.Errorf("proto: MeshNetworks: illegal tag %d (wire type %d)", fieldNum, wire) + } + switch fieldNum { + case 1: + if wireType != 2 { + return fmt.Errorf("proto: wrong wireType = %d for field Networks", wireType) + } + var msglen int + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowNetwork + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + msglen |= (int(b) & 0x7F) << shift + if b < 0x80 { + break + } + } + if msglen < 0 { + return ErrInvalidLengthNetwork + } + postIndex := iNdEx + msglen + if postIndex > l { + return io.ErrUnexpectedEOF + } + if m.Networks == nil { + m.Networks = make(map[string]*Network) + } + var mapkey string + var mapvalue *Network + for iNdEx < postIndex { + entryPreIndex := iNdEx + var wire uint64 + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowNetwork + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + wire |= (uint64(b) & 0x7F) << shift + if b < 0x80 { + break + } + } + fieldNum := int32(wire >> 3) + if fieldNum == 1 { + var stringLenmapkey uint64 + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowNetwork + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + stringLenmapkey |= (uint64(b) & 0x7F) << shift + if b < 0x80 { + break + } + } + intStringLenmapkey := int(stringLenmapkey) + if intStringLenmapkey < 0 { + return ErrInvalidLengthNetwork + } + postStringIndexmapkey := iNdEx + intStringLenmapkey + if postStringIndexmapkey > l { + return io.ErrUnexpectedEOF + } + mapkey = string(dAtA[iNdEx:postStringIndexmapkey]) + iNdEx = postStringIndexmapkey + } else if fieldNum == 2 { + var mapmsglen int + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowNetwork + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + mapmsglen |= (int(b) & 0x7F) << shift + if b < 0x80 { + break + } + } + if mapmsglen < 0 { + return ErrInvalidLengthNetwork + } + postmsgIndex := iNdEx + mapmsglen + if mapmsglen < 0 { + return ErrInvalidLengthNetwork + } + if postmsgIndex > l { + return io.ErrUnexpectedEOF + } + mapvalue = &Network{} + if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil { + return err + } + iNdEx = postmsgIndex + } else { + iNdEx = entryPreIndex + skippy, err := skipNetwork(dAtA[iNdEx:]) + if err != nil { + return err + } + if skippy < 0 { + return ErrInvalidLengthNetwork + } + if (iNdEx + skippy) > postIndex { + return io.ErrUnexpectedEOF + } + iNdEx += skippy + } + } + m.Networks[mapkey] = mapvalue + iNdEx = postIndex + default: + iNdEx = preIndex + skippy, err := skipNetwork(dAtA[iNdEx:]) + if err != nil { + return err + } + if skippy < 0 { + return ErrInvalidLengthNetwork + } + if (iNdEx + skippy) > l { + return io.ErrUnexpectedEOF + } + iNdEx += skippy + } + } + + if iNdEx > l { + return io.ErrUnexpectedEOF + } + return nil +} func skipNetwork(dAtA []byte) (n int, err error) { l := len(dAtA) iNdEx := 0 @@ -1087,26 +1310,31 @@ var ( func init() { proto.RegisterFile("mesh/v1alpha1/network.proto", fileDescriptorNetwork) } var fileDescriptorNetwork = []byte{ - // 334 bytes of a gzipped FileDescriptorProto - 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x7c, 0x52, 0xdd, 0x4a, 0xf3, 0x30, - 0x18, 0x5e, 0xd6, 0xf1, 0x6d, 0x7b, 0x3f, 0x07, 0x92, 0x21, 0x84, 0x8a, 0x63, 0x08, 0x42, 0x4f, - 0x6c, 0x9d, 0x7a, 0x05, 0x13, 0x71, 0xa2, 0xec, 0x20, 0x9e, 0x79, 0xe0, 0x88, 0x6b, 0xdc, 0x82, - 0x5b, 0x53, 0x92, 0xb0, 0xb1, 0x8b, 0xf1, 0x3e, 0xbc, 0x04, 0x0f, 0xbd, 0x04, 0xd9, 0x95, 0x48, - 0xd2, 0x66, 0x43, 0x19, 0x1e, 0x35, 0x79, 0xfe, 0x92, 0x3e, 0x79, 0xe1, 0x70, 0xce, 0xf5, 0x34, - 0x59, 0xf4, 0xd8, 0x2c, 0x9f, 0xb2, 0x5e, 0x92, 0x71, 0xb3, 0x94, 0xea, 0x35, 0xce, 0x95, 0x34, - 0x12, 0xb7, 0x85, 0x36, 0x42, 0xc6, 0x56, 0x12, 0x7b, 0xc9, 0xf1, 0x7b, 0x00, 0xf5, 0x61, 0x21, - 0xc3, 0x18, 0x6a, 0x19, 0x9b, 0x73, 0x82, 0xba, 0x28, 0x6a, 0x52, 0xb7, 0xc6, 0x77, 0xd0, 0xe4, - 0x59, 0x9a, 0x4b, 0x91, 0x19, 0x4d, 0xaa, 0xdd, 0x20, 0xfa, 0x7f, 0x7e, 0x1a, 0xef, 0x08, 0x8a, - 0xcb, 0x10, 0xff, 0xbd, 0xf6, 0x26, 0xba, 0xf5, 0xe3, 0x7b, 0x68, 0x4c, 0x98, 0xe1, 0x4b, 0xb6, - 0xd2, 0x24, 0x70, 0x59, 0x67, 0x7f, 0x66, 0xdd, 0x5a, 0xae, 0xdc, 0xdc, 0x14, 0x46, 0xba, 0x49, - 0x08, 0x9f, 0x60, 0xff, 0xf7, 0x61, 0xf8, 0x08, 0x9a, 0x2f, 0x4a, 0xce, 0x47, 0x63, 0x91, 0xaa, - 0xe2, 0x3f, 0x06, 0x15, 0xda, 0xb0, 0xd0, 0x95, 0x48, 0x15, 0x3e, 0x81, 0x96, 0xa3, 0x15, 0x9f, - 0x08, 0x6d, 0xd4, 0x8a, 0x54, 0x4b, 0xc9, 0x9e, 0x85, 0x69, 0x89, 0xf6, 0x6b, 0x50, 0xcd, 0x78, - 0xf8, 0x86, 0xa0, 0xbd, 0xe3, 0x06, 0xf8, 0x12, 0x0e, 0xbc, 0x7f, 0xa4, 0xb9, 0x5a, 0x88, 0x31, - 0x1f, 0x6d, 0x7b, 0x1b, 0x54, 0x68, 0xdb, 0xd3, 0x0f, 0x05, 0x3b, 0xb4, 0x45, 0x86, 0x50, 0x67, - 0x69, 0xaa, 0xb8, 0xd6, 0x9b, 0x43, 0x3d, 0x60, 0x8b, 0xcf, 0xa5, 0x32, 0x24, 0xe8, 0xa2, 0xa8, - 0x45, 0xdd, 0x1a, 0x87, 0xd0, 0x98, 0xc9, 0x31, 0x9b, 0x09, 0xb3, 0x22, 0x35, 0xf7, 0x20, 0x9b, - 0xbd, 0xbd, 0xdf, 0x64, 0xd9, 0x8f, 0x3e, 0xd6, 0x1d, 0xf4, 0xb9, 0xee, 0xa0, 0xaf, 0x75, 0x07, - 0x3d, 0x86, 0x45, 0x91, 0x42, 0x26, 0x2c, 0x17, 0xc9, 0x8f, 0x39, 0x78, 0xfe, 0xe7, 0x06, 0xe0, - 0xe2, 0x3b, 0x00, 0x00, 0xff, 0xff, 0xf8, 0x20, 0x95, 0x94, 0x1f, 0x02, 0x00, 0x00, + // 403 bytes of a gzipped FileDescriptorProto + 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x7c, 0x92, 0xcf, 0x8e, 0xda, 0x30, + 0x10, 0xc6, 0xeb, 0x84, 0x96, 0x30, 0x80, 0x84, 0x8c, 0x2a, 0x45, 0x69, 0x8b, 0x10, 0x52, 0xa5, + 0x5c, 0x9a, 0x14, 0xda, 0x43, 0xd5, 0x23, 0x15, 0x6a, 0x2b, 0x5a, 0x0e, 0xee, 0xa9, 0x3d, 0x14, + 0xb9, 0xc4, 0x05, 0x8b, 0x24, 0x8e, 0x6c, 0x2f, 0x28, 0x0f, 0xb3, 0xb7, 0x7d, 0x86, 0x7d, 0x86, + 0x3d, 0xee, 0x23, 0xac, 0x78, 0x92, 0x55, 0xfe, 0xee, 0xb2, 0x42, 0x9c, 0x6c, 0xcf, 0xf7, 0xfd, + 0x66, 0xc6, 0x63, 0xc3, 0xab, 0x88, 0xa9, 0x8d, 0xbf, 0x1b, 0xd3, 0x30, 0xd9, 0xd0, 0xb1, 0x1f, + 0x33, 0xbd, 0x17, 0x72, 0xeb, 0x25, 0x52, 0x68, 0x81, 0xfb, 0x5c, 0x69, 0x2e, 0xbc, 0xcc, 0xe2, + 0x55, 0x96, 0xd1, 0x95, 0x09, 0xcd, 0x45, 0x61, 0xc3, 0x73, 0x68, 0xb1, 0x38, 0x48, 0x04, 0x8f, + 0xb5, 0xb2, 0x8d, 0xa1, 0xe9, 0xb6, 0x27, 0xef, 0xbc, 0x13, 0x90, 0x57, 0x02, 0xd5, 0x3a, 0xab, + 0x20, 0xf2, 0xc0, 0xe3, 0x1f, 0x60, 0xad, 0xa9, 0x66, 0x7b, 0x9a, 0x2a, 0xdb, 0xcc, 0x73, 0xbd, + 0x3f, 0x9b, 0xeb, 0x7b, 0xa6, 0x95, 0x87, 0xaf, 0x05, 0x48, 0xea, 0x0c, 0xce, 0x5f, 0xe8, 0x3d, + 0x2d, 0x86, 0xdf, 0x40, 0xeb, 0xbf, 0x14, 0xd1, 0x72, 0xc5, 0x03, 0x69, 0xa3, 0x21, 0x72, 0x5b, + 0xdf, 0x9e, 0x11, 0x2b, 0x0b, 0x7d, 0xe1, 0x81, 0xc4, 0x6f, 0xa1, 0x9b, 0xcb, 0x92, 0xad, 0xb9, + 0xd2, 0x32, 0xb5, 0x8d, 0xd2, 0xd2, 0xc9, 0xc2, 0xa4, 0x8c, 0x4e, 0x1b, 0x60, 0xc4, 0xcc, 0xb9, + 0x44, 0xd0, 0x3f, 0xd1, 0x01, 0xfe, 0x08, 0x2f, 0x2b, 0x7e, 0xa9, 0x98, 0xdc, 0xf1, 0x15, 0x5b, + 0xc6, 0x34, 0x62, 0x75, 0xbd, 0x7e, 0x25, 0xff, 0x2a, 0xd4, 0x05, 0x8d, 0x18, 0x76, 0xa0, 0x49, + 0x83, 0x40, 0x32, 0xa5, 0xea, 0xa2, 0x55, 0x00, 0x63, 0x68, 0x24, 0x42, 0x6a, 0xdb, 0x1c, 0x22, + 0xb7, 0x4b, 0xf2, 0x3d, 0x76, 0xc0, 0x0a, 0xc5, 0x8a, 0x86, 0x5c, 0xa7, 0x76, 0x23, 0x03, 0x48, + 0x7d, 0xce, 0xfa, 0x5b, 0xef, 0x47, 0xd7, 0x08, 0x3a, 0x3f, 0x99, 0xda, 0x94, 0xed, 0x29, 0x3c, + 0x07, 0xab, 0x7c, 0x5d, 0x65, 0xa3, 0x7c, 0xbc, 0xfe, 0xc9, 0xf1, 0x3e, 0x86, 0xaa, 0x59, 0xab, + 0x59, 0xac, 0x65, 0x4a, 0xea, 0x04, 0xce, 0x6f, 0xe8, 0x1e, 0x49, 0xb8, 0x07, 0xe6, 0x96, 0xa5, + 0xc5, 0x25, 0x49, 0xb6, 0xc5, 0x13, 0x78, 0xbe, 0xa3, 0xe1, 0x05, 0xcb, 0x2f, 0xd4, 0x9e, 0xbc, + 0x3e, 0xf7, 0x96, 0xa4, 0xb0, 0x7e, 0x36, 0x3e, 0xa1, 0xa9, 0x7b, 0x73, 0x18, 0xa0, 0xdb, 0xc3, + 0x00, 0xdd, 0x1d, 0x06, 0xe8, 0x8f, 0x53, 0x50, 0x5c, 0xf8, 0x34, 0xe1, 0xfe, 0xd1, 0x67, 0xfd, + 0xf7, 0x22, 0xff, 0xa5, 0x1f, 0xee, 0x03, 0x00, 0x00, 0xff, 0xff, 0xbc, 0x70, 0x44, 0x24, 0xc4, + 0x02, 0x00, 0x00, } diff --git a/mesh/v1alpha1/network.proto b/mesh/v1alpha1/network.proto index 8fb6941f31..278fd033df 100644 --- a/mesh/v1alpha1/network.proto +++ b/mesh/v1alpha1/network.proto @@ -24,9 +24,6 @@ option go_package="istio.io/api/mesh/v1alpha1"; // endpoint. The endpoint locality will be obtained from the service // registry. message Network { - // A unique name assigned to the network. - string name = 1; - // NetworkEndpoints describes how the network associated with an endpoint // should be inferred. An endpoint will be assigned to a network based on // the following rules: @@ -61,9 +58,9 @@ message Network { } } - // The list of endpoints in the network (obtained through the constituent - // service registries or from CIDR ranges). All endpoints in the network - // are directly accessible to one another. + // REQUIRED: The list of endpoints in the network (obtained through the + // constituent service registries or from CIDR ranges). All endpoints in + // the network are directly accessible to one another. repeated NetworkEndpoints endpoints = 2; // The gateway associated with this network. Traffic from remote networks @@ -84,12 +81,33 @@ message Network { string address = 2; } - // The port associated with the gateway. + // REQUIRED: The port associated with the gateway. uint32 port = 3; // The locality associated with an explicitly specified gateway (i.e. ip) string locality = 4; } + // REQUIRED: Set of gateways associated with the network. repeated IstioNetworkGateway gateways = 3; } + +// MeshNetworks (config map) provides information about the set of networks +// inside a mesh and how to route to endpoints in each network. For example +// +// MeshNetworks(file/config map): +// networks: +// - network1: +// - endpoints: +// - fromRegistry: registry1 #must match secret name in kubernetes +// - fromCidr: 192.168.100.0/22 #a VM network for example +// gateways: +// - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local +// port: 15443 +// locality: us-east-1a +message MeshNetworks { + // REQUIRED: The set of networks inside this mesh. Each network should + // have a unique name and information about how to infer the endpoints in + // the network as well as the gateways associated with the network. + map networks = 1; +} \ No newline at end of file diff --git a/python/istio_api/mesh/v1alpha1/network_pb2.py b/python/istio_api/mesh/v1alpha1/network_pb2.py index 65040c2a26..b41c6bd91b 100644 --- a/python/istio_api/mesh/v1alpha1/network_pb2.py +++ b/python/istio_api/mesh/v1alpha1/network_pb2.py @@ -19,7 +19,7 @@ name='mesh/v1alpha1/network.proto', package='istio.mesh.v1alpha1', syntax='proto3', - serialized_pb=_b('\n\x1bmesh/v1alpha1/network.proto\x12\x13istio.mesh.v1alpha1\"\xd6\x02\n\x07Network\x12\x0c\n\x04name\x18\x01 \x01(\t\x12@\n\tendpoints\x18\x02 \x03(\x0b\x32-.istio.mesh.v1alpha1.Network.NetworkEndpoints\x12\x42\n\x08gateways\x18\x03 \x03(\x0b\x32\x30.istio.mesh.v1alpha1.Network.IstioNetworkGateway\x1a\x46\n\x10NetworkEndpoints\x12\x13\n\tfrom_cidr\x18\x01 \x01(\tH\x00\x12\x17\n\rfrom_registry\x18\x02 \x01(\tH\x00\x42\x04\n\x02ne\x1ao\n\x13IstioNetworkGateway\x12\x1f\n\x15registry_service_name\x18\x01 \x01(\tH\x00\x12\x11\n\x07\x61\x64\x64ress\x18\x02 \x01(\tH\x00\x12\x0c\n\x04port\x18\x03 \x01(\r\x12\x10\n\x08locality\x18\x04 \x01(\tB\x04\n\x02gwB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3') + serialized_pb=_b('\n\x1bmesh/v1alpha1/network.proto\x12\x13istio.mesh.v1alpha1\"\xc8\x02\n\x07Network\x12@\n\tendpoints\x18\x02 \x03(\x0b\x32-.istio.mesh.v1alpha1.Network.NetworkEndpoints\x12\x42\n\x08gateways\x18\x03 \x03(\x0b\x32\x30.istio.mesh.v1alpha1.Network.IstioNetworkGateway\x1a\x46\n\x10NetworkEndpoints\x12\x13\n\tfrom_cidr\x18\x01 \x01(\tH\x00\x12\x17\n\rfrom_registry\x18\x02 \x01(\tH\x00\x42\x04\n\x02ne\x1ao\n\x13IstioNetworkGateway\x12\x1f\n\x15registry_service_name\x18\x01 \x01(\tH\x00\x12\x11\n\x07\x61\x64\x64ress\x18\x02 \x01(\tH\x00\x12\x0c\n\x04port\x18\x03 \x01(\r\x12\x10\n\x08locality\x18\x04 \x01(\tB\x04\n\x02gw\"\xa0\x01\n\x0cMeshNetworks\x12\x41\n\x08networks\x18\x01 \x03(\x0b\x32/.istio.mesh.v1alpha1.MeshNetworks.NetworksEntry\x1aM\n\rNetworksEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12+\n\x05value\x18\x02 \x01(\x0b\x32\x1c.istio.mesh.v1alpha1.Network:\x02\x38\x01\x42\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3') ) @@ -61,8 +61,8 @@ name='ne', full_name='istio.mesh.v1alpha1.Network.NetworkEndpoints.ne', index=0, containing_type=None, fields=[]), ], - serialized_start=212, - serialized_end=282, + serialized_start=198, + serialized_end=268, ) _NETWORK_ISTIONETWORKGATEWAY = _descriptor.Descriptor( @@ -115,8 +115,8 @@ name='gw', full_name='istio.mesh.v1alpha1.Network.IstioNetworkGateway.gw', index=0, containing_type=None, fields=[]), ], - serialized_start=284, - serialized_end=395, + serialized_start=270, + serialized_end=381, ) _NETWORK = _descriptor.Descriptor( @@ -127,22 +127,83 @@ containing_type=None, fields=[ _descriptor.FieldDescriptor( - name='name', full_name='istio.mesh.v1alpha1.Network.name', index=0, + name='endpoints', full_name='istio.mesh.v1alpha1.Network.endpoints', index=0, + number=2, type=11, cpp_type=10, label=3, + has_default_value=False, default_value=[], + message_type=None, enum_type=None, containing_type=None, + is_extension=False, extension_scope=None, + options=None, file=DESCRIPTOR), + _descriptor.FieldDescriptor( + name='gateways', full_name='istio.mesh.v1alpha1.Network.gateways', index=1, + number=3, type=11, cpp_type=10, label=3, + has_default_value=False, default_value=[], + message_type=None, enum_type=None, containing_type=None, + is_extension=False, extension_scope=None, + options=None, file=DESCRIPTOR), + ], + extensions=[ + ], + nested_types=[_NETWORK_NETWORKENDPOINTS, _NETWORK_ISTIONETWORKGATEWAY, ], + enum_types=[ + ], + options=None, + is_extendable=False, + syntax='proto3', + extension_ranges=[], + oneofs=[ + ], + serialized_start=53, + serialized_end=381, +) + + +_MESHNETWORKS_NETWORKSENTRY = _descriptor.Descriptor( + name='NetworksEntry', + full_name='istio.mesh.v1alpha1.MeshNetworks.NetworksEntry', + filename=None, + file=DESCRIPTOR, + containing_type=None, + fields=[ + _descriptor.FieldDescriptor( + name='key', full_name='istio.mesh.v1alpha1.MeshNetworks.NetworksEntry.key', index=0, number=1, type=9, cpp_type=9, label=1, has_default_value=False, default_value=_b("").decode('utf-8'), message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='endpoints', full_name='istio.mesh.v1alpha1.Network.endpoints', index=1, - number=2, type=11, cpp_type=10, label=3, - has_default_value=False, default_value=[], + name='value', full_name='istio.mesh.v1alpha1.MeshNetworks.NetworksEntry.value', index=1, + number=2, type=11, cpp_type=10, label=1, + has_default_value=False, default_value=None, message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), + ], + extensions=[ + ], + nested_types=[], + enum_types=[ + ], + options=_descriptor._ParseOptions(descriptor_pb2.MessageOptions(), _b('8\001')), + is_extendable=False, + syntax='proto3', + extension_ranges=[], + oneofs=[ + ], + serialized_start=467, + serialized_end=544, +) + +_MESHNETWORKS = _descriptor.Descriptor( + name='MeshNetworks', + full_name='istio.mesh.v1alpha1.MeshNetworks', + filename=None, + file=DESCRIPTOR, + containing_type=None, + fields=[ _descriptor.FieldDescriptor( - name='gateways', full_name='istio.mesh.v1alpha1.Network.gateways', index=2, - number=3, type=11, cpp_type=10, label=3, + name='networks', full_name='istio.mesh.v1alpha1.MeshNetworks.networks', index=0, + number=1, type=11, cpp_type=10, label=3, has_default_value=False, default_value=[], message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, @@ -150,7 +211,7 @@ ], extensions=[ ], - nested_types=[_NETWORK_NETWORKENDPOINTS, _NETWORK_ISTIONETWORKGATEWAY, ], + nested_types=[_MESHNETWORKS_NETWORKSENTRY, ], enum_types=[ ], options=None, @@ -159,8 +220,8 @@ extension_ranges=[], oneofs=[ ], - serialized_start=53, - serialized_end=395, + serialized_start=384, + serialized_end=544, ) _NETWORK_NETWORKENDPOINTS.containing_type = _NETWORK @@ -179,7 +240,11 @@ _NETWORK_ISTIONETWORKGATEWAY.fields_by_name['address'].containing_oneof = _NETWORK_ISTIONETWORKGATEWAY.oneofs_by_name['gw'] _NETWORK.fields_by_name['endpoints'].message_type = _NETWORK_NETWORKENDPOINTS _NETWORK.fields_by_name['gateways'].message_type = _NETWORK_ISTIONETWORKGATEWAY +_MESHNETWORKS_NETWORKSENTRY.fields_by_name['value'].message_type = _NETWORK +_MESHNETWORKS_NETWORKSENTRY.containing_type = _MESHNETWORKS +_MESHNETWORKS.fields_by_name['networks'].message_type = _MESHNETWORKS_NETWORKSENTRY DESCRIPTOR.message_types_by_name['Network'] = _NETWORK +DESCRIPTOR.message_types_by_name['MeshNetworks'] = _MESHNETWORKS _sym_db.RegisterFileDescriptor(DESCRIPTOR) Network = _reflection.GeneratedProtocolMessageType('Network', (_message.Message,), dict( @@ -205,7 +270,24 @@ _sym_db.RegisterMessage(Network.NetworkEndpoints) _sym_db.RegisterMessage(Network.IstioNetworkGateway) +MeshNetworks = _reflection.GeneratedProtocolMessageType('MeshNetworks', (_message.Message,), dict( + + NetworksEntry = _reflection.GeneratedProtocolMessageType('NetworksEntry', (_message.Message,), dict( + DESCRIPTOR = _MESHNETWORKS_NETWORKSENTRY, + __module__ = 'mesh.v1alpha1.network_pb2' + # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.MeshNetworks.NetworksEntry) + )) + , + DESCRIPTOR = _MESHNETWORKS, + __module__ = 'mesh.v1alpha1.network_pb2' + # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.MeshNetworks) + )) +_sym_db.RegisterMessage(MeshNetworks) +_sym_db.RegisterMessage(MeshNetworks.NetworksEntry) + DESCRIPTOR.has_options = True DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z\032istio.io/api/mesh/v1alpha1')) +_MESHNETWORKS_NETWORKSENTRY.has_options = True +_MESHNETWORKS_NETWORKSENTRY._options = _descriptor._ParseOptions(descriptor_pb2.MessageOptions(), _b('8\001')) # @@protoc_insertion_point(module_scope) From e23ad3b761e5b62e87ddcfe63c627f49e896e03d Mon Sep 17 00:00:00 2001 From: Shriram Rajagopalan Date: Mon, 22 Oct 2018 18:23:40 -0400 Subject: [PATCH 3/5] MCP server configuration (#669) * MCP server configuration Signed-off-by: Shriram Rajagopalan * nits Signed-off-by: Shriram Rajagopalan --- mesh/v1alpha1/config.pb.go | 351 +++++++++++++++---- mesh/v1alpha1/config.proto | 22 +- mesh/v1alpha1/istio.mesh.v1alpha1.pb.html | 50 ++- python/istio_api/mesh/v1alpha1/config_pb2.py | 71 +++- 4 files changed, 407 insertions(+), 87 deletions(-) diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go index df48c35359..d80c94df7c 100644 --- a/mesh/v1alpha1/config.pb.go +++ b/mesh/v1alpha1/config.pb.go @@ -11,6 +11,7 @@ It has these top-level messages: MeshConfig + ConfigSource Network MeshNetworks Tracing @@ -22,6 +23,7 @@ import proto "github.com/gogo/protobuf/proto" import fmt "fmt" import math "math" import google_protobuf "github.com/gogo/protobuf/types" +import istio_networking_v1alpha31 "istio.io/api/networking/v1alpha3" import io "io" @@ -159,8 +161,10 @@ type MeshConfig struct { // Unix Domain Socket through which envoy communicates with NodeAgent SDS to get key/cert for mTLS. // Use secret-mount files instead of SDS if set to empty. SdsUdsPath string `protobuf:"bytes,20,opt,name=sds_uds_path,json=sdsUdsPath,proto3" json:"sds_uds_path,omitempty"` - // Address of the galley service exposing the Mesh Control Protocol (MCP). - GalleyAddress string `protobuf:"bytes,22,opt,name=galley_address,json=galleyAddress,proto3" json:"galley_address,omitempty"` + // ConfigSource describes a source of configuration data for networking + // rules, and other Istio configuration artifacts. Multiple data sources + // can be configured for a single control plane. + ConfigSources []*ConfigSource `protobuf:"bytes,22,rep,name=config_sources,json=configSources" json:"config_sources,omitempty"` // $hide_from_docs // This flag is used by secret discovery service(SDS). // If set to true(prerequisite: https://kubernetes.io/docs/concepts/storage/volumes/#projected), Istio will inject volumes mount @@ -286,11 +290,11 @@ func (m *MeshConfig) GetSdsUdsPath() string { return "" } -func (m *MeshConfig) GetGalleyAddress() string { +func (m *MeshConfig) GetConfigSources() []*ConfigSource { if m != nil { - return m.GalleyAddress + return m.ConfigSources } - return "" + return nil } func (m *MeshConfig) GetEnableSdsTokenMount() bool { @@ -300,8 +304,42 @@ func (m *MeshConfig) GetEnableSdsTokenMount() bool { return false } +// ConfigSource describes information about a configuration store inside a +// mesh. A single control plane instance can interact with one or more data +// sources. +type ConfigSource struct { + // Address of the server implementing the Istio Mesh Configuration + // protocol (MCP). Can be IP address or a fully qualified DNS name. + // Use file:/// to specify a file-based backend with absolute path to the directory. + Address string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"` + // Use the tls_settings to specify the tls mode to use. If the MCP server + // uses Istio MTLS and shares the root CA with Pilot, specify the TLS + // mode as ISTIO_MUTUAL. + TlsSettings *istio_networking_v1alpha31.TLSSettings `protobuf:"bytes,2,opt,name=tls_settings,json=tlsSettings" json:"tls_settings,omitempty"` +} + +func (m *ConfigSource) Reset() { *m = ConfigSource{} } +func (m *ConfigSource) String() string { return proto.CompactTextString(m) } +func (*ConfigSource) ProtoMessage() {} +func (*ConfigSource) Descriptor() ([]byte, []int) { return fileDescriptorConfig, []int{1} } + +func (m *ConfigSource) GetAddress() string { + if m != nil { + return m.Address + } + return "" +} + +func (m *ConfigSource) GetTlsSettings() *istio_networking_v1alpha31.TLSSettings { + if m != nil { + return m.TlsSettings + } + return nil +} + func init() { proto.RegisterType((*MeshConfig)(nil), "istio.mesh.v1alpha1.MeshConfig") + proto.RegisterType((*ConfigSource)(nil), "istio.mesh.v1alpha1.ConfigSource") proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_IngressControllerMode", MeshConfig_IngressControllerMode_name, MeshConfig_IngressControllerMode_value) proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_AuthPolicy", MeshConfig_AuthPolicy_name, MeshConfig_AuthPolicy_value) } @@ -430,13 +468,19 @@ func (m *MeshConfig) MarshalTo(dAtA []byte) (int, error) { i = encodeVarintConfig(dAtA, i, uint64(len(m.SdsUdsPath))) i += copy(dAtA[i:], m.SdsUdsPath) } - if len(m.GalleyAddress) > 0 { - dAtA[i] = 0xb2 - i++ - dAtA[i] = 0x1 - i++ - i = encodeVarintConfig(dAtA, i, uint64(len(m.GalleyAddress))) - i += copy(dAtA[i:], m.GalleyAddress) + if len(m.ConfigSources) > 0 { + for _, msg := range m.ConfigSources { + dAtA[i] = 0xb2 + i++ + dAtA[i] = 0x1 + i++ + i = encodeVarintConfig(dAtA, i, uint64(msg.Size())) + n, err := msg.MarshalTo(dAtA[i:]) + if err != nil { + return 0, err + } + i += n + } } if m.EnableSdsTokenMount { dAtA[i] = 0xb8 @@ -461,6 +505,40 @@ func (m *MeshConfig) MarshalTo(dAtA []byte) (int, error) { return i, nil } +func (m *ConfigSource) Marshal() (dAtA []byte, err error) { + size := m.Size() + dAtA = make([]byte, size) + n, err := m.MarshalTo(dAtA) + if err != nil { + return nil, err + } + return dAtA[:n], nil +} + +func (m *ConfigSource) MarshalTo(dAtA []byte) (int, error) { + var i int + _ = i + var l int + _ = l + if len(m.Address) > 0 { + dAtA[i] = 0xa + i++ + i = encodeVarintConfig(dAtA, i, uint64(len(m.Address))) + i += copy(dAtA[i:], m.Address) + } + if m.TlsSettings != nil { + dAtA[i] = 0x12 + i++ + i = encodeVarintConfig(dAtA, i, uint64(m.TlsSettings.Size())) + n3, err := m.TlsSettings.MarshalTo(dAtA[i:]) + if err != nil { + return 0, err + } + i += n3 + } + return i, nil +} + func encodeVarintConfig(dAtA []byte, offset int, v uint64) int { for v >= 1<<7 { dAtA[offset] = uint8(v&0x7f | 0x80) @@ -526,9 +604,11 @@ func (m *MeshConfig) Size() (n int) { if l > 0 { n += 2 + l + sovConfig(uint64(l)) } - l = len(m.GalleyAddress) - if l > 0 { - n += 2 + l + sovConfig(uint64(l)) + if len(m.ConfigSources) > 0 { + for _, e := range m.ConfigSources { + l = e.Size() + n += 2 + l + sovConfig(uint64(l)) + } } if m.EnableSdsTokenMount { n += 3 @@ -540,6 +620,20 @@ func (m *MeshConfig) Size() (n int) { return n } +func (m *ConfigSource) Size() (n int) { + var l int + _ = l + l = len(m.Address) + if l > 0 { + n += 1 + l + sovConfig(uint64(l)) + } + if m.TlsSettings != nil { + l = m.TlsSettings.Size() + n += 1 + l + sovConfig(uint64(l)) + } + return n +} + func sovConfig(x uint64) (n int) { for { n++ @@ -960,9 +1054,9 @@ func (m *MeshConfig) Unmarshal(dAtA []byte) error { iNdEx = postIndex case 22: if wireType != 2 { - return fmt.Errorf("proto: wrong wireType = %d for field GalleyAddress", wireType) + return fmt.Errorf("proto: wrong wireType = %d for field ConfigSources", wireType) } - var stringLen uint64 + var msglen int for shift := uint(0); ; shift += 7 { if shift >= 64 { return ErrIntOverflowConfig @@ -972,20 +1066,22 @@ func (m *MeshConfig) Unmarshal(dAtA []byte) error { } b := dAtA[iNdEx] iNdEx++ - stringLen |= (uint64(b) & 0x7F) << shift + msglen |= (int(b) & 0x7F) << shift if b < 0x80 { break } } - intStringLen := int(stringLen) - if intStringLen < 0 { + if msglen < 0 { return ErrInvalidLengthConfig } - postIndex := iNdEx + intStringLen + postIndex := iNdEx + msglen if postIndex > l { return io.ErrUnexpectedEOF } - m.GalleyAddress = string(dAtA[iNdEx:postIndex]) + m.ConfigSources = append(m.ConfigSources, &ConfigSource{}) + if err := m.ConfigSources[len(m.ConfigSources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil { + return err + } iNdEx = postIndex case 23: if wireType != 0 { @@ -1057,6 +1153,118 @@ func (m *MeshConfig) Unmarshal(dAtA []byte) error { } return nil } +func (m *ConfigSource) Unmarshal(dAtA []byte) error { + l := len(dAtA) + iNdEx := 0 + for iNdEx < l { + preIndex := iNdEx + var wire uint64 + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowConfig + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + wire |= (uint64(b) & 0x7F) << shift + if b < 0x80 { + break + } + } + fieldNum := int32(wire >> 3) + wireType := int(wire & 0x7) + if wireType == 4 { + return fmt.Errorf("proto: ConfigSource: wiretype end group for non-group") + } + if fieldNum <= 0 { + return fmt.Errorf("proto: ConfigSource: illegal tag %d (wire type %d)", fieldNum, wire) + } + switch fieldNum { + case 1: + if wireType != 2 { + return fmt.Errorf("proto: wrong wireType = %d for field Address", wireType) + } + var stringLen uint64 + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowConfig + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + stringLen |= (uint64(b) & 0x7F) << shift + if b < 0x80 { + break + } + } + intStringLen := int(stringLen) + if intStringLen < 0 { + return ErrInvalidLengthConfig + } + postIndex := iNdEx + intStringLen + if postIndex > l { + return io.ErrUnexpectedEOF + } + m.Address = string(dAtA[iNdEx:postIndex]) + iNdEx = postIndex + case 2: + if wireType != 2 { + return fmt.Errorf("proto: wrong wireType = %d for field TlsSettings", wireType) + } + var msglen int + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowConfig + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + msglen |= (int(b) & 0x7F) << shift + if b < 0x80 { + break + } + } + if msglen < 0 { + return ErrInvalidLengthConfig + } + postIndex := iNdEx + msglen + if postIndex > l { + return io.ErrUnexpectedEOF + } + if m.TlsSettings == nil { + m.TlsSettings = &istio_networking_v1alpha31.TLSSettings{} + } + if err := m.TlsSettings.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { + return err + } + iNdEx = postIndex + default: + iNdEx = preIndex + skippy, err := skipConfig(dAtA[iNdEx:]) + if err != nil { + return err + } + if skippy < 0 { + return ErrInvalidLengthConfig + } + if (iNdEx + skippy) > l { + return io.ErrUnexpectedEOF + } + iNdEx += skippy + } + } + + if iNdEx > l { + return io.ErrUnexpectedEOF + } + return nil +} func skipConfig(dAtA []byte) (n int, err error) { l := len(dAtA) iNdEx := 0 @@ -1165,51 +1373,56 @@ var ( func init() { proto.RegisterFile("mesh/v1alpha1/config.proto", fileDescriptorConfig) } var fileDescriptorConfig = []byte{ - // 723 bytes of a gzipped FileDescriptorProto - 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x84, 0x54, 0xdd, 0x4e, 0xfb, 0x36, - 0x1c, 0xfd, 0x07, 0x02, 0x04, 0xf7, 0x2b, 0x75, 0x57, 0x30, 0x9d, 0xd4, 0x55, 0x4c, 0x63, 0x15, - 0x9a, 0x52, 0x01, 0xda, 0xc5, 0x2e, 0x4b, 0xa1, 0x1b, 0x55, 0x0b, 0x55, 0x9a, 0xde, 0xec, 0xc6, - 0x32, 0x89, 0x9b, 0x58, 0xa4, 0x71, 0x14, 0x3b, 0x08, 0xde, 0x70, 0x97, 0x93, 0xf6, 0x02, 0x13, - 0x4f, 0x32, 0xc5, 0x4e, 0xf9, 0x90, 0x2a, 0xed, 0x32, 0xe7, 0x9c, 0xdf, 0xe7, 0xf9, 0x39, 0xa0, - 0xb3, 0xa6, 0x22, 0x1a, 0x3c, 0x5f, 0x90, 0x38, 0x8d, 0xc8, 0xc5, 0xc0, 0xe7, 0xc9, 0x8a, 0x85, - 0x4e, 0x9a, 0x71, 0xc9, 0x61, 0x8b, 0x09, 0xc9, 0xb8, 0x53, 0x28, 0x9c, 0x8d, 0xa2, 0xd3, 0x0d, - 0x39, 0x0f, 0x63, 0x3a, 0x50, 0x92, 0xc7, 0x7c, 0x35, 0x08, 0xf2, 0x8c, 0x48, 0xc6, 0x13, 0x1d, - 0xd4, 0x39, 0xf9, 0x9a, 0x30, 0xcd, 0xf8, 0xcb, 0xab, 0xa6, 0x4e, 0xff, 0xb1, 0x00, 0x98, 0x51, - 0x11, 0x8d, 0x54, 0x11, 0xf8, 0x0b, 0x80, 0x6b, 0xf6, 0x42, 0x33, 0xec, 0x47, 0xd4, 0x7f, 0xc2, - 0x82, 0x66, 0xcf, 0x34, 0x43, 0x46, 0xcf, 0xe8, 0x1f, 0xba, 0xb6, 0x62, 0x46, 0x05, 0xb1, 0x50, - 0x38, 0x74, 0x40, 0x4b, 0xab, 0x33, 0x9a, 0xf2, 0x4c, 0x6e, 0xe4, 0x3b, 0x4a, 0xde, 0x54, 0x94, - 0xab, 0x98, 0x52, 0x7f, 0x09, 0xda, 0x01, 0x13, 0xe4, 0x31, 0xa6, 0x38, 0xe5, 0x31, 0xf3, 0x5f, - 0x75, 0x19, 0x81, 0x76, 0x7b, 0x46, 0xdf, 0x72, 0x5b, 0x25, 0x39, 0x57, 0x9c, 0x2a, 0x24, 0xe0, - 0x39, 0x68, 0xaa, 0x7e, 0x71, 0xcc, 0x84, 0xa4, 0x09, 0x2e, 0xd2, 0x21, 0xb3, 0x67, 0xf4, 0xf7, - 0xdc, 0x86, 0x22, 0xa6, 0x0a, 0x9f, 0xf3, 0x4c, 0xc2, 0x33, 0xa0, 0x21, 0x1c, 0x49, 0x99, 0x6a, - 0xe5, 0x9e, 0x52, 0xd6, 0x14, 0xfc, 0x87, 0x94, 0xa9, 0xd2, 0x5d, 0x83, 0x86, 0xcf, 0x93, 0x84, - 0xfa, 0x12, 0x4b, 0xb6, 0xa6, 0x3c, 0x97, 0x68, 0xbf, 0x67, 0xf4, 0x2b, 0x97, 0x27, 0x8e, 0xde, - 0xa4, 0xb3, 0xd9, 0xa4, 0x73, 0x53, 0x6e, 0xd2, 0xad, 0x97, 0x11, 0x9e, 0x0e, 0x80, 0x3f, 0x82, - 0x1a, 0x4b, 0xc2, 0x8c, 0x0a, 0x81, 0xfd, 0x98, 0x08, 0x81, 0x0e, 0xd4, 0xd4, 0xd5, 0x12, 0x1c, - 0x15, 0x18, 0xfc, 0x19, 0x34, 0x36, 0xa2, 0x62, 0x37, 0xcc, 0xa7, 0xc8, 0x52, 0xb2, 0x7a, 0x09, - 0x2f, 0x34, 0x0a, 0xd7, 0xe0, 0xf8, 0x3d, 0x1b, 0x4f, 0x64, 0xc6, 0xe3, 0x98, 0x66, 0x78, 0xcd, - 0x03, 0x8a, 0x0e, 0x7b, 0x46, 0xbf, 0x7e, 0xf9, 0xab, 0xb3, 0xc5, 0x78, 0xe7, 0xc3, 0x39, 0xe7, - 0xae, 0xac, 0xfb, 0x1e, 0x3d, 0xe3, 0x01, 0x75, 0xdb, 0x6c, 0x1b, 0x0c, 0x1f, 0x40, 0x85, 0xe4, - 0x32, 0x2a, 0x5d, 0x40, 0x40, 0x95, 0x38, 0xff, 0xbf, 0x12, 0xc3, 0x5c, 0x46, 0xda, 0x9b, 0xeb, - 0x1d, 0x64, 0xb8, 0x80, 0xbc, 0x7f, 0xc3, 0x9f, 0x40, 0x9d, 0x26, 0xca, 0x58, 0x99, 0x11, 0x9f, - 0x25, 0x21, 0xaa, 0x2a, 0x4b, 0x6b, 0x1a, 0xf5, 0x34, 0x58, 0x18, 0x44, 0x7c, 0xbf, 0x98, 0x32, - 0xe6, 0x21, 0x5e, 0xb1, 0x98, 0xa2, 0x9a, 0xda, 0x47, 0x4d, 0xc3, 0x53, 0x1e, 0x8e, 0x59, 0x4c, - 0xe1, 0xef, 0xa0, 0x1e, 0xd0, 0x15, 0xc9, 0x63, 0x89, 0xf5, 0xf5, 0xa3, 0xba, 0xf2, 0xa7, 0xb7, - 0xb5, 0xc5, 0x79, 0x61, 0xae, 0xee, 0xd1, 0xad, 0x95, 0x71, 0xe5, 0x3d, 0xdf, 0x80, 0x1f, 0xca, - 0xbe, 0xfc, 0x98, 0xd1, 0x44, 0x62, 0xc1, 0x82, 0xaf, 0xc7, 0x87, 0x5a, 0xaa, 0xd1, 0xef, 0xb5, - 0x6c, 0xa4, 0x54, 0x0b, 0x16, 0x7c, 0x3e, 0x42, 0xd8, 0x03, 0x55, 0x11, 0x08, 0x9c, 0x07, 0x02, - 0xa7, 0x44, 0x46, 0xe8, 0x3b, 0xd5, 0x33, 0x10, 0x81, 0x58, 0x06, 0x62, 0x4e, 0x64, 0x54, 0xcc, - 0x1f, 0x92, 0x38, 0xa6, 0xaf, 0x98, 0x04, 0x41, 0xb1, 0x70, 0x74, 0xa4, 0xe7, 0xd2, 0xe8, 0x50, - 0x83, 0xf0, 0x0a, 0x1c, 0x95, 0xed, 0x14, 0xf9, 0x24, 0x7f, 0xa2, 0x09, 0x5e, 0xf3, 0x3c, 0x91, - 0xe8, 0x58, 0xbf, 0x00, 0xcd, 0x2e, 0x02, 0xe1, 0x15, 0xdc, 0xac, 0xa0, 0x8a, 0x17, 0xf0, 0x79, - 0x69, 0x3c, 0x5b, 0x13, 0x89, 0x90, 0x4a, 0xdf, 0xf8, 0x58, 0x9b, 0x82, 0x4f, 0x7f, 0x03, 0xed, - 0xad, 0x87, 0x00, 0x0f, 0xc0, 0xee, 0xc3, 0x78, 0x6c, 0x7f, 0x83, 0x15, 0x70, 0x70, 0x73, 0x3b, - 0x1e, 0x2e, 0xa7, 0x9e, 0x6d, 0x40, 0x00, 0xf6, 0x17, 0x9e, 0x7b, 0x37, 0xf2, 0xec, 0x9d, 0xd3, - 0x33, 0x00, 0x3e, 0x0c, 0x86, 0x16, 0x30, 0xef, 0x1f, 0xee, 0x6f, 0xed, 0x6f, 0xb0, 0x0e, 0xc0, - 0x6c, 0xe9, 0x2d, 0x87, 0x53, 0xec, 0x4d, 0x17, 0xb6, 0x31, 0x31, 0xad, 0x8a, 0x5d, 0x9d, 0x98, - 0x56, 0xc3, 0xb6, 0x27, 0xa6, 0x65, 0xdb, 0xcd, 0x89, 0x69, 0x35, 0x6d, 0x38, 0x31, 0x2d, 0x68, - 0xb7, 0x26, 0xa6, 0xd5, 0xb6, 0x8f, 0xae, 0xfb, 0x7f, 0xbd, 0x75, 0x8d, 0xbf, 0xdf, 0xba, 0xc6, - 0xbf, 0x6f, 0x5d, 0xe3, 0xcf, 0x8e, 0x36, 0x8d, 0xf1, 0x01, 0x49, 0xd9, 0xe0, 0xcb, 0xbf, 0xe8, - 0x71, 0x5f, 0xbd, 0xb4, 0xab, 0xff, 0x02, 0x00, 0x00, 0xff, 0xff, 0xd9, 0xc9, 0xa0, 0x33, 0xf4, - 0x04, 0x00, 0x00, + // 814 bytes of a gzipped FileDescriptorProto + 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x84, 0x54, 0x5d, 0x4f, 0xe4, 0x36, + 0x14, 0xdd, 0xc0, 0x2c, 0x64, 0xef, 0x7c, 0x05, 0x4f, 0x61, 0xbd, 0x54, 0xa2, 0x53, 0xaa, 0xd2, + 0x11, 0xaa, 0x32, 0xda, 0x41, 0x7d, 0xe8, 0x23, 0x0c, 0x4b, 0x97, 0xd1, 0xb0, 0xa0, 0x24, 0xbc, + 0xf4, 0xc5, 0x0a, 0x89, 0x49, 0x2c, 0x32, 0x71, 0x64, 0x3b, 0xdb, 0xdd, 0x7f, 0xd8, 0xc7, 0xfe, + 0x84, 0x8a, 0x1f, 0xd1, 0xe7, 0x2a, 0xb6, 0x07, 0x06, 0x69, 0xa4, 0x7d, 0xf4, 0x39, 0xc7, 0xbe, + 0xc7, 0xe7, 0x5e, 0x1b, 0xf6, 0x17, 0x54, 0xe6, 0xe3, 0xcf, 0xef, 0xe3, 0xa2, 0xca, 0xe3, 0xf7, + 0xe3, 0x84, 0x97, 0xf7, 0x2c, 0xf3, 0x2b, 0xc1, 0x15, 0x47, 0x03, 0x26, 0x15, 0xe3, 0x7e, 0xa3, + 0xf0, 0x97, 0x8a, 0xfd, 0x83, 0x8c, 0xf3, 0xac, 0xa0, 0x63, 0x2d, 0xb9, 0xab, 0xef, 0xc7, 0x69, + 0x2d, 0x62, 0xc5, 0x78, 0x69, 0x36, 0xed, 0xbf, 0x7b, 0x79, 0x60, 0x25, 0xf8, 0x97, 0xaf, 0x96, + 0x3a, 0x2e, 0xa9, 0xfa, 0x8b, 0x8b, 0x07, 0x56, 0x66, 0x4b, 0xc1, 0xc9, 0x38, 0xa5, 0x52, 0xb1, + 0x52, 0x9f, 0x40, 0x44, 0x5d, 0x50, 0xa3, 0x3d, 0xfc, 0xcf, 0x05, 0xb8, 0xa2, 0x32, 0x9f, 0x6a, + 0x43, 0xe8, 0x57, 0x40, 0x0b, 0xf6, 0x85, 0x0a, 0x92, 0xe4, 0x34, 0x79, 0x20, 0x92, 0x8a, 0xcf, + 0x54, 0x60, 0x67, 0xe8, 0x8c, 0xde, 0x04, 0x9e, 0x66, 0xa6, 0x0d, 0x11, 0x6a, 0x1c, 0xf9, 0x30, + 0x30, 0x6a, 0x41, 0x2b, 0x2e, 0xd4, 0x52, 0xbe, 0xa1, 0xe5, 0x3b, 0x9a, 0x0a, 0x34, 0x63, 0xf5, + 0x13, 0xd8, 0x4d, 0x99, 0x8c, 0xef, 0x0a, 0x4a, 0x2a, 0x5e, 0xb0, 0xe4, 0xab, 0x29, 0x23, 0xf1, + 0xe6, 0xd0, 0x19, 0xb9, 0xc1, 0xc0, 0x92, 0x37, 0x9a, 0xd3, 0x85, 0x24, 0x3a, 0x86, 0x1d, 0x7d, + 0x37, 0x52, 0x30, 0xa9, 0x68, 0x49, 0x9a, 0xe3, 0x70, 0x6b, 0xe8, 0x8c, 0x5e, 0x07, 0x7d, 0x4d, + 0xcc, 0x35, 0x7e, 0xc3, 0x85, 0x42, 0x47, 0x60, 0x20, 0x92, 0x2b, 0x55, 0x19, 0xe5, 0x6b, 0xad, + 0xec, 0x6a, 0xf8, 0xa3, 0x52, 0x95, 0xd6, 0x9d, 0x41, 0x3f, 0xe1, 0x65, 0x49, 0x13, 0x45, 0x14, + 0x5b, 0x50, 0x5e, 0x2b, 0xbc, 0x35, 0x74, 0x46, 0xed, 0xc9, 0x3b, 0xdf, 0xa4, 0xee, 0x2f, 0x53, + 0xf7, 0xcf, 0x6d, 0xea, 0x41, 0xcf, 0xee, 0x88, 0xcc, 0x06, 0xf4, 0x13, 0x74, 0x59, 0x99, 0x09, + 0x2a, 0x25, 0x49, 0x8a, 0x58, 0x4a, 0xbc, 0xad, 0x6f, 0xdd, 0xb1, 0xe0, 0xb4, 0xc1, 0xd0, 0x2f, + 0xd0, 0x5f, 0x8a, 0x9a, 0x6c, 0x58, 0x42, 0xb1, 0xab, 0x65, 0x3d, 0x0b, 0x87, 0x06, 0x45, 0x0b, + 0x78, 0xfb, 0x74, 0x1a, 0x2f, 0x95, 0xe0, 0x45, 0x41, 0x05, 0x59, 0xf0, 0x94, 0xe2, 0x37, 0x43, + 0x67, 0xd4, 0x9b, 0xfc, 0xe6, 0xaf, 0x19, 0x12, 0xff, 0xb9, 0x73, 0xfe, 0xa5, 0xad, 0xfb, 0xb4, + 0xfb, 0x8a, 0xa7, 0x34, 0xd8, 0x65, 0xeb, 0x60, 0x74, 0x0d, 0xed, 0xb8, 0x56, 0xb9, 0xed, 0x02, + 0x06, 0x5d, 0xe2, 0xf8, 0x5b, 0x25, 0x4e, 0x6b, 0x95, 0x9b, 0xde, 0x9c, 0x6d, 0x60, 0x27, 0x80, + 0xf8, 0x69, 0x8d, 0x7e, 0x86, 0x1e, 0x2d, 0x75, 0x63, 0x95, 0x88, 0x13, 0x56, 0x66, 0xb8, 0xa3, + 0x5b, 0xda, 0x35, 0x68, 0x64, 0xc0, 0xa6, 0x41, 0x71, 0x92, 0x34, 0xb7, 0x2c, 0x78, 0x46, 0xee, + 0x59, 0x41, 0x71, 0x57, 0xe7, 0xd1, 0x35, 0xf0, 0x9c, 0x67, 0x17, 0xac, 0xa0, 0xe8, 0x0f, 0xe8, + 0xa5, 0xf4, 0x3e, 0xae, 0x0b, 0x45, 0xcc, 0x4b, 0xc1, 0x3d, 0xdd, 0x9f, 0xe1, 0x5a, 0x8b, 0x37, + 0x4d, 0x73, 0x8d, 0xc7, 0xa0, 0x6b, 0xf7, 0xd9, 0x79, 0x3e, 0x87, 0x1f, 0xac, 0xaf, 0xa4, 0x60, + 0xb4, 0x54, 0x44, 0xb2, 0xf4, 0xe5, 0xf0, 0xe1, 0x81, 0x36, 0xfa, 0xbd, 0x91, 0x4d, 0xb5, 0x2a, + 0x64, 0xe9, 0xea, 0x10, 0xa2, 0x21, 0x74, 0x64, 0x2a, 0x49, 0x9d, 0x4a, 0x52, 0xc5, 0x2a, 0xc7, + 0xdf, 0x69, 0xcf, 0x20, 0x53, 0x79, 0x9b, 0xca, 0x9b, 0x58, 0xe5, 0xe8, 0x23, 0xf4, 0x8c, 0x51, + 0x22, 0x79, 0x2d, 0x12, 0x2a, 0xf1, 0xde, 0x70, 0x73, 0xd4, 0x9e, 0xfc, 0xb8, 0xd6, 0xb0, 0x31, + 0x17, 0x6a, 0x65, 0xd0, 0x4d, 0x56, 0x56, 0x12, 0x9d, 0xc0, 0x9e, 0x75, 0xdc, 0x94, 0x54, 0xfc, + 0x81, 0x96, 0x64, 0xc1, 0xeb, 0x52, 0xe1, 0xb7, 0xe6, 0x91, 0x18, 0x36, 0x4c, 0x65, 0xd4, 0x70, + 0x57, 0x0d, 0xd5, 0x3c, 0x92, 0xd5, 0x5c, 0xb9, 0x58, 0xc4, 0x0a, 0x63, 0xed, 0xb2, 0xff, 0x9c, + 0xac, 0x86, 0x0f, 0x7f, 0x87, 0xdd, 0xb5, 0xb3, 0x82, 0xb6, 0x61, 0xf3, 0xfa, 0xe2, 0xc2, 0x7b, + 0x85, 0xda, 0xb0, 0x7d, 0xfe, 0xe1, 0xe2, 0xf4, 0x76, 0x1e, 0x79, 0x0e, 0x02, 0xd8, 0x0a, 0xa3, + 0xe0, 0x72, 0x1a, 0x79, 0x1b, 0x87, 0x47, 0x00, 0xcf, 0x33, 0x80, 0x5c, 0x68, 0x7d, 0xba, 0xfe, + 0xf4, 0xc1, 0x7b, 0x85, 0x7a, 0x00, 0x57, 0xb7, 0xd1, 0xed, 0xe9, 0x9c, 0x44, 0xf3, 0xd0, 0x73, + 0x66, 0x2d, 0xb7, 0xed, 0x75, 0x66, 0x2d, 0xb7, 0xef, 0x79, 0xb3, 0x96, 0xeb, 0x79, 0x3b, 0xb3, + 0x96, 0xbb, 0xe3, 0xa1, 0x59, 0xcb, 0x45, 0xde, 0x60, 0xd6, 0x72, 0x77, 0xbd, 0xbd, 0x43, 0x09, + 0x9d, 0xd5, 0x18, 0x10, 0x86, 0xed, 0x38, 0x4d, 0x1b, 0x5b, 0xf6, 0xbb, 0x59, 0x2e, 0xd1, 0x25, + 0x74, 0x54, 0xd1, 0x3c, 0x20, 0xa5, 0x58, 0x99, 0x49, 0xfd, 0xbd, 0xb4, 0x27, 0x47, 0x36, 0xd9, + 0xe7, 0xbf, 0x6e, 0x99, 0xef, 0x89, 0x1f, 0xcd, 0xc3, 0xd0, 0xaa, 0x83, 0xb6, 0x2a, 0xe4, 0x72, + 0x71, 0x36, 0xfa, 0xfb, 0xf1, 0xc0, 0xf9, 0xe7, 0xf1, 0xc0, 0xf9, 0xf7, 0xf1, 0xc0, 0xf9, 0x73, + 0xdf, 0x9c, 0xc0, 0xf8, 0x38, 0xae, 0xd8, 0xf8, 0xc5, 0x7f, 0x7a, 0xb7, 0xa5, 0x7f, 0x80, 0x93, + 0xff, 0x03, 0x00, 0x00, 0xff, 0xff, 0x12, 0xda, 0x0b, 0xab, 0xb8, 0x05, 0x00, 0x00, } diff --git a/mesh/v1alpha1/config.proto b/mesh/v1alpha1/config.proto index f20e21dffa..997669f648 100644 --- a/mesh/v1alpha1/config.proto +++ b/mesh/v1alpha1/config.proto @@ -16,6 +16,7 @@ syntax = "proto3"; import "google/protobuf/duration.proto"; import "mesh/v1alpha1/proxy.proto"; +import "networking/v1alpha3/destination_rule.proto"; // $title: Service Mesh // $description: Configuration affecting the service mesh as a whole. @@ -139,8 +140,10 @@ message MeshConfig { reserved 21; - // Address of the galley service exposing the Mesh Control Protocol (MCP). - string galley_address = 22; + // ConfigSource describes a source of configuration data for networking + // rules, and other Istio configuration artifacts. Multiple data sources + // can be configured for a single control plane. + repeated ConfigSource config_sources = 22; // $hide_from_docs // This flag is used by secret discovery service(SDS). @@ -152,3 +155,18 @@ message MeshConfig { // $hide_from_docs // Next available field number: 25 } + +// ConfigSource describes information about a configuration store inside a +// mesh. A single control plane instance can interact with one or more data +// sources. +message ConfigSource { + // Address of the server implementing the Istio Mesh Configuration + // protocol (MCP). Can be IP address or a fully qualified DNS name. + // Use file:/// to specify a file-based backend with absolute path to the directory. + string address = 1; + + // Use the tls_settings to specify the tls mode to use. If the MCP server + // uses Istio MTLS and shares the root CA with Pilot, specify the TLS + // mode as ISTIO_MUTUAL. + istio.networking.v1alpha3.TLSSettings tls_settings = 2; +} diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html index b91f5001c0..c8e07f12bf 100644 --- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html +++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html @@ -4,7 +4,7 @@ generator: protoc-gen-docs aliases: - /docs/reference/config/service-mesh.html -number_of_entries: 12 +number_of_entries: 13 ---

AuthenticationPolicy

@@ -41,6 +41,44 @@

AuthenticationPolicy

Use the policy defined by the parent scope. Should not be used for mesh policy.

+ + +
 +
FieldTypeDescription
networksmap<string, Network> +

REQUIRED: The set of networks inside this mesh. Each network should +have a unique name and information about how to infer the endpoints in +the network as well as the gateways associated with the network.

+
namestring -

A unique name assigned to the network.

- -
endpoints Network.NetworkEndpoints[] -

The list of endpoints in the network (obtained through the constituent -service registries or from CIDR ranges). All endpoints in the network -are directly accessible to one another.

+

REQUIRED: The list of endpoints in the network (obtained through the +constituent service registries or from CIDR ranges). All endpoints in +the network are directly accessible to one another.
gateways Network.IstioNetworkGateway[] +

REQUIRED: Set of gateways associated with the network.

+
port uint32 -

The port associated with the gateway.

+

REQUIRED: The port associated with the gateway.
+
+

ConfigSource

+
+

ConfigSource describes information about a configuration store inside a +mesh. A single control plane instance can interact with one or more data +sources.

+ + + + + + + + + + + + + + + + + + + @@ -207,11 +245,13 @@

MeshConfig

- - - + + + diff --git a/python/istio_api/mesh/v1alpha1/config_pb2.py b/python/istio_api/mesh/v1alpha1/config_pb2.py index 31f46e3adb..98825c8ae9 100644 --- a/python/istio_api/mesh/v1alpha1/config_pb2.py +++ b/python/istio_api/mesh/v1alpha1/config_pb2.py @@ -15,15 +15,16 @@ from google.protobuf import duration_pb2 as google_dot_protobuf_dot_duration__pb2 from mesh.v1alpha1 import proxy_pb2 as mesh_dot_v1alpha1_dot_proxy__pb2 +from networking.v1alpha3 import destination_rule_pb2 as networking_dot_v1alpha3_dot_destination__rule__pb2 DESCRIPTOR = _descriptor.FileDescriptor( name='mesh/v1alpha1/config.proto', package='istio.mesh.v1alpha1', syntax='proto3', - serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\"\x9d\x06\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x16\n\x0egalley_address\x18\x16 \x01(\t\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01J\x04\x08\x0b\x10\x0cJ\x04\x08\x0f\x10\x10J\x04\x08\x10\x10\x11J\x04\x08\x11\x10\x12J\x04\x08\x12\x10\x13J\x04\x08\x15\x10\x16\x42\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3') + serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xc0\x06\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01J\x04\x08\x0b\x10\x0cJ\x04\x08\x0f\x10\x10J\x04\x08\x10\x10\x11J\x04\x08\x11\x10\x12J\x04\x08\x12\x10\x13J\x04\x08\x15\x10\x16\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettingsB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3') , - dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,mesh_dot_v1alpha1_dot_proxy__pb2.DESCRIPTOR,]) + dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,mesh_dot_v1alpha1_dot_proxy__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_destination__rule__pb2.DESCRIPTOR,]) @@ -48,8 +49,8 @@ ], containing_type=None, options=None, - serialized_start=775, - serialized_end=832, + serialized_start=854, + serialized_end=911, ) _sym_db.RegisterEnumDescriptor(_MESHCONFIG_INGRESSCONTROLLERMODE) @@ -70,8 +71,8 @@ ], containing_type=None, options=None, - serialized_start=834, - serialized_end=872, + serialized_start=913, + serialized_end=951, ) _sym_db.RegisterEnumDescriptor(_MESHCONFIG_AUTHPOLICY) @@ -196,9 +197,9 @@ is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='galley_address', full_name='istio.mesh.v1alpha1.MeshConfig.galley_address', index=16, - number=22, type=9, cpp_type=9, label=1, - has_default_value=False, default_value=_b("").decode('utf-8'), + name='config_sources', full_name='istio.mesh.v1alpha1.MeshConfig.config_sources', index=16, + number=22, type=11, cpp_type=10, label=3, + has_default_value=False, default_value=[], message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), @@ -223,17 +224,58 @@ extension_ranges=[], oneofs=[ ], - serialized_start=111, - serialized_end=908, + serialized_start=155, + serialized_end=987, +) + + +_CONFIGSOURCE = _descriptor.Descriptor( + name='ConfigSource', + full_name='istio.mesh.v1alpha1.ConfigSource', + filename=None, + file=DESCRIPTOR, + containing_type=None, + fields=[ + _descriptor.FieldDescriptor( + name='address', full_name='istio.mesh.v1alpha1.ConfigSource.address', index=0, + number=1, type=9, cpp_type=9, label=1, + has_default_value=False, default_value=_b("").decode('utf-8'), + message_type=None, enum_type=None, containing_type=None, + is_extension=False, extension_scope=None, + options=None, file=DESCRIPTOR), + _descriptor.FieldDescriptor( + name='tls_settings', full_name='istio.mesh.v1alpha1.ConfigSource.tls_settings', index=1, + number=2, type=11, cpp_type=10, label=1, + has_default_value=False, default_value=None, + message_type=None, enum_type=None, containing_type=None, + is_extension=False, extension_scope=None, + options=None, file=DESCRIPTOR), + ], + extensions=[ + ], + nested_types=[], + enum_types=[ + ], + options=None, + is_extendable=False, + syntax='proto3', + extension_ranges=[], + oneofs=[ + ], + serialized_start=989, + serialized_end=1082, ) _MESHCONFIG.fields_by_name['connect_timeout'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION _MESHCONFIG.fields_by_name['ingress_controller_mode'].enum_type = _MESHCONFIG_INGRESSCONTROLLERMODE _MESHCONFIG.fields_by_name['auth_policy'].enum_type = _MESHCONFIG_AUTHPOLICY _MESHCONFIG.fields_by_name['default_config'].message_type = mesh_dot_v1alpha1_dot_proxy__pb2._PROXYCONFIG +_MESHCONFIG.fields_by_name['config_sources'].message_type = _CONFIGSOURCE _MESHCONFIG_INGRESSCONTROLLERMODE.containing_type = _MESHCONFIG _MESHCONFIG_AUTHPOLICY.containing_type = _MESHCONFIG +_CONFIGSOURCE.fields_by_name['tls_settings'].message_type = networking_dot_v1alpha3_dot_destination__rule__pb2._TLSSETTINGS DESCRIPTOR.message_types_by_name['MeshConfig'] = _MESHCONFIG +DESCRIPTOR.message_types_by_name['ConfigSource'] = _CONFIGSOURCE _sym_db.RegisterFileDescriptor(DESCRIPTOR) MeshConfig = _reflection.GeneratedProtocolMessageType('MeshConfig', (_message.Message,), dict( @@ -243,6 +285,13 @@ )) _sym_db.RegisterMessage(MeshConfig) +ConfigSource = _reflection.GeneratedProtocolMessageType('ConfigSource', (_message.Message,), dict( + DESCRIPTOR = _CONFIGSOURCE, + __module__ = 'mesh.v1alpha1.config_pb2' + # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.ConfigSource) + )) +_sym_db.RegisterMessage(ConfigSource) + DESCRIPTOR.has_options = True DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z\032istio.io/api/mesh/v1alpha1')) From 3f8c1a7cfbf6ff36916b6338fec549775a2c7ed6 Mon Sep 17 00:00:00 2001 From: Ozben Evren Date: Tue, 23 Oct 2018 12:15:04 -0700 Subject: [PATCH 4/5] Update OWNERS (#671) --- OWNERS | 2 ++ 1 file changed, 2 insertions(+) diff --git a/OWNERS b/OWNERS index eae6f42913..019052cac5 100644 --- a/OWNERS +++ b/OWNERS @@ -8,6 +8,7 @@ reviewers: - hklai - kyessenov - mandarjog + - ozevren - qiwzhang - rshriram - sebastienvas @@ -21,6 +22,7 @@ approvers: - hklai - kyessenov - mandarjog + - ozevren - qiwzhang - rshriram - sebastienvas From 9e5a9173e61ed2af3807c94915e6693e1062425a Mon Sep 17 00:00:00 2001 From: Yangmin Zhu Date: Tue, 23 Oct 2018 13:25:54 -0700 Subject: [PATCH 5/5] Add mesh config to allow setting network policy fail open (#670) --- mesh/v1alpha1/config.pb.go | 152 ++++++++++++------- mesh/v1alpha1/config.proto | 7 +- mesh/v1alpha1/istio.mesh.v1alpha1.pb.html | 10 ++ python/istio_api/mesh/v1alpha1/config_pb2.py | 53 ++++--- 4 files changed, 146 insertions(+), 76 deletions(-) diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go index d80c94df7c..04cfb65148 100644 --- a/mesh/v1alpha1/config.pb.go +++ b/mesh/v1alpha1/config.pb.go @@ -124,6 +124,10 @@ type MeshConfig struct { // Disable policy checks by the mixer service. Default // is false, i.e. mixer policy check is enabled by default. DisablePolicyChecks bool `protobuf:"varint,3,opt,name=disable_policy_checks,json=disablePolicyChecks,proto3" json:"disable_policy_checks,omitempty"` + // Allow all traffic in cases when the mixer policy service cannot be reached. + // Default is false which means the traffic is denied when the client is unable + // to connect to Mixer. + PolicyCheckFailOpen bool `protobuf:"varint,25,opt,name=policy_check_fail_open,json=policyCheckFailOpen,proto3" json:"policy_check_fail_open,omitempty"` // Port on which Envoy should listen for incoming connections from // other services. ProxyListenPort int32 `protobuf:"varint,4,opt,name=proxy_listen_port,json=proxyListenPort,proto3" json:"proxy_listen_port,omitempty"` @@ -199,6 +203,13 @@ func (m *MeshConfig) GetDisablePolicyChecks() bool { return false } +func (m *MeshConfig) GetPolicyCheckFailOpen() bool { + if m != nil { + return m.PolicyCheckFailOpen + } + return false +} + func (m *MeshConfig) GetProxyListenPort() int32 { if m != nil { return m.ProxyListenPort @@ -502,6 +513,18 @@ func (m *MeshConfig) MarshalTo(dAtA []byte) (int, error) { i = encodeVarintConfig(dAtA, i, uint64(len(m.AccessLogFormat))) i += copy(dAtA[i:], m.AccessLogFormat) } + if m.PolicyCheckFailOpen { + dAtA[i] = 0xc8 + i++ + dAtA[i] = 0x1 + i++ + if m.PolicyCheckFailOpen { + dAtA[i] = 1 + } else { + dAtA[i] = 0 + } + i++ + } return i, nil } @@ -617,6 +640,9 @@ func (m *MeshConfig) Size() (n int) { if l > 0 { n += 2 + l + sovConfig(uint64(l)) } + if m.PolicyCheckFailOpen { + n += 3 + } return n } @@ -1132,6 +1158,26 @@ func (m *MeshConfig) Unmarshal(dAtA []byte) error { } m.AccessLogFormat = string(dAtA[iNdEx:postIndex]) iNdEx = postIndex + case 25: + if wireType != 0 { + return fmt.Errorf("proto: wrong wireType = %d for field PolicyCheckFailOpen", wireType) + } + var v int + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowConfig + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + v |= (int(b) & 0x7F) << shift + if b < 0x80 { + break + } + } + m.PolicyCheckFailOpen = bool(v != 0) default: iNdEx = preIndex skippy, err := skipConfig(dAtA[iNdEx:]) @@ -1373,56 +1419,58 @@ var ( func init() { proto.RegisterFile("mesh/v1alpha1/config.proto", fileDescriptorConfig) } var fileDescriptorConfig = []byte{ - // 814 bytes of a gzipped FileDescriptorProto - 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x84, 0x54, 0x5d, 0x4f, 0xe4, 0x36, - 0x14, 0xdd, 0xc0, 0x2c, 0x64, 0xef, 0x7c, 0x05, 0x4f, 0x61, 0xbd, 0x54, 0xa2, 0x53, 0xaa, 0xd2, - 0x11, 0xaa, 0x32, 0xda, 0x41, 0x7d, 0xe8, 0x23, 0x0c, 0x4b, 0x97, 0xd1, 0xb0, 0xa0, 0x24, 0xbc, - 0xf4, 0xc5, 0x0a, 0x89, 0x49, 0x2c, 0x32, 0x71, 0x64, 0x3b, 0xdb, 0xdd, 0x7f, 0xd8, 0xc7, 0xfe, - 0x84, 0x8a, 0x1f, 0xd1, 0xe7, 0x2a, 0xb6, 0x07, 0x06, 0x69, 0xa4, 0x7d, 0xf4, 0x39, 0xc7, 0xbe, - 0xc7, 0xe7, 0x5e, 0x1b, 0xf6, 0x17, 0x54, 0xe6, 0xe3, 0xcf, 0xef, 0xe3, 0xa2, 0xca, 0xe3, 0xf7, - 0xe3, 0x84, 0x97, 0xf7, 0x2c, 0xf3, 0x2b, 0xc1, 0x15, 0x47, 0x03, 0x26, 0x15, 0xe3, 0x7e, 0xa3, - 0xf0, 0x97, 0x8a, 0xfd, 0x83, 0x8c, 0xf3, 0xac, 0xa0, 0x63, 0x2d, 0xb9, 0xab, 0xef, 0xc7, 0x69, - 0x2d, 0x62, 0xc5, 0x78, 0x69, 0x36, 0xed, 0xbf, 0x7b, 0x79, 0x60, 0x25, 0xf8, 0x97, 0xaf, 0x96, - 0x3a, 0x2e, 0xa9, 0xfa, 0x8b, 0x8b, 0x07, 0x56, 0x66, 0x4b, 0xc1, 0xc9, 0x38, 0xa5, 0x52, 0xb1, - 0x52, 0x9f, 0x40, 0x44, 0x5d, 0x50, 0xa3, 0x3d, 0xfc, 0xcf, 0x05, 0xb8, 0xa2, 0x32, 0x9f, 0x6a, - 0x43, 0xe8, 0x57, 0x40, 0x0b, 0xf6, 0x85, 0x0a, 0x92, 0xe4, 0x34, 0x79, 0x20, 0x92, 0x8a, 0xcf, - 0x54, 0x60, 0x67, 0xe8, 0x8c, 0xde, 0x04, 0x9e, 0x66, 0xa6, 0x0d, 0x11, 0x6a, 0x1c, 0xf9, 0x30, - 0x30, 0x6a, 0x41, 0x2b, 0x2e, 0xd4, 0x52, 0xbe, 0xa1, 0xe5, 0x3b, 0x9a, 0x0a, 0x34, 0x63, 0xf5, - 0x13, 0xd8, 0x4d, 0x99, 0x8c, 0xef, 0x0a, 0x4a, 0x2a, 0x5e, 0xb0, 0xe4, 0xab, 0x29, 0x23, 0xf1, - 0xe6, 0xd0, 0x19, 0xb9, 0xc1, 0xc0, 0x92, 0x37, 0x9a, 0xd3, 0x85, 0x24, 0x3a, 0x86, 0x1d, 0x7d, - 0x37, 0x52, 0x30, 0xa9, 0x68, 0x49, 0x9a, 0xe3, 0x70, 0x6b, 0xe8, 0x8c, 0x5e, 0x07, 0x7d, 0x4d, - 0xcc, 0x35, 0x7e, 0xc3, 0x85, 0x42, 0x47, 0x60, 0x20, 0x92, 0x2b, 0x55, 0x19, 0xe5, 0x6b, 0xad, - 0xec, 0x6a, 0xf8, 0xa3, 0x52, 0x95, 0xd6, 0x9d, 0x41, 0x3f, 0xe1, 0x65, 0x49, 0x13, 0x45, 0x14, - 0x5b, 0x50, 0x5e, 0x2b, 0xbc, 0x35, 0x74, 0x46, 0xed, 0xc9, 0x3b, 0xdf, 0xa4, 0xee, 0x2f, 0x53, - 0xf7, 0xcf, 0x6d, 0xea, 0x41, 0xcf, 0xee, 0x88, 0xcc, 0x06, 0xf4, 0x13, 0x74, 0x59, 0x99, 0x09, - 0x2a, 0x25, 0x49, 0x8a, 0x58, 0x4a, 0xbc, 0xad, 0x6f, 0xdd, 0xb1, 0xe0, 0xb4, 0xc1, 0xd0, 0x2f, - 0xd0, 0x5f, 0x8a, 0x9a, 0x6c, 0x58, 0x42, 0xb1, 0xab, 0x65, 0x3d, 0x0b, 0x87, 0x06, 0x45, 0x0b, - 0x78, 0xfb, 0x74, 0x1a, 0x2f, 0x95, 0xe0, 0x45, 0x41, 0x05, 0x59, 0xf0, 0x94, 0xe2, 0x37, 0x43, - 0x67, 0xd4, 0x9b, 0xfc, 0xe6, 0xaf, 0x19, 0x12, 0xff, 0xb9, 0x73, 0xfe, 0xa5, 0xad, 0xfb, 0xb4, - 0xfb, 0x8a, 0xa7, 0x34, 0xd8, 0x65, 0xeb, 0x60, 0x74, 0x0d, 0xed, 0xb8, 0x56, 0xb9, 0xed, 0x02, - 0x06, 0x5d, 0xe2, 0xf8, 0x5b, 0x25, 0x4e, 0x6b, 0x95, 0x9b, 0xde, 0x9c, 0x6d, 0x60, 0x27, 0x80, - 0xf8, 0x69, 0x8d, 0x7e, 0x86, 0x1e, 0x2d, 0x75, 0x63, 0x95, 0x88, 0x13, 0x56, 0x66, 0xb8, 0xa3, - 0x5b, 0xda, 0x35, 0x68, 0x64, 0xc0, 0xa6, 0x41, 0x71, 0x92, 0x34, 0xb7, 0x2c, 0x78, 0x46, 0xee, - 0x59, 0x41, 0x71, 0x57, 0xe7, 0xd1, 0x35, 0xf0, 0x9c, 0x67, 0x17, 0xac, 0xa0, 0xe8, 0x0f, 0xe8, - 0xa5, 0xf4, 0x3e, 0xae, 0x0b, 0x45, 0xcc, 0x4b, 0xc1, 0x3d, 0xdd, 0x9f, 0xe1, 0x5a, 0x8b, 0x37, - 0x4d, 0x73, 0x8d, 0xc7, 0xa0, 0x6b, 0xf7, 0xd9, 0x79, 0x3e, 0x87, 0x1f, 0xac, 0xaf, 0xa4, 0x60, - 0xb4, 0x54, 0x44, 0xb2, 0xf4, 0xe5, 0xf0, 0xe1, 0x81, 0x36, 0xfa, 0xbd, 0x91, 0x4d, 0xb5, 0x2a, - 0x64, 0xe9, 0xea, 0x10, 0xa2, 0x21, 0x74, 0x64, 0x2a, 0x49, 0x9d, 0x4a, 0x52, 0xc5, 0x2a, 0xc7, - 0xdf, 0x69, 0xcf, 0x20, 0x53, 0x79, 0x9b, 0xca, 0x9b, 0x58, 0xe5, 0xe8, 0x23, 0xf4, 0x8c, 0x51, - 0x22, 0x79, 0x2d, 0x12, 0x2a, 0xf1, 0xde, 0x70, 0x73, 0xd4, 0x9e, 0xfc, 0xb8, 0xd6, 0xb0, 0x31, - 0x17, 0x6a, 0x65, 0xd0, 0x4d, 0x56, 0x56, 0x12, 0x9d, 0xc0, 0x9e, 0x75, 0xdc, 0x94, 0x54, 0xfc, - 0x81, 0x96, 0x64, 0xc1, 0xeb, 0x52, 0xe1, 0xb7, 0xe6, 0x91, 0x18, 0x36, 0x4c, 0x65, 0xd4, 0x70, - 0x57, 0x0d, 0xd5, 0x3c, 0x92, 0xd5, 0x5c, 0xb9, 0x58, 0xc4, 0x0a, 0x63, 0xed, 0xb2, 0xff, 0x9c, - 0xac, 0x86, 0x0f, 0x7f, 0x87, 0xdd, 0xb5, 0xb3, 0x82, 0xb6, 0x61, 0xf3, 0xfa, 0xe2, 0xc2, 0x7b, - 0x85, 0xda, 0xb0, 0x7d, 0xfe, 0xe1, 0xe2, 0xf4, 0x76, 0x1e, 0x79, 0x0e, 0x02, 0xd8, 0x0a, 0xa3, - 0xe0, 0x72, 0x1a, 0x79, 0x1b, 0x87, 0x47, 0x00, 0xcf, 0x33, 0x80, 0x5c, 0x68, 0x7d, 0xba, 0xfe, - 0xf4, 0xc1, 0x7b, 0x85, 0x7a, 0x00, 0x57, 0xb7, 0xd1, 0xed, 0xe9, 0x9c, 0x44, 0xf3, 0xd0, 0x73, - 0x66, 0x2d, 0xb7, 0xed, 0x75, 0x66, 0x2d, 0xb7, 0xef, 0x79, 0xb3, 0x96, 0xeb, 0x79, 0x3b, 0xb3, - 0x96, 0xbb, 0xe3, 0xa1, 0x59, 0xcb, 0x45, 0xde, 0x60, 0xd6, 0x72, 0x77, 0xbd, 0xbd, 0x43, 0x09, - 0x9d, 0xd5, 0x18, 0x10, 0x86, 0xed, 0x38, 0x4d, 0x1b, 0x5b, 0xf6, 0xbb, 0x59, 0x2e, 0xd1, 0x25, - 0x74, 0x54, 0xd1, 0x3c, 0x20, 0xa5, 0x58, 0x99, 0x49, 0xfd, 0xbd, 0xb4, 0x27, 0x47, 0x36, 0xd9, - 0xe7, 0xbf, 0x6e, 0x99, 0xef, 0x89, 0x1f, 0xcd, 0xc3, 0xd0, 0xaa, 0x83, 0xb6, 0x2a, 0xe4, 0x72, - 0x71, 0x36, 0xfa, 0xfb, 0xf1, 0xc0, 0xf9, 0xe7, 0xf1, 0xc0, 0xf9, 0xf7, 0xf1, 0xc0, 0xf9, 0x73, - 0xdf, 0x9c, 0xc0, 0xf8, 0x38, 0xae, 0xd8, 0xf8, 0xc5, 0x7f, 0x7a, 0xb7, 0xa5, 0x7f, 0x80, 0x93, - 0xff, 0x03, 0x00, 0x00, 0xff, 0xff, 0x12, 0xda, 0x0b, 0xab, 0xb8, 0x05, 0x00, 0x00, + // 838 bytes of a gzipped FileDescriptorProto + 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x84, 0x54, 0xdd, 0x4e, 0x23, 0x37, + 0x18, 0xdd, 0x81, 0x2c, 0x84, 0x2f, 0x7f, 0x83, 0x53, 0x58, 0x43, 0x25, 0x9a, 0x52, 0x95, 0x46, + 0xa8, 0x9a, 0x68, 0x83, 0x7a, 0xd1, 0x4b, 0x08, 0x9b, 0x2e, 0x51, 0x58, 0xd0, 0x64, 0xb8, 0xe9, + 0x8d, 0x35, 0xcc, 0x38, 0x33, 0x16, 0x8e, 0x3d, 0x1a, 0x7b, 0xb6, 0xbb, 0xcf, 0xd4, 0x17, 0xe9, + 0x65, 0x1f, 0xa1, 0xe2, 0x49, 0xaa, 0xb1, 0x27, 0x24, 0x48, 0x91, 0xf6, 0xd2, 0xe7, 0x1c, 0xfb, + 0x3b, 0xfe, 0xce, 0x67, 0xc3, 0xf1, 0x82, 0xaa, 0x74, 0xf0, 0xf9, 0x7d, 0xc8, 0xb3, 0x34, 0x7c, + 0x3f, 0x88, 0xa4, 0x98, 0xb3, 0xc4, 0xcb, 0x72, 0xa9, 0x25, 0xea, 0x32, 0xa5, 0x99, 0xf4, 0x4a, + 0x85, 0xb7, 0x54, 0x1c, 0x9f, 0x24, 0x52, 0x26, 0x9c, 0x0e, 0x8c, 0xe4, 0xb1, 0x98, 0x0f, 0xe2, + 0x22, 0x0f, 0x35, 0x93, 0xc2, 0x6e, 0x3a, 0x3e, 0x7a, 0x7d, 0x60, 0x96, 0xcb, 0x2f, 0x5f, 0x2b, + 0xea, 0x5c, 0x50, 0xfd, 0x97, 0xcc, 0x9f, 0x98, 0x48, 0x96, 0x82, 0x8b, 0x41, 0x4c, 0x95, 0x66, + 0xc2, 0x9c, 0x40, 0xf2, 0x82, 0x53, 0xab, 0x3d, 0xfd, 0x7b, 0x0f, 0xe0, 0x96, 0xaa, 0x74, 0x64, + 0x0c, 0xa1, 0x5f, 0x01, 0x2d, 0xd8, 0x17, 0x9a, 0x93, 0x28, 0xa5, 0xd1, 0x13, 0x51, 0x34, 0xff, + 0x4c, 0x73, 0xec, 0xf4, 0x9c, 0xfe, 0x9e, 0xef, 0x1a, 0x66, 0x54, 0x12, 0x33, 0x83, 0x23, 0x0f, + 0xba, 0x56, 0x9d, 0xd3, 0x4c, 0xe6, 0x7a, 0x29, 0xdf, 0x32, 0xf2, 0x7d, 0x43, 0xf9, 0x86, 0xa9, + 0xf4, 0x43, 0x38, 0x88, 0x99, 0x0a, 0x1f, 0x39, 0x25, 0x99, 0xe4, 0x2c, 0xfa, 0x6a, 0xcb, 0x28, + 0xbc, 0xdd, 0x73, 0xfa, 0x75, 0xbf, 0x5b, 0x91, 0xf7, 0x86, 0x33, 0x85, 0x14, 0x3a, 0x87, 0x7d, + 0x73, 0x37, 0xc2, 0x99, 0xd2, 0x54, 0x90, 0xf2, 0x38, 0x5c, 0xeb, 0x39, 0xfd, 0xb7, 0x7e, 0xc7, + 0x10, 0x53, 0x83, 0xdf, 0xcb, 0x5c, 0xa3, 0x33, 0xb0, 0x10, 0x49, 0xb5, 0xce, 0xac, 0xf2, 0xad, + 0x51, 0xb6, 0x0c, 0xfc, 0x51, 0xeb, 0xcc, 0xe8, 0xae, 0xa0, 0x13, 0x49, 0x21, 0x68, 0xa4, 0x89, + 0x66, 0x0b, 0x2a, 0x0b, 0x8d, 0x77, 0x7a, 0x4e, 0xbf, 0x31, 0x3c, 0xf2, 0x6c, 0xd7, 0xbd, 0x65, + 0xd7, 0xbd, 0xeb, 0xaa, 0xeb, 0x7e, 0xbb, 0xda, 0x11, 0xd8, 0x0d, 0xe8, 0x27, 0x68, 0x31, 0x91, + 0xe4, 0x54, 0x29, 0x12, 0xf1, 0x50, 0x29, 0xbc, 0x6b, 0x6e, 0xdd, 0xac, 0xc0, 0x51, 0x89, 0xa1, + 0x5f, 0xa0, 0xb3, 0x14, 0x95, 0xbd, 0x61, 0x11, 0xc5, 0x75, 0x23, 0x6b, 0x57, 0xf0, 0xcc, 0xa2, + 0x68, 0x01, 0xef, 0x5e, 0x4e, 0x93, 0x42, 0xe7, 0x92, 0x73, 0x9a, 0x93, 0x85, 0x8c, 0x29, 0xde, + 0xeb, 0x39, 0xfd, 0xf6, 0xf0, 0x37, 0x6f, 0xc3, 0x90, 0x78, 0xab, 0xe4, 0xbc, 0x9b, 0xaa, 0xee, + 0xcb, 0xee, 0x5b, 0x19, 0x53, 0xff, 0x80, 0x6d, 0x82, 0xd1, 0x1d, 0x34, 0xc2, 0x42, 0xa7, 0x55, + 0x0a, 0x18, 0x4c, 0x89, 0xf3, 0x6f, 0x95, 0xb8, 0x2c, 0x74, 0x6a, 0xb3, 0xb9, 0xda, 0xc2, 0x8e, + 0x0f, 0xe1, 0xcb, 0x1a, 0xfd, 0x0c, 0x6d, 0x2a, 0x4c, 0xb0, 0x3a, 0x0f, 0x23, 0x26, 0x12, 0xdc, + 0x34, 0x91, 0xb6, 0x2c, 0x1a, 0x58, 0xb0, 0x0c, 0x28, 0x8c, 0xa2, 0xf2, 0x96, 0x5c, 0x26, 0x64, + 0xce, 0x38, 0xc5, 0x2d, 0xd3, 0x8f, 0x96, 0x85, 0xa7, 0x32, 0x19, 0x33, 0x4e, 0xd1, 0x1f, 0xd0, + 0x8e, 0xe9, 0x3c, 0x2c, 0xb8, 0x26, 0xf6, 0xa5, 0xe0, 0xb6, 0xc9, 0xa7, 0xb7, 0xd1, 0xe2, 0x7d, + 0x19, 0xae, 0xf5, 0xe8, 0xb7, 0xaa, 0x7d, 0xd5, 0x3c, 0x5f, 0xc3, 0x0f, 0x95, 0xaf, 0x88, 0x33, + 0x2a, 0x34, 0x51, 0x2c, 0x7e, 0x3d, 0x7c, 0xb8, 0x6b, 0x8c, 0x7e, 0x6f, 0x65, 0x23, 0xa3, 0x9a, + 0xb1, 0x78, 0x7d, 0x08, 0x51, 0x0f, 0x9a, 0x2a, 0x56, 0xa4, 0x88, 0x15, 0xc9, 0x42, 0x9d, 0xe2, + 0xef, 0x8c, 0x67, 0x50, 0xb1, 0x7a, 0x88, 0xd5, 0x7d, 0xa8, 0x53, 0xf4, 0x11, 0xda, 0xd6, 0x28, + 0x51, 0xb2, 0xc8, 0x23, 0xaa, 0xf0, 0x61, 0x6f, 0xbb, 0xdf, 0x18, 0xfe, 0xb8, 0xd1, 0xb0, 0x35, + 0x37, 0x33, 0x4a, 0xbf, 0x15, 0xad, 0xad, 0x14, 0xba, 0x80, 0xc3, 0xca, 0x71, 0x59, 0x52, 0xcb, + 0x27, 0x2a, 0xc8, 0x42, 0x16, 0x42, 0xe3, 0x77, 0xf6, 0x91, 0x58, 0x76, 0x16, 0xab, 0xa0, 0xe4, + 0x6e, 0x4b, 0xaa, 0x7c, 0x24, 0xeb, 0x7d, 0x95, 0xf9, 0x22, 0xd4, 0x18, 0x1b, 0x97, 0x9d, 0x55, + 0x67, 0x0d, 0x5c, 0x16, 0x58, 0xbf, 0x3f, 0x99, 0x87, 0x8c, 0x13, 0x99, 0x51, 0x81, 0x8f, 0x6c, + 0x81, 0x6c, 0x75, 0xf3, 0x71, 0xc8, 0xf8, 0x5d, 0x46, 0xc5, 0xe9, 0xef, 0x70, 0xb0, 0x71, 0xc0, + 0xd0, 0x2e, 0x6c, 0xdf, 0x8d, 0xc7, 0xee, 0x1b, 0xd4, 0x80, 0xdd, 0xeb, 0x0f, 0xe3, 0xcb, 0x87, + 0x69, 0xe0, 0x3a, 0x08, 0x60, 0x67, 0x16, 0xf8, 0x37, 0xa3, 0xc0, 0xdd, 0x3a, 0x3d, 0x03, 0x58, + 0x0d, 0x0e, 0xaa, 0x43, 0xed, 0xd3, 0xdd, 0xa7, 0x0f, 0xee, 0x1b, 0xd4, 0x06, 0xb8, 0x7d, 0x08, + 0x1e, 0x2e, 0xa7, 0x24, 0x98, 0xce, 0x5c, 0x67, 0x52, 0xab, 0x37, 0xdc, 0xe6, 0xa4, 0x56, 0xef, + 0xb8, 0xee, 0xa4, 0x56, 0x77, 0xdd, 0xfd, 0x49, 0xad, 0xbe, 0xef, 0xa2, 0x49, 0xad, 0x8e, 0xdc, + 0xee, 0xa4, 0x56, 0x3f, 0x70, 0x0f, 0x4f, 0x15, 0x34, 0xd7, 0x7b, 0x87, 0x30, 0xec, 0x86, 0x71, + 0x5c, 0xda, 0xaa, 0xfe, 0xa8, 0xe5, 0x12, 0xdd, 0x40, 0x53, 0xf3, 0xf2, 0xd5, 0x69, 0xcd, 0x44, + 0xa2, 0xcc, 0x9f, 0xd4, 0x18, 0x9e, 0x55, 0x71, 0xac, 0x3e, 0xc8, 0x65, 0x28, 0x17, 0x5e, 0x30, + 0x9d, 0xcd, 0x2a, 0xb5, 0xdf, 0xd0, 0x5c, 0x2d, 0x17, 0x57, 0xfd, 0x7f, 0x9e, 0x4f, 0x9c, 0x7f, + 0x9f, 0x4f, 0x9c, 0xff, 0x9e, 0x4f, 0x9c, 0x3f, 0x8f, 0xed, 0x09, 0x4c, 0x0e, 0xc2, 0x8c, 0x0d, + 0x5e, 0x7d, 0xc2, 0x8f, 0x3b, 0xe6, 0xdb, 0xb8, 0xf8, 0x3f, 0x00, 0x00, 0xff, 0xff, 0x4a, 0x5f, + 0x27, 0x27, 0xed, 0x05, 0x00, 0x00, } diff --git a/mesh/v1alpha1/config.proto b/mesh/v1alpha1/config.proto index 997669f648..4ed253bc91 100644 --- a/mesh/v1alpha1/config.proto +++ b/mesh/v1alpha1/config.proto @@ -56,6 +56,11 @@ message MeshConfig { // is false, i.e. mixer policy check is enabled by default. bool disable_policy_checks = 3; + // Allow all traffic in cases when the mixer policy service cannot be reached. + // Default is false which means the traffic is denied when the client is unable + // to connect to Mixer. + bool policy_check_fail_open = 25; + // Port on which Envoy should listen for incoming connections from // other services. int32 proxy_listen_port = 4; @@ -153,7 +158,7 @@ message MeshConfig { bool enable_sds_token_mount = 23; // $hide_from_docs - // Next available field number: 25 + // Next available field number: 26 } // ConfigSource describes information about a configuration store inside a diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html index c8e07f12bf..c78edc388d 100644 --- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html +++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html @@ -136,6 +136,16 @@

MeshConfig

Disable policy checks by the mixer service. Default is false, i.e. mixer policy check is enabled by default.

+ + + + + + diff --git a/python/istio_api/mesh/v1alpha1/config_pb2.py b/python/istio_api/mesh/v1alpha1/config_pb2.py index 98825c8ae9..0d32c45cae 100644 --- a/python/istio_api/mesh/v1alpha1/config_pb2.py +++ b/python/istio_api/mesh/v1alpha1/config_pb2.py @@ -22,7 +22,7 @@ name='mesh/v1alpha1/config.proto', package='istio.mesh.v1alpha1', syntax='proto3', - serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xc0\x06\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01J\x04\x08\x0b\x10\x0cJ\x04\x08\x0f\x10\x10J\x04\x08\x10\x10\x11J\x04\x08\x11\x10\x12J\x04\x08\x12\x10\x13J\x04\x08\x15\x10\x16\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettingsB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3') + serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xe0\x06\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x1e\n\x16policy_check_fail_open\x18\x19 \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01J\x04\x08\x0b\x10\x0cJ\x04\x08\x0f\x10\x10J\x04\x08\x10\x10\x11J\x04\x08\x11\x10\x12J\x04\x08\x12\x10\x13J\x04\x08\x15\x10\x16\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettingsB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3') , dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,mesh_dot_v1alpha1_dot_proxy__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_destination__rule__pb2.DESCRIPTOR,]) @@ -49,8 +49,8 @@ ], containing_type=None, options=None, - serialized_start=854, - serialized_end=911, + serialized_start=886, + serialized_end=943, ) _sym_db.RegisterEnumDescriptor(_MESHCONFIG_INGRESSCONTROLLERMODE) @@ -71,8 +71,8 @@ ], containing_type=None, options=None, - serialized_start=913, - serialized_end=951, + serialized_start=945, + serialized_end=983, ) _sym_db.RegisterEnumDescriptor(_MESHCONFIG_AUTHPOLICY) @@ -106,105 +106,112 @@ is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='proxy_listen_port', full_name='istio.mesh.v1alpha1.MeshConfig.proxy_listen_port', index=3, + name='policy_check_fail_open', full_name='istio.mesh.v1alpha1.MeshConfig.policy_check_fail_open', index=3, + number=25, type=8, cpp_type=7, label=1, + has_default_value=False, default_value=False, + message_type=None, enum_type=None, containing_type=None, + is_extension=False, extension_scope=None, + options=None, file=DESCRIPTOR), + _descriptor.FieldDescriptor( + name='proxy_listen_port', full_name='istio.mesh.v1alpha1.MeshConfig.proxy_listen_port', index=4, number=4, type=5, cpp_type=1, label=1, has_default_value=False, default_value=0, message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='proxy_http_port', full_name='istio.mesh.v1alpha1.MeshConfig.proxy_http_port', index=4, + name='proxy_http_port', full_name='istio.mesh.v1alpha1.MeshConfig.proxy_http_port', index=5, number=5, type=5, cpp_type=1, label=1, has_default_value=False, default_value=0, message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='connect_timeout', full_name='istio.mesh.v1alpha1.MeshConfig.connect_timeout', index=5, + name='connect_timeout', full_name='istio.mesh.v1alpha1.MeshConfig.connect_timeout', index=6, number=6, type=11, cpp_type=10, label=1, has_default_value=False, default_value=None, message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='ingress_class', full_name='istio.mesh.v1alpha1.MeshConfig.ingress_class', index=6, + name='ingress_class', full_name='istio.mesh.v1alpha1.MeshConfig.ingress_class', index=7, number=7, type=9, cpp_type=9, label=1, has_default_value=False, default_value=_b("").decode('utf-8'), message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='ingress_service', full_name='istio.mesh.v1alpha1.MeshConfig.ingress_service', index=7, + name='ingress_service', full_name='istio.mesh.v1alpha1.MeshConfig.ingress_service', index=8, number=8, type=9, cpp_type=9, label=1, has_default_value=False, default_value=_b("").decode('utf-8'), message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='ingress_controller_mode', full_name='istio.mesh.v1alpha1.MeshConfig.ingress_controller_mode', index=8, + name='ingress_controller_mode', full_name='istio.mesh.v1alpha1.MeshConfig.ingress_controller_mode', index=9, number=9, type=14, cpp_type=8, label=1, has_default_value=False, default_value=0, message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='auth_policy', full_name='istio.mesh.v1alpha1.MeshConfig.auth_policy', index=9, + name='auth_policy', full_name='istio.mesh.v1alpha1.MeshConfig.auth_policy', index=10, number=10, type=14, cpp_type=8, label=1, has_default_value=False, default_value=0, message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001')), file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='enable_tracing', full_name='istio.mesh.v1alpha1.MeshConfig.enable_tracing', index=10, + name='enable_tracing', full_name='istio.mesh.v1alpha1.MeshConfig.enable_tracing', index=11, number=12, type=8, cpp_type=7, label=1, has_default_value=False, default_value=False, message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='access_log_file', full_name='istio.mesh.v1alpha1.MeshConfig.access_log_file', index=11, + name='access_log_file', full_name='istio.mesh.v1alpha1.MeshConfig.access_log_file', index=12, number=13, type=9, cpp_type=9, label=1, has_default_value=False, default_value=_b("").decode('utf-8'), message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='access_log_format', full_name='istio.mesh.v1alpha1.MeshConfig.access_log_format', index=12, + name='access_log_format', full_name='istio.mesh.v1alpha1.MeshConfig.access_log_format', index=13, number=24, type=9, cpp_type=9, label=1, has_default_value=False, default_value=_b("").decode('utf-8'), message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='default_config', full_name='istio.mesh.v1alpha1.MeshConfig.default_config', index=13, + name='default_config', full_name='istio.mesh.v1alpha1.MeshConfig.default_config', index=14, number=14, type=11, cpp_type=10, label=1, has_default_value=False, default_value=None, message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='enable_client_side_policy_check', full_name='istio.mesh.v1alpha1.MeshConfig.enable_client_side_policy_check', index=14, + name='enable_client_side_policy_check', full_name='istio.mesh.v1alpha1.MeshConfig.enable_client_side_policy_check', index=15, number=19, type=8, cpp_type=7, label=1, has_default_value=False, default_value=False, message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='sds_uds_path', full_name='istio.mesh.v1alpha1.MeshConfig.sds_uds_path', index=15, + name='sds_uds_path', full_name='istio.mesh.v1alpha1.MeshConfig.sds_uds_path', index=16, number=20, type=9, cpp_type=9, label=1, has_default_value=False, default_value=_b("").decode('utf-8'), message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='config_sources', full_name='istio.mesh.v1alpha1.MeshConfig.config_sources', index=16, + name='config_sources', full_name='istio.mesh.v1alpha1.MeshConfig.config_sources', index=17, number=22, type=11, cpp_type=10, label=3, has_default_value=False, default_value=[], message_type=None, enum_type=None, containing_type=None, is_extension=False, extension_scope=None, options=None, file=DESCRIPTOR), _descriptor.FieldDescriptor( - name='enable_sds_token_mount', full_name='istio.mesh.v1alpha1.MeshConfig.enable_sds_token_mount', index=17, + name='enable_sds_token_mount', full_name='istio.mesh.v1alpha1.MeshConfig.enable_sds_token_mount', index=18, number=23, type=8, cpp_type=7, label=1, has_default_value=False, default_value=False, message_type=None, enum_type=None, containing_type=None, @@ -225,7 +232,7 @@ oneofs=[ ], serialized_start=155, - serialized_end=987, + serialized_end=1019, ) @@ -262,8 +269,8 @@ extension_ranges=[], oneofs=[ ], - serialized_start=989, - serialized_end=1082, + serialized_start=1021, + serialized_end=1114, ) _MESHCONFIG.fields_by_name['connect_timeout'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION
FieldTypeDescription
addressstring +

Address of the server implementing the Istio Mesh Configuration +protocol (MCP). Can be IP address or a fully qualified DNS name. +Use file:/// to specify a file-based backend with absolute path to the directory.

+ +
tlsSettingsistio.networking.v1alpha3.TLSSettings +

Use the tlssettings to specify the tls mode to use. If the MCP server +uses Istio MTLS and shares the root CA with Pilot, specify the TLS +mode as ISTIOMUTUAL.

+
galleyAddressstring
configSourcesConfigSource[] -

Address of the galley service exposing the Mesh Control Protocol (MCP).

+

ConfigSource describes a source of configuration data for networking +rules, and other Istio configuration artifacts. Multiple data sources +can be configured for a single control plane.
policyCheckFailOpenbool +

Allow all traffic in cases when the mixer policy service cannot be reached. +Default is false which means the traffic is denied when the client is unable +to connect to Mixer.

+