fix EnvoyFilter docs

authentication/v1alpha1/policy.proto

@@ -155,7 +155,7 @@ message Jwt {
   // the issuer or (b) inferred from the email domain of the issuer (e.g. a
   // Google service account).
   //
-  // Example: https://www.googleapis.com/oauth2/v1/certs
+  // Example: `https://www.googleapis.com/oauth2/v1/certs`
   string jwks_uri = 3;
 
   // Two fields below define where to extract the JWT from an HTTP request.
@@ -274,7 +274,7 @@ enum PrincipalBinding {
 // apiVersion: authentication.istio.io/v1alpha1
 // kind: Policy
 // metadata:
-//   name: productpage_mTLS_disable
+//   name: productpage-mTLS-disable
 //   namespace: frod
 // spec:
 //   targets:
@@ -287,7 +287,7 @@ enum PrincipalBinding {
 // apiVersion: authentication.istio.io/v1alpha1
 // kind: Policy
 // metadata:
-//   name: productpage_mTLS_with_JWT
+//   name: productpage-mTLS-with-JWT
 //   namespace: frod
 // spec:
 //   target:

dictionaries/custom.txt

@@ -13,6 +13,7 @@ jitter
 JSON
 JWT
 Kubernetes
+LightStep
 MCP
 multicluster
 NACK
@@ -27,6 +28,7 @@ scalability
 SDS
 SNI
 SPIFFE
+subnet
 TCP
 TLS
 UDP
@@ -35,3 +37,5 @@ unmanaged
 unterminated
 URI
 URL
+VM
+Zipkin

envoy/config/filter/http/jwt_auth/v2alpha1/config.proto

@@ -69,15 +69,14 @@ message DataSource {
   }
 }
 
-// This message specifies how a JSON Web Token (JWT) can be verified. JWT format is defined
-// `here <https://tools.ietf.org/html/rfc7519>`_. Please see `OAuth2.0
-//  <https://tools.ietf.org/html/rfc6749>`_ and `OIDC1.0  <http://openid.net/connect>`_ for
+// This message specifies how a JSON Web Token (JWT) can be verified. See the [JWT format definition](https://tools.ietf.org/html/rfc7519)
+// for details. Please see [OAuth2.0](https://tools.ietf.org/html/rfc6749) and
+// [OIDC1.0](http://openid.net/connect) for
 // the authentication flow.
 //
 // Example:
 //
-// .. code-block:: yaml
-//
+// ```yaml
 //     issuer: https://example.com
 //     audiences:
 //     - bookstore_android.apps.googleusercontent.com
@@ -88,8 +87,7 @@ message DataSource {
 //         cluster: example_jwks_cluster
 //       cache_duration:
 //       - seconds: 300
-//
-// [#not-implemented-hide:]
+// ```
 message JwtRule {
   // Identifies the principal that issued the JWT. See `here
   //  <https://tools.ietf.org/html/rfc7519#section-4.1.1>`_. Usually a URL or an email address.

mesh/v1alpha1/config.proto

@@ -196,7 +196,7 @@ message MeshConfig {
 
   // $hide_from_docs
   // This flag is used by secret discovery service(SDS).
-  // If set to true(prerequisite: https://kubernetes.io/docs/concepts/storage/volumes/#projected), Istio will inject volumes mount
+  // If set to true ([prerequisite](https://kubernetes.io/docs/concepts/storage/volumes/#projected)), Istio will inject volumes mount
   // for Kubernetes service account trustworthy JWT(which is available with Kubernetes 1.12 or higher), so that the Kubernetes API server
   // mounts Kubernetes service account trustworthy JWT to the Envoy container, which will be used to request key/cert eventually.
   // This isn't supported for non-Kubernetes cases.
@@ -261,7 +261,7 @@ message MeshConfig {
 
   // $hide_from_docs
   // The namespace to treat as the administrative root namespace for
-  // istio configuration. When processing a leaf namespace Istio will search for
+  // Istio configuration. When processing a leaf namespace Istio will search for
   // declarations in that namespace first and if none are found it will
   // search in the root namespace. Any matching declaration found in the root
   // namespace is processed as if it were declared in the leaf namespace.
@@ -270,8 +270,8 @@ message MeshConfig {
   // type.
   //
   // There is no default value for this flag in 1.1 but in later releases it
-  // is expected to default to a new namespace, "istio-config", which is
-  // maintained separately from the "istio-system" namespace where an instance
+  // is expected to default to a new namespace, `istio-config`, which is
+  // maintained separately from the `istio-system` namespace where an instance
   // of the control plane runtime is deployed. This separates the concerns of
   // configuring the control-plane runtime from configuration of the mesh.
   string root_namespace = 34;
@@ -297,7 +297,7 @@ message ConfigSource {
 
   // Use the tls_settings to specify the tls mode to use. If the MCP server
   // uses Istio mutual TLS and shares the root CA with Pilot, specify the TLS
-  // mode as ISTIO_MUTUAL.
+  // mode as `ISTIO_MUTUAL`.
   istio.networking.v1alpha3.TLSSettings tls_settings = 2;
 }
 
@@ -385,7 +385,7 @@ message LocalityLoadBalancerSetting{
 
   // Optional: only one of distribute or failover can be set.
   // Explicitly specify loadbalancing weight across different zones and geographical locations.
-  // Refer to [Locality weighted load balancing](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing.html?highlight=load_balancing_weight#locality-weighted-load-balancing)
+  // Refer to [Locality weighted load balancing](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/load_balancing/locality_weight)
   // If empty, the locality weight is set according to the endpoints number within it.
   repeated Distribute distribute = 1;