[RELEASE 0.1] Change our configurations to work with Istio 1.0 validation.#1725
[RELEASE 0.1] Change our configurations to work with Istio 1.0 validation.#1725mattmoor merged 1 commit intoknative:release-0.1from
Conversation
- Set a default TLS mode. - Change header names to lowercase.
google-prow-robot
added
the
size/S
|
/assign @mattmoor |
mattmoor
changed the title
|
/lgtm This LGTM, thanks for putting this together to quickly. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: mattmoor, tcnghia The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
google-prow-robot
added
the
approved
|
/hold For a second set of eyes (I suspect I will need to merge anyways given the branch ACL) |
google-prow-robot
added
the
do-not-merge/hold
| hosts: | ||
| - "*" | ||
| tls: | ||
| mode: PASSTHROUGH |
There was a problem hiding this comment.
this seems to mean that SNI is used to route, is it always there?
There was a problem hiding this comment.
Docs for this option are scant: https://istio.io/docs/reference/config/istio.networking.v1alpha3/#Server.TLSOptions.TLSmode
I'm also curious how this value was chosen. Is it intended to have the same behavior as before?
grantr
left a comment
grantr
left a comment
There was a problem hiding this comment.
LGTM but I'm also curious about tls mode setting.
| hosts: | ||
| - "*" | ||
| tls: | ||
| mode: PASSTHROUGH |
There was a problem hiding this comment.
Docs for this option are scant: https://istio.io/docs/reference/config/istio.networking.v1alpha3/#Server.TLSOptions.TLSmode
I'm also curious how this value was chosen. Is it intended to have the same behavior as before?
|
@grantr that is the only mode that doesn't require a SSL cert to be set. We have instructions to update the cert in I already checked these changes into our master yesterday. We could let that bake for a while before applying this patch to have more surety. |
|
Istio released their 1.0 so I'd like to check this in and create a 0.1.1 |
|
@tcnghia find me tomorrow, and unless someone speaks up we can merge this. |
|
/hold cancel |
google-prow-robot
removed
the
do-not-merge/hold
|
/retest |
|
@tcnghia: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
7 participants
Istio has tightened several aspects of its validation in 1.0:
tls.modeto be set when we useHTTPS, and