Proxy config: Add tls_certs_to_watch field #824

drichelson · 2019-02-28T00:29:02Z

See comments here for context

istio-testing · 2019-02-28T00:29:18Z

Hi @drichelson. Thanks for your PR.

I'm waiting for a istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

rshriram · 2019-02-28T01:18:34Z

/ok-to-test

rshriram · 2019-02-28T01:20:30Z

mesh/v1alpha1/proxy.proto

  // Tracing configuration to be used by the proxy.
  Tracing tracing = 19;
+
+  // Absolute paths to cert/key files to watch for changes (e.g. /etc/certs/key.pem,/etc/certs/cert.pem)


Absolute path to certs/key files used for istio mTLS. If omitted, defaults to /etc/certs/...

rshriram

fix comment

istio-testing · 2019-02-28T01:50:04Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: drichelson
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: kyessenov

If they are not already assigned, you can assign the PR to them by writing /assign @kyessenov in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

hzxuzhonghu · 2019-02-28T02:17:00Z

mesh/v1alpha1/proxy.proto

+
+  // Absolute path to certs/key files used for istio mTLS. If omitted, defaults to
+  // /etc/certs/cert-chain.pem,/etc/certs/key.pem,/etc/certs/root-cert.pem
+  repeated string tls_certs_to_watch = 21;


I have a question : how can you distinguish which is the key/cert file?

we dont. pilot agent simply watches files in that path and if any of them change, it forces envoy to restart

This reverts commit e613e35.

* Doc fixes. * Add high-level overview and diagrams for MCP (#805) * document MCP * add additional note on NACK behavior * add a note about ignoring stale nonces * Add envoy metrics service configuration to ProxyConfig (#803) * Add envoy metrics service configuration to ProxyConfig Similar to the statsd sink config, this change is in preparation for adding support for the envoy metrics service API. * Update proto.lock * Reorder metrics_service_address just after statsd_udp_address * Update comment in the authN API to match with 1.1 behavior (#808) * Rename metrics_service_address to clarify that it is for Envoy's API (#809) Since "metrics service" is so ambiguous, this change specifically denotes that the config is for Envoy's metrics service API. The comments also now link to detailed info about the metrics service API. * Generate separate HTML page per proto under networking (#811) * Generate separate pages for each networking proto Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * update Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * tweaks Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * Fix interdoc references * separate doc and go gen * change dash to underscore * fix * more fixes * makefile fix Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * remove bad target * Revert "change dash to underscore" This reverts commit 7fbced6. * final update Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * Revert "Generate separate HTML page per proto under networking (#811)" This reverts commit 5f14ead since it breaks the ability to generate reference docs in istio.io * Update to latest tools. * Revert "Update to latest tools." This reverts commit 231fadc which I accidentally pushed to the wrong place. * fix mcp update error diagram (#810) * update istio/tools (#815) * Revert "Revert "Generate separate HTML page per proto under networking (#811)"" (#818) * Minor updates for building docker images. (#817) * Add spell checking for docs. (#819) * Add a bunch of words to the custom dictionary. * Document exportTo restrictions (#820) * Doc fixes. (#821) * Proxy config: Add tls_certs_to_watch field (#824) * Proxy config: Add tls_certs_to_watch field * Address PR comment * Revert "Proxy config: Add tls_certs_to_watch field (#824)" (#825) This reverts commit e613e35. * Update gateway and sidecar hosts doc (#826) * Update gateway and sidecar hosts doc * regen * review comments * Update API docs (service entry, gateway, sidecar) (#831) * Update sidecar and gateway docs Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * gen docs Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * update service entry Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * updates Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * add configurable dns refresh rate to mesh for strict dns cluster, (#832) * add configurable dns refresh rate to mesh for strict dns cluster, issue #12181 * add lock file * Post-merge generation

* Doc fixes. * Add high-level overview and diagrams for MCP (#805) * document MCP * add additional note on NACK behavior * add a note about ignoring stale nonces * Add envoy metrics service configuration to ProxyConfig (#803) * Add envoy metrics service configuration to ProxyConfig Similar to the statsd sink config, this change is in preparation for adding support for the envoy metrics service API. * Update proto.lock * Reorder metrics_service_address just after statsd_udp_address * Update comment in the authN API to match with 1.1 behavior (#808) * Rename metrics_service_address to clarify that it is for Envoy's API (#809) Since "metrics service" is so ambiguous, this change specifically denotes that the config is for Envoy's metrics service API. The comments also now link to detailed info about the metrics service API. * Generate separate HTML page per proto under networking (#811) * Generate separate pages for each networking proto Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * update Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * tweaks Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * Fix interdoc references * separate doc and go gen * change dash to underscore * fix * more fixes * makefile fix Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * remove bad target * Revert "change dash to underscore" This reverts commit 7fbced6. * final update Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * Revert "Generate separate HTML page per proto under networking (#811)" This reverts commit 5f14ead since it breaks the ability to generate reference docs in istio.io * Update to latest tools. * Revert "Update to latest tools." This reverts commit 231fadc which I accidentally pushed to the wrong place. * fix mcp update error diagram (#810) * update istio/tools (#815) * Revert "Revert "Generate separate HTML page per proto under networking (#811)"" (#818) * Minor updates for building docker images. (#817) * Add spell checking for docs. (#819) * Add a bunch of words to the custom dictionary. * Document exportTo restrictions (#820) * Doc fixes. (#821) * Proxy config: Add tls_certs_to_watch field (#824) * Proxy config: Add tls_certs_to_watch field * Address PR comment * Revert "Proxy config: Add tls_certs_to_watch field (#824)" (#825) This reverts commit e613e35. * Update gateway and sidecar hosts doc (#826) * Update gateway and sidecar hosts doc * regen * review comments * Update API docs (service entry, gateway, sidecar) (#831) * Update sidecar and gateway docs Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * gen docs Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * update service entry Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * updates Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * add configurable dns refresh rate to mesh for strict dns cluster, (#832) * add configurable dns refresh rate to mesh for strict dns cluster, issue #12181 * add lock file * Hosts are not ignored in ServiceEntry for HTTPs (#833) * Hosts are not ignored in ServiceEntry for HTTPs * Clarify * Reword * Generate protos * Address code review comments * Fix typo * generate * make mixer config marshal deterministic (#846) Signed-off-by: Kuat Yessenov <kuat@google.com> * Fix some doc errors. (#854) This started out to just fix a bad link to unblock work on istio.io, but I ended up fixing a bunch of typos/incorrect format throughout. * Fix two more broken links. (#856) * Fix CRD examples for release-1.1 (#859) * fix MeshNetworks demo (#841) * fix MeshNetworks demo * generate * update * last minute doc fixes (#865) Signed-off-by: Shriram Rajagopalan <rshriram@gmail.com> * Clarify comment for server_name field in Mixer oop auth config (#800) * add mixerclient config to istio.io reference docs (#827) * Envoyfilter docs fix (#867) * Tweaks to get the mixer client config docs to be published. (#868) * Change where the Mixer client docs are published.

Proxy config: Add tls_certs_to_watch field

9e8fb7f

istio-testing requested review from frankbu and kyessenov February 28, 2019 00:29

drichelson changed the base branch from master to release-1.1 February 28, 2019 00:29

googlebot added the cla: yes Set by the Google CLA bot to indicate the author of a PR has signed the Google CLA. label Feb 28, 2019

istio-testing added the needs-ok-to-test label Feb 28, 2019

drichelson mentioned this pull request Feb 28, 2019

do not hardcode cert watch path in pilot agent istio/istio#12142

Closed

istio-testing added ok-to-test Set this label allow normal testing to take place for a PR not submitted by an Istio org member. and removed needs-ok-to-test labels Feb 28, 2019

rshriram reviewed Feb 28, 2019

View reviewed changes

rshriram approved these changes Feb 28, 2019

View reviewed changes

Address PR comment

e727b42

hzxuzhonghu reviewed Feb 28, 2019

View reviewed changes

rshriram approved these changes Feb 28, 2019

View reviewed changes

rshriram merged commit e613e35 into istio:release-1.1 Feb 28, 2019

rshriram added a commit that referenced this pull request Feb 28, 2019

Revert "Proxy config: Add tls_certs_to_watch field (#824)"

f74bfcc

This reverts commit e613e35.

rshriram mentioned this pull request Feb 28, 2019

Revert "Proxy config: Add tls_certs_to_watch field" #825

Merged

rshriram added a commit that referenced this pull request Feb 28, 2019

Revert "Proxy config: Add tls_certs_to_watch field (#824)" (#825)

4fd261a

This reverts commit e613e35.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Proxy config: Add tls_certs_to_watch field #824

Proxy config: Add tls_certs_to_watch field #824

Uh oh!

drichelson commented Feb 28, 2019

Uh oh!

istio-testing commented Feb 28, 2019

Uh oh!

rshriram commented Feb 28, 2019

Uh oh!

rshriram Feb 28, 2019

Uh oh!

rshriram left a comment

Uh oh!

istio-testing commented Feb 28, 2019

Uh oh!

hzxuzhonghu Feb 28, 2019

Uh oh!

rshriram Feb 28, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Proxy config: Add tls_certs_to_watch field #824

Proxy config: Add tls_certs_to_watch field #824

Uh oh!

Conversation

drichelson commented Feb 28, 2019

Uh oh!

istio-testing commented Feb 28, 2019

Uh oh!

rshriram commented Feb 28, 2019

Uh oh!

rshriram Feb 28, 2019

Choose a reason for hiding this comment

Uh oh!

rshriram left a comment

Choose a reason for hiding this comment

Uh oh!

istio-testing commented Feb 28, 2019

Uh oh!

hzxuzhonghu Feb 28, 2019

Choose a reason for hiding this comment

Uh oh!

rshriram Feb 28, 2019

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants