Add blog on inbound forwarding changes #9150

howardjohn · 2021-03-08T16:37:23Z

This adds a new blog post to describe upcoming changes, and how users can detect and plan for the change

istio-testing · 2021-03-08T16:37:42Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

content/en/blog/2021/upcoming-networking-changes/index.md

frankbu · 2021-04-08T15:58:32Z

content/en/blog/2021/upcoming-networking-changes/index.md

+For new users, this change should only be an improvement.
+However, if you are an existing user, you may have come to depend on the old behavior, intentionally or accidentally.
+
+To help detect these situations, we have added a check to find pods that will be impacted.


What version of istioctl has these checks? Is it already in 1.9? If we post the blog before Istio 1.10 is released, you should mention what version they need to use to do the checking.

1.10 only unfortunately, and not easy to backport. Ill add a note

rvennam · 2021-04-07T23:59:25Z

content/en/blog/2021/upcoming-networking-changes/index.md

+However, if you are an existing user, you may have come to depend on the old behavior, intentionally or accidentally.
+
+To help detect these situations, we have added a check to find pods that will be impacted.
+You can run the `istioctl precheck` command to get a report of any pods binding to `lo` on a port exposed in a `Service`.


istioctl experimental precheck right?

linsun · 2021-04-09T20:01:37Z

Q @howardjohn on the background and current behavior diagram, the application containers are 2 app containers? Are they really complete 2 different containers? Think of our samples like sleep or product page, it is just 1 app container.

howardjohn · 2021-04-09T20:04:29Z

Q @howardjohn on the background and current behavior diagram, the application containers are 2 app containers? Are they really complete 2 different containers? Think of our samples like sleep or product page, it is just 1 app container.

No, its supposed to be one app. Its just saying it can bind to one or both network interfaces. Maybe it would be more clear to have one blob that is the app

linsun · 2021-04-09T20:04:45Z

content/en/blog/2021/upcoming-networking-changes/index.md

+To help detect these situations, we have added a check to find pods that will be impacted.
+You can run the `istioctl experimental precheck` command to get a report of any pods binding to `lo` on a port exposed in a `Service`.
+This command is available in Istio 1.10+.
+Without action, these ports will no longer be accessible upon upgrade.


Suggested change

Without action, these ports will no longer be accessible upon upgrade.

**Without action, these ports will no longer be accessible upon upgrade.**

Suggest highlight this.

I think it makes sense to say if the error (since you are changing the msg from warning to error) has occurred, you must use revision based upgrade to thoroughly test your application continues to work with the new control plane.

linsun · 2021-04-09T20:12:59Z

content/en/blog/2021/upcoming-networking-changes/index.md

+If you are currently binding to `lo`, you have a few options:
+
+* Switch your application to bind to all interfaces (`0.0.0.0` or `::`).
+* Explicitly configure the port using the [`Sidecar` ingress configuration](/docs/reference/config/networking/sidecar/#IstioIngressListener) to send to `lo`, preserving the old behavior.


Is the configuration for the port or defaultEndpoint field in sidecar resource? A simple example would be really helpful here.

Walking through a migration scenario, if I create the sidecar resource for my istio 1.10 cp, and also created my app with 1.10's data plane, would that sidecar resource break traffic for my app with 1.9's data plane? (Correct me if I am wrong, I think our sidecar resource is global for a ns regardless of which control plane revision?)

Is the configuration for the port or defaultEndpoint field in sidecar resource

Both are required fields

The steps would be:

Create sidecar in 1.9. This is scoped to a workload. It has no impact.

Upgrade to 1.10. Because of sidecar explicitly saying to connect to localhost, there is no change in behavior

Yea was trying to see if we could isolate the sidecar only for 1.10. I don't think we could. In that case, user should validate sidecar resource has no impact to the app (1.9 based) first before upgrading to 1.10.

Note: some of the stateful apps, we ask users to change certain configs to listen on localhost, probably a good time to revert that change after testing.

You can with istio.io/rev, but there is no real reason to. I already changed that in https://preliminary.istio.io/latest/about/faq#applications.

linsun · 2021-04-09T20:14:12Z

Q @howardjohn on the background and current behavior diagram, the application containers are 2 app containers? Are they really complete 2 different containers? Think of our samples like sleep or product page, it is just 1 app container.

No, its supposed to be one app. Its just saying it can bind to one or both network interfaces. Maybe it would be more clear to have one blob that is the app

Yes, I think it would.

mandarjog · 2021-04-09T21:03:21Z

@howardjohn the blog title is too vague.
“Upcoming changes ...”

We need to make it more about the specific topic about inbound networking and the fast that it is a breaking change.

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

frankbu · 2021-04-14T12:49:15Z

content/en/blog/2021/upcoming-networking-changes/index.md

@@ -0,0 +1,91 @@
+---
+title: "Upcoming changes to Istio networking In Istio 1.10"


Suggested change

title: "Upcoming changes to Istio networking In Istio 1.10"

title: "Upcoming networking changes In Istio 1.10"

frankbu · 2021-04-14T12:50:57Z

content/en/blog/2021/upcoming-networking-changes/index.md

+For example, to configure request to be sent to `localhost` for the `ratings` application:
+
+{{< text yaml >}}
+apiVersion: networking.istio.io/v1beta1
+kind: Sidecar
+metadata:
+  name: ratings
+spec:
+  workloadSelector:
+    labels:
+      app: ratings
+  ingress:
+  - port:
+      number: 8080
+      protocol: HTTP
+      name: http
+    defaultEndpoint: 127.0.0.1:8080
+{{< /text >}}


Suggested change

For example, to configure request to be sent to `localhost` for the `ratings` application:

{{< text yaml >}}

apiVersion: networking.istio.io/v1beta1

kind: Sidecar

metadata:

name: ratings

spec:

workloadSelector:

labels:

app: ratings

ingress:

- port:

number: 8080

protocol: HTTP

name: http

defaultEndpoint: 127.0.0.1:8080

{{< /text >}}

For example, to configure request to be sent to `localhost` for the `ratings` application:

{{< text yaml >}}

apiVersion: networking.istio.io/v1beta1

kind: Sidecar

metadata:

name: ratings

spec:

workloadSelector:

labels:

app: ratings

ingress:

- port:

number: 8080

protocol: HTTP

name: http

defaultEndpoint: 127.0.0.1:8080

{{< /text >}}

linsun · 2021-04-14T13:19:21Z

content/en/blog/2021/upcoming-networking-changes/index.md

+    defaultEndpoint: 127.0.0.1:8080
+{{< /text >}}
+
+* Disable the change entirely with the `PILOT_ENABLE_INBOUND_PASSTHROUGH=false` environment variable in Istiod. This option will be removed in the future.


Suggested change

* Disable the change entirely with the `PILOT_ENABLE_INBOUND_PASSTHROUGH=false` environment variable in Istiod. This option will be removed in the future.

* Disable the change entirely with the `PILOT_ENABLE_INBOUND_PASSTHROUGH=false` environment variable in Istiod to enable the same behavior as prior to Istio 1.10. This option will be removed in the future.

linsun · 2021-04-14T13:19:50Z

@howardjohn thank you - it is pretty clear to me!

howardjohn · 2021-04-14T16:36:41Z

@linsun @frankbu thanks, I applied your comments

google-cla · 2021-04-14T16:36:42Z

All (the pull request submitter and all commit authors) CLAs are signed, but one or more commits were authored or co-authored by someone other than the pull request submitter.

We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that by leaving a comment that contains only @googlebot I consent. in this pull request.

Note to project maintainer: There may be cases where the author cannot leave a comment, or the comment is not properly detected as consent. In those cases, you can manually confirm consent of the commit author(s), and set the cla label to yes (if enabled on your project).

ℹ️ Googlers: Go here for more info.

craigbox · 2021-04-14T16:38:04Z

@frankbu please pay homage to Googlebot when you have a chance.

content/en/blog/2021/upcoming-networking-changes/index.md

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

google-cla · 2021-04-15T03:30:27Z

All (the pull request submitter and all commit authors) CLAs are signed, but one or more commits were authored or co-authored by someone other than the pull request submitter.

We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that by leaving a comment that contains only @googlebot I consent. in this pull request.

Note to project maintainer: There may be cases where the author cannot leave a comment, or the comment is not properly detected as consent. In those cases, you can manually confirm consent of the commit author(s), and set the cla label to yes (if enabled on your project).

ℹ️ Googlers: Go here for more info.

howardjohn · 2021-04-15T03:37:26Z

Does anyone mind if I make a post on #announcenents to get some extra eyes on this?

frankbu · 2021-04-15T13:02:08Z

/test doc.test.profile_default_istio.io

ericvn · 2021-04-15T13:49:37Z

/retest

istio-testing · 2021-04-15T16:34:53Z

In response to a cherrypick label: new pull request created: #9532

istio-testing added the do-not-merge/work-in-progress Block merging of a PR because it isn't ready yet. label Mar 8, 2021

google-cla bot added the cla: yes Set by the Google CLA bot to indicate the author of a PR has signed the Google CLA. label Mar 8, 2021

istio-testing added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Mar 8, 2021

howardjohn changed the title ~~WIP: Add blog on inbound forwarding changes~~ Add blog on inbound forwarding changes Mar 25, 2021

howardjohn force-pushed the blog/inbound-forwarding branch from 09786a9 to 139da7c Compare March 25, 2021 18:25

istio-policy-bot added the lifecycle/stale Indicates a PR or issue hasn't been manipulated by an Istio team member for a while label Apr 7, 2021

howardjohn marked this pull request as ready for review April 7, 2021 23:31

howardjohn requested a review from a team as a code owner April 7, 2021 23:31

istio-testing removed the do-not-merge/work-in-progress Block merging of a PR because it isn't ready yet. label Apr 7, 2021

frankbu reviewed Apr 8, 2021

View reviewed changes

content/en/blog/2021/upcoming-networking-changes/index.md Outdated Show resolved Hide resolved

istio-policy-bot removed the lifecycle/stale Indicates a PR or issue hasn't been manipulated by an Istio team member for a while label Apr 8, 2021

frankbu reviewed Apr 8, 2021

View reviewed changes

content/en/blog/2021/upcoming-networking-changes/index.md Outdated Show resolved Hide resolved

frankbu reviewed Apr 8, 2021

View reviewed changes

content/en/blog/2021/upcoming-networking-changes/index.md Outdated Show resolved Hide resolved

frankbu reviewed Apr 8, 2021

View reviewed changes

content/en/blog/2021/upcoming-networking-changes/index.md Outdated Show resolved Hide resolved

frankbu reviewed Apr 8, 2021

View reviewed changes

content/en/blog/2021/upcoming-networking-changes/index.md Outdated Show resolved Hide resolved

frankbu reviewed Apr 8, 2021

View reviewed changes

content/en/blog/2021/upcoming-networking-changes/index.md Outdated Show resolved Hide resolved

frankbu added the cherrypick/release-1.9 label Apr 8, 2021

frankbu reviewed Apr 8, 2021

View reviewed changes

rvennam reviewed Apr 8, 2021

View reviewed changes

linsun reviewed Apr 9, 2021

View reviewed changes

howardjohn and others added 4 commits April 13, 2021 13:30

Add blog on inbound forwarding changes

e4d2c87

updates

6fd17d6

updates

efc4d36

Apply suggestions from code review

e2a6056

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

howardjohn added the cla: yes Set by the Google CLA bot to indicate the author of a PR has signed the Google CLA. label Apr 13, 2021

howardjohn requested review from frankbu, linsun and rvennam April 13, 2021 21:21

frankbu reviewed Apr 14, 2021

View reviewed changes

linsun reviewed Apr 14, 2021

View reviewed changes

address comments

f670bf6

google-cla bot added cla: no Set by the Google CLA bot to indicate the author of a PR has not signed the Google CLA. and removed cla: yes Set by the Google CLA bot to indicate the author of a PR has signed the Google CLA. labels Apr 14, 2021

howardjohn added cla: yes Set by the Google CLA bot to indicate the author of a PR has signed the Google CLA. and removed cla: no Set by the Google CLA bot to indicate the author of a PR has not signed the Google CLA. labels Apr 14, 2021

frankbu reviewed Apr 15, 2021

View reviewed changes

content/en/blog/2021/upcoming-networking-changes/index.md Outdated Show resolved Hide resolved

Update content/en/blog/2021/upcoming-networking-changes/index.md

ac78903

Co-authored-by: Frank Budinsky <frankb@ca.ibm.com>

google-cla bot added cla: no Set by the Google CLA bot to indicate the author of a PR has not signed the Google CLA. and removed cla: yes Set by the Google CLA bot to indicate the author of a PR has signed the Google CLA. labels Apr 15, 2021

howardjohn added cla: yes Set by the Google CLA bot to indicate the author of a PR has signed the Google CLA. and removed cla: no Set by the Google CLA bot to indicate the author of a PR has not signed the Google CLA. labels Apr 15, 2021

frankbu approved these changes Apr 15, 2021

View reviewed changes

istio-testing merged commit 54261a1 into istio:master Apr 15, 2021

istio-testing mentioned this pull request Apr 15, 2021

[release-1.9] Add blog on inbound forwarding changes #9532

Merged

	Without action, these ports will no longer be accessible upon upgrade.
	Without action, these ports will no longer be accessible upon upgrade.

		@@ -0,0 +1,91 @@
		---
		title: "Upcoming changes to Istio networking In Istio 1.10"

	title: "Upcoming changes to Istio networking In Istio 1.10"
	title: "Upcoming networking changes In Istio 1.10"

	* Disable the change entirely with the `PILOT_ENABLE_INBOUND_PASSTHROUGH=false` environment variable in Istiod. This option will be removed in the future.
	* Disable the change entirely with the `PILOT_ENABLE_INBOUND_PASSTHROUGH=false` environment variable in Istiod to enable the same behavior as prior to Istio 1.10. This option will be removed in the future.

Add blog on inbound forwarding changes #9150

Add blog on inbound forwarding changes #9150

Uh oh!

Conversation

howardjohn commented Mar 8, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

istio-testing commented Mar 8, 2021

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

linsun commented Apr 9, 2021

Uh oh!

howardjohn commented Apr 9, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

linsun commented Apr 9, 2021

Uh oh!

mandarjog commented Apr 9, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

linsun commented Apr 14, 2021

Uh oh!

howardjohn commented Apr 14, 2021

Uh oh!

google-cla bot commented Apr 14, 2021

Uh oh!

craigbox commented Apr 14, 2021

Uh oh!

Uh oh!

google-cla bot commented Apr 15, 2021

Uh oh!

howardjohn commented Apr 15, 2021

Uh oh!

frankbu commented Apr 15, 2021

Uh oh!

ericvn commented Apr 15, 2021

Uh oh!

istio-testing commented Apr 15, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

howardjohn commented Mar 8, 2021 •

edited

Loading