-
Notifications
You must be signed in to change notification settings - Fork 7.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Implement a secured debug interface for istio #31338
Conversation
c1f319f
to
0fc66ed
Compare
Looks great overall! |
/test unit-tests_istio |
5ae7089
to
841bcc1
Compare
/retest |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks great
@howardjohn PTAL, Thanks! |
By default it will use the default serviceAccount from (istio-system) namespace if the pod is not specified. | ||
`, | ||
Example: ` # Retrieve sync status for all Envoys in a mesh | ||
istioctl x debug syncz |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am getting
$ istioctl x debug syncz
Error: resource name may not be empty
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
you need specify --xds-address xxxx:15012
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can we improve the error message somehow? Also I am not sure why I need to specify that, given the example doesn't. I want to access incluster istiod
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
sure, will address this in the following up PR
By default it will use the default serviceAccount from (istio-system) namespace if the pod is not specified. | ||
`, | ||
Example: ` # Retrieve sync status for all Envoys in a mesh | ||
istioctl x debug syncz |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can we improve the error message somehow? Also I am not sure why I need to specify that, given the example doesn't. I want to access incluster istiod
} | ||
if len(args) == 0 { | ||
return CommandParseError{ | ||
e: fmt.Errorf("debug type is required"), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit: there is no format specifier here.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. Thanks.
make the debug interface secured via xds.
@howardjohn @esnible I put an initial version here to get early feedbacks. Thanks!