Support for resources opting-out of tap #2807
Conversation
Fixes #2778 Signed-off-by: Alejandro Pedraza <alejandro@buoyant.io>
|
Integration test results for ecd598f: success 🎉 |
| flags.BoolVar( | ||
| &options.disableTap, "disable-tap", options.disableTap, | ||
| "Disables resources from from being tapped", | ||
| ) |
There was a problem hiding this comment.
until the proxy supports it, should we do flags.MarkHidden("disable-tap") ? maybe reference a Github issue in a comment for the proxy change? or, since the control-plane is also filtering, maybe this is ok?
related: does this mean both the control-plane and the proxy will independently guard against tapping?
There was a problem hiding this comment.
As is, tapping gets disabled through the control plane API, but that doesn't disallow someone hitting directly the proxy. I think it makes sense to mark the flag hidden in the meantime.
There was a problem hiding this comment.
Created #2811 to track proxy-side work
…tappable Signed-off-by: Alejandro Pedraza <alejandro@buoyant.io>
Signed-off-by: Alejandro Pedraza <alejandro@buoyant.io>
|
Integration test results for a6d3528: success 🎉 |
Fixes #2778
This one is just for the control-plane side of things.
The env var injected into the sidecar proxy was labeled
LINKERD2_PROXY_TAP_DISABLED.