forked from istio/istio
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Use envoy v2 bootstrap for sidecar (istio#2561)
* Add a basic kube-lego config, for automatic cert creation for SNI * Add a half working v2 ingress, with zero vpn and sni * Move the envoy v2 config to the proxy docker image * Updates * Initial agent package, using original code (without changing the source) * Bad merge * Remove files updated accidentally * Simplified generation, the code was far too complex * Add a new golden file, using pb format (less conversions, better error messages) * Finally a working golden pb ! * Switch back to json-based config, add it to deb and docker * Somehow grafana template got modified by test * Move some files to separate PR * Fix the config and tests * Fix missing : * Revert accidental change * Format files with bin/fmt.sh * Add missing license to test, rename the file since it has no dep on envoy * Remove unused file * Add the renamed files to git... * Fix lint error * Fetch logs, use json and better error message * Add the golden files. * Add the pilot SAN * Go fmt and add the log, so it can be debugged * Attempt to get istioct to accept kubeconfig * Revert the debug messages for artifacts
- Loading branch information
1 parent
cb4b526
commit aa51353
Showing
21 changed files
with
679 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| // Copyright 2018 Istio Authors | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package bootstrap | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "io/ioutil" | ||
| "os" | ||
| "path" | ||
| "strings" | ||
| "text/template" | ||
|
|
||
| meshconfig "istio.io/api/mesh/v1alpha1" | ||
| ) | ||
|
|
||
| // Generate the envoy v2 bootstrap configuration, using template. | ||
| const ( | ||
| // EpochFileTemplate is a template for the root config JSON | ||
| EpochFileTemplate = "envoy-rev%d.json" | ||
| DefaultCfgDir = "/var/lib/istio/envoy/envoy_bootstrap_tmpl.json" | ||
| ) | ||
|
|
||
| func configFile(config string, epoch int) string { | ||
| return path.Join(config, fmt.Sprintf(EpochFileTemplate, epoch)) | ||
| } | ||
|
|
||
| // WriteBootstrap generates an envoy config based on config and epoch, and returns the filename. | ||
| // TODO: in v2 some of the LDS ports (port, http_port) should be configured in the bootstrap. | ||
| func WriteBootstrap(config *meshconfig.ProxyConfig, epoch int, pilotSAN []string) (string, error) { | ||
| if err := os.MkdirAll(config.ConfigPath, 0700); err != nil { | ||
| return "", err | ||
| } | ||
| // attempt to write file | ||
| fname := configFile(config.ConfigPath, epoch) | ||
|
|
||
| cfg := config.CustomConfigFile | ||
| if cfg == "" { | ||
| cfg = DefaultCfgDir | ||
| } | ||
|
|
||
| cfgTmpl, err := ioutil.ReadFile(cfg) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| t, err := template.New("bootstrap").Parse(string(cfgTmpl)) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| opts := map[string]interface{}{ | ||
| "config": config, | ||
| } | ||
|
|
||
| if pilotSAN != nil { | ||
| opts["pilot_SAN"] = pilotSAN | ||
| } | ||
|
|
||
| // Simplify the template | ||
| opts["refresh_delay"] = fmt.Sprintf("{\"seconds\": %d, \"nanos\": %d}", config.DiscoveryRefreshDelay.Seconds, config.DiscoveryRefreshDelay.Nanos) | ||
| opts["connect_timeout"] = fmt.Sprintf("{\"seconds\": %d, \"nanos\": %d}", config.ConnectTimeout.Seconds, config.ConnectTimeout.Nanos) | ||
|
|
||
| addPort := strings.Split(config.DiscoveryAddress, ":") | ||
| opts["pilot_address"] = fmt.Sprintf("{\"address\": \"%s\", \"port_value\": %s}", addPort[0], addPort[1]) | ||
|
|
||
| if config.ZipkinAddress != "" { | ||
| addPort = strings.Split(config.ZipkinAddress, ":") | ||
| opts["zipkin"] = fmt.Sprintf("{\"address\": \"%s\", \"port_value\": %s}", addPort[0], addPort[1]) | ||
| } | ||
| if config.StatsdUdpAddress != "" { | ||
| addPort = strings.Split(config.StatsdUdpAddress, ":") | ||
| opts["statsd"] = fmt.Sprintf("{\"address\": \"%s\", \"port_value\": %s}", addPort[0], addPort[1]) | ||
| } | ||
| fout, err := os.Create(fname) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| // Execute needs some sort of io.Writer | ||
| err = t.Execute(fout, opts) | ||
| return fname, err | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| // Copyright 2018 Istio Authors | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| package bootstrap | ||
|
|
||
| import ( | ||
| "io/ioutil" | ||
| "os" | ||
| "testing" | ||
|
|
||
| "github.com/golang/protobuf/proto" | ||
|
|
||
| meshconfig "istio.io/api/mesh/v1alpha1" | ||
| ) | ||
|
|
||
| func TestGolden(t *testing.T) { | ||
| cases := []struct { | ||
| base string | ||
| }{ | ||
| { | ||
| "auth", | ||
| }, | ||
| { | ||
| "default", | ||
| }, | ||
| { | ||
| // Specify zipkin/statsd address, similar with the default config in v1 tests | ||
| "all", | ||
| }, | ||
| } | ||
|
|
||
| out := os.Getenv("ISTIO_OUT") // defined in the makefile | ||
| if out == "" { | ||
| out = "/tmp" | ||
| } | ||
|
|
||
| for _, c := range cases { | ||
| t.Run("Bootrap-"+c.base, func(t *testing.T) { | ||
| cfg, err := loadProxyConfig(c.base, out, t) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| fn, err := WriteBootstrap(cfg, 0, []string{ | ||
| "spiffe://cluster.local/ns/istio-system/sa/istio-pilot-service-account"}) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| real, err := ioutil.ReadFile(fn) | ||
| if err != nil { | ||
| t.Error("Error reading generated file ", err) | ||
| return | ||
| } | ||
| golden, err := ioutil.ReadFile("testdata/" + c.base + "_golden.json") | ||
| if err != nil { | ||
| golden = []byte{} | ||
| } | ||
| if string(real) != string(golden) { | ||
| t.Error("Generated incorrect config, want:\n" + string(golden) + "\ngot:\n" + string(real)) | ||
| } | ||
| }) | ||
| } | ||
|
|
||
| } | ||
|
|
||
| func loadProxyConfig(base, out string, t *testing.T) (*meshconfig.ProxyConfig, error) { | ||
| content, err := ioutil.ReadFile("testdata/" + base + ".proto") | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| cfg := &meshconfig.ProxyConfig{} | ||
| err = proto.UnmarshalText(string(content), cfg) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| // Exported from makefile or env | ||
| cfg.ConfigPath = out + "/bootstrap/" + base | ||
| gobase := os.Getenv("ISTIO_GO") | ||
| if gobase == "" { | ||
| gobase = "../.." | ||
| } | ||
| cfg.CustomConfigFile = gobase + "/tools/deb/envoy_bootstrap_tmpl.json" | ||
| return cfg, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| config_path: "/etc/istio/proxy" | ||
| binary_path: "/usr/local/bin/envoy" | ||
| service_cluster: "istio-proxy" | ||
| drain_duration: {seconds: 5} | ||
| parent_shutdown_duration: {seconds: 6} | ||
| discovery_address: "mypilot:1001" | ||
| discovery_refresh_delay: {seconds: 3} | ||
| zipkin_address: "localhost:6000" | ||
| connect_timeout: {seconds: 7} | ||
| statsd_udp_address: "10.1.1.1:9125" | ||
| proxy_admin_port: 15003 | ||
| availability_zone: "AZ" | ||
| control_plane_auth_policy: MUTUAL_TLS | ||
| stat_name_length: 200 | ||
|
|
||
| # Sets all relevant options to values different than default |
Oops, something went wrong.