47 Pull requests merged by 16 people

• Enable PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API by default

  #51319 merged May 31, 2024

• Fix `istio-cni` log levels not applying because scoping doesn't work in a global context

  #51338 merged May 31, 2024

• istioctl: update ZtunnelDump struct to unmarshall data correctly

  #51225 merged May 31, 2024

• istiod: improve error message when values.yaml is invalid

  #51228 merged May 31, 2024

• [release-1.20] Change pod repair getPodNetNs logic to not rely on /32 route in host ns.

  #51334 merged May 31, 2024

• [release-1.21] Change pod repair getPodNetNs logic to not rely on /32 route in host ns.

  #51325 merged May 31, 2024

• Ambient: Fix bug with initial node agent snapshot create

  #51321 merged May 31, 2024

• addons: modify kiali imagepullpolicy to IfNotPresent

  #51332 merged May 31, 2024

• Automator: update ztunnel@master in istio/istio@master

  #51331 merged May 31, 2024

• Add missing auth-pol for bookinfo cleanup

  #51329 merged May 31, 2024

• Remove unused function in security/pki/util

  #51328 merged May 31, 2024

• Automator: update common-files@master in istio/istio@master

  #51330 merged May 31, 2024

• Automator: update proxy@master in istio/istio@master

  #51317 merged May 31, 2024

• Add ambient profile to profile validate test

  #51326 merged May 31, 2024

• Change pod repair getPodNetNs logic to not rely on /32 route in host ns.

  #51223 merged May 31, 2024

• run make gen

  #51320 merged May 31, 2024

• Automator: update common-files@master in istio/istio@master

  #51315 merged May 30, 2024

• Don't hardcode CA_TRUSTED_NODE_ACCOUNTS everywhere

  #51311 merged May 30, 2024

• fix log wording, drop `PROTO` (it's hardcoded anyway)

  #51309 merged May 30, 2024

• Automator: update istio/client-go@master dependency in istio/istio@master

  #51306 merged May 30, 2024

• Automator: update ztunnel@master in istio/istio@master

  #51303 merged May 30, 2024

• Automator: update ztunnel@release-1.22 in istio/istio@release-1.22

  #51304 merged May 30, 2024

• put review service on its own line

  #51297 merged May 30, 2024

• Automator: update istio/client-go@master dependency in istio/istio@master

  #51298 merged May 30, 2024

• [release-1.22] Stop running waypoint as root

  #51295 merged May 29, 2024

• Stop running waypoint as root

  #51290 merged May 29, 2024

• [release-1.22] pilot: fix double SE deletion

  #51284 merged May 29, 2024

• CNI Plugin: Adds K8S_POD_UID Field to K8sArgs Struct

  #51293 merged May 29, 2024

• pilot: fix double SE deletion

  #51226 merged May 29, 2024

• Automator: update ztunnel@release-1.22 in istio/istio@release-1.22

  #51283 merged May 29, 2024

• Automator: update ztunnel@master in istio/istio@master

  #51282 merged May 29, 2024

• added a unit test for function injectionDisabled

  #51192 merged May 29, 2024

• minor refactor and optimize serviceregistry

  #51245 merged May 29, 2024

• Send HBONE endpoints in the local network

  #51248 merged May 29, 2024

• Build + push+ update bookinfo images

  #51269 merged May 28, 2024

• [release-1.22] Copy stable validation policy to istiod-remote

  #51268 merged May 28, 2024

• Automator: update proxy@master in istio/istio@master

  #51266 merged May 28, 2024

• Automator: update istio/client-go@master dependency in istio/istio@master

  #51265 merged May 28, 2024

• Copy stable validation policy to istiod-remote

  #50923 merged May 28, 2024

• Automator: update common-files@master in istio/istio@master

  #51264 merged May 28, 2024

• Update error message for node authorizer

  #51249 merged May 28, 2024

• update some example imagepullpolicy to IfNotPresent

  #51246 merged May 28, 2024

• Cosmetic: should quote after default

  #51262 merged May 28, 2024

• validation: avoid redundant api server requests on each startup

  #51237 merged May 28, 2024

• Automator: update proxy@master in istio/istio@master

  #51259 merged May 28, 2024

• Automator: update go-control-plane in istio/istio@master

  #51258 merged May 28, 2024

• refresh the look of Bookinfo sample app

  #51239 merged May 28, 2024

16 Pull requests opened by 9 people

• operator: do not reconcile all IOPs if `REVISION` env is set to blank

  #51250 opened May 27, 2024

• Added dynamic namespace selector for mutating webhook

  #51270 opened May 28, 2024

• Fix false positives in IST0162 analyzer

  #51278 opened May 29, 2024

• Support mutiple addresses for IstioEndpoint

  #51279 opened May 29, 2024

• update supported groups for TLS

  #51280 opened May 29, 2024

• Wasm integration tests for Ambient Mode

  #51286 opened May 29, 2024

• Fuzzing for OpenAPI/CEL vs Webhook validation

  #51287 opened May 29, 2024

• improved istioctl version format more user-friendly

  #51301 opened May 30, 2024

• istioctl install detect '-distroless' tag when ambient

  #51302 opened May 30, 2024

• Automator: update istio/client-go@master dependency in istio/istio@master

  #51316 opened May 30, 2024

• Fix a few missing fields in ambient SE conversion

  #51318 opened May 30, 2024

• [release-1.22] Change pod repair getPodNetNs logic to not rely on /32 route in host ns.

  #51323 opened May 31, 2024

• Add initial Ztunnel Grafana dashboard

  #51335 opened May 31, 2024

• Bump API and client-go deps

  #51339 opened May 31, 2024

• [1.22 manual cherrypick] Fix bug with initial snapshot create

  #51341 opened May 31, 2024

• validation: improve header validation

  #51343 opened May 31, 2024

20 Issues closed by 12 people

• Stabilize PILOT_MULTI_NETWORK_DISCOVER_GATEWAY_API

  #51010 closed May 31, 2024

• Pod injection fails with Istio 1.22.0 but succeeds with Istio 1.21.2

  #51071 closed May 31, 2024

• Question about the performance of isio and envoy

  #51324 closed May 31, 2024

• Support multiple outbound ports instead of only one 15001 to avoid local source port exhaustion

  #51210 closed May 30, 2024

• Istio upgrade from 1.18.5 to 1.21.1 fails in IPv6 cluster

  #50660 closed May 30, 2024

• IstioOperator: annotation 'proxy.istio.io/config' erase 'meshConfig.defaultConfig'

  #49560 closed May 30, 2024

• Forwarding the b3 header from the service in cluster to the istio ingress gateway will create a new trace with the same x-request-id

  #51230 closed May 30, 2024

• In multi-cluster mode, adding topology.kubernetes.io/region label to a new nodes does not trigger the update of envoy cluster endpoints.

  #51144 closed May 30, 2024

• Add 15020 named ContainerPort to sidecar template

  #47882 closed May 30, 2024

• Support for Custom Resource Configurations in Waypoint

  #51251 closed May 30, 2024

• consider making ingress gateway an optional component in Kiali

  #51271 closed May 30, 2024

• Running waypoint (istio-proxy container) as non root

  #51291 closed May 29, 2024

• CNI Plugin: Inconsistent Kubernetes Args

  #51292 closed May 29, 2024

• applying then deleting a ServiceEntry with the same host results in missing endpoint

  #51212 closed May 29, 2024

• Can Istio-IngressGateway be used to route internal service-to-service requests over mTLS ?

  #49351 closed May 29, 2024

• Adopt ClusterTrustBundle (K8s 1.27 alpha)

  #43986 closed May 29, 2024

• Telemetry API for mesh-wide tracing settings does not working.

  #51256 closed May 29, 2024

• Send HBONE does not work well with multi-network

  #51202 closed May 29, 2024

• Telemetry API - Promote to Beta - Status Tracker

  #46720 closed May 28, 2024

• Support Conditional Logic in Telemetry Configuration for Dynamic Metric Labels EnvoyFilter

  #47827 closed May 26, 2024

29 Issues opened by 26 people

• ambient mesh timeout on EKS for sample application (bookinfo)

  #51342 opened May 31, 2024

• WatchedResource data race

  #51340 opened May 31, 2024

• [release-1.22] Ambient: Fix bug with initial node agent snapshot create

  #51337 opened May 31, 2024

• Sidecar inbound HBONE doesn't allow arbitrary passthrough ports

  #51336 opened May 31, 2024

• inject sidecar

  #51327 opened May 31, 2024

• Waypoint service account leak after gateway deleted

  #51322 opened May 31, 2024

• Istio routing doesn't work If matching by sourceLabels and the label is not present in calling pod.

  #51314 opened May 30, 2024

• Update documentation and dashboards to account for reporter=Waypoint

  #51313 opened May 30, 2024

• We overwrite the namespace label for `istio.io/use-waypoint`

  #51312 opened May 30, 2024

• holdApplicationUntilProxyStarts not working

  #51310 opened May 30, 2024

• Support for extraEnv in ingress/egress gateways charts

  #51308 opened May 30, 2024

• Teleport connection upgrade fobiddent Ingress Gateway

  #51307 opened May 30, 2024

• Connection pooling in HBONE causes thread stickiness in waypoints, decreasing performance

  #51305 opened May 30, 2024

• istioctl output is unclear when cluster not installed

  #51296 opened May 30, 2024

• Creating a waypoint with the same name as a workload results in the waypoint (silently) not being created

  #51294 opened May 29, 2024

• Service Account Annotation Formatting Error

  #51289 opened May 29, 2024

• Ambient : WebAssembly filter configuration for specific service not functioning as expected

  #51288 opened May 29, 2024

• Allow sniHosts with underscores in virtualservices

  #51285 opened May 29, 2024

• Inaccurate list of supported groups for TLS

  #51281 opened May 29, 2024

• service with multiple hosts endpoints with mtls client certs managed by istio to be reached via corporate proxy.

  #51277 opened May 29, 2024

• Request: Option for istio gateways to return more logical response codes

  #51276 opened May 29, 2024

• istioctl analyze: IST0101, IST0127: look for matching workloads inside "apps" and "batch" objects

  #51273 opened May 29, 2024

• Istio sidecar communication only works in one direction?

  #51267 opened May 28, 2024

• Allow more flexible patterns in hosts field in Sidecar CRD for ephemeral environments use case

  #51263 opened May 28, 2024

• Istio-side tests to validate `istioctl` can correctly deserialize output from various ztunnel endpoints

  #51261 opened May 28, 2024

• istioctl IST0162 wrong report

  #51257 opened May 28, 2024

• failed to update resource with server-side apply for obj

  #51255 opened May 28, 2024

• Multi-tenancy for tracing using grafana-tempo - design questions

  #51254 opened May 27, 2024

• ExportTo "*" is not working when we have multiple virtualservices with a same host

  #51253 opened May 27, 2024

82 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• `istio-proxy` taking a long time to get ready

  #51160 commented on May 30, 2024 • 9 new comments

• manifests: add `gateways.securityContext` option to custom gateway securityContext

  #51234 commented on May 31, 2024 • 7 new comments

• doc: update the doc of the --log_rotate_max_age

  #50662 commented on May 29, 2024 • 7 new comments

• Support customization for Kubernetes Gateway API automated deployments

  #46594 commented on May 30, 2024 • 6 new comments

• Change bookinfo gateway Port to 80 from 8080

  #50693 commented on May 31, 2024 • 4 new comments

• serviceentry / virtual service not work when target to outside server.

  #50997 commented on May 29, 2024 • 4 new comments

• EnvoyFilter FIlterClass not implemented

  #51177 commented on May 29, 2024 • 3 new comments

• IstioEndpoint Record ResourceVersion

  #51163 commented on May 28, 2024 • 3 new comments

• Istio standard metrics do not increase after 1hour or so even though real time traffic is flowing

  #51100 commented on May 31, 2024 • 3 new comments

• ZTunnel Safe Upgrade

  #51126 commented on May 31, 2024 • 3 new comments

• Possible critical bug involving Istio configs from isolated namespaces causing blackholes cluster-wide

  #48055 commented on May 31, 2024 • 3 new comments

• fix istioctl analyze vs error when a custom cluster domain

  #51064 commented on May 29, 2024 • 2 new comments

• Detect `tag: ...-distroless`

  #51040 commented on May 30, 2024 • 2 new comments

• Waypoint Sandwich

  #48362 commented on May 29, 2024 • 2 new comments

• prometheus scraping config doesn't support ipv6

  #35915 commented on May 29, 2024 • 2 new comments

• Dual-stack : Promote to Alpha - Status Tracker

  #47998 commented on May 29, 2024 • 2 new comments

• Expose PadForwardPayloadHeader in JWTRule

  #50856 commented on May 31, 2024 • 2 new comments

• ambient: "failed to add pod to ztunnel" on k3s cluster

  #50072 commented on May 29, 2024 • 2 new comments

• Traffic is not dropped when VS HTTPMatch is not matched by port

  #49516 commented on May 31, 2024 • 1 new comment

• Unready istio-proxy container not evicted

  #49512 commented on May 31, 2024 • 1 new comment

• SE disables VS on port 80

  #49508 commented on May 31, 2024 • 1 new comment

• Deprecation warnings for downstream_connections

  #49490 commented on May 31, 2024 • 1 new comment

• Wildcard host in SE results in route error

  #49485 commented on May 31, 2024 • 1 new comment

• Broken pipe on applications when traffic is routed via sidecar with default configuration

  #49484 commented on May 31, 2024 • 1 new comment

• TLS origination doesn't work with resolution NONE in ServiceEntry

  #49450 commented on May 31, 2024 • 1 new comment

• WorkloadSelector in SE makes no effect when the packet is partially matched in VS

  #49440 commented on May 31, 2024 • 1 new comment

• "Waiting for Istio ingress IP to become available ..."

  #49225 commented on May 31, 2024 • 1 new comment

• how to proxy domain as nginx proxy_pass

  #48124 commented on May 31, 2024 • 1 new comment

• Custom labels added for istio-cni deployment and pods in helm chart

  #50694 commented on May 30, 2024 • 1 new comment

• Support multiple addresses for IstioEndpoint based on proposal

  #47273 commented on May 27, 2024 • 1 new comment

• Can't deploy gateway with net.ipv4.ip_unprivileged_port_start

  #49549 commented on May 31, 2024 • 1 new comment

• Collision between SEs with the same host

  #49550 commented on May 31, 2024 • 1 new comment

• Istio should consistently set transport socket match for headless services attached to ingress gateway

  #49584 commented on May 31, 2024 • 1 new comment

• Changing of Request Method from PUT or DELETE to GET when request reaches ISTIO

  #49597 commented on May 31, 2024 • 1 new comment

• SourceLabel disables all VS in sidecar

  #49631 commented on May 31, 2024 • 1 new comment

• Ambient test flake

  #49650 commented on May 31, 2024 • 1 new comment

• 503 UC upstream_reset_before_response_started{connection_termination}

  #49660 commented on May 31, 2024 • 1 new comment

• Sanity check envoy checksum during private Envoy builds

  #49670 commented on May 31, 2024 • 1 new comment

• Service defined on port 80 causes VS cannot capture traffic with specific host

  #49673 commented on May 31, 2024 • 1 new comment

• Migrate Grafana dashboards to a more maintainable form

  #50127 commented on May 31, 2024 • 1 new comment

• File path based Gateway TLS setting is not working when using SPIRE as workload identity issuer.

  #47481 commented on May 28, 2024 • 1 new comment

• Automated Kubernetes Gateway API update service and deployment

  #48000 commented on May 28, 2024 • 1 new comment

• JWTRule support specify jwt requirement

  #43982 commented on May 28, 2024 • 1 new comment

• optimize calico install for ci

  #49565 commented on May 28, 2024 • 1 new comment

• test ambient with kubernetes netpol

  #49301 commented on May 28, 2024 • 1 new comment

• Documentation unclear about sidecar customization (could be bug in injector)

  #51187 commented on May 28, 2024 • 1 new comment

• A lot of intermittent UH errors on istio egress gateway

  #50075 commented on May 28, 2024 • 1 new comment

• Ambient: Support workloadEntry from remote clusters

  #46779 commented on May 31, 2024 • 1 new comment

• Support Prefix Rewrite and Regex Rewrite for HTTP Redirections

  #47500 commented on May 31, 2024 • 1 new comment

• TLS passthrough sends all traffic on 443 to single service

  #51220 commented on May 28, 2024 • 1 new comment

• VM Workload Auto-registration Fails due to Can't find Workloadgroup

  #51211 commented on May 28, 2024 • 1 new comment

• disable opencensus

  #50808 commented on May 27, 2024 • 1 new comment

• istioctl bug-report include filtering logic not working with namespace and pod filtering

  #47522 commented on May 31, 2024 • 1 new comment

• Documentation on Istio Federation with SPIRE on multiple mesh

  #48998 commented on May 27, 2024 • 1 new comment

• CUSTOM AuthorizationPolicy filter Order

  #51173 commented on May 27, 2024 • 1 new comment

• Using Istio with CronJobs

  #11659 commented on May 25, 2024 • 1 new comment

• istioctl should install Gateway API CRDs for you

  #51190 commented on May 25, 2024 • 1 new comment

• How is the `localityLbSetting` of DR works in envoy config?

  #51146 commented on May 25, 2024 • 1 new comment

• Istio wild card egress rule for Azure service bus common host: "www.servicebus.windows.net" not working

  #50027 commented on May 25, 2024 • 1 new comment

• WasmPlugin OnHttpRequestBody doesn't get invoked in every scenario

  #50135 commented on May 25, 2024 • 1 new comment

• istioctl precheck: add unit tests

  #50255 commented on May 27, 2024 • 0 new comments

• Helm parity with istioctl

  #47838 commented on May 27, 2024 • 0 new comments

• Clean constants

  #50170 commented on May 31, 2024 • 0 new comments

• OutlierDetection Support for Grpc-Xds proxyless

  #48022 commented on May 31, 2024 • 0 new comments

• WorkloadSelector in DestinationRule resulting in route error

  #49111 commented on May 31, 2024 • 0 new comments

• GRPC Proxyless support for EnvoyFilters

  #47927 commented on May 31, 2024 • 0 new comments

• Multicluster: graceful update of clusters

  #49349 commented on May 31, 2024 • 0 new comments

• No validation for kind's value for Istio Operator Install

  #49355 commented on May 31, 2024 • 0 new comments

• proxy has trouble discovering gRPC endpoints after server pods restart

  #49391 commented on May 31, 2024 • 0 new comments

• HTTP traffic passthroughs cluster when SE endpoints set to internal address

  #49430 commented on May 31, 2024 • 0 new comments

• Consider/design nftables alternative for redirection

  #47821 commented on May 31, 2024 • 0 new comments

• Local rate limits per path are not working

  #49432 commented on May 31, 2024 • 0 new comments

• istio - rewriteAppHTTPProbers default value true causes connection pooling issues for probe requests

  #49454 commented on May 31, 2024 • 0 new comments

• Different routing behavior between 1.20 and 1.22 alpha

  #49458 commented on May 31, 2024 • 0 new comments

• Wildcard host in SE cannot match the host in Destination

  #49482 commented on May 31, 2024 • 0 new comments

• Istio is deleting Authorization header with certain JWTs

  #49483 commented on May 31, 2024 • 0 new comments

• Istio Creates Unnecessary Envoy Clusters

  #45979 commented on May 31, 2024 • 0 new comments

• failoverPriority and missing IstioEndpoint labels in Multi-Primary on different networks

  #49500 commented on May 31, 2024 • 0 new comments

• [release-1.21] Add COMPLIANCE_POLICY to Istio

  #49502 commented on May 31, 2024 • 0 new comments

• PILOT_ENABLE_STATUS causes excessive Istiod pushes

  #44613 commented on May 31, 2024 • 0 new comments

• JWKS unsafe missing retries on startup

  #42202 commented on May 31, 2024 • 0 new comments

• Add documentation for Istio support for gRPC's proxyless service mesh features

  #42009 commented on May 31, 2024 • 0 new comments