Cherry pick: Apply peer authentication policy (#20829)#20955
Merged
istio-testing merged 1 commit intoistio:release-1.5from Feb 8, 2020
Merged
Cherry pick: Apply peer authentication policy (#20829)#20955istio-testing merged 1 commit intoistio:release-1.5from
istio-testing merged 1 commit intoistio:release-1.5from
Conversation
Contributor
Author
Thanks. |
Member
|
oh wow, #20511 is a major release blocker that got missed cherrypicking back to release-1.5 |
Contributor
Author
Ha, great. I can wait for you to cherry pick it so I don't have to do a manual fix. Of if you want, I can create one. |
* Apply beta peer authentication policy down to workload level * Clean up * Lint * Check beta policy for auto mtls. This can be removed when EP metadata take into account the policy * Use explicit peerauthentication policy for permissive, as we haven't remove old mesh policy during installation * pilot/pkg/security/authn/v1beta1/policy_applier.go * Move all test for beta mTLS api to the end * Change to namespace policy * Revert cluster.go * Change peer authn consolidation algorithm for UNSET (inheritant mode) * Reimplement getMostSpecificConfig (now composePeerAuthentication) which also consolidate port-level policies. * Fix inheritance: do not inherit if it is weaker than the current mode * Remove debug logs * Change test policy to namespace level to make sure they are clean up properly with the existing test setup. * Address comment * Lint * Simplify logic to pick the oldest * fix typo * Update function comment
26aa4cd to
770271a
Compare
fpesce
approved these changes
Feb 8, 2020
This was referenced Feb 25, 2020
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
git cherry-pick 9053f47
Apply beta peer authentication policy down to workload level
Clean up
Lint
Check beta policy for auto mtls. This can be removed when EP metadata take into account the policy
Use explicit peerauthentication policy for permissive, as we haven't remove old mesh policy during installation
pilot/pkg/security/authn/v1beta1/policy_applier.go
Move all test for beta mTLS api to the end
Change to namespace policy
Revert cluster.go
Change peer authn consolidation algorithm for UNSET (inheritant mode)
Reimplement getMostSpecificConfig (now composePeerAuthentication) which also consolidate port-level policies.
Fix inheritance: do not inherit if it is weaker than the current mode
Remove debug logs
Change test policy to namespace level to make sure they are clean up properly with the existing test setup.
Address comment
Lint
Simplify logic to pick the oldest
fix typo
Update function comment