Skip to content

bookinfo fixes#7109

Merged
rshriram merged 6 commits intoistio:release-1.0from
krancour:bookinfo-fixes
Jul 17, 2018
Merged

bookinfo fixes#7109
rshriram merged 6 commits intoistio:release-1.0from
krancour:bookinfo-fixes

Conversation

@krancour
Copy link
Copy Markdown
Contributor

@krancour krancour commented Jul 13, 2018

Fixes #7047

Important: requires #7098 to be merged first since that make some critical fixes to the bookinfo sample app's build process, which fails in its current state.

This PR corrects unrealistic behavior in the sample app.

Currently, the productpage app stores user identity in a cookie that is neither encrypted nor signed. It is easily tampered with by even the most novice attacker. Additionally, the productpage app forwards that same cookie to the downstream reviews service. This is also bad. Both of these, however, were obviously done to facilitate an impactful demo that shows request routing decisions being done on the basis of user identity.

This PR transforms the example to use more realistic behavior without compromising on the demo's impact. The cookie is now encoded and digitally signed (the flask framework automatically encodes any session data that is kept in a cookie-based session store). It can be decoded, but tampering with it (successfully) is not possible due to the signature. The productinfo page also ceases to share this cookie with the downstream review service. Instead, it injects the end-user's username into a custom end-user header on the outbound requests to the reviews service. The end result is that there is still a plain text header present that routing decisions can be based on, but from start to finish, we didn't have to compromise on security to make that possible.

All sample routing rules (used by tasks in the documentation) are also updated by this PR.

Note that the images referenced in the various yaml files do not exist yet in dockerhub because I don't have permissions to push them and, as far as I can tell, there isn't any automated build/push process for those. So someone else needs to build and push these, I guess?

Will open a complementary PR in the docs repo momentarily.

@rshriram
Copy link
Copy Markdown
Member

@krancour Thanks for this PR. Can you push the changes to your dockerhub account and update the bookinfo YAMLs to point to your version ? Once they pass, I can copy and push them into istio's official docker hub and update the YAML references in a separate PR

@rshriram
Copy link
Copy Markdown
Member

Also, please rebase the PR to release-1.0 branch

@krancour
Copy link
Copy Markdown
Contributor Author

@rshriram sure thing. Will wait for #7152 to be merged first.

@rshriram
Copy link
Copy Markdown
Member

I have merged the other PR. Please rebase this to release-1.0 branch

@krancour krancour changed the base branch from master to release-1.0 July 17, 2018 13:32
@krancour
Copy link
Copy Markdown
Contributor Author

@rshriram working on it. Seems I did break the e2e tests, so I am trying to resolve that before continuing.

@googlebot
Copy link
Copy Markdown
Collaborator

So there's good news and bad news.

👍 The good news is that everyone that needs to sign a CLA (the pull request submitter and all commit authors) have done so. Everything is all good there.

😕 The bad news is that it appears that one or more commits were authored or co-authored by someone other than the pull request submitter. We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that here in the pull request.

Note to project maintainer: This is a terminal state, meaning the cla/google commit status will not change from this state. It's up to you to confirm consent of the commit author(s) and merge this pull request when appropriate.

@googlebot googlebot added cla: no Set by the Google CLA bot to indicate the author of a PR has not signed the Google CLA. and removed cla: yes labels Jul 17, 2018
@rshriram
Copy link
Copy Markdown
Member

You have to close this PR and open a new PR for release-1.0 branch.. changing the target branch in Github doesn't seem to work properly (if thats what you did).

@krancour
Copy link
Copy Markdown
Contributor Author

changing the target branch in Github doesn't seem to work properly (if thats what you did).

I changed the target branch, but didn't push anything that I have rebased yet. That's why this looks all screwy.

I'll have this all fixed up as soon as I get those e2e tests fixed.

@rshriram
Copy link
Copy Markdown
Member

/ok-to-test

@rshriram rshriram changed the base branch from release-1.0 to master July 17, 2018 18:44
@rshriram
Copy link
Copy Markdown
Member

@krancour please debug fro release-1.0 branch. Lots of fixes went in. Master may be very much outdated.

@codecov
Copy link
Copy Markdown

codecov bot commented Jul 17, 2018

Codecov Report

Merging #7109 into release-1.0 will decrease coverage by 1%.
The diff coverage is n/a.

Impacted file tree graph

@@             Coverage Diff              @@
##           release-1.0   #7109    +/-   ##
============================================
- Coverage           72%     72%   -<1%     
============================================
  Files              356     356            
  Lines            30537   30534     -3     
============================================
- Hits             21780   21741    -39     
- Misses            7853    7887    +34     
- Partials           904     906     +2
Impacted Files Coverage Δ
mixer/adapter/rbac/controller.go 29% <0%> (-24%) ⬇️
...olarwinds/internal/papertrail/papertrail_logger.go 59% <0%> (-21%) ⬇️
mixer/adapter/servicecontrol/handler.go 39% <0%> (-8%) ⬇️
mixer/adapter/stackdriver/trace/exporter.go 71% <0%> (-4%) ⬇️
mixer/adapter/rbac/rbacStore.go 76% <0%> (-3%) ⬇️
mixer/adapter/signalfx/metrics.go 41% <0%> (-2%) ⬇️
mixer/adapter/statsd/statsd.go 96% <0%> (-1%) ⬇️
mixer/pkg/protobuf/yaml/castUtil.go 94% <0%> (ø) ⬇️
mixer/adapter/list/list.go 100% <0%> (ø) ⬇️
mixer/pkg/protobuf/yaml/encoder.go 99% <0%> (ø) ⬇️
... and 10 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7ca1b06...8396033. Read the comment docs.

@istio-testing istio-testing added the needs-rebase Indicates a PR needs to be rebased before being merged label Jul 17, 2018
@krancour krancour changed the base branch from master to release-1.0 July 17, 2018 19:22
@krancour
Copy link
Copy Markdown
Contributor Author

@rshriram updating e2e tests took me a little while, but I think this should be g2g now. lmk

@rshriram
Copy link
Copy Markdown
Member

Please fix lint..
Also, I am unable to build the reviews image

~/go/src/istio.io/istio/samples/bookinfo/src/reviews ~/go/src/istio.io/istio/samples/bookinfo
src/build-services.sh: line 42: PWD: command not found
Unable to find image 'gradle:4.8.1' locally
4.8.1: Pulling from library/gradle
55cbf04beb70: Already exists 
1607093a898c: Pull complete 
9a8ea045c926: Pull complete 
d4eee24d4dac: Pull complete 
c58988e753d7: Pull complete 
794a04897db9: Pull complete 
70fcfa476f73: Pull complete 
0539c80a02be: Pull complete 
54fefc6dcf80: Pull complete 
facf6a71baf4: Pull complete 
38ca283ac663: Pull complete 
Digest: sha256:2963e0798bf2c32630485a0ef8000ca17fd220be1ebacbdeb880ca29e97fbf88
Status: Downloaded newer image for gradle:4.8.1

Welcome to Gradle 4.8.1!

Here are the highlights of this release:
 - Dependency locking
 - Maven Publish and Ivy Publish plugins improved and marked stable
 - Incremental annotation processing enhancements
 - APIs to configure tasks at creation time

For more details see https://docs.gradle.org/4.8.1/release-notes.html

Starting a Gradle Daemon (subsequent builds will be faster)

FAILURE: Build failed with an exception.

* What went wrong:
Could not create service of type ScriptPluginFactory using BuildScopeServices.createScriptPluginFactory().
> Could not create service of type CrossBuildFileHashCache using BuildSessionScopeServices.createCrossBuildFileHashCache().

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.

* Get more help at https://help.gradle.org

BUILD FAILED in 1s

@krancour krancour mentioned this pull request Jul 17, 2018
@krancour
Copy link
Copy Markdown
Contributor Author

krancour commented Jul 17, 2018

@rshriram your issue with building reviews images seems to have been introduced by a recent PR other than my own:

b0a1c95#diff-030573cbbec06dc83bf87af67b0ae74eR42

I'm happy to fix this, however.

Ack on lint error.

@rshriram
Copy link
Copy Markdown
Member

I see this in release-1.0 branch

pushd $SCRIPTDIR/reviews
  #java build the app.
  docker run --rm -v $(PWD):/home/gradle/project -w /home/gradle/project gradle:4.8.1 gradle clean build
  pushd reviews-wlpcfg
    #plain build -- no ratings
    docker build -t istio/examples-bookinfo-reviews-v1:${VERSION} -t istio/examples-bookinfo-reviews-v1:latest --build-arg service_version=v1 .
    #with ratings black stars
    docker build -t istio/examples-bookinfo-reviews-v2:${VERSION} -t istio/examples-bookinfo-reviews-v2:latest --build-arg service_version=v2 \
           --build-arg enable_ratings=true .
    #with ratings red stars
    docker build -t istio/examples-bookinfo-reviews-v3:${VERSION} -t istio/examples-bookinfo-reviews-v3:latest --build-arg service_version=v3 \
           --build-arg enable_ratings=true --build-arg star_color=red .
  popd
popd

@rshriram
Copy link
Copy Markdown
Member

@krancour
Copy link
Copy Markdown
Contributor Author

@rshriram I changed that line, yes, but the problem you are facing (pwd related) came from #6988

@istio-testing
Copy link
Copy Markdown
Collaborator

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: krancour
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approvers: chxchx, frankbu

Assign the PR to them by writing /assign @chxchx @frankbu in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@istio-testing istio-testing removed the needs-rebase Indicates a PR needs to be rebased before being merged label Jul 17, 2018
@googlebot
Copy link
Copy Markdown
Collaborator

CLAs look good, thanks!

@googlebot googlebot added cla: yes and removed cla: no Set by the Google CLA bot to indicate the author of a PR has not signed the Google CLA. labels Jul 17, 2018
@krancour
Copy link
Copy Markdown
Contributor Author

Also, make lint passed for me. It's not clear to me why that stage failed in the CI pipeline.

@rshriram rshriram merged commit 7e65cd9 into istio:release-1.0 Jul 17, 2018
@krancour krancour deleted the bookinfo-fixes branch July 17, 2018 21:06
@krancour
Copy link
Copy Markdown
Contributor Author

@rshriram thanks for the help with this!

@krancour
Copy link
Copy Markdown
Contributor Author

@rshriram just a reminder that official Docker images still need to be published and references to my dockerhub repos need to be corrected in a follow-up. If you publish the updated images, I'd be happy to submit that follow-up.

rshriram pushed a commit to rshriram/istio that referenced this pull request Jul 20, 2018
istio-testing pushed a commit that referenced this pull request Jul 23, 2018
* Remove api.* attributes from accesslog as they are yet to be implemented (#7019)

* mixer: setup initial liveness probe (#7065)

* Setup initial liveness probe for Mixer

* Prefer /version to /metrics

* remove unused legacy v1alpha1 routing apis (#7091)

* Updating Kiali to v0.5.0 in Helm Installer (#7007)

* Updating Kiali to v0.5.0

* Adding quotaspecs and quotaspecbindings in clusterole

* Upgrading Kiali Versrion on Requirements File

* better logging for attribute bag (#7031)

Signed-off-by: Kuat Yessenov <kuat@google.com>

* Istio-remote helm: allow setup pilot svc & endpoint for controlPlaneSecurity (#7094)

When controlPlaneSecurityEnabled the spiffe configured by sidecar injector
assumes that the pilot discoveryAddress is a hostname.namespace formatted
string.  This change makes the istio-remote helm chart setup a selectorless
service and endpoint from the pilotAddress when the remotePilotCreateSvcEndpoint
arg is true and sets the MeshConfig discoveryAddress to be the hostname
for istio-pilot.

* remove MeshPolicy/DefaultDestRule when mtls isn't enabled (#7095)

* Change job name to indicate release version (#7092)

* Polishing for messages, reporting, metrics (#6946)

* Make version, timestamp available in service for k8s

* More error and metrics cleanup

* Address Shriram's comments

* Format

* Fix verbose log, format, init

* More work - the push is async, and things are trickier than they look

* Rename mixer job, so upgrade works

* Add back iperf3 without sidecar

* Format

* Switch to *env, no copy by value

* Cleanup, resolve conflicts

* Also convert node to pointer, and add explicit param

* Polish, cleanups

* Revert changes moved to other PRs

* Logging too much

* Polish, less log

* Extra safety, sometimes a stale message is stuck until config change

* fmt and lint errors

* Addres review comments

* Add the ttls test

* Revert the review fix - it breaks tests (some send old style).
Will update post 1.1

* Fix for ingress conflict with tracing ingress (#7039)

* force to use proxyv2 for istio-telemetry pod (#7111)

* delete unix socket, before calling listen (#7110)

* typo: connctionDuration -> connectionDuration (#7134)

* Add RbacConfig CRD to Helm chart (#7125)

* Fix two data races (#7119)

* TCP routing cleanups/bug fixes: part 1 (#7101)

* TCP routing cleanups: part 1

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* missing sort

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* sort destination cidrs

* proxy sha update

* undo istio proxy sha

* fixups

* compile fixes

* nil check

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* nits

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* Update proxy sha based on Piotrs changes

* undo Piotrs changes

* add reporterKind attribute to accesslog and tcpaccesslog (#7147)

* Improve outbound listener conflict messages (#7113)

This is needed to better support e2e testing of conflicts.

* Update accesslog config (#7158)

* Update hub and tag in values.yaml in use daily releases (#7116)

* add latest tag to values.yaml

* switch latest in istioctl

* configurable mixer port (#7156)

Signed-off-by: Kuat Yessenov <kuat@google.com>

* Adding unit test for TCP over TCP conflicts. (#7160)

* Adding unit test for TCP over TCP conflicts.

* addressing comments.

* addressing comments.

* addressing comments.

* Assorted small fixes for setup (#7123)

* Assorted small fixes

* spaces

* Fix certmanager (#7141)

* Adding e2e test for outbound listener conflicts (#7173)

* remove static route generation. improve gateway validation (#7175)

* remove static route generation

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* more validation for gateways

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* validation fixes

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* fix test

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* Updating Kiali to v0.5.0 in Ansible Installer (#7042)

* Multicluster make zipkin conditional (#7085)

This change makes the zipkin arguement in
the sidecar config map to be conditional
based on zipkin being used in remote clusters.

* Yet another place of the connctionDuration typo (#7177)

* Put back citadel templates and re-generate them when running updateVersion.sh (#7178)

* make bookinfo sample build repeatable (#7152)

* make bookinfo sample build repeatable

* update bookinfo image references to 1.8

* delete me later-- reference temporary images

* remove v1 registration from readiness probe and use debu/endpointz (#7189)

* bookinfo fixes (#7109)

* update bookinfo productpage service

* update bookinfo reviews service

* update routing rules

* fix me after-- update image references

* update e2e tests

* fix buildinfo build bug from #6988

* Cleaning up inject test files (#7188)

There are a lot of files and its confusing which files are used by
inject_test vs webhook_test. Splitting out the files into two
subdirectories under testdata/ to make it clear.  Making copies of
files that are shared.

* add TCP mixerfilter test (#7172)

Signed-off-by: Kuat Yessenov <kuat@google.com>

* Fix broken ingress (#7144)

* Fix ingress

* Move merging ingress into VirtualService and dedup to separate PR. Add back the previously and still broken gateway generation

* Another attempt to avoid duplicated vhosts and merge ingress

* Missed a pointer

* Remove again mergeIngress

* Improved messages. Will need to be turned into metrics soon

* Merge, assorted fixes

* Leave the push param in gateay, it will be needed later

* deps: update proxy (#7196)

* update sha

Signed-off-by: Kuat Yessenov <kuat@google.com>

* merge

Signed-off-by: Kuat Yessenov <kuat@google.com>

* fix tests

Signed-off-by: Kuat Yessenov <kuat@google.com>

* typo

Signed-off-by: Kuat Yessenov <kuat@google.com>

* rbac: add e2e tests for envoy based rbac. (#7193)

See #6377.

* Cleanup default metrics configuration (#7034)

* WIP: Cleanup default metrics configuration

* Remove last vestige of destination_namespace

* Update accesslog config

* Update syntax used to configure xDS servers. (#7201)

Signed-off-by: Piotr Sikora <piotrsikora@google.com>

* Update go-control-plane to 8cef83f9. (#7202)

Signed-off-by: Piotr Sikora <piotrsikora@google.com>

* bump bookinfo version (#7195)

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* Add contents of install/ansible to release script (#7194)

Fixes: #4359, istio/old_issues_repo#223

* update for 1.0.0 path (#7088)

* update api sha (#7204)

* Delete namespace after tests when using helm (#7051)

* Delete namespace after tests when using helm

Signed-off-by: Neil Hickey <nhickey@pivotal.io>

* Do not return error if namespace deletion fails

If the helm chart being deleted has the namespace manifest then the HelmDelete would've already deleted the namespace

* Add an e2e test for RedisQuota Adapter  (#6720)

* Add an e2e test for RedisQuota Adapter

Fix RedisQuota Unit Test and lint error in kuberntes.go

Remove additional log added in redisquota adapter
delete the route rule after test finishes in  mixer_test.go

Fix vectorValue function and remove local port forwarding to redisquota server

Add an e2e test for RedisQuota Adapter

Fix RedisQuota Unit Test and lint error in kuberntes.go

Remove additional log added in redisquota adapter
delete the route rule after test finishes in  mixer_test.go

Add an e2e test for RedisQuota Adapter

Fix RedisQuota Unit Test and lint error in kuberntes.go

Remove additional log added in redisquota adapter
delete the route rule after test finishes in  mixer_test.go

Fix vectorValue function and remove local port forwarding to redisquota server

Add an e2e test for RedisQuota Adapter

Fix RedisQuota Unit Test and lint error in kuberntes.go

Remove additional log added in redisquota adapter
delete the route rule after test finishes in  mixer_test.go

Remove destination version label for quota test

Make calculations more tight for RedisQuota

Format test

Format test

* Fix tests based on  metrics change

* Scale istio-policy pod to 2 for redisquota test

* Fix spelling mistake in comment in kube_utils.go

* Fix lint error with mixer_test.go

* Fix lint error with mixer_test.go

* Fix path for networking and policy rules

* Move Kubernetes Ansible to proper location (#7207)

* Fixing a wrong Json key for the CreationTimestamp field (#7206)

* rename key for istio-remote chart repository->hub (#7209)

* Move "repository" to "hub" and hardcode image name (#7187)

* Move "repository" to "hub" and hardcode image name

The imagename hard code comes from the pattern laid down in certmanager.
I'm not super keen on this as it makes determining the image names for airgapped
installs a bit more difficult.  The good news is we can always add an "image"
field for each service if we want to expose that information in values.yaml
or just document it appropriately.

* Move hyperkube back to globals

* Fix a typo

* Fix error in change

* Sort configs by creation time before returning (#7216)

* Sort configs by creation time before returning

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* format

* Moved RBAC CRDs to group rbac.istio.io from config.istio.io (#6874)

* Moved RBAC CRDs to group rbac.istio.io from config.istio.io

* Review comments addressed

* Modify global RbacConfig group too

* Updated new files added in recent PRs

* Updated a recently added RbacConfig CRD too

* rbac.istio.io/v1alpha2 -> rbac.istio.io/v1alpha1

* Change protos version to v1alpha1

* Updated a test file that was recently added

* Add useful warnings when quota specs do not match (#7226)

* Add named logging scope for model

* Add warning and tests to QuotaSpecByDestination

1. Add warning messages under correct conditions to inform
  user that some common error conditions were encountered.
2. Add test coverage for QuotaSpecByDestination.
3. Add previously omitted support for simple wildcard match.

* review comments

* update envoy sha - fix memory leak (#7232)

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* More debug/troubleshooting (#7227)

* More debug/troubleshooting

* Build error

* Fix istio-remote sidecar-injector-configmap rendered yaml parse error (#7245)

Fixes: #7244

* use receive only channel (#6960)

* Tool to aggregate third party licenses (#7220)

* Tool to aggregate third party licenses

* Clean up and add match info as an option

* Add readme, change binary name

* Update readme, make --branch optional

* Don't run licensee if not required

* Lint

* part 2 TCP routing cleanups/bug fixes for header matcher (#7236)

* update envoy sha - fix memory leak

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* Fixing assorted bugs in service entries using filter chain matches

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* format

* bug fix

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* lint

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* lint

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* multicluster bug fixes

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* backward compatibility

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* use new header match specifier

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* mixer: add sidecar health probe (#7102)

* sidecar health

Signed-off-by: Kuat Yessenov <kuat@google.com>

* typos

Signed-off-by: Kuat Yessenov <kuat@google.com>

* remove tracing of health checks

Signed-off-by: Kuat Yessenov <kuat@google.com>

* change to 15093

Signed-off-by: Kuat Yessenov <kuat@google.com>

* Add proxy version to the proxy-status command (#7269)

* use new websocket option and remove deprecated one (#7247)

* use new websocket option and remove deprecated one

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* backward compatibility

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* consistency

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* cleanup

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* dont append upgrade configs

* remove requestedServerName attribute (#7278)

it does not work, requires debugging and possibly implementation, will not be in time before the release

* Handle virtual service sni_hosts matches in gateway. (#7192)

* dirty poc

* working poc

* comments + cleanup

* lint

* add simple e2e test to egress

* minor refactoring

* cleanups, lots of comments

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* more duplication for clarity

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* simplifying gateway opaque tcp logic

* final cleanups

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* nil pointer check

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>

* Add add operation into expression language (#6776)

* add op.

* fix duplicated test.

* Mixer Conditional Quota (#7265)

* add tests for conditional and unknown quota

* add conditional and unknown quota

* Option to disable pilot sidecar (#7280)

* Remove whitespace between host: and port in 'istioctl authn tls-check' (#7084)

* Remove whitespace between host: and port

* Typo
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants