bookinfo fixes#7109
Conversation
|
@krancour Thanks for this PR. Can you push the changes to your dockerhub account and update the bookinfo YAMLs to point to your version ? Once they pass, I can copy and push them into istio's official docker hub and update the YAML references in a separate PR |
|
Also, please rebase the PR to release-1.0 branch |
|
I have merged the other PR. Please rebase this to release-1.0 branch |
|
@rshriram working on it. Seems I did break the e2e tests, so I am trying to resolve that before continuing. |
|
So there's good news and bad news. 👍 The good news is that everyone that needs to sign a CLA (the pull request submitter and all commit authors) have done so. Everything is all good there. 😕 The bad news is that it appears that one or more commits were authored or co-authored by someone other than the pull request submitter. We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that here in the pull request. Note to project maintainer: This is a terminal state, meaning the |
|
You have to close this PR and open a new PR for release-1.0 branch.. changing the target branch in Github doesn't seem to work properly (if thats what you did). |
I changed the target branch, but didn't push anything that I have rebased yet. That's why this looks all screwy. I'll have this all fixed up as soon as I get those e2e tests fixed. |
|
/ok-to-test |
|
@krancour please debug fro release-1.0 branch. Lots of fixes went in. Master may be very much outdated. |
Codecov Report
@@ Coverage Diff @@
## release-1.0 #7109 +/- ##
============================================
- Coverage 72% 72% -<1%
============================================
Files 356 356
Lines 30537 30534 -3
============================================
- Hits 21780 21741 -39
- Misses 7853 7887 +34
- Partials 904 906 +2
Continue to review full report at Codecov.
|
|
@rshriram updating e2e tests took me a little while, but I think this should be g2g now. lmk |
|
Please fix lint.. |
|
@rshriram your issue with building reviews images seems to have been introduced by a recent PR other than my own: b0a1c95#diff-030573cbbec06dc83bf87af67b0ae74eR42 I'm happy to fix this, however. Ack on lint error. |
|
I see this in release-1.0 branch |
|
which came from your prior PR https://github.com/istio/istio/blob/release-1.0/samples/bookinfo/src/build-services.sh#L42 ? |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: krancour Assign the PR to them by writing The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
CLAs look good, thanks! |
|
Also, |
|
@rshriram thanks for the help with this! |
|
@rshriram just a reminder that official Docker images still need to be published and references to my dockerhub repos need to be corrected in a follow-up. If you publish the updated images, I'd be happy to submit that follow-up. |
This reverts commit 7e65cd9.
* Remove api.* attributes from accesslog as they are yet to be implemented (#7019) * mixer: setup initial liveness probe (#7065) * Setup initial liveness probe for Mixer * Prefer /version to /metrics * remove unused legacy v1alpha1 routing apis (#7091) * Updating Kiali to v0.5.0 in Helm Installer (#7007) * Updating Kiali to v0.5.0 * Adding quotaspecs and quotaspecbindings in clusterole * Upgrading Kiali Versrion on Requirements File * better logging for attribute bag (#7031) Signed-off-by: Kuat Yessenov <kuat@google.com> * Istio-remote helm: allow setup pilot svc & endpoint for controlPlaneSecurity (#7094) When controlPlaneSecurityEnabled the spiffe configured by sidecar injector assumes that the pilot discoveryAddress is a hostname.namespace formatted string. This change makes the istio-remote helm chart setup a selectorless service and endpoint from the pilotAddress when the remotePilotCreateSvcEndpoint arg is true and sets the MeshConfig discoveryAddress to be the hostname for istio-pilot. * remove MeshPolicy/DefaultDestRule when mtls isn't enabled (#7095) * Change job name to indicate release version (#7092) * Polishing for messages, reporting, metrics (#6946) * Make version, timestamp available in service for k8s * More error and metrics cleanup * Address Shriram's comments * Format * Fix verbose log, format, init * More work - the push is async, and things are trickier than they look * Rename mixer job, so upgrade works * Add back iperf3 without sidecar * Format * Switch to *env, no copy by value * Cleanup, resolve conflicts * Also convert node to pointer, and add explicit param * Polish, cleanups * Revert changes moved to other PRs * Logging too much * Polish, less log * Extra safety, sometimes a stale message is stuck until config change * fmt and lint errors * Addres review comments * Add the ttls test * Revert the review fix - it breaks tests (some send old style). Will update post 1.1 * Fix for ingress conflict with tracing ingress (#7039) * force to use proxyv2 for istio-telemetry pod (#7111) * delete unix socket, before calling listen (#7110) * typo: connctionDuration -> connectionDuration (#7134) * Add RbacConfig CRD to Helm chart (#7125) * Fix two data races (#7119) * TCP routing cleanups/bug fixes: part 1 (#7101) * TCP routing cleanups: part 1 Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * missing sort Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * sort destination cidrs * proxy sha update * undo istio proxy sha * fixups * compile fixes * nil check Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * nits Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * Update proxy sha based on Piotrs changes * undo Piotrs changes * add reporterKind attribute to accesslog and tcpaccesslog (#7147) * Improve outbound listener conflict messages (#7113) This is needed to better support e2e testing of conflicts. * Update accesslog config (#7158) * Update hub and tag in values.yaml in use daily releases (#7116) * add latest tag to values.yaml * switch latest in istioctl * configurable mixer port (#7156) Signed-off-by: Kuat Yessenov <kuat@google.com> * Adding unit test for TCP over TCP conflicts. (#7160) * Adding unit test for TCP over TCP conflicts. * addressing comments. * addressing comments. * addressing comments. * Assorted small fixes for setup (#7123) * Assorted small fixes * spaces * Fix certmanager (#7141) * Adding e2e test for outbound listener conflicts (#7173) * remove static route generation. improve gateway validation (#7175) * remove static route generation Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * more validation for gateways Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * validation fixes Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * fix test Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * Updating Kiali to v0.5.0 in Ansible Installer (#7042) * Multicluster make zipkin conditional (#7085) This change makes the zipkin arguement in the sidecar config map to be conditional based on zipkin being used in remote clusters. * Yet another place of the connctionDuration typo (#7177) * Put back citadel templates and re-generate them when running updateVersion.sh (#7178) * make bookinfo sample build repeatable (#7152) * make bookinfo sample build repeatable * update bookinfo image references to 1.8 * delete me later-- reference temporary images * remove v1 registration from readiness probe and use debu/endpointz (#7189) * bookinfo fixes (#7109) * update bookinfo productpage service * update bookinfo reviews service * update routing rules * fix me after-- update image references * update e2e tests * fix buildinfo build bug from #6988 * Cleaning up inject test files (#7188) There are a lot of files and its confusing which files are used by inject_test vs webhook_test. Splitting out the files into two subdirectories under testdata/ to make it clear. Making copies of files that are shared. * add TCP mixerfilter test (#7172) Signed-off-by: Kuat Yessenov <kuat@google.com> * Fix broken ingress (#7144) * Fix ingress * Move merging ingress into VirtualService and dedup to separate PR. Add back the previously and still broken gateway generation * Another attempt to avoid duplicated vhosts and merge ingress * Missed a pointer * Remove again mergeIngress * Improved messages. Will need to be turned into metrics soon * Merge, assorted fixes * Leave the push param in gateay, it will be needed later * deps: update proxy (#7196) * update sha Signed-off-by: Kuat Yessenov <kuat@google.com> * merge Signed-off-by: Kuat Yessenov <kuat@google.com> * fix tests Signed-off-by: Kuat Yessenov <kuat@google.com> * typo Signed-off-by: Kuat Yessenov <kuat@google.com> * rbac: add e2e tests for envoy based rbac. (#7193) See #6377. * Cleanup default metrics configuration (#7034) * WIP: Cleanup default metrics configuration * Remove last vestige of destination_namespace * Update accesslog config * Update syntax used to configure xDS servers. (#7201) Signed-off-by: Piotr Sikora <piotrsikora@google.com> * Update go-control-plane to 8cef83f9. (#7202) Signed-off-by: Piotr Sikora <piotrsikora@google.com> * bump bookinfo version (#7195) Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * Add contents of install/ansible to release script (#7194) Fixes: #4359, istio/old_issues_repo#223 * update for 1.0.0 path (#7088) * update api sha (#7204) * Delete namespace after tests when using helm (#7051) * Delete namespace after tests when using helm Signed-off-by: Neil Hickey <nhickey@pivotal.io> * Do not return error if namespace deletion fails If the helm chart being deleted has the namespace manifest then the HelmDelete would've already deleted the namespace * Add an e2e test for RedisQuota Adapter (#6720) * Add an e2e test for RedisQuota Adapter Fix RedisQuota Unit Test and lint error in kuberntes.go Remove additional log added in redisquota adapter delete the route rule after test finishes in mixer_test.go Fix vectorValue function and remove local port forwarding to redisquota server Add an e2e test for RedisQuota Adapter Fix RedisQuota Unit Test and lint error in kuberntes.go Remove additional log added in redisquota adapter delete the route rule after test finishes in mixer_test.go Add an e2e test for RedisQuota Adapter Fix RedisQuota Unit Test and lint error in kuberntes.go Remove additional log added in redisquota adapter delete the route rule after test finishes in mixer_test.go Fix vectorValue function and remove local port forwarding to redisquota server Add an e2e test for RedisQuota Adapter Fix RedisQuota Unit Test and lint error in kuberntes.go Remove additional log added in redisquota adapter delete the route rule after test finishes in mixer_test.go Remove destination version label for quota test Make calculations more tight for RedisQuota Format test Format test * Fix tests based on metrics change * Scale istio-policy pod to 2 for redisquota test * Fix spelling mistake in comment in kube_utils.go * Fix lint error with mixer_test.go * Fix lint error with mixer_test.go * Fix path for networking and policy rules * Move Kubernetes Ansible to proper location (#7207) * Fixing a wrong Json key for the CreationTimestamp field (#7206) * rename key for istio-remote chart repository->hub (#7209) * Move "repository" to "hub" and hardcode image name (#7187) * Move "repository" to "hub" and hardcode image name The imagename hard code comes from the pattern laid down in certmanager. I'm not super keen on this as it makes determining the image names for airgapped installs a bit more difficult. The good news is we can always add an "image" field for each service if we want to expose that information in values.yaml or just document it appropriately. * Move hyperkube back to globals * Fix a typo * Fix error in change * Sort configs by creation time before returning (#7216) * Sort configs by creation time before returning Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * format * Moved RBAC CRDs to group rbac.istio.io from config.istio.io (#6874) * Moved RBAC CRDs to group rbac.istio.io from config.istio.io * Review comments addressed * Modify global RbacConfig group too * Updated new files added in recent PRs * Updated a recently added RbacConfig CRD too * rbac.istio.io/v1alpha2 -> rbac.istio.io/v1alpha1 * Change protos version to v1alpha1 * Updated a test file that was recently added * Add useful warnings when quota specs do not match (#7226) * Add named logging scope for model * Add warning and tests to QuotaSpecByDestination 1. Add warning messages under correct conditions to inform user that some common error conditions were encountered. 2. Add test coverage for QuotaSpecByDestination. 3. Add previously omitted support for simple wildcard match. * review comments * update envoy sha - fix memory leak (#7232) Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * More debug/troubleshooting (#7227) * More debug/troubleshooting * Build error * Fix istio-remote sidecar-injector-configmap rendered yaml parse error (#7245) Fixes: #7244 * use receive only channel (#6960) * Tool to aggregate third party licenses (#7220) * Tool to aggregate third party licenses * Clean up and add match info as an option * Add readme, change binary name * Update readme, make --branch optional * Don't run licensee if not required * Lint * part 2 TCP routing cleanups/bug fixes for header matcher (#7236) * update envoy sha - fix memory leak Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * Fixing assorted bugs in service entries using filter chain matches Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * format * bug fix Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * lint Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * lint Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * multicluster bug fixes Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * backward compatibility Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * use new header match specifier Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * mixer: add sidecar health probe (#7102) * sidecar health Signed-off-by: Kuat Yessenov <kuat@google.com> * typos Signed-off-by: Kuat Yessenov <kuat@google.com> * remove tracing of health checks Signed-off-by: Kuat Yessenov <kuat@google.com> * change to 15093 Signed-off-by: Kuat Yessenov <kuat@google.com> * Add proxy version to the proxy-status command (#7269) * use new websocket option and remove deprecated one (#7247) * use new websocket option and remove deprecated one Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * backward compatibility Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * consistency Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * cleanup Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * dont append upgrade configs * remove requestedServerName attribute (#7278) it does not work, requires debugging and possibly implementation, will not be in time before the release * Handle virtual service sni_hosts matches in gateway. (#7192) * dirty poc * working poc * comments + cleanup * lint * add simple e2e test to egress * minor refactoring * cleanups, lots of comments Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * more duplication for clarity Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * simplifying gateway opaque tcp logic * final cleanups Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * nil pointer check Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com> * Add add operation into expression language (#6776) * add op. * fix duplicated test. * Mixer Conditional Quota (#7265) * add tests for conditional and unknown quota * add conditional and unknown quota * Option to disable pilot sidecar (#7280) * Remove whitespace between host: and port in 'istioctl authn tls-check' (#7084) * Remove whitespace between host: and port * Typo
Fixes #7047
Important: requires #7098 to be merged first since that make some critical fixes to the bookinfo sample app's build process, which fails in its current state.
This PR corrects unrealistic behavior in the sample app.
Currently, the productpage app stores user identity in a cookie that is neither encrypted nor signed. It is easily tampered with by even the most novice attacker. Additionally, the productpage app forwards that same cookie to the downstream reviews service. This is also bad. Both of these, however, were obviously done to facilitate an impactful demo that shows request routing decisions being done on the basis of user identity.
This PR transforms the example to use more realistic behavior without compromising on the demo's impact. The cookie is now encoded and digitally signed (the flask framework automatically encodes any session data that is kept in a cookie-based session store). It can be decoded, but tampering with it (successfully) is not possible due to the signature. The productinfo page also ceases to share this cookie with the downstream review service. Instead, it injects the end-user's username into a custom
end-userheader on the outbound requests to the reviews service. The end result is that there is still a plain text header present that routing decisions can be based on, but from start to finish, we didn't have to compromise on security to make that possible.All sample routing rules (used by tasks in the documentation) are also updated by this PR.
Note that the images referenced in the various
yamlfiles do not exist yet in dockerhub because I don't have permissions to push them and, as far as I can tell, there isn't any automated build/push process for those. So someone else needs to build and push these, I guess?Will open a complementary PR in the docs repo momentarily.