Add flag trustDomain to pilot. by axel7born · Pull Request #9059 · istio/istio

axel7born · 2018-10-01T07:18:21Z

Add the flag identityDomain to the pilot to make the trust domain for PilotSAN configurable.

This PR is the first part of #8976 and is related to #8661

googlebot · 2018-10-01T07:18:26Z

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google.
In order to pass this check, please resolve this problem and have the pull request author add another comment and the bot will run again. If the bot doesn't comment, it means it doesn't think anything has changed.

codecov · 2018-10-09T10:24:58Z

Codecov Report

Merging #9059 into release-1.1 will increase coverage by 8%.
The diff coverage is 70%.

@@              Coverage Diff               @@
##           release-1.1   #9059      +/-   ##
==============================================
+ Coverage           63%     70%      +8%     
==============================================
  Files              561     438     -123     
  Lines            51937   41196   -10741     
==============================================
- Hits             32386   28717    -3669     
+ Misses           17691   11092    -6599     
+ Partials          1860    1387     -473

Impacted Files	Coverage Δ
mixer/pkg/checkcache/cache.go	`100% <ø> (ø)`	⬆️
mixer/pkg/runtime/config/snapshot.go	`58% <ø> (ø)`	⬆️
mixer/pkg/template/template.go	`61% <ø> (ø)`	⬆️
pilot/pkg/model/context.go	`74% <ø> (+5%)`	⬆️
galley/pkg/crd/validation/validation.go	`50% <0%> (+16%)`	⬆️
mixer/template/template.gen.go	`0% <0%> (-29%)`	⬇️
pilot/pkg/networking/plugin/mixer/mixer.go	`1% <0%> (ø)`	⬆️
mixer/pkg/runtime/config/strings.go	`92% <0%> (ø)`	⬆️
...t/pkg/networking/plugin/envoyfilter/envoyfilter.go	`21% <0%> (ø)`
mixer/pkg/runtime/routing/table.go	`100% <100%> (ø)`	⬆️
... and 210 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update dc84b66...82eccca. Read the comment docs.

googlebot · 2018-10-09T10:25:02Z

CLAs look good, thanks!

cmluciano · 2018-10-10T14:11:15Z

/ok-to-test

cc @elevran @myidpt

cmluciano · 2018-10-10T14:13:44Z

/retest

install/kubernetes/helm/istio/values.yaml

axel7born · 2018-10-16T08:41:59Z

/retest

c0d1ngm0nk3y · 2018-10-16T13:30:24Z

/test e2e-mixer-no_auth

pilot/pkg/kube/inject/testdata/webhook/daemonset.yaml.injected

pilot/pkg/model/context.go

pilot/cmd/pilot-agent/main.go

axel7born · 2018-10-17T11:02:18Z

/assign @ijsnellf
/assign @andraxylia
/assign @costinm

Co-authored-by: Ulrich Kramer <u.kramer@sap.com>

Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>

Co-authored-by: Ulrich Kramer <u.kramer@sap.com>

Fix wrong domain name for AuthenticationPolicy_NONE. Co-authored-by: Axel Siebenborn <axel.siebenborn@sap.com>

Issue istio#9313 If the helm templating is changed, the env REFRESH_GOLDEN can be used to update the HelmInject/webhook tests as well as the other pilot tests. Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>

Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>

Co-authored-by: Julia Plachetka <julia.plachetka@sap.com>

Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>

…ult of trust-domain from cluster.local to empty Co-authored-by: Jakob Schmid <jakob.schmid@sap.com>

jkbschmid · 2018-12-10T12:14:49Z

/retest

kramerul · 2018-12-10T13:57:45Z

@myidpt, @hklai Could you retrigger the ci/circleci tests?

myidpt · 2018-12-10T18:18:02Z

/test e2e-mixer-noauth-v1alpha3-v2

myidpt · 2018-12-10T19:03:51Z

/lgtm

istio-testing · 2018-12-10T19:03:57Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: axel7born, costinm, myidpt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~install/OWNERS~~ [costinm]
~~pilot/OWNERS~~ [costinm]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

myidpt · 2018-12-10T19:45:57Z

Finally we got this merged! Thanks everyone!

istio-testing · 2018-12-10T19:53:25Z

@axel7born: The following tests failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
prow/e2e-simpleTests-cni.sh	61418c70f6426b1420d3c70e967ee56af6becbe5	link	`/test e2e-simpleTests-cni`
prow/istio-pilot-multicluster-e2e.sh	`82eccca`	link	`/test istio-pilot-multicluster-e2e`

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

googlebot added the cla: no Set by the Google CLA bot to indicate the author of a PR has not signed the Google CLA. label Oct 1, 2018

istio-testing requested review from andraxylia and gyliu513 October 1, 2018 07:18

istio-testing added the needs-ok-to-test label Oct 1, 2018

jsPlachetka mentioned this pull request Oct 2, 2018

Move everything related to spiffe URIs to package spiffe #9090

Merged

kramerul force-pushed the pilot-trust-domain-1 branch from b4b17d7 to 8e6dd6b Compare October 9, 2018 10:24

googlebot added cla: yes and removed cla: no Set by the Google CLA bot to indicate the author of a PR has not signed the Google CLA. labels Oct 9, 2018

This was referenced Oct 9, 2018

[WIP] Allow identity domain to be configured in istio #8976

Closed

Allow identity domain to be configured in istio: Ensure e2e tests are working with different identity domain #9226

Merged

istio-testing removed the needs-ok-to-test label Oct 10, 2018

myidpt suggested changes Oct 10, 2018

View reviewed changes

install/kubernetes/helm/istio/values.yaml Outdated Show resolved Hide resolved

myidpt mentioned this pull request Oct 10, 2018

Allow configurable trust domain in Istio identities #8661

Closed

4 tasks

gyliu513 reviewed Oct 11, 2018

View reviewed changes

install/kubernetes/helm/istio/values.yaml Outdated Show resolved Hide resolved

axel7born mentioned this pull request Oct 12, 2018

Move value identityDomain to global scope. #8867

Closed

c0d1ngm0nk3y force-pushed the pilot-trust-domain-1 branch from 8e6dd6b to f19aa83 Compare October 15, 2018 08:51

myidpt reviewed Oct 16, 2018

View reviewed changes

jsPlachetka force-pushed the pilot-trust-domain-1 branch from f19aa83 to 19d1c32 Compare October 17, 2018 07:57

istio-testing added the needs-rebase Indicates a PR needs to be rebased before being merged label Oct 17, 2018

jsPlachetka force-pushed the pilot-trust-domain-1 branch from 19d1c32 to a80ada7 Compare October 17, 2018 08:46

istio-testing removed the needs-rebase Indicates a PR needs to be rebased before being merged label Oct 17, 2018

istio-testing assigned andraxylia Oct 17, 2018

axel7born and others added 16 commits December 7, 2018 21:01

Move value identityDomain to global scope.

603c24d

Co-authored-by: Ulrich Kramer <u.kramer@sap.com>

Refactor to make pilotSAN testable

6a5f398

Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>

Add unit test for existing pilotSAN determination

3131ede

Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>

Add IdentityDomain to model.Proxy

cb86d75

Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>

Move lines after compare to upstream

f1aa2a8

Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>

Add parameter --identity-domain to start pilot

a662edd

Co-authored-by: Ulrich Kramer <u.kramer@sap.com>

Split determinePilotSANandDomain into dedicated functions.

b2cac36

Fix wrong domain name for AuthenticationPolicy_NONE. Co-authored-by: Axel Siebenborn <axel.siebenborn@sap.com>

Add REFRESH_GOLDEN functionality to HelmInject tests.

b8bf1fe

Issue istio#9313 If the helm templating is changed, the env REFRESH_GOLDEN can be used to update the HelmInject/webhook tests as well as the other pilot tests. Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>

Rename Domain to DNSDomain and pilotDomain to pilotIdentityDomain

7e61f21

Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>

Add copyright to test file

4f258e4

Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>

Rename identity-domain to trust-domain.

a2a3682

Co-authored-by: Julia Plachetka <julia.plachetka@sap.com>

Fix formatting

60a2d6d

Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>

Remove second trustDomain definition from values file.

ee6e2b8

Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com>

Revert changes in golden files. Add comment to main_test. Change defa…

0b49683

…ult of trust-domain from cluster.local to empty Co-authored-by: Jakob Schmid <jakob.schmid@sap.com>

Fix linter error.

2c56f42

Fix cluster_test

82eccca

axel7born force-pushed the pilot-trust-domain-1 branch from 3b125f3 to 82eccca Compare December 7, 2018 20:02

istio-testing added the lgtm label Dec 10, 2018

istio-testing merged commit a1cafbe into istio:release-1.1 Dec 10, 2018

axel7born mentioned this pull request Mar 4, 2019

REQUEST: New membership for axel7born istio/community#146

Closed

4 tasks

kramerul mentioned this pull request Mar 22, 2019

REQUEST: New membership for kramerul istio/community#160

Closed

4 tasks

Conversation

axel7born commented Oct 1, 2018

Uh oh!

googlebot commented Oct 1, 2018

Uh oh!

codecov bot commented Oct 9, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

googlebot commented Oct 9, 2018

Uh oh!

cmluciano commented Oct 10, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cmluciano commented Oct 10, 2018

Uh oh!

Uh oh!

Uh oh!

axel7born commented Oct 16, 2018

Uh oh!

c0d1ngm0nk3y commented Oct 16, 2018

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

axel7born commented Oct 17, 2018

Uh oh!

jkbschmid commented Dec 10, 2018

Uh oh!

kramerul commented Dec 10, 2018

Uh oh!

myidpt commented Dec 10, 2018

Uh oh!

myidpt commented Dec 10, 2018

Uh oh!

istio-testing commented Dec 10, 2018

Uh oh!

myidpt commented Dec 10, 2018

Uh oh!

istio-testing commented Dec 10, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

codecov bot commented Oct 9, 2018 •

edited

Loading

cmluciano commented Oct 10, 2018 •

edited

Loading