40 Pull requests merged by 11 people

• docs: Add Makefile.k8s.mk Usage

  #53410 merged Oct 4, 2024

• Automator: update ztunnel@master in istio/istio@master

  #53420 merged Oct 4, 2024

• Automator: update proxy@master in istio/istio@master

  #53418 merged Oct 4, 2024

• Automator: update istio/client-go@master dependency in istio/istio@master

  #53417 merged Oct 3, 2024

• Remove istiod-remote chart in favor of a remote profile for istio-discovery

  #53294 merged Oct 3, 2024

• Automator: update common-files@master in istio/istio@master

  #53416 merged Oct 3, 2024

• Add curl sample to replace sleep

  #53381 merged Oct 3, 2024

• Add metrics port to waypoint

  #53373 merged Oct 3, 2024

• Automator: update proxy@master in istio/istio@master

  #53412 merged Oct 3, 2024

• Automator: update ztunnel@master in istio/istio@master

  #53403 merged Oct 3, 2024

• Automator: update istio/client-go@master dependency in istio/istio@master

  #53398 merged Oct 2, 2024

• Automator: update proxy@master in istio/istio@master

  #53394 merged Oct 2, 2024

• [release-1.22] Fix httpbin sample's command

  #53298 merged Oct 2, 2024

• Fix postsubmit fails caused by #53318

  #53378 merged Oct 2, 2024

• Automator: update proxy@master in istio/istio@master

  #53372 merged Oct 2, 2024

• Automator: update proxy@release-1.21 in istio/istio@release-1.21

  #53362 merged Oct 2, 2024

• Automator: update proxy@release-1.22 in istio/istio@release-1.22

  #53336 merged Oct 2, 2024

• Automator: update ztunnel@master in istio/istio@master

  #53380 merged Oct 2, 2024

• AuthorizationPolicy status for waypoint attachment

  #53091 merged Oct 1, 2024

• Default to always templating CRDs in the base chart.

  #53318 merged Oct 1, 2024

• cleanup invalid yaml in test

  #53376 merged Oct 1, 2024

• 1.23: bump to docker 26.1.5

  #53377 merged Oct 1, 2024

• Automator: update istio/client-go@master dependency in istio/istio@master

  #53374 merged Oct 1, 2024

• Added metrics port to kube-gateway.yaml manifest

  #53351 merged Oct 1, 2024

• Partial revert of #53348 to fix race

  #53360 merged Oct 1, 2024

• Minor optimization around SupportsTunnel

  #53356 merged Oct 1, 2024

• Fix missing directory for manifests dump in integration test

  #53358 merged Sep 30, 2024

• ambient status: add leader election

  #53296 merged Sep 30, 2024

• waypoint: disable protocol sniffing when possible

  #53194 merged Sep 30, 2024

• Automator: update proxy@release-1.23 in istio/istio@release-1.23

  #53355 merged Sep 30, 2024

• Automator: update proxy@master in istio/istio@master

  #53343 merged Sep 30, 2024

• minor optimize: use efficient string split func

  #53348 merged Sep 30, 2024

• Fix description of TestGetAllAddresses tests

  #53338 merged Sep 29, 2024

• Ambient: fix incorrect dualstack EDS with tunnelling

  #52984 merged Sep 29, 2024

• convert httpbin to go-based

  #53315 merged Sep 28, 2024

• Automator: update proxy@master in istio/istio@master

  #53340 merged Sep 28, 2024

• Automator: update proxy@master in istio/istio@master

  #53330 merged Sep 27, 2024

• Automator: update proxy@release-1.23 in istio/istio@release-1.23

  #53334 merged Sep 27, 2024

• Automator: update proxy@master in istio/istio@master

  #53328 merged Sep 27, 2024

• Automator: update proxy@release-1.23 in istio/istio@release-1.23

  #53327 merged Sep 27, 2024

20 Pull requests opened by 15 people

• fix `istioctl analyze` attempts to retrieve unnecessary resources during multi-cluster detection

  #53321 opened Sep 27, 2024

• Add retry with timeout for TestGatewayAPIRequestAuthentication

  #53322 opened Sep 27, 2024

• fix `istio install` output incorrect version

  #53324 opened Sep 27, 2024

• Bump gateway to 1.2.0

  #53329 opened Sep 27, 2024

• add cert to xfcc header for sidecar

  #53337 opened Sep 28, 2024

• istioctl: add revision shortcode for analyze

  #53339 opened Sep 28, 2024

• Update func TestNamespaceControllerWithDiscoverySelectors

  #53347 opened Sep 30, 2024

• add default deny rule for wasmplugin & fix default network allow-all

  #53363 opened Oct 1, 2024

• Allow extra spaces between namespaces in networking.istio.io/exportTo annotation

  #53367 opened Oct 1, 2024

• Pull in labels and annotations from istio.io/api

  #53375 opened Oct 1, 2024

• [release-1.23] Added metrics port to kube gateway.yaml manifest

  #53383 opened Oct 2, 2024

• experimental feature: custom ConfigMap name for CA root cert

  #53386 opened Oct 2, 2024

• B11

  #53391 opened Oct 2, 2024

• Automator: update proxy@release-1.23 in istio/istio@release-1.23

  #53392 opened Oct 2, 2024

• Allow explicitly setting the downgraded sidecar termination protocol

  #53396 opened Oct 2, 2024

• Air feature test

  #53401 opened Oct 2, 2024

• test author change

  #53406 opened Oct 3, 2024

• Feature: flag to allow randomly selecting which upstream to forward dns requests to

  #53419 opened Oct 3, 2024

• Feature: allow configuring the dns proxy upstream timeout

  #53421 opened Oct 3, 2024

• Raghu master

  #53427 opened Oct 4, 2024

24 Issues closed by 12 people

• Better handling of multiple hosts in VirtualService

  #51645 closed Oct 4, 2024

• Enhance Documentation for Makefile.k8s.mk Usage

  #53409 closed Oct 4, 2024

• Configure different tracing provider for different workloads & workloads in different clusters

  #53411 closed Oct 4, 2024

• How to enable ICMP on an Istio Gateway?

  #53384 closed Oct 3, 2024

• Istioctl help and documentation not updated with Istio 1.21 changes [IstioOperator CRD removed]

  #51628 closed Oct 3, 2024

• Ambient tests misleading due to filtering

  #51501 closed Oct 3, 2024

• Istiod helm chart should support mounting the cacerts volume with the Kubernetes CSI Secrets store driver

  #50036 closed Oct 3, 2024

• Documented setup of of OpenTelemetryTracingProvider breaks apps that write to those same URL's directly via https

  #53382 closed Oct 2, 2024

• HTTP2 compatibility

  #53352 closed Oct 2, 2024

• [Feature Request] Istio proxy images (incl. distroless) should include `tar`

  #53196 closed Oct 2, 2024

• Future proof Ambient Multicluster APIs and protocols

  #52695 closed Oct 1, 2024

• Ambient status reporting

  #52699 closed Oct 1, 2024

• Istio-base helm chart does not apply CRDs with correct app, chart, and release labels

  #43204 closed Oct 1, 2024

• Sampling needs to be configurable for tracing, even if using custom sampler. Current code results in massive log spam

  #53012 closed Oct 1, 2024

• ambient: review all new names/APIs

  #43437 closed Oct 1, 2024

• Hardening TLS certificate key size

  #53326 closed Oct 1, 2024

• support stats compression for merged metrics

  #49987 closed Oct 1, 2024

• Exceeded the default maximum gRPC message size

  #52815 closed Sep 30, 2024

• Short term server-first protocol support on waypoints

  #53033 closed Sep 30, 2024

• Create architecture doc for Istio CA

  #46852 closed Sep 30, 2024

• Dual stack mode does not support SE selecting Pod with dual stack IP

  #53333 closed Sep 29, 2024

• Service defined on port 80 causes VS cannot capture traffic with specific host

  #49673 closed Sep 29, 2024

• two threads, one thread has few 401 errors until becomes 200 when a new kid is added to the jwks file for the first time

  #51581 closed Sep 28, 2024

• opentelemetry tracing bug: status code not set for gRPC

  #53025 closed Sep 27, 2024

28 Issues opened by 22 people

• Make REQUESTED_SERVER_NAME DNS compliant

  #53426 opened Oct 4, 2024

• Adopt Gateway API v1.2

  #53415 opened Oct 3, 2024

• Make DNS proxying more resilient to DNS errors/latency

  #53414 opened Oct 3, 2024

• configure istio to accept http1.0 requests

  #53413 opened Oct 3, 2024

• Otel configuration shows HTTP Authorization headers

  #53408 opened Oct 3, 2024

• Internal envoy header sanitization

  #53402 opened Oct 2, 2024

• The IstioOperator does not honor the podAntiAffinityLabelSelector and podAntiAffinityTermLabelSelector

  #53397 opened Oct 2, 2024

• Envoy sets `set_compliance_policy` (or we find its not needed)

  #53395 opened Oct 2, 2024

• Native sidecars not working on istio 1.20.3

  #53393 opened Oct 2, 2024

• multi control plane: add integration tests for CNI

  #53390 opened Oct 2, 2024

• Multi Control Plane: support overlapping namespaces

  #53385 opened Oct 2, 2024

• Ambient: leaked pod in snapshot, leading to ztunnel failing to startup

  #53371 opened Oct 1, 2024

• upstream connect error or disconnect/reset before headers. retried and the latest reset reason: remote connection failure, transport failure reason: TLS_error:|268435703:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER:TLS_error_end:TLS_error_end

  #53368 opened Oct 1, 2024

• Istio Ingress memory utilization is high

  #53365 opened Oct 1, 2024

• Remove `enableCRDTemplates` Helm flag and label autogen after deprecation window.

  #53361 opened Sep 30, 2024

• WorkloadEntry will only get implicit network from environment for remote clusters

  #53359 opened Sep 30, 2024

• Propagate injection config parsing errors

  #53357 opened Sep 30, 2024

• support trafficDistribution in istiod helm chart

  #53354 opened Sep 30, 2024

• Istio Proxy local Build with "--define boringssl=fips" fails

  #53353 opened Sep 30, 2024

• The egress gateway does not capture outbound traffic

  #53350 opened Sep 30, 2024

• Traffic not shown in Kiali

  #53346 opened Sep 29, 2024

• [HELP] [Ambient] modify the HTTP request body before it is sent to the upstream service.

  #53344 opened Sep 29, 2024

• [release-1.23] convert httpbin to go-based

  #53342 opened Sep 28, 2024

• [release-1.22] convert httpbin to go-based

  #53341 opened Sep 28, 2024

• `istioctl ztunnel-config certificates` (and other `ztunnel-config` subcommands) randomly picking an instance is confusing

  #53335 opened Sep 27, 2024

• Enabling meshConfig.defaultProviders in Helm chart for istiod disables Telemetry V2

  #53332 opened Sep 27, 2024

• Ambient Status: ObservedGeneration for status conditions

  #53331 opened Sep 27, 2024

• istioctl install output installed version inconrrect

  #53323 opened Sep 27, 2024

54 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• Support sending from ingress -> service waypoint

  #52985 commented on Oct 3, 2024 • 40 new comments

• Added support for bytes buffer pool

  #53305 commented on Oct 1, 2024 • 7 new comments

• Expose retry_budget configuration in DestinationRule ConnectionPoolSettings

  #51823 commented on Oct 2, 2024 • 1 new comment

• helm: dynamic naming of ztunnel chart

  #52978 commented on Oct 4, 2024 • 1 new comment

• Use cluster contexts in kubeconfig instead of remote secrets in multi-cluster service analyzer.

  #53057 commented on Oct 2, 2024 • 1 new comment

• 503 UC upstream_reset_before_response_started{connection_termination} on incomming call after two minutes

  #51619 commented on Oct 4, 2024 • 0 new comments

• Add analyzer for missing validation webhook

  #51651 commented on Oct 4, 2024 • 0 new comments

• Sporadic 504 timeouts since 1.22 upgrade

  #51660 commented on Oct 4, 2024 • 0 new comments

• `verify-install` broken since IstioOperator writing was removed

  #51666 commented on Oct 4, 2024 • 0 new comments

• Already install self-signed root CA on OS, DestinationRule still unable to get local issuer certificate

  #51679 commented on Oct 4, 2024 • 0 new comments

• [multiple gateways] not able to use multiple gateways

  #51733 commented on Oct 4, 2024 • 0 new comments

• gateways chart deployment selector does not account for revision

  #51736 commented on Oct 4, 2024 • 0 new comments

• Bug: When the port is not explicitly designated as HTTP by other services, the protocol sniffing server port cannot route services using only the host.

  #51820 commented on Oct 4, 2024 • 0 new comments

• Test CNI ambient flow with integration tests

  #51845 commented on Oct 4, 2024 • 0 new comments

• operation name inconsistent depending on VirtualService configuration

  #51857 commented on Oct 4, 2024 • 0 new comments

• ambient: improper handling of duplicate hostnames

  #51863 commented on Oct 4, 2024 • 0 new comments

• Invalid pod lifecycle with native sidecars

  #51865 commented on Oct 4, 2024 • 0 new comments

• telemetry: add post process for metric

  #51730 commented on Oct 4, 2024 • 0 new comments

• [WIP] Idempotency and reconciliation for cni iptables

  #53153 commented on Oct 1, 2024 • 0 new comments

• Allow users to explicitly disable trust configmap creation

  #51951 commented on Oct 4, 2024 • 0 new comments

• Add manifest translate command

  #52281 commented on Oct 4, 2024 • 0 new comments

• Only apply metadata exchange filter to mesh internal services' cluster

  #52507 commented on Oct 4, 2024 • 0 new comments

• [release-1.23] allow sni hosts with outbound_ in vs, when bound to gw

  #52564 commented on Oct 4, 2024 • 0 new comments

• authz support string contains match

  #52583 commented on Oct 4, 2024 • 0 new comments

• WIP: making proxy resource override mutually exclusive

  #52700 commented on Oct 4, 2024 • 0 new comments

• [release-1.23] krt: fix FilterSelectsNonEmpty when the object has no labels

  #52936 commented on Oct 4, 2024 • 0 new comments

• Use per revision multicluster leader election

  #52990 commented on Oct 3, 2024 • 0 new comments

• istio egress connection on port 22 for ssh traffic

  #53095 commented on Sep 27, 2024 • 0 new comments

• Istio Ambient - Ztunnel XDS client connection error: gRPC connection error:status: Unknown, message: "client error (Connect)", source: tcp connect error: deadline has elapsed

  #53308 commented on Sep 27, 2024 • 0 new comments

• Ambient: make sourceLabels never match instead of always matching

  #51565 commented on Sep 27, 2024 • 0 new comments

• Image Pull Error Workaround with Istio Gateway Deployment via Argo CD

  #53290 commented on Sep 27, 2024 • 0 new comments

• Support HTTP upgrades in MeshConfig.ProxyConfig

  #52651 commented on Sep 27, 2024 • 0 new comments

• AuthorizationPolicy TCP traffic (namespaces and principals don't worked)

  #53048 commented on Sep 27, 2024 • 0 new comments

• Problems with istioctl analyze with multicluster

  #52951 commented on Sep 27, 2024 • 0 new comments

• Add more DNS configuration fields to ServiceEntry when resolution: DNS

  #53319 commented on Sep 29, 2024 • 0 new comments

• Multicluster , PrimaryRemote Deploy model, Istiod keep scanning eastwest-gateway port

  #53278 commented on Sep 29, 2024 • 0 new comments

• istio-clean-iptables does not clean up extra kube-virt-interfaces

  #48368 commented on Oct 1, 2024 • 0 new comments

• Support customization for Kubernetes Gateway API automated deployments

  #46594 commented on Oct 1, 2024 • 0 new comments

• Support Single Network Multicluster for Ambient

  #42137 commented on Oct 1, 2024 • 0 new comments

• `error="no healthy upstream"` when communicating with Kubenetes API (ambient)

  #53306 commented on Oct 1, 2024 • 0 new comments

• WasmPlugin causes pod to fail to start when failStrategy = FAIL_OPEN

  #53279 commented on Oct 2, 2024 • 0 new comments

• Expose retry budget configuration

  #27419 commented on Oct 2, 2024 • 0 new comments

• Update FIPS compliance mode to allow TLS 1.3

  #52926 commented on Oct 2, 2024 • 0 new comments

• Add the ability to control reloadable_features via Istio

  #53070 commented on Oct 3, 2024 • 0 new comments

• allow ztunnel timeout to be configurable and have init containers tolerate request failures with a retry and an exponential backoff

  #53271 commented on Oct 3, 2024 • 0 new comments

• EnvoyFilter not matching on other EnvoyFilter with lower priority

  #41536 commented on Oct 4, 2024 • 0 new comments

• WasmPlugin to scope to specific listener

  #46885 commented on Oct 4, 2024 • 0 new comments

• Delegate VirtualService support for rewrite in root VirtualService

  #49692 commented on Oct 4, 2024 • 0 new comments

• Build survey for usage of `--set compatibilityVersion`

  #49885 commented on Oct 4, 2024 • 0 new comments

• ambient: make waypoint Delta XDS optimized

  #49918 commented on Oct 4, 2024 • 0 new comments

• More improvements for istioctl analyze to help diagnose TLS certificate issues (or other doc/logging fixes)

  #50070 commented on Oct 4, 2024 • 0 new comments

• Regarding the cluster generated for the ServiceEntry

  #50119 commented on Oct 4, 2024 • 0 new comments

• Consider skipping EDS response instead of sending empty CLA in some cases

  #50189 commented on Oct 4, 2024 • 0 new comments

• 503 UC not being recorded in traces

  #50875 commented on Oct 4, 2024 • 0 new comments