mandarjog

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: metadata-exchange-1.4
  namespace: istio-system
spec:
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: ANY # inbound, outbound, and gateway

mandarjog

{
  "insertId": "13eox5eg3sm2c21",
  "httpRequest": {
    "requestMethod": "GET",
    "requestUrl": "://details:9080/details/0",
    "requestSize": "743",
    "status": 403,
    "responseSize": "1811",
    "remoteIp": "10.20.1.14:35972",
    "serverIp": "10.20.1.13:9080",

mandarjog

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  addonComponents:
    grafana:
      enabled: true
    prometheus:
      enabled: true
    kiali:
      enabled: true

mandarjog

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: disable-ingress-h2
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:

mandarjog

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  labels:
    istio.io/rev: default
    operator.istio.io/version: 1.4.8
  name: ext-authz-1
  namespace: istio-system
spec:
  configPatches:

mandarjog

+ install_istio_with_istioctl                                                                                                                                                         [23/1924]
+ local CR_PATH=/mnt/disks/sdb/go/src/istio.io/tools/perf/istio-install/istioctl_profiles/default.yaml
+ pushd /mnt/disks/sdb/go/src/istio.io/tools/perf/istio-install/tmp/1.5-alpha.c086a1cc8247d22c0778ba8f40ad95cf6797b0e2
/mnt/disks/sdb/go/src/istio.io/tools/perf/istio-install/tmp/1.5-alpha.c086a1cc8247d22c0778ba8f40ad95cf6797b0e2 /mnt/disks/sdb/go/src/istio.io/tools/perf/istio-install
+ ./istioctl manifest apply -f /mnt/disks/sdb/go/src/istio.io/tools/perf/istio-install/istioctl_profiles/default.yaml --set meshConfig.rootNamespace=istio-system --force=true
proto: tag has too few fields: "-"
- Applying manifest for component SidecarInjector...
- Applying manifest for component Base...
✔ Finished applying manifest for component SidecarInjector.
✔ Finished applying manifest for component Base.

mandarjog

Updating pilot envvars is not possible with istio-on-gke add-on because of the reconciliation loop.

The following steps can update pilot environment variables.

1. Create a config map with the delegation script

kubectl -n istio-system apply -f https://gist.githubusercontent.com/mandarjog/c5fd7201e0d0618d562d0b18cbeebfd8/raw/ae52fb362a5578530e38fe01ee3e40fa2f4b9a8c/istio-pilot-config-map.yaml

The script unsets PILOT_DISABLE_XDS_MARSHALING_TO_ANY env var.

mandarjog

apiVersion: v1
kind: ConfigMap
metadata:
  name: script
data:
  run.sh: |
    #!/bin/bash
    set -ex
    WD=$(dirname $0)
    WD=$(cd $WD;pwd)

mandarjog

  # Note that listener.trafficDirection should match "stackdriver_${traffic_direction}"
  # https://github.com/envoyproxy/envoy-wasm/blob/master/api/envoy/config/wasm/v2/wasm.proto
  # INBOUND
      filters:
        - name: envoy.http_connection_manager
          typed_config:
            '@type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
            forward_client_cert_details: APPEND_FORWARD
            generate_request_id: true
            http_filters:

mandarjog

{
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",