Documentation
¶
Index ¶
- Constants
- func DestinationRuleWithLocalityPreference(destinationRule *istionetworkingv1beta1.DestinationRule, ...) func() error
- func DestinationRuleWithLocalityPreferenceAndTLS(destinationRule *istionetworkingv1beta1.DestinationRule, ...) func() error
- func DestinationRuleWithTLSTermination(destinationRule *istionetworkingv1beta1.DestinationRule, ...) func() error
- func GatewayWithMutualTLS(gateway *istionetworkingv1beta1.Gateway, labels map[string]string, ...) func() error
- func GatewayWithTLSPassthrough(gateway *istionetworkingv1beta1.Gateway, labels map[string]string, ...) func() error
- func GatewayWithTLSTermination(gateway *istionetworkingv1beta1.Gateway, labels map[string]string, ...) func() error
- func IsHTTP2Port(port corev1.ServicePort) bool
- func VirtualServiceForTLSTermination(virtualService *istionetworkingv1beta1.VirtualService, ...) func() error
- func VirtualServiceWithSNIMatch(virtualService *istionetworkingv1beta1.VirtualService, ...) func() error
- type HTTPProtocolPolicy
- type ServerConfig
Constants ¶
const ( // MaxConnectionDuration is the maximum duration of a connection in seconds. It is set to 24 hours (86400 seconds) to prevent issues with expiring client certificates. MaxConnectionDuration = 86400 // TCPKeepaliveTime is the duration in seconds a connection needs to be idle before TCP keepalive probes are sent. TCPKeepaliveTime = 60 // TCPKeepaliveInterval is the duration in seconds between individual TCP keepalive probes. TCPKeepaliveInterval = 30 // TCPKeepaliveProbes is the number of TCP keepalive probes to send before considering the connection dead. // => After 60s + 30s * 5 = 210s (3.5 minutes) of idle time without answers to the keepalive probes, the connection will be considered dead and closed. // Values are chosen between the kubernetes client and server defaults, which are between 30s and 120s for the TCPKeepaliveTime and unspecified // TCPKeepaliveInterval and TCPKeepaliveProbes. // client: https://github.com/kubernetes/kubernetes/blob/b264d0913501e614a75eb021a0e2578ee12d0281/staging/src/k8s.io/client-go/transport/cache.go#L123 // server: https://github.com/kubernetes/kubernetes/blob/b264d0913501e614a75eb021a0e2578ee12d0281/staging/src/k8s.io/apiserver/pkg/server/secure_serving.go#L288 TCPKeepaliveProbes = 5 // HTTP2ConnectionKeepaliveInterval is the interval between HTTP/2 keepalive PING frames sent on upstream (todo: check) connections. HTTP2ConnectionKeepaliveInterval = "30s" // HTTP2ConnectionKeepaliveTimeout is the timeout after which an unacknowledged HTTP/2 keepalive PING causes the connection to be closed. // => At the latest after 45s (earliest after 15s) of unsanswered pings, the connection will be considered dead and closed. // Values chosen in line with the kubernetes client defaults: // https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/util/net/http.go#L178 HTTP2ConnectionKeepaliveTimeout = "15s" )
Variables ¶
This section is empty.
Functions ¶
func DestinationRuleWithLocalityPreference ¶
func DestinationRuleWithLocalityPreference(destinationRule *istionetworkingv1beta1.DestinationRule, labels map[string]string, exportTo []string, destinationHost string) func() error
DestinationRuleWithLocalityPreference returns a function setting the given attributes to a destination rule object.
func DestinationRuleWithLocalityPreferenceAndTLS ¶ added in v1.91.0
func DestinationRuleWithLocalityPreferenceAndTLS(destinationRule *istionetworkingv1beta1.DestinationRule, labels map[string]string, exportTo []string, destinationHost string, tls *istioapinetworkingv1beta1.ClientTLSSettings) func() error
DestinationRuleWithLocalityPreferenceAndTLS returns a function setting the given attributes to a destination rule object.
func DestinationRuleWithTLSTermination ¶ added in v1.114.0
func DestinationRuleWithTLSTermination(destinationRule *istionetworkingv1beta1.DestinationRule, labels map[string]string, exportTo []string, destinationHost, sniHost, caSecret string, mode istioapinetworkingv1beta1.ClientTLSSettings_TLSmode) func() error
DestinationRuleWithTLSTermination returns a function setting the given attributes to a destination rule object.
func GatewayWithMutualTLS ¶ added in v1.114.0
func GatewayWithMutualTLS(gateway *istionetworkingv1beta1.Gateway, labels map[string]string, istioLabels map[string]string, serverConfigs []ServerConfig) func() error
GatewayWithMutualTLS returns a function setting the given attributes to a gateway object.
func GatewayWithTLSPassthrough ¶
func GatewayWithTLSPassthrough(gateway *istionetworkingv1beta1.Gateway, labels map[string]string, istioLabels map[string]string, hosts []string) func() error
GatewayWithTLSPassthrough returns a function setting the given attributes to a gateway object.
func GatewayWithTLSTermination ¶ added in v1.91.0
func GatewayWithTLSTermination(gateway *istionetworkingv1beta1.Gateway, labels map[string]string, istioLabels map[string]string, hosts []string, tlsSecret string) func() error
GatewayWithTLSTermination returns a function setting the given attributes to a gateway object.
func IsHTTP2Port ¶
func IsHTTP2Port(port corev1.ServicePort) bool
IsHTTP2Port determines whether a service port uses HTTP/2 by replicating Istio's protocol detection logic. We duplicate this instead of importing istio.io/istio because that module is very large and only istio.io/api and istio.io/client-go are direct dependencies. See:
func VirtualServiceForTLSTermination ¶ added in v1.114.0
func VirtualServiceForTLSTermination(virtualService *istionetworkingv1beta1.VirtualService, labels map[string]string, exportTo []string, hosts []string, gatewayName string, port uint32, destinationHost, destinationUpgradeHost, connectionUpgradeRouteName string) func() error
VirtualServiceForTLSTermination returns a function for use with a gateway that performs TLS termination.
func VirtualServiceWithSNIMatch ¶
func VirtualServiceWithSNIMatch(virtualService *istionetworkingv1beta1.VirtualService, labels map[string]string, exportTo []string, hosts []string, gatewayName string, port uint32, destinationHost string) func() error
VirtualServiceWithSNIMatch returns a function setting the given attributes to a virtual service object.
Types ¶
type HTTPProtocolPolicy ¶
type HTTPProtocolPolicy int
HTTPProtocolPolicy represents how the Envoy cluster should handle HTTP protocol options.
const ( // HTTPProtocolPolicyDefault indicates no explicit HTTP protocol configuration is needed. HTTPProtocolPolicyDefault HTTPProtocolPolicy = iota // HTTPProtocolPolicyExplicitHTTP2 configures the cluster to always use HTTP/2. HTTPProtocolPolicyExplicitHTTP2 // HTTPProtocolPolicyUseClientProtocol configures the cluster to use the downstream client's protocol. HTTPProtocolPolicyUseClientProtocol )
func DetermineProtocolMode ¶
func DetermineProtocolMode(destinationRule *istionetworkingv1beta1.DestinationRule, port corev1.ServicePort) HTTPProtocolPolicy
DetermineProtocolMode determines the protocol mode for a given service port based on the DestinationRule's traffic policy settings and the port's protocol indicators.
type ServerConfig ¶ added in v1.114.0
type ServerConfig struct {
Hosts []string
PortName string
TLSSecret string
MinProtocolVersion istioapinetworkingv1beta1.ServerTLSSettings_TLSProtocol
}
ServerConfig is a configuration for a server in an Istio Gateway.