{"action":"created","comment":{"url":"https://api.github.com/repos/istio/istio/pulls/comments/150708978","pull_request_review_id":76298499,"id":150708978,"diff_hunk":"@@ -0,0 +1,72 @@\n+// Copyright 2017 Istio Authors\n+//\n+// Licensed under the Apache License, Version 2.0 (the \"License\");\n+// you may not use this file except in compliance with the License.\n+// You may obtain a copy of the License at\n+//\n+//     http://www.apache.org/licenses/LICENSE-2.0\n+//\n+// Unless required by applicable law or agreed to in writing, software\n+// distributed under the License is distributed on an \"AS IS\" BASIS,\n+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n+// See the License for the specific language governing permissions and\n+// limitations under the License.\n+\n+// Routing tests\n+\n+package main\n+\n+import (\n+\t\"fmt\"\n+)\n+\n+type authBlacklisting struct {\n+\t*infra\n+}\n+\n+func (r *authBlacklisting) String() string {\n+\treturn \"auth-blackisting\"\n+}\n+\n+func (r *authBlacklisting) setup() error {\n+\treturn nil\n+}\n+\n+func (r *authBlacklisting) teardown() {}\n+\n+func (r *authBlacklisting) run() error {\n+\tif err := r.makeRequests(); err != nil {\n+\t\treturn err\n+\t}\n+\treturn nil\n+}\n+\n+// makeRequests executes requests in pods and collects request ids per pod to check against access logs\n+func (r *authBlacklisting) makeRequests() error {\n+\t// fake-control service doesn't have sidecar, and is excluded from mTLS so\n+\t// client with sidecar should never use mTLS when talking to it. As the result,\n+\t// all request will works, as if mesh authentication is NONE.\n+\tsrcPods := []string{\"a\", \"b\", \"t\"}\n+\tdst := \"fake-control\"\n+\n+\tfuncs := make(map[string]func() status)\n+\tfor _, src := range srcPods {\n+\t\tfor _, port := range []string{\"\", \":80\", \":8080\"} {\n+\t\t\tfor _, domain := range []string{\"\", \".\" + r.Namespace} {\n+\t\t\t\tname := fmt.Sprintf(\"Request from %s to %s%s%s\", src, dst, domain, port)\n+\t\t\t\tfuncs[name] = (func(src, dst, port, domain string) func() status {\n+\t\t\t\t\turl := fmt.Sprintf(\"http://%s%s%s/%s\", dst, domain, port, src)\n+\t\t\t\t\treturn func() status {\n+\t\t\t\t\t\tresp := r.clientRequest(src, url, 1, \"\")\n+\t\t\t\t\t\t// Request should return successfully (status 200)\n+\t\t\t\t\t\tif len(resp.code) > 0 && resp.code[0] == \"200\" {\n+\t\t\t\t\t\t\treturn nil\n+\t\t\t\t\t\t}\n+\t\t\t\t\t\treturn errAgain\n+\t\t\t\t\t}\n+\t\t\t\t})(src, dst, port, domain)\n+\t\t\t}\n+\t\t}","path":"pilot/test/integration/auth_blacklisting.go","position":69,"original_position":69,"commit_id":"4e218fa8e501efb73a7abce537c84b5f6cf6b3d1","original_commit_id":"4e218fa8e501efb73a7abce537c84b5f6cf6b3d1","user":{"login":"rshriram","id":8202871,"avatar_url":"https://avatars1.githubusercontent.com/u/8202871?v=4","gravatar_id":"","url":"https://api.github.com/users/rshriram","html_url":"https://github.com/rshriram","followers_url":"https://api.github.com/users/rshriram/followers","following_url":"https://api.github.com/users/rshriram/following{/other_user}","gists_url":"https://api.github.com/users/rshriram/gists{/gist_id}","starred_url":"https://api.github.com/users/rshriram/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rshriram/subscriptions","organizations_url":"https://api.github.com/users/rshriram/orgs","repos_url":"https://api.github.com/users/rshriram/repos","events_url":"https://api.github.com/users/rshriram/events{/privacy}","received_events_url":"https://api.github.com/users/rshriram/received_events","type":"User","site_admin":false},"body":"Do we need this duplication? Is it possible to reuse the code from routing? @ijsnellf or @zackbutcher might be able to better assist you here. Or Nathan whose gh handle i don’t have. ","created_at":"2017-11-14T00:43:28Z","updated_at":"2017-11-14T00:46:18Z","html_url":"https://github.com/istio/istio/pull/1607#discussion_r150708978","pull_request_url":"https://api.github.com/repos/istio/istio/pulls/1607","author_association":"OWNER","_links":{"self":{"href":"https://api.github.com/repos/istio/istio/pulls/comments/150708978"},"html":{"href":"https://github.com/istio/istio/pull/1607#discussion_r150708978"},"pull_request":{"href":"https://api.github.com/repos/istio/istio/pulls/1607"}}},"pull_request":{"url":"https://api.github.com/repos/istio/istio/pulls/1607","id":151519674,"html_url":"https://github.com/istio/istio/pull/1607","diff_url":"https://github.com/istio/istio/pull/1607.diff","patch_url":"https://github.com/istio/istio/pull/1607.patch","issue_url":"https://api.github.com/repos/istio/istio/issues/1607","number":1607,"state":"open","locked":false,"title":"Add fields to mesh configs to (always) disable mTLS on control services.","user":{"login":"diemtvu","id":25132401,"avatar_url":"https://avatars0.githubusercontent.com/u/25132401?v=4","gravatar_id":"","url":"https://api.github.com/users/diemtvu","html_url":"https://github.com/diemtvu","followers_url":"https://api.github.com/users/diemtvu/followers","following_url":"https://api.github.com/users/diemtvu/following{/other_user}","gists_url":"https://api.github.com/users/diemtvu/gists{/gist_id}","starred_url":"https://api.github.com/users/diemtvu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diemtvu/subscriptions","organizations_url":"https://api.github.com/users/diemtvu/orgs","repos_url":"https://api.github.com/users/diemtvu/repos","events_url":"https://api.github.com/users/diemtvu/events{/privacy}","received_events_url":"https://api.github.com/users/diemtvu/received_events","type":"User","site_admin":false},"body":"**What this PR does / why we need it**:\r\n\r\nk8s control service (e.g API server) don't have envoy in front, so clients (with envoy) should never use mTLS to talk to them. This PR provides a way to listed those services so that pilot can always skip adding ssl_context to the outbound cluster to those services.\r\n\r\n**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #\r\n\r\nhttps://github.com/istio/istio/issues/1232\r\n\r\n**Special notes for your reviewer**:\r\n\r\nThis is work-in-progress, to make sure the it go in the right direction. The PR required API changes to add 2 repeated fields to the mesh config to keep the list of services and namespaces that should be blacklisted for auth-enable.\r\n\r\n\r\n\r\n**Release note**:\r\n<!--  Steps to write your release note:\r\n1. Use the release-note-* labels to set the release note state (if you have access)\r\n2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`.\r\n-->\r\n```NONE\r\n```\r\n","created_at":"2017-11-08T23:03:50Z","updated_at":"2017-11-14T00:46:18Z","closed_at":null,"merged_at":null,"merge_commit_sha":"4ea26325d7715e1d7362d2a09c190320072142c2","assignee":{"login":"rshriram","id":8202871,"avatar_url":"https://avatars1.githubusercontent.com/u/8202871?v=4","gravatar_id":"","url":"https://api.github.com/users/rshriram","html_url":"https://github.com/rshriram","followers_url":"https://api.github.com/users/rshriram/followers","following_url":"https://api.github.com/users/rshriram/following{/other_user}","gists_url":"https://api.github.com/users/rshriram/gists{/gist_id}","starred_url":"https://api.github.com/users/rshriram/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rshriram/subscriptions","organizations_url":"https://api.github.com/users/rshriram/orgs","repos_url":"https://api.github.com/users/rshriram/repos","events_url":"https://api.github.com/users/rshriram/events{/privacy}","received_events_url":"https://api.github.com/users/rshriram/received_events","type":"User","site_admin":false},"assignees":[{"login":"rshriram","id":8202871,"avatar_url":"https://avatars1.githubusercontent.com/u/8202871?v=4","gravatar_id":"","url":"https://api.github.com/users/rshriram","html_url":"https://github.com/rshriram","followers_url":"https://api.github.com/users/rshriram/followers","following_url":"https://api.github.com/users/rshriram/following{/other_user}","gists_url":"https://api.github.com/users/rshriram/gists{/gist_id}","starred_url":"https://api.github.com/users/rshriram/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rshriram/subscriptions","organizations_url":"https://api.github.com/users/rshriram/orgs","repos_url":"https://api.github.com/users/rshriram/repos","events_url":"https://api.github.com/users/rshriram/events{/privacy}","received_events_url":"https://api.github.com/users/rshriram/received_events","type":"User","site_admin":false}],"requested_reviewers":[],"milestone":null,"commits_url":"https://api.github.com/repos/istio/istio/pulls/1607/commits","review_comments_url":"https://api.github.com/repos/istio/istio/pulls/1607/comments","review_comment_url":"https://api.github.com/repos/istio/istio/pulls/comments{/number}","comments_url":"https://api.github.com/repos/istio/istio/issues/1607/comments","statuses_url":"https://api.github.com/repos/istio/istio/statuses/4e218fa8e501efb73a7abce537c84b5f6cf6b3d1","head":{"label":"diemtvu:authc","ref":"authc","sha":"4e218fa8e501efb73a7abce537c84b5f6cf6b3d1","user":{"login":"diemtvu","id":25132401,"avatar_url":"https://avatars0.githubusercontent.com/u/25132401?v=4","gravatar_id":"","url":"https://api.github.com/users/diemtvu","html_url":"https://github.com/diemtvu","followers_url":"https://api.github.com/users/diemtvu/followers","following_url":"https://api.github.com/users/diemtvu/following{/other_user}","gists_url":"https://api.github.com/users/diemtvu/gists{/gist_id}","starred_url":"https://api.github.com/users/diemtvu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diemtvu/subscriptions","organizations_url":"https://api.github.com/users/diemtvu/orgs","repos_url":"https://api.github.com/users/diemtvu/repos","events_url":"https://api.github.com/users/diemtvu/events{/privacy}","received_events_url":"https://api.github.com/users/diemtvu/received_events","type":"User","site_admin":false},"repo":{"id":109037449,"name":"istio","full_name":"diemtvu/istio","owner":{"login":"diemtvu","id":25132401,"avatar_url":"https://avatars0.githubusercontent.com/u/25132401?v=4","gravatar_id":"","url":"https://api.github.com/users/diemtvu","html_url":"https://github.com/diemtvu","followers_url":"https://api.github.com/users/diemtvu/followers","following_url":"https://api.github.com/users/diemtvu/following{/other_user}","gists_url":"https://api.github.com/users/diemtvu/gists{/gist_id}","starred_url":"https://api.github.com/users/diemtvu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diemtvu/subscriptions","organizations_url":"https://api.github.com/users/diemtvu/orgs","repos_url":"https://api.github.com/users/diemtvu/repos","events_url":"https://api.github.com/users/diemtvu/events{/privacy}","received_events_url":"https://api.github.com/users/diemtvu/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/diemtvu/istio","description":"Sample code, build and tests and governance material for the Istio project.","fork":true,"url":"https://api.github.com/repos/diemtvu/istio","forks_url":"https://api.github.com/repos/diemtvu/istio/forks","keys_url":"https://api.github.com/repos/diemtvu/istio/keys{/key_id}","collaborators_url":"https://api.github.com/repos/diemtvu/istio/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/diemtvu/istio/teams","hooks_url":"https://api.github.com/repos/diemtvu/istio/hooks","issue_events_url":"https://api.github.com/repos/diemtvu/istio/issues/events{/number}","events_url":"https://api.github.com/repos/diemtvu/istio/events","assignees_url":"https://api.github.com/repos/diemtvu/istio/assignees{/user}","branches_url":"https://api.github.com/repos/diemtvu/istio/branches{/branch}","tags_url":"https://api.github.com/repos/diemtvu/istio/tags","blobs_url":"https://api.github.com/repos/diemtvu/istio/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/diemtvu/istio/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/diemtvu/istio/git/refs{/sha}","trees_url":"https://api.github.com/repos/diemtvu/istio/git/trees{/sha}","statuses_url":"https://api.github.com/repos/diemtvu/istio/statuses/{sha}","languages_url":"https://api.github.com/repos/diemtvu/istio/languages","stargazers_url":"https://api.github.com/repos/diemtvu/istio/stargazers","contributors_url":"https://api.github.com/repos/diemtvu/istio/contributors","subscribers_url":"https://api.github.com/repos/diemtvu/istio/subscribers","subscription_url":"https://api.github.com/repos/diemtvu/istio/subscription","commits_url":"https://api.github.com/repos/diemtvu/istio/commits{/sha}","git_commits_url":"https://api.github.com/repos/diemtvu/istio/git/commits{/sha}","comments_url":"https://api.github.com/repos/diemtvu/istio/comments{/number}","issue_comment_url":"https://api.github.com/repos/diemtvu/istio/issues/comments{/number}","contents_url":"https://api.github.com/repos/diemtvu/istio/contents/{+path}","compare_url":"https://api.github.com/repos/diemtvu/istio/compare/{base}...{head}","merges_url":"https://api.github.com/repos/diemtvu/istio/merges","archive_url":"https://api.github.com/repos/diemtvu/istio/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/diemtvu/istio/downloads","issues_url":"https://api.github.com/repos/diemtvu/istio/issues{/number}","pulls_url":"https://api.github.com/repos/diemtvu/istio/pulls{/number}","milestones_url":"https://api.github.com/repos/diemtvu/istio/milestones{/number}","notifications_url":"https://api.github.com/repos/diemtvu/istio/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/diemtvu/istio/labels{/name}","releases_url":"https://api.github.com/repos/diemtvu/istio/releases{/id}","deployments_url":"https://api.github.com/repos/diemtvu/istio/deployments","created_at":"2017-10-31T18:33:52Z","updated_at":"2017-10-31T18:33:56Z","pushed_at":"2017-11-13T23:15:22Z","git_url":"git://github.com/diemtvu/istio.git","ssh_url":"git@github.com:diemtvu/istio.git","clone_url":"https://github.com/diemtvu/istio.git","svn_url":"https://github.com/diemtvu/istio","homepage":"https://istio.io","size":9977,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"istio:master","ref":"master","sha":"580f97c0c232129bdd5560bf2846e6b8e75e73f2","user":{"login":"istio","id":23534644,"avatar_url":"https://avatars1.githubusercontent.com/u/23534644?v=4","gravatar_id":"","url":"https://api.github.com/users/istio","html_url":"https://github.com/istio","followers_url":"https://api.github.com/users/istio/followers","following_url":"https://api.github.com/users/istio/following{/other_user}","gists_url":"https://api.github.com/users/istio/gists{/gist_id}","starred_url":"https://api.github.com/users/istio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/istio/subscriptions","organizations_url":"https://api.github.com/users/istio/orgs","repos_url":"https://api.github.com/users/istio/repos","events_url":"https://api.github.com/users/istio/events{/privacy}","received_events_url":"https://api.github.com/users/istio/received_events","type":"Organization","site_admin":false},"repo":{"id":74175805,"name":"istio","full_name":"istio/istio","owner":{"login":"istio","id":23534644,"avatar_url":"https://avatars1.githubusercontent.com/u/23534644?v=4","gravatar_id":"","url":"https://api.github.com/users/istio","html_url":"https://github.com/istio","followers_url":"https://api.github.com/users/istio/followers","following_url":"https://api.github.com/users/istio/following{/other_user}","gists_url":"https://api.github.com/users/istio/gists{/gist_id}","starred_url":"https://api.github.com/users/istio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/istio/subscriptions","organizations_url":"https://api.github.com/users/istio/orgs","repos_url":"https://api.github.com/users/istio/repos","events_url":"https://api.github.com/users/istio/events{/privacy}","received_events_url":"https://api.github.com/users/istio/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/istio/istio","description":"Istio service mesh for polyglot microservice applications","fork":false,"url":"https://api.github.com/repos/istio/istio","forks_url":"https://api.github.com/repos/istio/istio/forks","keys_url":"https://api.github.com/repos/istio/istio/keys{/key_id}","collaborators_url":"https://api.github.com/repos/istio/istio/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/istio/istio/teams","hooks_url":"https://api.github.com/repos/istio/istio/hooks","issue_events_url":"https://api.github.com/repos/istio/istio/issues/events{/number}","events_url":"https://api.github.com/repos/istio/istio/events","assignees_url":"https://api.github.com/repos/istio/istio/assignees{/user}","branches_url":"https://api.github.com/repos/istio/istio/branches{/branch}","tags_url":"https://api.github.com/repos/istio/istio/tags","blobs_url":"https://api.github.com/repos/istio/istio/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/istio/istio/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/istio/istio/git/refs{/sha}","trees_url":"https://api.github.com/repos/istio/istio/git/trees{/sha}","statuses_url":"https://api.github.com/repos/istio/istio/statuses/{sha}","languages_url":"https://api.github.com/repos/istio/istio/languages","stargazers_url":"https://api.github.com/repos/istio/istio/stargazers","contributors_url":"https://api.github.com/repos/istio/istio/contributors","subscribers_url":"https://api.github.com/repos/istio/istio/subscribers","subscription_url":"https://api.github.com/repos/istio/istio/subscription","commits_url":"https://api.github.com/repos/istio/istio/commits{/sha}","git_commits_url":"https://api.github.com/repos/istio/istio/git/commits{/sha}","comments_url":"https://api.github.com/repos/istio/istio/comments{/number}","issue_comment_url":"https://api.github.com/repos/istio/istio/issues/comments{/number}","contents_url":"https://api.github.com/repos/istio/istio/contents/{+path}","compare_url":"https://api.github.com/repos/istio/istio/compare/{base}...{head}","merges_url":"https://api.github.com/repos/istio/istio/merges","archive_url":"https://api.github.com/repos/istio/istio/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/istio/istio/downloads","issues_url":"https://api.github.com/repos/istio/istio/issues{/number}","pulls_url":"https://api.github.com/repos/istio/istio/pulls{/number}","milestones_url":"https://api.github.com/repos/istio/istio/milestones{/number}","notifications_url":"https://api.github.com/repos/istio/istio/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/istio/istio/labels{/name}","releases_url":"https://api.github.com/repos/istio/istio/releases{/id}","deployments_url":"https://api.github.com/repos/istio/istio/deployments","created_at":"2016-11-18T23:57:21Z","updated_at":"2017-11-13T23:58:48Z","pushed_at":"2017-11-14T00:08:03Z","git_url":"git://github.com/istio/istio.git","ssh_url":"git@github.com:istio/istio.git","clone_url":"https://github.com/istio/istio.git","svn_url":"https://github.com/istio/istio","homepage":"https://istio.io","size":10039,"stargazers_count":3825,"watchers_count":3825,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":423,"mirror_url":null,"archived":false,"open_issues_count":329,"forks":423,"open_issues":329,"watchers":3825,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/istio/istio/pulls/1607"},"html":{"href":"https://github.com/istio/istio/pull/1607"},"issue":{"href":"https://api.github.com/repos/istio/istio/issues/1607"},"comments":{"href":"https://api.github.com/repos/istio/istio/issues/1607/comments"},"review_comments":{"href":"https://api.github.com/repos/istio/istio/pulls/1607/comments"},"review_comment":{"href":"https://api.github.com/repos/istio/istio/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/istio/istio/pulls/1607/commits"},"statuses":{"href":"https://api.github.com/repos/istio/istio/statuses/4e218fa8e501efb73a7abce537c84b5f6cf6b3d1"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"rshriram"}}