You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Issue:
Flagger always attaches its created VirtualService to the 'mesh' gateway, both as default (configuration specifies no other gateway) and as an additional gateway (configuration does specify other gateway)
Instead, a configured gateway list should be applied explicitly - ie 'mesh' is attached if and only if it explicitly appears in the list of gateways in Flagger 'gateway' spec
Use-Case:
Internet connections traverse a standalone gateway resource and are subject to http match rules but mesh-only connections do not traverse the gateway and should be excluded from match rules.
Suppose that a service will be created by Flagger (my-service) and will be reachable via Internet as https://my-site.com/api/v1/my-service On-the-fly, a VirtualService (also created by Flagger) rewrites the request because my-service listens for connections at the root (/)
If the created VirtualService is applied to the 'mesh' gateway, then both Internet and internal connections will be subject to the rule. More to the point, internal connections that target the service directly will connect to my-service.namespace.svc.cluster.local/ which results in a 404 if the rewrite is being applied.
Example:
In this example, the VirtualService would attach to my-gateway but not to mesh:
Issue:
Flagger always attaches its created VirtualService to the 'mesh' gateway, both as default (configuration specifies no other gateway) and as an additional gateway (configuration does specify other gateway)
Instead, a configured gateway list should be applied explicitly - ie 'mesh' is attached if and only if it explicitly appears in the list of gateways in Flagger 'gateway' spec
Use-Case:
Internet connections traverse a standalone gateway resource and are subject to http match rules but mesh-only connections do not traverse the gateway and should be excluded from match rules.
Suppose that a service will be created by Flagger (my-service) and will be reachable via Internet as https://my-site.com/api/v1/my-service On-the-fly, a VirtualService (also created by Flagger) rewrites the request because my-service listens for connections at the root (/)
If the created VirtualService is applied to the 'mesh' gateway, then both Internet and internal connections will be subject to the rule. More to the point, internal connections that target the service directly will connect to my-service.namespace.svc.cluster.local/ which results in a 404 if the rewrite is being applied.
Example:
In this example, the VirtualService would attach to my-gateway but not to mesh:
To be inline both for Internet and Mesh-internal traversal:
The text was updated successfully, but these errors were encountered: