Skip to content

Commit

Permalink
Fixed yaml formats
Browse files Browse the repository at this point in the history
Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com>
  • Loading branch information
biswajit-9776 committed Jul 28, 2024
1 parent 00e684c commit dd3d477
Show file tree
Hide file tree
Showing 6 changed files with 9 additions and 9 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ spec:
- name: ISTIO_META_WORKLOAD_NAME
value: cluster-local-gateway
- name: ISTIO_META_OWNER
value:
value:
kubernetes://apis/apps/v1/namespaces/istio-system/deployments/cluster-local-gateway
- name: ISTIO_META_MESH_ID
value: cluster.local
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,4 +11,4 @@ spec:
app: cluster-local-gateway
istio: cluster-local-gateway
rules:
- {}
- {}
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@ apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: cluster-local-gateway
namespace: istio-system
namespace: istio-system
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Penetration test enahncement: check port 15010 & 8080 in istiod: According to https://istio.io/latest/docs/ops/best-practices/security/#control-plane port 15010
# is not that problematic (only resource discovery). Other parts of the documentation also say| 15010 | GRPC | XDS and CA services (Plaintext, only for secure networks) |
# We have a secure network layer and only XDS is served.
# Port 8080 is not listed in the service and even if it would be somehow reachable by IP it only "offers read access".
# is not that problematic (only resource discovery). Other parts of the documentation also say| 15010 | GRPC | XDS and CA services (Plaintext, only for secure networks) |
# We have a secure network layer and only XDS is served.
# Port 8080 is not listed in the service and even if it would be somehow reachable by IP it only "offers read access".
# Nevertheless we set ENABLE_DEBUG_ON_HTTP=false do disable it entirely.
apiVersion: apps/v1
kind: Deployment
Expand Down
4 changes: 2 additions & 2 deletions common/istio-1-22/istio-install/base/x-forwarded-host.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,8 @@ spec:
patch:
operation: INSERT_BEFORE
value:
name: envoy.filters.http.lua
typed_config:
name: envoy.filters.http.lua
typed_config:
"@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
inlineCode: |
function envoy_on_request(request_handle)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ metadata:
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-edit: "true"
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-istio-admin: "true"
rules:
- apiGroups:
- apiGroups:
- istio.io
- networking.istio.io
resources: ["*"]
Expand Down

0 comments on commit dd3d477

Please sign in to comment.