Introducing per-service filtering #1725
Conversation
|
Will also address setting Permissive to TCP proxy, we do have some drawbacks to take care of. |
|
Fixes for CI/demo expected values will need to be addressed |
eduser25
force-pushed
the
listener-per-f
branch
from
5602330 to
e317813
Compare
Codecov Report
@@ Coverage Diff @@
## main #1725 +/- ##
==========================================
- Coverage 57.28% 53.40% -3.88%
==========================================
Files 118 124 +6
Lines 5436 5065 -371
==========================================
- Hits 3114 2705 -409
- Misses 2319 2357 +38
Partials 3 3
Continue to review full report at Codecov.
|
| return nil, err | ||
| } | ||
|
|
||
| // Transform into set, when listing apex services we might face repetitions |
There was a problem hiding this comment.
Maybe use a mapset instead.
There was a problem hiding this comment.
mapset is a map underneath, I imagine you want it for readability at this point; I personally dislike adding deps if not strictly needed - more so if those are not golang official packages
There was a problem hiding this comment.
for readability and helpers it provides. We already use it across the code.
There was a problem hiding this comment.
I know, and I never liked it. Want me to change it here though? I'm ok with either in any case
There was a problem hiding this comment.
not necessarily for this PR but in a follow-up would be good.
eduser25
force-pushed
the
listener-per-f
branch
from
d5e536b to
135057c
Compare
Introduces per-destination filter-chain matching on outbound. This change will allow setting specific L4 or L7 filtering, precursor for TCP routing. - Since we are filtering all permitted traffic, we can generalize the remaining traffic and simplify Egress, which will not require a CIDR anymore. (TODO: cleanup CIDR flags/code) - Since we can match all destination traffic, Permissive mode can now use TCP proxy (instead of wildcarded RDS) to allow also L4 protocols between services. - Additional work that might benefit from it: per-service route table on RDS, TCP routing, .... Additionally: - Fixing the listener tests required adding the long-awaited catalog mock. Will add more tests in subsequent commits.
Co-authored-by: Sneha Chhabria <snchh@microsoft.com>
eduser25
dismissed stale reviews from shashankram and snehachhabria
via
3171c3a
eduser25
force-pushed
the
listener-per-f
branch
from
a6c478e to
3171c3a
Compare
Introduces per-destination filter-chain matching on outbound
This change will allow setting specific network filtering on per service
destination, which enables finer configuration per-service level,
as well as the use of different network filters to allow not only L7 traffic
through.
Additional benefits:
any remaining traffic as Egress (when enabled), which simplifies
Egressto not need a CIDR anymore. (TODO: cleanup CIDR flags/code)
on RDS, TCP routing, ....
Additionally:
Fixing the listener tests required adding the long-awaited catalog mock.
Will add more tests in subsequent commits.
New Functionality [X]
Control Plane [X]
Networking [X]
SMI Policy [X]
Does this change contain code from or inspired by another project? If so, did you notify the maintainers and provide attribution?
No