Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ambient: Document that PeerAuthentication mTLS.Mode = DISABLE is a no… #14852

Closed
wants to merge 1 commit into from

Conversation

pegasas
Copy link

@pegasas pegasas commented Apr 8, 2024

…-op in ambient

Description

resolve: #14789
clarify In ambient, you can still create PeerAuthentication policy at the mesh or namespace level that uses DISABLE, but it will be ignored.

Reviewers

  • Ambient
  • Docs
  • Installation
  • Networking
  • Performance and Scalability
  • Extensions and Telemetry
  • Security
  • Test and Release
  • User Experience
  • Developer Infrastructure
  • Localization/Translation

@pegasas pegasas requested a review from a team as a code owner April 8, 2024 00:27
@istio-policy-bot
Copy link

😊 Welcome! This is either your first contribution to the Istio documentation repo, or
it's been a while since you've been here. A few things you should know:

  • You can learn about how we write and maintain documentation, our style guidelines,
    and the available web site features by visiting Contributing to the Docs.

  • In the next few minutes, an automatic preview of your change will be built with
    a full copy of the istio.io website. You can find this preview by clicking on
    the Details link next to the deploy/netlify entry in the status section of this
    page.

  • We care about quality, so we've put in place a number of checks to ensure our documentation
    is top-notch. We do spell checking, sanitize the Markdown, ensure all hyperlinks point to a
    valid location, and more. If your PR doesn't pass one of these checks, you'll see a red X in the
    lint_istio.io entry in the status section. Click on the Details link to get a list of the
    problems with your PR. Fix those problems and push an update; this will automatically re-run the
    tests. Hopefully this time everything will be perfect!

  • Once your changes are accepted and merged into the repository, they will initially show up
    on https://preliminary.istio.io. The changes will be published to https://istio.io
    the next time we do a major release (which typically happens every 3 months or so).
    To publish them sooner, add a cherrypick/release-x.xx label, where x.xx is the current
    release of Istio.

Thanks for contributing!

Courtesy of your friendly welcome wagon.

@istio-testing istio-testing added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Apr 8, 2024
@@ -32,6 +32,7 @@ Sidecar traffic has a variety of associated connections. Let's break them down o
By default, the sidecar will be configured to accept both mTLS and non-mTLS traffic, known as `PERMISSIVE` mode.
The mode can alternatively be configured to `STRICT`, where traffic must be mTLS, or `DISABLE`, where traffic must be plaintext.
The mTLS mode is configured using a [`PeerAuthentication` resource](/docs/reference/config/security/peer_authentication/).
In ambient, you can still create `PeerAuthentication` policy at the mesh or namespace level that uses DISABLE, but it will be ignored.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I expect this comment would likely be missed as it's about ambient mode and it's inside a Sidecars section. It might be better to include a ambient section that refers to the sidecar section and then has differences noted.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After I saw https://github.com/istio/istio.io/tree/master/content/en/docs/ambient/install
It seems like PeerAuthentication not belongs to base installation in our official guide.

I think user must know this feature when they try to open this for their cluster.
In that situation, he will search mTLS related configuration so that this part will not be missed.

@craigbox
Copy link
Contributor

craigbox commented May 8, 2024

I'll pull that into the new policy page I'm working on at the moment, so I'll close this. Thanks for raising it though as I would have missed it otherwise!

@craigbox craigbox closed this May 8, 2024
@pegasas pegasas deleted the issues/14789 branch May 8, 2024 02:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Ambient: Document that PeerAuthentication mTLS.Mode = DISABLE is a no-op in ambient
5 participants