Istio Fork for Fixing Multicluster Registry Bug #1
Conversation
FAIR.md
Outdated
| @@ -0,0 +1,32 @@ | |||
| # Why this Fork | |||
| In a mutual TLS-disabled multicluster Kubernetes setup, gRPC liveness and readiness probes don't work in remote clusters. However, this behavior could not be replicated on the Kubernetes cluster running the Istio control plane. | |||
FAIR.md
Outdated
|
|
||
| After diving into the Istio source, we only found that 3333 and 9999 were ports returned from the [Envoy debug registry](https://github.com/istio/istio/blob/1.0.2/pilot/pkg/proxy/envoy/v2/debug.go#L324-L337). | ||
|
|
||
| In the Istio logs, we could see that a remote cluster registry was being picked up. However, based off of the [server bootup order]*(https://github.com/istio/istio/blob/1.0.2/pilot/pkg/bootstrap/server.go#L211-L219) (note that Discovery service is always init'd before Multicluster), it looked like the debug registry would always be loaded before the multicluster ones. Since the debug registry would always return entries for the management ports, it meant that the debug management ports would always be used instead of the remote cluster ones, meaning that liveness and readiness probes for remote clusters would NEVER work. |
There was a problem hiding this comment.
You've got a * which is breaking the link [server bootup order]*(https://...) should be [server bootup order](https://...)
There was a problem hiding this comment.
I would elaborate a tiny bit to explain that their are various providers that the aggregate controller uses to get ManagementPorts, and that it iterates over them sequently, taking the first one that returns a non-nil result.
And then further highlight that the MultiCluster one is appended AFTER the debug one, which means that the remote one will never be called since debug always returns a value.
You kind of already said that, but just being explicit about how those providers are iterated over i think makes it clearer.
There was a problem hiding this comment.
Whoa this is really weird. I don't see that in my text editor (the *). Good catch.
catherinetcai
changed the title
No description provided.