[ambient] Include information to help troubleshooting #7970
Conversation
04fb448 to
323a6f4
Compare
Co-authored-by: Jay Shaughnessy <jshaughn@redhat.com>
Co-authored-by: Jay Shaughnessy <jshaughn@redhat.com>
Good catch about the missing sidecar. |
|
Thanks for the review, @jshaughn , I think all the comments has been addressed |
Co-authored-by: Jay Shaughnessy <jshaughn@redhat.com>
Co-authored-by: Jay Shaughnessy <jshaughn@redhat.com>
|
I see that when EDS is IGNORED, I cannot see traffic from this waypoint, probably this should be a warning, probably just ignore RDS for waypoints/gateways: Update: It looks like it is working, so that might be related to other reasons |
There was a problem hiding this comment.
Are these all "internal" API types? I'm concerned that this will be the same as getting data from the "istio registry" in that it is subject to change between istio versions and will break Kiali. What is the data that we need to get from here that we can't get or infer from another resource?
There was a problem hiding this comment.
This is doing the request to the debug endpoint, with a forward request, to the ztunnel pod. It is similar to the request config_dump to Envoy, but ztunnel returns a different format.
https://github.com/kiali/kiali/blob/master/istio/discovery.go#L111
There is data, like the pod's protocol, HBONE/TCP, that I haven't seen in another place. It also has many information for every service/workload that it is handling, probably it could be "guessed" (Not sure if all) but we could put together this information and It might be not so reliable as this. Also, not sure where to get all the certificates information (It is not shown at the moment but it could be useful).
For example:
istioctl ztunnel-config services
NAMESPACE SERVICE NAME SERVICE VIP WAYPOINT ENDPOINTS
bookinfo bookinfo-gateway-istio 10.105.216.212 waypoint 1/1
bookinfo details 10.101.230.19 waypoint 1/1
bookinfo details-v1 10.109.126.190 waypoint 1/1
bookinfo productpage 10.105.99.217 waypoint 1/1
bookinfo productpage-v1 10.100.178.206 waypoint 1/1
bookinfo ratings 10.102.52.197 waypoint 1/1
Certificates:
istioctl ztunnel-config certificates
CERTIFICATE NAME TYPE STATUS VALID CERT SERIAL NUMBER NOT AFTER NOT BEFORE
spiffe://cluster.local/ns/bookinfo/sa/bookinfo-details Leaf Available true c7fedb8436712d249a416859b6387883 2024-12-18T13:31:39Z 2024-12-17T13:29:39Z
In case of failure and this data structure change, I think just the ztunnel page would be affected, but don't break Kiali.
* Get config dump info --------- Co-authored-by: Jay Shaughnessy <jshaughn@redhat.com>
* Get config dump info --------- Co-authored-by: Jay Shaughnessy <jshaughn@redhat.com>
Describe the change
Include relevant information to help troubleshooting.
Show workload pod protocol (HBONE is shown for Ambient mesh):
Show L7 waypoint link:
For the waypoint proxy, show waypoint proxy label:
For the waypoint proxy, show the Envoy tab:
Show waypoint/gateway traces:
Add waypoint proxy status. A new method is added to return IGNORED if sent is empty, instead NOT SENT (Ref: https://github.com/istio/istio/pull/51638/files#diff-fded610aca2639111f0d6b42e18dfc1ce047126340a2d36bb976cfa4c575b984R8). Used just for the waypoint. This condition is not shown as a warning.
Using this config dump, show for the ztunnel pods a ztunnel config map with the output for:
istioctl ztunnel-config workloadsistioctl ztunnel-config servicesERR GetWaypoints: Error fetching namespaces for cluster cluster-default. namespaces is forbidden: User "oidc:user" cannot list resource "namespaces" in API group "" at the cluster scopeSteps to test the PR
Install Ambient and bookinfo added into Ambient Mesh.
istio/install-istio-via-istioctl.sh -c kubectl -cp ambientistio/install-bookinf 10000 o-demo.sh -c kubectl -ai false -tg -w trueGo to:
Automation testing
Added unit tests
Issue reference
Ref. #7826
Tested with user with permissions just in the bookinfo namespace.
hack/setup-kind-in-ci.sh -a openid -ab true