Dave Cheney

Thanks for raising this issue. I think for the moment the answer is to prevent Ingress via RBAC. I'm going to move this to the unplanned milestone and we'll re-evaluate...

Thank you for your reply. At the moment the way we expect admins to restrict which k8s objects are used inside their cluster is RBAC. The resource quote method is...

For the record my suggestion on the k8s slack was to address this with RBAC in the cluster rather than introduce logic into contour. Rbac would let the user know...

Thank you for raising this issue. I'm sorry this is a problem for you. We are working to make the split envoy and contour deployment the default by the 0.15...

For the five 👍 's I encourage you to join the next community meeting https://projectcontour.io/community/ So we can talk about the issue in a higher bandwidth form. I'm not saying...

@PhilipGough sure thing but please, before sending any code, please write a sketch of your change here. Specifically, if this invariant is broken, what happens? Logging is not appropriate as...

@PhilipGough thanks for your reply. The outstanding problem is what to do when the invariant that `svh.TCPProxy == nil` is violated? Should that invalidate the httpproxy object? Should it be...

This sounds like a good thing to have if someone wants to investigate the options inside Envoy for doing this.

This is something i’d like to see fo contour 1.0. Marking as 0.15 to review if the feature has landed upstream.

Thanks for checking. I'm moving this to the unplanned milestone. It's unlikely that we'll make it to envoy 1.12 by october for contour 1.0 so we'll reassess after contour 1.0...