John Howard
John Howard
to be clear - use istioctl 1.22.4 to install 1.22.4
on in 1.25, off in 1.24 sounds right to me (caveat: I haven't read the PR yet)
> This breaks disabling ambient on a running pod: This might be from https://github.com/istio/istio/pull/53951 being split out and not rebased maybe
LGTM aside from that comment though
> So we'd have yes/auto/no as the choices, and Yep. I am still not 100% convinced its safe to ever use "auto" (and 'yes' is definitely not able to be...
rebased!
By setting maxConnections=1 aren't you basically saying "reject any connections if I have more than 1 open already"? And then having fortio open multiple connections, so some will be rejected?
``` - number: 80 name: http protocol: TCP # THIS ``` means envoy is treatinbg it as opaque TCP. So it cannot send a 503, it can only close the...
Hmm with the same setup, I see ``` [2025-03-17T15:41:02.097Z] "GET /get HTTP/1.1" 503 UO upstream_reset_before_response_started{overflow} - "-" 0 81 0 - "-" "fortio.org/fortio-1.68.0" "0bf6d02b-27df-46fd-becf-3a077b0f5d45" "httpbingo.org" "-" inbound-vip|80|http|httpbingo.org - 240.240.0.1:80 192.168.0.23:57674...
> Existing ingress rules in NetowrkPolicy do not apply anymore in ambient mode. To be explicit, this is not accurate. The policies do apply. You just ALSO added a new...