John Howard
John Howard
In general it will be hard to troubleshoot issues without the full YAML/error messages ,logs, etc. I recommend starting with https://github.com/istio/istio/wiki/Troubleshooting-Istio and going from there!
I am 100% on board with a warning. Turning a warning into errors, even if only for older releases is probably not great... we very likely have a lot of...
I am also supportive - Kubernetes let's you disable Kubernetes APIs, too, as another example On Mon, Nov 10, 2025, 6:03 AM Daniel Grimm ***@***.***> wrote: > *dgn* left a...
This does not read the resources and ignore them, it filters before a watch is initiated in the first place.
Not sure sidecars handle this or not either. Or kubernetes JWT mounting
Still good to have
> Is this decided for sure? It seems to me that mixing and matching is plausible even if likely not recommended and more error prone. IMO you should be able...
I've added some tests and validation. I have blocked usage of SA with principals, in the same `from`, since they are ANDed -- it does not make sense to say...
> Felt a little odd to have namespace inside the value for serviceAccount while we also have namespace as a separate field under `source` but does make sense in this...
> A service account in another weird format only used by Istio is not making things much better. I have a hard time aligning this with the current state of...