John Howard

Tune TLS settings

11

Should use a strict cipher set and TLS 1.3 only

Ensure https://github.com/istio/istio/issues/38982 is fixed in ambient

Mixing build container with non-build container invalidates compiler caches

5

In go, the cache is outside of the repo. In ztunnel, it is in `out/`. When building in the container vs not the container, we use the same folder, causing...

CNI repair broken for non-restartable pods

2

When a job has restartPolicy=Never or low backoffLimit, CNI race repair may not work. This is because the pod will not just crashloop until its fixed, it will stop immediately....

Create a ValidatingAdmissionPolicy for MeshConfig

16

For CRDs, we are largely moving away from webhook to native validation (https://github.com/istio/istio/issues/46151) (not really _away_ for awhile, but augment it). For MeshConfig, its a configmap so we don't have...

ambient: fix nil pointer when pod cache is stale

4

I ran into this in an *extremely* bespoke and unsupported environment, but I think it could occur in real world. We are looping outside of GetPodIfAmbient for the pod to...