kuma-website
kuma-website copied to clipboard
kumahq
Limitation when apply TrafficPermission, FaultInjection and RateLimit on ZoneEgress
What happened?
Policies such as Fault Injections, Rate Limit, and Traffic Permissions support arbitrary tags in Destination, but we lose this information if placing policies in the map just by Service's name. Example:
type: ExternalService
mesh: default
name: es-v1
tags:
kuma.io/service: my-external-service
version: v1
type: ExternalService
mesh: default
name: es-v2
tags:
kuma.io/service: my-external-service
version: v2
type: FaultInjection
mesh: default
name: fi1
destinations:
- match:
kuma.io/service: my-external-service
version: v1
...
type: FaultInjection
mesh: default
name: fi2
destinations:
- match:
kuma.io/service: my-external-service
version: v2
...
Then we'll build a map: "my-external-service" -> ["fi1", "fi2"]
And lately, we'll place fi1 and fi2 on all fault injections filter chains for my-external-service (in external_services_generator.go)
Triage: We need to document this limitation. What's the behaviour with ExternalService without ZoneEgress? Should just disallow externalService with arbitrary tags?
Seems like we need tags for metadata info so let's just document this limitation.
This issue was inactive for 30 days it will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant please comment on it promptly or attend the next triage meeting.
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
This issue was inactive for 30 days it will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant please comment on it promptly or attend the next triage meeting.
This issue was inactive for 30 days it will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant please comment on it promptly or attend the next triage meeting.
This issue was inactive for 30 days it will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant please comment on it promptly or attend the next triage meeting.
This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant, please comment on it or attend the next triage meeting.
This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant, please comment on it or attend the next triage meeting.
Yes, it's still a limitation. At this moment we can't apply the policy only to some subset of my-external-service (like version=v2) because all my-external-service endpoints are located in the same DNS cluster
This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant, please comment on it or attend the next triage meeting.
This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant, please comment on it or attend the next triage meeting.
Is this something we want to fix? Should we just say there are no subsets of external services. You should be using a route if you want something like this
This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant, please comment on it or attend the next triage meeting.
This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant, please comment on it or attend the next triage meeting.
Is this something we want to fix? Should we just say there are no subsets of external services. You should be using a route if you want something like this
Did anyone ask for this? If not then I think we can just document. On the other hand fixing this shouldn't be that big of a problem.
I don't think it makes sense to fix this for old policies. Probably we should just make sure similar use case works for new policies and new external service
This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed. If you think this issue is still relevant, please comment on it or attend the next triage meeting.
Closing since MeshExternalService doesn't have tags on individual endpoints, so the problem doesn't exist.