Skip to content

dry run auth #1659

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

dry run auth #1659

wants to merge 2 commits into from

Conversation

@Stevenjin8
Copy link
Contributor

@Stevenjin8 Stevenjin8 commented Oct 28, 2025

might be a slow rollout

Here are the semantics:

  • first check for dry-run deny, and log all that match
  • then check for real deny. short circuit if any match
  • then check for dry run accept and log all that match
  • then check for real accept.

@Stevenjin8 Stevenjin8 requested a review from a team as a code owner October 28, 2025 20:39
@istio-testing istio-testing added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Oct 28, 2025
Stevenjin8
Stevenjin8 commented Oct 30, 2025
View reviewed changes
src/state.rs

for pol in deny_dry_run.iter() {
if pol.matches(conn) {
debug!(policy = pol.to_key().as_str(), "dry-run deny policy match");
Copy link
Contributor Author

@Stevenjin8 Stevenjin8 Oct 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've always found it curious that these are debug logs in envoy.

@ilrudie
Copy link
Contributor

ilrudie commented Nov 3, 2025

Was there a document around this or was it just discussion in WG?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@Stevenjin8 @ilrudie @istio-testing