Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revert STS from 1.4 with cherry picks of integration and stress test fixes. #180

Merged

Conversation

duderino
Copy link

@duderino duderino commented Mar 3, 2020

This is an alternate to #175. It cherry picks some integration and stress test fixes from envoyproxy/envoy-wasm in addition to the STS reverts to try to get builds passing.

duderino and others added 11 commits March 3, 2020 13:10
…o#162)

Backport envoyproxy/envoy-wasm#422 and its prerequisite (envoyproxy#10009).

* Plumb the flaky flag from envoy_cc_test to the native.cc_test (envoyproxy#10009)

Signed-off-by: Yan Avlasov <yavlasov@google.com>

* ci: mark //test/integration:protocol_integration_test as flaky. (envoyproxy#422)

Signed-off-by: Piotr Sikora <piotrsikora@google.com>
Signed-off-by: gargnupur <gargnupur@google.com>
Signed-off-by: gargnupur <gargnupur@google.com>
std::unordered_map<uint32_t, std::unique_ptr<GrpcCallHandlerBase>> grpc_calls_;
std::unique_ptr<GrpcStreamHandlerBase> cur_grpc_stream_;

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You shouldn't be reverting those changes, see: #175 (comment)

Copy link
Author

@duderino duderino Mar 4, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But we didn't ship that in 1.4.6. I think instead we should get release-1.4 into a state that looks like the 1.4.6 release we just shipped, tag it, then reapply any fixes which can go out in 1.4.7

@howardjohn CC

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a valid point. OK, fair enough, no one should be using Wasm in 1.4 anyway...

cc @mandarjog @kyessenov @bianpengyuan for visibility.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I disagree that we need to get release-1.4 branch into a state that looks like 1.4.6. We did not ship from 1.4 branch, as in reality we created a private 1.4.6 branch that was developed independently from 1.4 branch. Now that 1.4.6 branch is done, we should simply merge 1.4.6 branch into 1.4 branch (and that was exceptional due to secrecy around the patches).

@istio-testing istio-testing merged commit 4b22cf6 into istio:release-1.4 Mar 4, 2020
@howardjohn
Copy link
Member

howardjohn commented Mar 5, 2020 via email

@duderino
Copy link
Author

duderino commented Mar 5, 2020

OK, I can agree with that. And John's point is accurate - we just need to get it into a state for what we want shipped in 1.4.7.

That means at this point that if there are pure bug fix SHAs they should stay in the branch. So @kyessenov @bianpengyuan send them in a PR or list the SHAs here and I'll get them back into the branch. But if there are features mixed in with the SHAs, then we are still having a discussion with the community about whether we can include them in 1.4.7

@kyessenov
Copy link

I think the relevant stake holders are the release managers for 1.4, who have already looked into those PRs (in master or other branches sometimes and cherry-picked).
Please let's not call STS a google-specific extension. This is an IETF draft-ietf-oauth-token-exchange-16, which is implemented by AWS and other providers.

@duderino
Copy link
Author

duderino commented Mar 5, 2020

@kyessenov the issue is that these are features going into a patch release. I am within my rights to object to that.

Also, I can't find a place where STS is called a google-specific extension.

@mandarjog
Copy link

@kyessenov

  1. We don’t have a clear view of what to do with vendor specific extensions yet. But now we will have to figure it out.
  2. Since this is the Envoy repo, if upstream envoy accepts something, we don’t need to have independent judgment about vendor specificity of the issue.

vendor specificity is an issue for OSs istio-proxy repo, but we can set that aside for now.

The primary issue then is feature addition in 1.4.5 of Istio. Since this code has never been shipped in a OSS release we can let it all roll back.

@kyessenov
Copy link

I get that features in a patch release is an issue, and I'm OK with pretending those changes never were approved. I just don't think we should be using the CVE release as the reason to revert those changes. It's making a bad precedent to have a bunch of changes reverted post-factum, and creates a lot of work figuring out which change corresponds to which feature. Clearly, we do want some important bug fixes in 1.4.7.

If I were to patch 1.4 six months from now (like what I had to do for 1.2), I'd be enormously confused by what happened in the commit history.

@bianpengyuan
Copy link

#185 for the bug fix reverted by this pr.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

9 participants