John Howard howardjohn

This script analyzes AuthorizationPolicies in a cluster and checks whether there are Selector based policies that span multiple service accounts. This info may help guide future API decisions.

Example output:

$ curl -sL https://gist.githubusercontent.com/howardjohn/ae20c608bebfb79e701009ee8f83b57b/raw/8af7a83dff4ed000b18858cc96527b6c1f688ed8/find-cross-service-account-policies | sh
Policy echo/echo/ns1 has selects service accounts 'alpha,beta,', but doesn't fully select 'alpha,'
Policy echo/echo/ns1 has 2 Service accounts: 'alpha beta,
Policy echo/echo/policy has selects service accounts 'waypoint,', but doesn't fully select 'waypoint,'
Root Policy istio-system/ns1 has 2 Service accounts: alpha beta

Demo of experimental Gateway API for Mesh

Concrete example:

$ kubectl apply -f demo-install.yaml
$ kubectl apply -f demo.yaml
$ kubectl exec deployment/shell -- curl -s echo/{0..10} | grep Hostname=
Hostname=echo-v1-f9bc8b978-jwvvx
Hostname=echo-v2-6b54fc5c67-jltt2

Multicluster statefulset

alpha.yaml: install in cluster "alpha" beta.yaml: install in cluster "beta"

Results:

Same network

echo-alpha.default: sort of works, but load balancing is broken (istio/istio#31064)

	package main

	import (
	"flag"
	"net"
	"time"

	"log"
	)

	package main

	import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/tls"
	"crypto/x509"
	"encoding/pem"
	"flag"
	syscall "golang.org/x/sys/unix"

	#!/bin/bash

	# Usage: tracing::init [endpoint; default localhost:4317]
	function tracing::init() {
	export OTEL_EXPORTER_OTLP_ENDPOINT="${1:-${OTEL_EXPORTER_OTLP_ENDPOINT:-localhost:4317}}"
	}

	# Usage: tracing::auto::init [endpoint; default localhost:4317]
	function tracing::auto::init() {
	tracing::init

	#!/bin/bash
	export OTEL_EXPORTER_OTLP_ENDPOINT=localhost:4317

	function gen-uid() {
	tr -dc 'a-f0-9' < /dev/urandom \| head -c$1
	}

	trace=`gen-uid 32`
	spans=()
	starts=()

	#!/bin/bash

	t="$(mktemp -d)"
	cp "${1:?file to trace}" "$t/trace"
	cat <<'EOF' > "$t/index.html"
	<!doctype html>
	<html lang="en-us">
	<link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">
	<body>

	# This script checks which virtual services are creating in producer namespaces (eg defining a VirtualService for a Service I own) vs in consumer namespce (defining a VirtualService for a Service in another namespace).

	# Raw results
	kubectl get vs -A -ojson \| jq '.items[] \| {match: (.spec.hosts[] \| select(. \| contains(".svc.cluster.local")) \| split(".")[1]), ns: .metadata.namespace}' -c

	# Just get the counts
	kubectl get vs -A -ojson \| jq '[.items[] \| {match: (.spec.hosts[] \| select(. \| contains(".svc.cluster.local")) \| split(".")[1]), ns: .metadata.namespace}] \| group_by(.match == .ns)\| map(length) \| "Consumer: " + (.[0] \| tostring) + "\nProducer: " + (.[1] \| tostring)' -r

	#!/bin/bash

	# Usage: go test -exec=true -toolexec=go-compile-without-link -vet=off ./...
	# Preferably as an alias like `alias go-test-compile='go test -exec=true -toolexec=go-compile-without-link -vet=off'`
	# This will compile all tests, but not link them (which is the least cacheable part)

	if [[ "${2}" == "-V=full" ]]; then
	"$@"
	exit 0
	fi