Panic Error in istiod discovery container: Slice bounds out of range #51610
Comments
|
error log |
After deleting the EnvoyFilter like the above, it has been confirmed that istiod does not terminate abnormally. |
|
Without envoy filter: filterChains:
- filterChainMatch:
serverNames:
- foo.com
filters:
- name: istio.stats
typedConfig:
'@type': type.googleapis.com/stats.PluginConfig
disableHostHeaderFallback: true
- name: envoy.filters.network.tcp_proxy
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
cluster: outbound|80||echo.sidecar.svc.cluster.local
statPrefix: outbound|80||echo.sidecar.svc.cluster.local
transportSocket:
name: envoy.transport_sockets.tls
typedConfig:
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
commonTlsContext:
alpnProtocols:
- h2
- http/1.1
tlsCertificateSdsSecretConfigs:
- name: kubernetes:https://sds-credential
sdsConfig:
ads: {}
resourceApiVersion: V3
requireClientCertificate: falseWith: filterChains:
- filterChainMatch:
serverNames:
- foo.com
filters:
- name: envoy.filters.network.tcp_proxy
typedConfig:
'@type': type.googleapis.com/stats.PluginConfig
disableHostHeaderFallback: true
metrics:
- {}
- name: envoy.filters.network.tcp_proxy
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
cluster: outbound|80||echo.sidecar.svc.cluster.local
idleTimeout: 3s
statPrefix: outbound|80||echo.sidecar.svc.cluster.local
transportSocket:
name: envoy.transport_sockets.tls
typedConfig:
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
commonTlsContext:
alpnProtocols:
- h2
- http/1.1
tlsCertificateSdsSecretConfigs:
- name: kubernetes:https://sds-credential
sdsConfig:
ads: {}
resourceApiVersion: V3
requireClientCertificate: falseRemoving the filter, permanently in broken state: filterChains:
- filterChainMatch:
serverNames:
- foo.com
filters:
- name: envoy.filters.network.tcp_proxy
typedConfig:
'@type': type.googleapis.com/stats.PluginConfig
disableHostHeaderFallback: true
metrics:
- {}
- name: envoy.filters.network.tcp_proxy
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
cluster: outbound|80||echo.sidecar.svc.cluster.local
statPrefix: outbound|80||echo.sidecar.svc.cluster.local
transportSocket:
name: envoy.transport_sockets.tls
typedConfig:
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
commonTlsContext:
alpnProtocols:
- h2
- http/1.1
tlsCertificateSdsSecretConfigs:
- name: kubernetes:https://sds-credential
sdsConfig:
ads: {}
resourceApiVersion: V3
requireClientCertificate: false |
|
It works fine like this: apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: idle-timeout-example
namespace: istio-system
spec:
configPatches:
- applyTo: NETWORK_FILTER
match:
listener:
filterChain:
sni: foo.com
filter:
name: envoy.filters.network.tcp_proxy
patch:
operation: MERGE
value:
name: envoy.filters.network.tcp_proxy
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
idle_timeout: 3sNote the added match. Maybe we should make this more robust against misconfig |
Thank you for your investigation, I confirmed too. In my environment, there was a memory leak in istio-proxy as like below. I expect these issues to be resolved by applying the correct EnvoyFilter. |
Is this the right place to submit this?
Bug Description
I am encountering a runtime error in the istiod discovery container that results in a panic. The error message suggests that the slice bounds are out of range. Below is the error log for your reference:
This error does not occur every time, but only occasionally.
Version
Additional Information
No response
The text was updated successfully, but these errors were encountered: