-
Notifications
You must be signed in to change notification settings - Fork 7.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Panic Error in istiod discovery container: Slice bounds out of range #51610
Comments
error log
|
After deleting the EnvoyFilter like the above, it has been confirmed that istiod does not terminate abnormally. |
Without envoy filter: filterChains:
- filterChainMatch:
serverNames:
- foo.com
filters:
- name: istio.stats
typedConfig:
'@type': type.googleapis.com/stats.PluginConfig
disableHostHeaderFallback: true
- name: envoy.filters.network.tcp_proxy
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
cluster: outbound|80||echo.sidecar.svc.cluster.local
statPrefix: outbound|80||echo.sidecar.svc.cluster.local
transportSocket:
name: envoy.transport_sockets.tls
typedConfig:
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
commonTlsContext:
alpnProtocols:
- h2
- http/1.1
tlsCertificateSdsSecretConfigs:
- name: kubernetes:https://sds-credential
sdsConfig:
ads: {}
resourceApiVersion: V3
requireClientCertificate: false With: filterChains:
- filterChainMatch:
serverNames:
- foo.com
filters:
- name: envoy.filters.network.tcp_proxy
typedConfig:
'@type': type.googleapis.com/stats.PluginConfig
disableHostHeaderFallback: true
metrics:
- {}
- name: envoy.filters.network.tcp_proxy
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
cluster: outbound|80||echo.sidecar.svc.cluster.local
idleTimeout: 3s
statPrefix: outbound|80||echo.sidecar.svc.cluster.local
transportSocket:
name: envoy.transport_sockets.tls
typedConfig:
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
commonTlsContext:
alpnProtocols:
- h2
- http/1.1
tlsCertificateSdsSecretConfigs:
- name: kubernetes:https://sds-credential
sdsConfig:
ads: {}
resourceApiVersion: V3
requireClientCertificate: false Removing the filter, permanently in broken state: filterChains:
- filterChainMatch:
serverNames:
- foo.com
filters:
- name: envoy.filters.network.tcp_proxy
typedConfig:
'@type': type.googleapis.com/stats.PluginConfig
disableHostHeaderFallback: true
metrics:
- {}
- name: envoy.filters.network.tcp_proxy
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
cluster: outbound|80||echo.sidecar.svc.cluster.local
statPrefix: outbound|80||echo.sidecar.svc.cluster.local
transportSocket:
name: envoy.transport_sockets.tls
typedConfig:
'@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
commonTlsContext:
alpnProtocols:
- h2
- http/1.1
tlsCertificateSdsSecretConfigs:
- name: kubernetes:https://sds-credential
sdsConfig:
ads: {}
resourceApiVersion: V3
requireClientCertificate: false |
It works fine like this: apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: idle-timeout-example
namespace: istio-system
spec:
configPatches:
- applyTo: NETWORK_FILTER
match:
listener:
filterChain:
sni: foo.com
filter:
name: envoy.filters.network.tcp_proxy
patch:
operation: MERGE
value:
name: envoy.filters.network.tcp_proxy
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
idle_timeout: 3s Note the added match. Maybe we should make this more robust against misconfig |
Thank you for your investigation, I confirmed too. In my environment, there was a memory leak in istio-proxy as like below. I expect these issues to be resolved by applying the correct EnvoyFilter. |
Is this the right place to submit this?
Bug Description
I am encountering a runtime error in the istiod discovery container that results in a panic. The error message suggests that the slice bounds are out of range. Below is the error log for your reference:
This error does not occur every time, but only occasionally.
Version
Additional Information
No response
The text was updated successfully, but these errors were encountered: