istio-policy-bot
commented
2 years ago 🚧 This issue or pull request has been closed due to not having had activity from an Istio team member since 2022-03-05. If you feel this issue or pull request deserves attention, please reopen the issue. Please see this wiki page for more information. Thank you for your contributions.
Created by the issue and PR lifecycle manager.
Bug Description
See https://github.com/grpc/grpc-go/issues/5159 for details - the RBAC filters for allow and deny use the same filter name, and this is not compatible with proxyless gRPC which validates name uniquness.
Unique names seem to be the correct behavior - and envoy may enforce this at some point, so it would be great to have this fixed in Istiod.
It is relatively simple to change the name to be unique - but I am not sure if it'll work with all envoys version we support, or if we have sufficient coverage for allow+deny chains.
Version
Additional Information
No response