►
From YouTube: What is NEW in Istio 1.14?
Description
What is new in Istio 1.14, anything exciting? Join Lin and Faseela to learn what is new in Istio 1.14 and watch Istio 1.14 in action. Faseela has made quite a few contributions to Istio 1.14 such as auto SNI, workloadSelector for DestinationRule etc and she will share her contributor experience and DEMO her implemented features in Istio 1.14!
#istio #servicemesh #helm
https://github.com/solo-io/hoot/tree/master/28-what-is-new-istio-1.14
00:04 welcome + speakers intro
2:05 service mesh, Cilium, eBPF news
4:45 contributing experience to Istio
6:30 general discussion around Istio 1.14 new features, release notes & upgrade notes
22:14 Live DEMO from Faseela on auto SNI, workload selector & credentialName for destination rule, Q & A
34:00 Live DEMO from Lin on min TLS with Helm, telemetry API new addition along with tips, Q & A
52:35 wrap up
A
B
A
So
I
really
look
forward
to
learn
from
you
today
and
you
know,
watch
your
live
demo,
so
I'm
so
excited
before
we
get
to
the
episode
I'd
like
to
quickly
discuss
the
news
for
this
week.
So
we
already
discussed
about
is
your
1.14,
which
we
will
dive
into
really
quickly.
After
the
news
and
the
biggest
news,
I
think
for
the
week
is
broadcom
to
acquire
vmware
for
61
billion
dollars
in
cash
and
stock.
Now
that
a
lot
of
people
are
thinking,
ibm
acquire
red
hat
for
30
plus
billion
sounds
very
cheap.
A
I
feel
honest,
I
feel
pretty
bad
for
our
friends
at
vmware,
because
I've
heard
rumors
about
you,
know
rituals
reduction
with
this
news.
So
good
luck
to
everyone
on
that.
We
just
did
a
instil
khan
recap
at
the
it's.
Your
meet
up,
I
think,
was
a
week
ago.
So
if
you
missed
istio
khan
check
out
the
key
takeaways
from
me
when
I
presented
to
you,
the
israel
community
meetup
phenomenal
feedback
of
istiocon
by
the
way,
thank
you
for
everyone
who
put
in
the
survey
for
istio
khan.
A
We
got
4.5
ratings,
really
really
cool.
I
would
also
like
to
remind
folks
about
our
next
huge
episode.
Well,
we
are
going
to
come
back
and
talk
about
ebpf
and
why
you
put,
I
want
to
put
evpf
application
to
bumblebee
and
walk
through
a
tutorial
with
live
demo
on
how
to
do
that.
In
fact,
I'm
going
to
have
christian
coming
back.
If
you
remember
christian,
he
was
on
episode
20.
Well,
he
talked
about
how
and
it's
your
1.13
so
he's
going
to
teach
us
about
ebpf.
A
I
am
super
excited
about
that.
There
will
not
be
a
hoots
live
stream
on
the
21st
and
28th,
because
I
will
be
traveling
to
austin
and
boston
very
excited
about
my
trip.
Last
not
the
least
I
want
you
also
mention
this
workshop
of
cillian.
Well,
we
introduced
ebpf
and
psyllium
with
the
certification
option.
I
believe
the
workshop
is
in
one
day's
20
hours
this
thursday.
So
if
you
have
time,
please
join
us
and
get
a
little
bit
of
hands-on
with
evpf,
along
with
salim
with
that
that's
the
news
of
the
week.
B
Yeah,
as
I
told
before,
I
started
with
istio
only
like
one
or
two
releases
before,
but
I
would
say
that
it
has
been
one
of
the
most
or
the
smoothest
open
source
experience
of.
For
me.
With
the
first
release
itself,
I
was
able
to
do
some
good
contributions
to
the
project
yeah.
I
should
say
that
the
istio
community
is
actually
very
supportive.
Of
course,
open
source
is
all
about
about
the
giving
and
taking
so
when
I
had
contributions
to
make.
B
There
were
enough
people
in
the
community
who
supported
me
and
also
still
has
very
good
documentation
which
made
the
journey
easier.
So
I
started
with
some
contributions
like
the
software
bill
of
materials
which
got
into
1.13
and
then
for
1.14.
Now,
by
that
time,
yeah
I
used
to
really
get
a
lot
of
help
from
different
community
members
and
for
1.14
I
was
able
to
make
a
bigger
contribution
so.
A
A
That's
wonderful
to
hear
we
can't
ask
for
better.
You
know
just
the
hood
before
two
hoods
before
this
one.
We
had
max
from
hpe
team,
who
also
had
a
really
pleasant
experience
contributing
to
istio.
So
I'm
just
super
delightful
about
this
contributor
experience,
because
that's
one
thing
you
know:
we've
heard
some
of
the
user
have
hard
times
so
we'll
constantly
improve
the
experience
for
the
user.
A
With
that,
let's
pull
out
the
release,
notes
for
istio
1.14,
so
there
are
essentially
four
highlights
of
the
release
for
silver
feel
free
to
chime
in
anytime,
because
it's
a
live
discussion
between
you
and
me.
So
the
first
one
is
the
spell
runtime
integration
added
to
istio,
thanks
to
our
hpe
team,
for
their
hard
work
on
this
one
thing
really
interesting
about
this.
It
essentially
enables
a
spell
to
do
a
testation
right.
So
we've
talked
about
this
in
our
hood
episode
with
max.
A
It
still
also
provides
a
good
documentation
for
this,
so
you
can
configure
your
spell
integration
and
you
know,
install
is
still
full
spell
and
and
the
main
changes
in
the
site
cycle
injector
web
hook.
So
I'm
not
going
to
go
through
the
detail,
because
we
did
a
hood
together
two
to
three
weeks
ago.
The
only
thing
I
would
mention
that
we
didn't
cover
at
the
hood
is
create
federated
registration
entries.
So
this
is
very
interesting.
A
B
Yeah,
so
it's
an
io
server
name
indication
is
an
extension
to
the
tls
protocol,
which
can
be
used
by
a
client
to
indicate
which
host
is
trying
to
connect
to.
So
there
were
a
lot
of
people
who
are
interested
in
this
particular
feature
because
envoy
was
already
supporting
this
auto
sni
and
which
enabled
automatic
setting
of
sni
based
on
the
host
or
authority
header.
So
that
is
what
exactly
which
we
enabled
using
this
auto
sni
feature
now
in
istio.
B
So
with
this,
you
know
longer
has
to
explicitly
set
the
sni
in
the
destination
rule
when
a
side
card
has
to
talk
to
a
service
which
is
outside
the
mesh.
So
that's
what
auto
sni
is
about,
but
of
course
currently
it
is
with
a
feature
flag
and
you
have
to
explicitly
enable
the
feature
flag
to
get
the
feature.
A
There
is
a
detailed
documentation
on
that
which
we
will
also
show
you
a
demo
and
cover
some
of
the
gotchas
that
you
may
run
into
which
I
run
into
the
next
highlight
is
the
telometry
improvement,
specifically
around
access
logging?
Many
of
our
users
actually
been
using
exploring
telemetry
api
and
then
find
out.
The
configuration
is
a
little
bit
limited,
so
the
filter
based
on
workload
mode
allows
you
to
configure
whether
you
want
to
see
access
log
based
on
client,
side
or
server
side,
or
you
want
to
see
both
client
and
server,
which
is
the
default.
A
So
we're
going
to
show
a
demo
on
this
too.
Last,
not
the
list
upgrade
1.14.
We
always
welcome
you
to
fill
out
the
survey
and
then
istio
kong
wrap
up,
which
we
mentioned
very
high.
Satisfaction
score
with
that.
I
like
to
go
to
the
upgrade
note,
because
this
is
normally
the
first
thing
you
know
existing
user
would
read.
A
B
A
B
B
So
there
are
definitely
cases
where
there
are
needs
for
services
within
the
cluster,
but
outside
the
mesh
to
communicate
to
mesh
internal
services.
So
this
was
one
of
the
most
important
use
cases
for
us
internally
and
for
this
use
case,
actually
it
does
not
make
much
sense
for
the
traffic
to
go
via
this
egress
gateway,
and
we
wanted
to
reduce
this
additional
hope.
B
So
currently,
it
still
has
a
mechanism
to
realize
this
particular
use
case,
but
actually
it
requires
a
lot
of
complex
configuration.
We
can
use
a
destination
rule
by
specifying
the
tls
key
and
certificate
parts
and
later
mount
these
certificates
explicitly
using
sidecar
annotations
for
all
the
amounts
and
to
add
to
the
overhead.
This
dr
used
to
get
applied
to
all
the
workloads
and
this
used
to
result
in
a
lot
of
warnings
and
error
messages
in
the
workloads
where
these
certificates
were
actually
not
present.
So
for
1.14
release.
B
A
B
Settings
for
specific
workloads
instead
of
applying
this
destination
or
rule
globally.
So
this
solves
the
initial
problem
of
the
client
certificate
settings
going
to
you
know
all
the
side,
cars
and,
on
top
of
this,
the
ability
to
configure
credential
name
was
added
to
dr,
and
this
helps
you
to
simply
simplify
the
things
further
and
it
makes
it
easier
to
use
kubernetes
secrets
for
tls
settings
instead
of
the
need
for
specifying
the
certificates
or
key
parts
in
dr
and
then
mounting
them
explicitly.
So
a
lot
of
configuration
has
been
optimized
like
this.
A
B
B
A
Yeah,
I
guess
from
my
perspective,
when
looking
at
the
release
notes,
you
know
the
first
one.
It's
actually
interesting
that
we
added
support
for
sending
our
house
already
and
points
to
our
boy,
and
it's
interesting
that
this
is
actually
this
a
this
is
enabled
by
d
default,
so
this
is
used
for
when
you
are
slow
start
in
mode
in
envoy.
A
So
if
not
use
this,
it
probably
makes
sense
to
disable
it
honestly,
in
my
opinion,
because
I'm
sending
on
ready
and
points
to
onboard
probably
won't
gain
you
much
benefits
if
you're
not
using
the
slow
start
mode.
The
other
thing
I
guess
the
ip
table
configuration
sorry,
were
you
going
to
say
something?
Oh.
B
B
A
A
I
think
it's
related
to
issue
causing
traffic
from
a
gateway
with
the
service
with
undeclared
protocol,
so
I
would
definitely
recommend
to
disable
protocol
sniffing
in
production
so
that
you
know
you
kind
of
will
declare
your
protocol
always
as
be
very
explicit
to
tell
issue
what
protocol
you
use
instead
of
having
issue
to
automatically
detect
that
which
you
know
could
be
wrong
and
it
could
also
cause
performance
concerns.
So
that's
one
thing:
I
want
to
point
out.
A
Yeah,
that's
an
interesting
one
too.
Oh
this
one
is
very
interesting
there.
The
default
load,
balancer
algorithm,
is
actually
changed
from
round
robin
into
this
request,
so
community,
I
believe,
with
lace
and
miller
from
google,
actually
done
a
bunch
of
testing
and
to
the
end
we
find
at
least
a
request
actually
outperforms
around
robbie
in
all
the
cases
that
he
runs,
and
so
we
made
the
decision.
You
know
change
to
this
request.
We
don't
expect
this
to
impact
anybody,
but
if
you
do
believe
wrong,
robbing
works
better
for
you.
A
You
mean
this
one
yeah
yeah,
that
it
actually
wasn't
highlighted
in
the
upgrade
notice,
because
we
didn't
expect
it
to
impact
anybody,
but
it's
in
the
release
notes
just
make
a
note
on.
If
it's
impact
anybody
yeah
the
I
guess
the
other
thing
I
would
say
this
is
pretty
cool
right.
If
you
use
wasm
plug-in
today,
it
can
actually
support
image
pro
secrets
now.
So
if
you
use
a
private
repo
so
that
you
pull
your
wizard
module
or
wasm
images,
you
can
specify
the
two
secrets
now.
A
So
that's
very
cool
and
the
telometry
side
changes.
I
think
we
talked
about
the
workload
mode.
I
guess
one
thing
interesting
is
the
add
environment
variable
to
wasm
extension.
So
another
changes
to
addition
to
the
wasm
plug-in
api
for
folks
who
are
interested
in
run
gateway
as
a
daemon
set.
Now
it's
possible
with
helm.
Previously
we
had
it
possible
with
israel
cuddle,
but
not
with
helm.
So
that's
nice,
and
then
we
have
a
bunch
of
fixes
and.
A
I
guess,
on
the
istiocado
side
I
thought
the
adding
support
for
ecds
was
interesting
to
show
the
extension
config
discovery
service
information.
So
if
you're
using
wasm
plugin,
that's
probably
relevant
to
you
and
then
the
cluster
id
shows
in
the
proxy
status
command.
So
that's
very
useful.
If
you
have
multi
cluster.
A
B
A
A
B
B
Okay,
that's
it
so
what
I
have
chosen
here
is
this
egress
tls
origination
example
itself,
just
thought
of
showing
what
is
there
in
the
document.
So
I
have
already
enhanced
the
document
so
that
it
has
included
a
new
section
of
yeah
for
this
mutual
dls
yeah
origination
for
regress.
This
is
a
newly
added
section
for
1.40,
which
explains
the
new
steps
based
on
the
credential
name,
support
which
was
done
in
1.14.
B
B
The
same
example
has
workload
selected
for
the
dr
being
used,
so
we
can
just
see
how
the
tls
settings
is
going
only
to
one
of
the
side,
cars
and
not
the
other
side,
cars
in
the
name
space
and
then,
finally,
we
will
see
how
auto
smi
is
enabled
when
the
sni
is
not
set
in
the
dr
hope.
My
terminal
is
visible.
B
Yeah,
I
can
see
your
terminal
okay,
so
I
have
put
everything
in
script
so
that
I
don't
make
any
mistakes
during
the
live
session.
So
first
I'll
just
so,
I'm
not
go
trying
to
go
through
the
each
step
in
the
script,
because
it's
exactly
the
same
steps
as
what
is
already
documented
in
the
istio
io
page.
So
whoever
has
any
doubts
can
go
back
and
refer
to
the
documentation.
I
have
copied
the
same
thing
only
to
the
documentation.
B
B
B
Of
course,
I
have
added
the
feature
flag
called
enable
autos,
and
actually
I
have
not
explicitly
set
it
as
an
environment
variable.
I
have
a
image
built
by
turning
it
on
by
default,
but
whoever
wants
to
enable
it.
The
information
is
there
in
the
destination
role,
istio
io
page
already.
It's
documented.
B
So
sometimes
we
make
mistakes
with
all
these
keys
and
configurations,
so
I
just
put
everything
in
the
script
yeah,
so
I
can
just
show
this
documentation
once
again,
so
this
documentation.
What
in
this
example?
What
exactly
it
does
is?
It
has
a
client
where
the
tls
settings
are
configured
and
then
there
is
an
nginx
server
which
is
outside
the
service
mesh,
and
then
we
will
be
trying
to
show
how
whether
based
your
configuration,
helps
you
originate
to
cls
traffic
towards
the
server.
That's
what
the
demo
is
all
about.
B
Yeah
the
steps
are
all
mentioned
here.
How
so
how
the
secret
is
created
and
whoever
has
already
done.
The
sidecar
request
will
be
already
familiar
with
these
steps,
so
the
secrets
are
created
and
the
only
difference
is
that
the
circuit
is
created
and
now
that
secret
can
be
applied
directly
at
the
side
requests
using
the
credential
name
like
this.
That's
the
major
difference
in.
B
It
has
sni
specified
like
this,
but
I
have
removed
it
so
that
I
can
show
the
autos-
and
I
feature
also
along
with
the
same
example,
so
the
configuration
is
completed.
So
I
have
an
auto
sni
name
space
here,
where
there
are
two
parts:
http
bin
pod
and
sleep
bot.
I
have
added
a
tcp
dump
port
also
to
the
sleep
so
that
I
can
show
that
how
the
auto
is
nice
properly
working
with
the
wireshark
capture.
B
So
in
the
dr,
what
we
we
have
just
seen
that
the
dr
has
a
workflow
selector,
which
says
apply
this
tls
settings
only
to
the
sleep
bar.
So
I
will
just
take
the
proxy
config
command,
which
displays
the
secrets.
So
here
you
can
see
that
I
am
displaying
the
secret
that
has
been
configured
yeah
to
the
sleep
pod
and
you
can
see
that
the
client
credential
secret,
which
I
configured
has
been
it's
properly
configured
on
the
sleep
board.
Now,
if
I
yeah.
B
So
this
is
the
http
bing
port.
Both
were
in
the
same
name
space.
So
previously,
when
we
did
not
have
this
workload
selector
support,
what
we
you
would
usually
see
is
when
you
configure
the
tls
settings,
it
will
go.
The
same.
Tls
settings
will
go
to
both
the
ports.
Now
you
can
see
that
it's
not
even
gone
to
the
second
http
being
called
on,
and
only
the
the
first
sleep
board
has
those
secrets
configured
so.
B
B
B
B
Okay,
so
I'll
just
go
straight
to
the
tls
part.
So
if
you
see
the
client
hello
here,
so
you
have
seen
that
in
the
dr,
I
did
not
have
an
sni
explicitly
said
previously.
We
used
to
set
it
explicitly
so
that
the
sni
extension
will
come
in
here.
But
what
you
will
now
see
is
auto.
Smi
is
enabled.
So,
let's
see
if
server
name
extension
is
automatically
picked
up
or
not
so
in
the
voice
shark.
B
A
A
B
B
B
A
A
B
Cool
very
nice.
Thank
you
very
much
about
the
demos
yeah.
Of
course,
it's
enabled
only
with
this
enable
auto
sni
feature
flag
and
yeah.
Autosan
validation
is
also
in
progress.
I
think
most
of
the
patches
are
already
merged,
so
that
is
also
something
related
to
this.
We,
we
will
talk
about
it
some
other
later
time.
Okay,.
A
A
A
A
If
you
watch
our
episode
20,
we
teach
how
you
can
install
istio
using
helm
and
particularly
using
helm
file.
So
this
is
I'm
pretty
much
actually
reusing
the
contents
from
episode
20
right.
What
I
love
about
helm
file
is,
you
can
specify
the
repository,
so
it
actually
goes
through,
like
the
repository
upgrade
with
you.
So
you
don't
have
to
manually.
A
Keep
your
repository
updated,
so
you
don't
need
to
run
repo
upgrade
commands
and
also
you
can
specify
your
releases
like
in
this
case
I
specify
istio
base
and
the
istio
discovery,
and-
and
also
I
can
specify
my
issue.
Discovery
needs
the
base
right.
So
that's
pretty
powerful
too,
to
specify
you
know
the
dependencies
and
then
I
specify
I
install
it's.
A
Your
ingress
gateway,
which
I
also
mentioned
it
needs,
is
your
base
and
it's
your
discovery
here
and
then
last
not
the
least
I
deploy
permissus
stack
and
this
helm
file
also
have
a
support
for
if
you
specify
your
values
file
outside
of
the
helm
file.
So
that's
supported
in
this
example
for
permissus.
A
A
A
There's
only
one
proxy
in
the
data
plane.
Guess
what
that's,
because
it's
my
istio
ingress
gateway
right.
So
the
first
thing
you
know
I'm
going
to
do
is
we're
going
to
figure
out
how
to
add
the
minimum
protocol
version
tls
1
3,
to
2
to
to
the
feature
we
talked
about
earlier.
So
let
me
go
to
share
my
other
screens.
A
A
So
if
you
see
my
screen
here
right,
so
we
talk
about
the
issue
release
highlight
the
second
highlight
is:
the
third
highlight:
is
the
trs
version,
so
this
document
tells
me
you
know
you
go
to
mash
config
and
go
to
your
istio
operator,
and
you
know
adding
these
blog
to.
You
is
your
operator,
but
this
is
actually
not
clear
to
me
because
now
I'm
using
helm,
so
how
do
I
figure
out?
What's
the
equivalent
home
value?
A
So
the
first
thing
I
do
I
want
to
is
I
go
to
the
helm,
installation
dot
and
I
was
trying
to
find
the
example.
Unfortunately,
it
was
not
an
obvious
example.
So
so
what
I
end
up
doing
is,
if
I
go
ahead,
share
my
terminal
back,
I
end
up
doing
is
running
on
this
helm
commands
to
help
me
figure
out
how
to
use
this.
So,
first
of
all,
I
need
to
figure
out
where
is
mesh
config
so
that
I
can
add
this
minimum
tls
version
right.
A
I'm
not
even
yes,
sorry,
I
forgot
to
add
to
the
stream.
Thank
you.
Hopefully
I
don't
need
to
split
back
first,
so
I
just
issued
a
helm,
show
values,
it's
your
slash
space
right.
So
that
shows
me
the
value
of
the
base
charts
and
you
can
see
the
the
mesh
config
which
we're
looking
for
is
not
in
here.
So
the
next
command
I'm
going
to
do
is
I'm
going
to
run
the
same
command
for
sdod,
because
I
want
to
see
if
it's
in
the
sdod
configuration.
A
It
also
have
issue
d
configuration
yeah.
It
has
the
default
resource,
so
it
has
room
yes,
mesh
config
is
right
here.
So
what
I
really
like
about
the
helm
is,
I
don't
have
to
look
into
istio.io
to
figure
out
what
other
configurations
are
available
for
me,
because
when
I
use
is
your
operator,
I
pretty
much
have
to
go
to
istio
api
repo
to
figure
out
what
is
the
proto
for
the
israel
operator.
So,
with
help
I
can
immediately
figure
out
mesh
config.
A
A
So
the
next
thing
we're
going
to
do
is
we're
going
to
apply
the
change
of
our
helm
file
to
environment
right,
so
the
helm
file
sync
essentially
does
is
push
the
latest
configuration
I
have
in
home
file
and
then
push
it
to
my
cluster.
So
now
it's
going
to
refresh
everything
in
my
cluster
so
switch
over
to
the
right
side.
A
If
I'm
doing
it
right
in
the
k9s
environment.
What
I
want
to
do
is
I
want
to
see
the
config
maps,
because
so
one
thing
that's
supposed
to
do
is
with
this
helm
file.
It's
supposed
to
open
up
the
istio
installation-
and
you
know
open
up
the
update
the
istio
config
map
and
add
the
minimum
configuration
for
me
so
looks
like
the
changes
are
done.
So
what
I'm
going
to
do
is
open
up
the
file
again.
Look.
It
has
the
minimum
protocol
version
right
here.
A
So
that's
the
change
we
added
to
the
mesh
config
through
the
hem
file.
I
just
talked
about
so.
Let's
test
that
function
now
that
we've
applied
the
minimum
protocol
configuration
of
version
one
three
of
tls
to
my
cluster.
So
in
order
to
test
things,
the
first
thing
we're
going
to
do
is
create
a
namespace
called
full
and
then
we're
going
to
deploy
http
and
sleep
to
this
namespace
and
notice,
I'm
using
the
manual
injection.
So
I
didn't
add
any
label
here,
but
you
could
potentially
use
auto
injection
so
switch
to
the
right
side.
A
A
And
open
a
connection
using
open
ssl.
So
in
this
case
you
can
see
we
were
able
to
connect
right.
So
you
can
see
the
certificate
chain,
the
server
certificate
that
you
can
see
it's
connected,
so
that
all
looks
good
by
the
way.
One
thing
I
want
to
ask
you
why
we
are
using
is
your
proxy
instead
of
sleep
here,
because
it's
a
proxy
has
to
open
ssl
our
tooling.
So
if
you
use
sleepless,
it
probably
would
fail
now.
A
The
next
thing
we're
going
to
do
is
run
the
exact
same
command,
but
we're
going
to
use
trs
one
two
here
to
see
if
the
connection
would
go
through.
So
as
you
can
tell
you
know
it's
connect,
but
it
didn't
work
right
because
there's
no
gls
search
presented
and
searching
handshaking,
so
it
didn't
go
through.
So
this
is
because,
on
the
server
side
we
only
allow
1.3
as
minimum
trs
1
3
as
the
minimum.
So
it's
not
going
to
allow
1.2
of
tls.
A
A
So
that
is
exactly
the
configuration
we
pushed
to
mesh
config
and
then
mesh
config
was
able
to
push
down
to
our
our
workloads
within
the
match.
In
this
case,
is
the
adjective
beam
so
in
case
you're
wondering
which
I
was
curious
too,
why
there
are
three
of
this
right,
because
there
are
virtual
inbound.
There
are
virtual
inbound
with
raw
buffer.
A
There
are
also,
as
transport
protocol
there's
also
virtual
inbound
with
cacho
http.
So
that's
why
there
are
three
of
these,
so
we
talked
about
how
if
this
works
in
gateway
right,
yes,
it
does.
If
you
go
to
the
gateway
api,
you
will
see
you
can
config
minimum
version
in
gateway,
so
this
is
just
an
addition.
Nice
addition
added
to
the
sidecar
configuration
okay.
So
that's
a
minimum
trs
version
for
istio
for
issue
workloads
within
the
mesh.
A
The
next
demo
I
want
to
show
you
is:
I
want
to
enable
access
log
for
the
mesh,
so
the
first
thing
I'm
going
to
do
is
using
the
telemetry
api,
which
is
a
recommended
way
to
enable
access
locks
now,
because
it's
actually
so
much
easier
than
writing
onward
filters
in
the
past
right.
So
the
first
thing
we're
going
to
do
is
we're
going
to
enable
disable
access
log
for
the
entire
mesh
right,
because
access
log
could
be
pretty
chatty
right.
A
Every
single
request
would
go
through
access
logs,
so
it
could
produce
a
lot
of
contents,
so
we're
going
to
disable
that
because
there's
no
need
to
enable
for
everything,
but
in
the
meanwhile
we're
going
to
enable
access
log
for
the
full
name
space,
which
is
our
playground
right.
So,
in
order
for
you
to
enable
it's
really
simple,
you
just
remove
disable
equals
true
because
by
default
it's
it's
enabled
so
essentially
we're
setting
a
global
configuration
to
say
I'm
disable
access
log,
but
in
the
full
name
space
we
are
enabling
access
log.
A
So
with
that,
I'm
going
to
send
a
request
to
from
the
issue
proxy
of
the
sleep
to
http
bing
right,
so
switch
on
the
right
side.
Let's
go
to
http
bean.
I
would
exact
expect
to
see
the
access
log
right.
So
if
you
go
back
again
here,
you
can
see
the
access
log
did
pop
in
right,
so
it
did
capture
the
access
log.
But
one
thing
I
stumble
with
is:
if
you
actually
go
back
on
the
right
side,
if
this
works.
A
A
So,
of
course,
there's
no
locks
because
the
request
was
from
israel
proxy.
So
if
you
do
switch
this
to
cart
from
the
sleep
container,
that
should
generate
the
access
lock
right.
So
when
you
are
debugging
issue
with
access
lock,
this
is
a
particular
thing.
You
do
want
your
watch
out
for
so
there's
on.
So
now
we're
going
to
leverage
the
new
feature
in
1.14
to
enable
access
log.
A
A
Yes,
that's
exactly
right!
That
is
the
workload
mode
where
you
specify
client,
server
or
client
and
server
yes.
So
now
you
can
see,
I
did
another
request.
It
did
show
up
in
my
client
so
with
that
I'm
going
to
switch
back
to
to
my
http
bing
right,
so
we're
going
to
open
up
the
proxy
locks
right.
So
we're
going
to
you
know
think
about
go
back
here
to
see
run
the
request
again.
So
you
can
see.
A
A
B
A
Yeah,
so
it's
actually
you
just
run.
This
is
the
command
I
use.
I
can
pull
it
out
again
for
you.
So
essentially
the
key
thing
is
you
just
match
on
the
mode
of
the
client
yeah.
So
when
I
built
this,
I
actually
made
mistake.
I
always
make
mistakes.
So
it's
your
cuddle
analyze
was
super
helpful
for
me.
So
I
remember
I
was
putting
a
dash
here
before
match
and
the
analyzer
was
detecting
it.
A
A
A
It
can
go
either
way,
yeah
that
that
is
why
I
remember
we
were
in
upstream
actually
debating
on
the
api
quite
for
quite
some
time.
Okay,
awesome.
I
guess
this
is
fun
chatting
with
you.
I
I
want
to
take
a
minute
to
thank
you
priscilla,
to
chat
with
me
today.
You
know
to
teach
us
about
other
sni
workload,
selector
in
destination
rule
and
also
on
the
newly
added
credential
name
in
destination
rule
and
goes
through.
You
know
some
of
the
new
features
of
istio
114
with
me.