Repository: higress-group/higress-standalone
Pull request #157: feat: Support modifying mesh config files in all-in-one images
Author: login: CH3CHO
Created: 2025-05-03T11:19:48Z | Merged: 2025-05-12T11:26:20Z

During start-up, extract the content of mesh configs (`mesh` and `meshNetworks`) in `higress-config.yaml` file into `/etc/istio/config` dir. So user can modify them by changing the content of `higress-config.yaml`.


Diff:
diff --git a/all-in-one/Dockerfile b/all-in-one/Dockerfile
index e361930..27a711d 100644
--- a/all-in-one/Dockerfile
+++ b/all-in-one/Dockerfile
@@ -64,14 +64,17 @@ COPY --from=grafana /usr/share/grafana /usr/share/grafana
 COPY --from=grafana /run.sh /usr/local/bin/grafana.sh
 
 # Install supervisord, logrotate, cron and initialize related folders
-RUN apt-get update --allow-unauthenticated && \
+RUN arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
+  apt-get update --allow-unauthenticated; \
   apt-get install --no-install-recommends -y --allow-unauthenticated \
-  supervisor logrotate cron \
-  && apt-get upgrade -y --allow-unauthenticated \
-  && apt-get clean \
-  && rm -rf /var/log/*log /var/lib/apt/lists/* /var/log/apt/* /var/lib/dpkg/*-old /var/cache/debconf/*-old \
-  && mkdir -p /var/log/higress \
-  && mkdir /data
+    wget supervisor logrotate cron; \
+  apt-get upgrade -y --allow-unauthenticated; \
+  apt-get clean; \
+  rm -rf /var/log/*log /var/lib/apt/lists/* /var/log/apt/* /var/lib/dpkg/*-old /var/cache/debconf/*-old; \
+  wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_$arch -O /usr/local/bin/yq && chmod +x /usr/local/bin/yq; \
+  mkdir -p /var/log/higress; \
+  mkdir /data;
+
 COPY ./supervisord/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
 
 # Initialize configurations
diff --git a/all-in-one/config/configmaps/higress-config.yaml b/all-in-one/config/configmaps/higress-config.yaml
index bb87e9f..4c0070e 100644
--- a/all-in-one/config/configmaps/higress-config.yaml
+++ b/all-in-one/config/configmaps/higress-config.yaml
@@ -18,4 +18,30 @@ data:
       routeTimeout: 0
     upstream:
       connectionBufferLimits: 10485760
-      idleTimeout: 10
\ No newline at end of file
+      idleTimeout: 10
+  mesh: |-
+    accessLogEncoding: TEXT
+    accessLogFile: /dev/stdout
+    accessLogFormat: |
+      {"ai_log":"%FILTER_STATE(wasm.ai_log:PLAIN)%","authority":"%REQ(X-ENVOY-ORIGINAL-HOST?:AUTHORITY)%","bytes_received":"%BYTES_RECEIVED%","bytes_sent":"%BYTES_SENT%","downstream_local_address":"%DOWNSTREAM_LOCAL_ADDRESS%","downstream_remote_address":"%DOWNSTREAM_REMOTE_ADDRESS%","duration":"%DURATION%","istio_policy_status":"%DYNAMIC_METADATA(istio.mixer:status)%","method":"%REQ(:METHOD)%","path":"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%","protocol":"%PROTOCOL%","request_id":"%REQ(X-REQUEST-ID)%","requested_server_name":"%REQUESTED_SERVER_NAME%","response_code":"%RESPONSE_CODE%","response_flags":"%RESPONSE_FLAGS%","route_name":"%ROUTE_NAME%","start_time":"%START_TIME%","trace_id":"%REQ(X-B3-TRACEID)%","upstream_cluster":"%UPSTREAM_CLUSTER%","upstream_host":"%UPSTREAM_HOST%","upstream_local_address":"%UPSTREAM_LOCAL_ADDRESS%","upstream_service_time":"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%","upstream_transport_failure_reason":"%UPSTREAM_TRANSPORT_FAILURE_REASON%","user_agent":"%REQ(USER-AGENT)%","x_forwarded_for":"%REQ(X-FORWARDED-FOR)%","response_code_details":"%RESPONSE_CODE_DETAILS%"}
+    configSources:
+    - address: xds://127.0.0.1:15051
+    - address: k8s://
+    defaultConfig:
+      disableAlpnH2: true
+      discoveryAddress: 127.0.0.1:15012
+      controlPlaneAuthPolicy: MUTUAL_TLS
+      proxyStatsMatcher:
+        inclusionRegexps:
+        - .*
+    dnsRefreshRate: 200s
+    enableAutoMtls: false
+    enablePrometheusMerge: true
+    ingressControllerMode: "OFF"
+    mseIngressGlobalConfig:
+      enableH3: false
+      enableProxyProtocol: false
+    protocolDetectionTimeout: 100ms
+    rootNamespace: higress-system
+    trustDomain: cluster.local
+  meshNetworks: 'networks: {}'
\ No newline at end of file
diff --git a/all-in-one/scripts/start-apiserver.sh b/all-in-one/scripts/start-apiserver.sh
index c38886b..111f7e1 100644
--- a/all-in-one/scripts/start-apiserver.sh
+++ b/all-in-one/scripts/start-apiserver.sh
@@ -22,4 +22,20 @@ if [ -n "$CONFIG_TEMPLATE" ]; then
     fi
 fi
 
+MESH_CONFIG_DIR='/etc/istio/config'
+mkdir -p $MESH_CONFIG_DIR
+HIGRESS_CONFIG_FILE="/data/configmaps/higress-config.yaml"
+MESH_CONFIG_FILES=$(yq '.data | keys | .[]' "$HIGRESS_CONFIG_FILE")
+if [ -z "$MESH_CONFIG_FILES" ]; then
+    echo "  Missing required files in higress-config ConfigMap."
+    exit -1
+fi
+IFS=$'\n'
+for MESH_CONFIG_FILE in $MESH_CONFIG_FILES; do
+    if [ -z "$MESH_CONFIG_FILE" -o "$MESH_CONFIG_FILE" == "higress" ]; then
+        continue
+    fi
+    yq ".data.$MESH_CONFIG_FILE" "$HIGRESS_CONFIG_FILE" > "$MESH_CONFIG_DIR/$MESH_CONFIG_FILE"
+done
+
 apiserver --bind-address 127.0.0.1 --secure-port 18443 --storage file --file-root-dir /data --cert-dir /tmp
\ No newline at end of file


Reviews:
user: login: lingma-agents[bot]
body: ## 🔍 代码评审报告

### 🎯 评审意见概览

| 严重度 | 数量 | 说明 |
|:---|:---:|:---|
| 🔴 **Blocker** | 0 | 阻断性问题，需立即修复。例如：系统崩溃、关键功能不可用或严重安全漏洞。 |
| 🟠 **Critical** | 1 | 严重问题，高优先级修复。例如：核心功能异常或性能瓶颈影响用户体验。 |
| 🟡 **Major** | 1 | 主要问题，建议修复。例如：非核心功能缺陷或代码维护性较差。 |
| 🟢 **Minor** | 0 | 次要问题，酌情优化。例如：代码格式不规范或注释缺失。 |

**总计：** 2 个问题

---

## 📋 评审意见详情

### 💡 单文件建议

<blockquote>
以下是文件级别的代码建议，聚焦于代码的可读性、可维护性和潜在问题。
</blockquote>

<details>
<summary>📄 all-in-one/Dockerfile (1 💬)</summary>

<ul>
<li><a href="https://github.com/higress-group/higress-standalone/pull/157#discussion_r2072375992">架构检测逻辑存在缺陷可能导致yq工具下载失败</a> (L67-L74)</li>
</ul>
</details>

<details>
<summary>📋 all-in-one/config/configmaps/higress-config.yaml (1 💬)</summary>

<ul>
<li><a href="https://github.com/higress-group/higress-standalone/pull/157#discussion_r2072375993">meshNetworks配置格式不正确可能导致解析失败</a> (L47)</li>
</ul>
</details>

### 🚀 跨文件建议

<blockquote>
以下是对代码架构和设计的综合分析，聚焦于跨文件交互、系统一致性和潜在优化空间。
</blockquote>

<details>
<summary>🔍 <strong>1. 依赖管理不安全导致潜在安全风险</strong></summary>

Dockerfile中直接通过wget下载yq工具且未进行签名验证，存在中间人攻击风险。该操作未验证下载文件的完整性及来源可靠性，可能导致恶意软件注入。同时APT安装使用了--allow-unauthenticated参数，允许安装未经验证的包，违反安全最佳实践。

**📌 关键代码：**
-  [`all-in-one/Dockerfile` (67-74)](https://github.com/higress-group/higress-standalone/blob/feat/aio-mesh-config/all-in-one/Dockerfile#L67-L74)
```
wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_$arch -O /usr/local/bin/yq && chmod +x /usr/local/bin/yq; \
apt-get install ... --allow-unauthenticated; \
```

**⚠️ 潜在风险：** 可能导致恶意软件注入或安装不可信组件，引发系统级安全漏洞

</details>

<details>
<summary>🔍 <strong>2. 配置文件解析逻辑与格式定义存在不一致性</strong></summary>

configmaps/higress-config.yaml中meshNetworks配置被定义为字符串类型（'networks: {}'），而start-apiserver.sh脚本假设其为结构化数据进行处理。这种类型不一致可能导致解析失败，破坏配置注入流程。

**📌 关键代码：**
-  [`all-in-one/config/configmaps/higress-config.yaml`](https://github.com/higress-group/higress-standalone/blob/feat/aio-mesh-config/all-in-one/config/configmaps/higress-config.yaml)
```yaml
meshNetworks: 'networks: {}'
```

-  [`all-in-one/scripts/start-apiserver.sh`](https://github.com/higress-group/higress-standalone/blob/feat/aio-mesh-config/all-in-one/scripts/start-apiserver.sh)
```sh
MESH_CONFIG_FILES=$(yq '.data | keys | .[]' "$HIGRESS_CONFIG_FILE")
```

**⚠️ 潜在风险：** 配置解析失败将导致服务启动异常，影响系统核心功能

</details>

<details>
<summary>🔍 <strong>3. 关键依赖项安装缺乏健壮性保障</strong></summary>

yq工具的安装过程未进行架构检测的异常处理，当dpkg命令执行失败时会导致构建中断。同时，Dockerfile中将多个apt操作合并到单个RUN指令中，增大了构建失败时的调试难度。

**📌 关键代码：**
-  [`all-in-one/Dockerfile` (67-74)](https://github.com/higress-group/higress-standalone/blob/feat/aio-mesh-config/all-in-one/Dockerfile#L67-L74)
```
arch="$(dpkg --print-architecture)"; ... apt-get install ...
```

**⚠️ 潜在风险：** 构建流程脆弱性增加，可能因环境差异导致CI/CD流水线失败

</details>

<details>
<summary>🔍 <strong>4. 配置管理存在潜在覆盖风险</strong></summary>

start-apiserver.sh脚本直接将配置写入/etc/istio/config目录，但未处理配置文件冲突问题。若存在同名配置文件可能导致关键配置被意外覆盖，破坏现有配置体系。

**📌 关键代码：**
-  [`all-in-one/scripts/start-apiserver.sh`](https://github.com/higress-group/higress-standalone/blob/feat/aio-mesh-config/all-in-one/scripts/start-apiserver.sh)
```sh
MESH_CONFIG_DIR='/etc/istio/config'
```

**⚠️ 潜在风险：** 生产环境配置被意外覆盖导致服务异常

</details>

<details>
<summary>🔍 <strong>5. 架构模式与设计文档不一致</strong></summary>

新增的mesh配置包含enableAutoMtls等字段，但Dockerfile未相应添加mTLS所需的证书管理逻辑。这种架构层面的不匹配可能导致安全策略执行失效，违背服务网格设计原则。

**📌 关键代码：**
-  [`all-in-one/config/configmaps/higress-config.yaml`](https://github.com/higress-group/higress-standalone/blob/feat/aio-mesh-config/all-in-one/config/configmaps/higress-config.yaml)
```yaml
controlPlaneAuthPolicy: MUTUAL_TLS
```

**⚠️ 潜在风险：** 安全策略配置与实际运行环境不匹配，导致安全防护失效

</details>

---

<details>
<summary><strong>💡 小贴士</strong></summary>

### 与 lingma-agents 交流的方式

**📜 直接回复评论**
直接回复本条评论，lingma-agents 将自动处理您的请求。例如：

- _在当前代码中添加详细的注释说明。_

- _请详细介绍一下你说的 LRU 改造方案，并使用伪代码加以说明。_

**📜 在代码行处标记**
在文件的特定位置创建评论并 @lingma-agents。例如：
- _@Lingma-Agent 分析这个方法的性能瓶颈并提供优化建议。_

- _@Lingma-Agent 对这个方法生成优化代码。_

**📜 在讨论中提问**
在任何讨论中 @lingma-agents 来获取帮助。例如：
- _@Lingma-Agent 请总结上述讨论并提出解决方案。_

- _@Lingma-Agent 请根据讨论内容生成优化代码。_

</details>

state: COMMENTED
author_association: NONE
submitted_at: 2025-05-03T11:22:26Z
user: login: CH3CHO
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-12T10:29:38Z
user: login: lingma-agents[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-05-12T10:29:52Z

Review comments:
diff_hunk: @@ -64,14 +64,17 @@ COPY --from=grafana /usr/share/grafana /usr/share/grafana
 COPY --from=grafana /run.sh /usr/local/bin/grafana.sh
 
 # Install supervisord, logrotate, cron and initialize related folders
-RUN apt-get update --allow-unauthenticated && \
+RUN arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
+  apt-get update --allow-unauthenticated; \
   apt-get install --no-install-recommends -y --allow-unauthenticated \
-  supervisor logrotate cron \
-  && apt-get upgrade -y --allow-unauthenticated \
-  && apt-get clean \
-  && rm -rf /var/log/*log /var/lib/apt/lists/* /var/log/apt/* /var/lib/dpkg/*-old /var/cache/debconf/*-old \
-  && mkdir -p /var/log/higress \
-  && mkdir /data
+    wget supervisor logrotate cron; \
+  apt-get upgrade -y --allow-unauthenticated; \
+  apt-get clean; \
+  rm -rf /var/log/*log /var/lib/apt/lists/* /var/log/apt/* /var/lib/dpkg/*-old /var/cache/debconf/*-old; \
+  wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_$arch -O /usr/local/bin/yq && chmod +x /usr/local/bin/yq; \
path: all-in-one/Dockerfile
user: login: lingma-agents[bot]
body: **架构检测逻辑存在缺陷可能导致yq工具下载失败**

> 🟠 **Critical** | 🐞 **Bugs**

### 📋 问题详情

在RUN指令中通过`dpkg --print-architecture`获取架构时，使用`${arch##*-}`的截取方式可能导致错误架构名称。例如当返回值为`arm64_be`时，截取后会得到`be`，而实际有效架构应为`arm64`。这会导致wget下载错误的yq二进制文件，引发后续命令执行失败。

### 💡 解决方案

修改架构检测逻辑，确保获取正确的架构名称：
```diff
-arch="$(dpkg --print-architecture)"; arch="${arch##*-}"
+arch="$(dpkg --print-architecture | cut -d '-' -f 1)"
```
新架构检测将直接取第一个分隔符前的名称，避免截断错误




---

> 您的反馈对我们很重要！(建议右键在新标签页中打开以下链接)

  [有用意见👍](https://ap-southeast-1.lingma-agents-api.aliyuncs.com/v1/code-platform/sessions/s-d0avnlnetijtsr876kf0/feedback?suggestion_id=sg-9f4fecef35d4&feedback_type=helpful) ｜ [无用意见👎](https://ap-southeast-1.lingma-agents-api.aliyuncs.com/v1/code-platform/sessions/s-d0avnlnetijtsr876kf0/feedback?suggestion_id=sg-9f4fecef35d4&feedback_type=neutral) ｜ [错误意见❌](https://ap-southeast-1.lingma-agents-api.aliyuncs.com/v1/code-platform/sessions/s-d0avnlnetijtsr876kf0/feedback?suggestion_id=sg-9f4fecef35d4&feedback_type=misleading)



<!-- This is an auto-generated comment by LingmaAgent -->


created_at: 2025-05-03T11:22:26Z
author_association: NONE
diff_hunk: @@ -18,4 +18,30 @@ data:
       routeTimeout: 0
     upstream:
       connectionBufferLimits: 10485760
-      idleTimeout: 10
\ No newline at end of file
+      idleTimeout: 10
+  mesh: |-
+    accessLogEncoding: TEXT
+    accessLogFile: /dev/stdout
+    accessLogFormat: |
+      {"ai_log":"%FILTER_STATE(wasm.ai_log:PLAIN)%","authority":"%REQ(X-ENVOY-ORIGINAL-HOST?:AUTHORITY)%","bytes_received":"%BYTES_RECEIVED%","bytes_sent":"%BYTES_SENT%","downstream_local_address":"%DOWNSTREAM_LOCAL_ADDRESS%","downstream_remote_address":"%DOWNSTREAM_REMOTE_ADDRESS%","duration":"%DURATION%","istio_policy_status":"%DYNAMIC_METADATA(istio.mixer:status)%","method":"%REQ(:METHOD)%","path":"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%","protocol":"%PROTOCOL%","request_id":"%REQ(X-REQUEST-ID)%","requested_server_name":"%REQUESTED_SERVER_NAME%","response_code":"%RESPONSE_CODE%","response_flags":"%RESPONSE_FLAGS%","route_name":"%ROUTE_NAME%","start_time":"%START_TIME%","trace_id":"%REQ(X-B3-TRACEID)%","upstream_cluster":"%UPSTREAM_CLUSTER%","upstream_host":"%UPSTREAM_HOST%","upstream_local_address":"%UPSTREAM_LOCAL_ADDRESS%","upstream_service_time":"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%","upstream_transport_failure_reason":"%UPSTREAM_TRANSPORT_FAILURE_REASON%","user_agent":"%REQ(USER-AGENT)%","x_forwarded_for":"%REQ(X-FORWARDED-FOR)%","response_code_details":"%RESPONSE_CODE_DETAILS%"}
+    configSources:
+    - address: xds://127.0.0.1:15051
+    - address: k8s://
+    defaultConfig:
+      disableAlpnH2: true
+      discoveryAddress: 127.0.0.1:15012
+      controlPlaneAuthPolicy: MUTUAL_TLS
+      proxyStatsMatcher:
+        inclusionRegexps:
+        - .*
+    dnsRefreshRate: 200s
+    enableAutoMtls: false
+    enablePrometheusMerge: true
+    ingressControllerMode: "OFF"
+    mseIngressGlobalConfig:
+      enableH3: false
+      enableProxyProtocol: false
+    protocolDetectionTimeout: 100ms
+    rootNamespace: higress-system
+    trustDomain: cluster.local
+  meshNetworks: 'networks: {}'
path: all-in-one/config/configmaps/higress-config.yaml
user: login: lingma-agents[bot]
body: **meshNetworks配置格式不正确可能导致解析失败**

> 🟡 **Major** | 🧹 **Code Smells**

### 📋 问题详情

在`meshNetworks`配置项中，使用单引号包裹的字符串'networks: {}'会被解析为普通字符串而非YAML对象，导致配置无法被正确加载。需要将该配置改为标准的YAML格式以确保配置生效。

### 💡 解决方案

修改为标准YAML格式：
```diff
-meshNetworks: 'networks: {}'
+meshNetworks:
+  networks: {}
```




---

> 您的反馈对我们很重要！(建议右键在新标签页中打开以下链接)

  [有用意见👍](https://ap-southeast-1.lingma-agents-api.aliyuncs.com/v1/code-platform/sessions/s-d0avnlnetijtsr876kf0/feedback?suggestion_id=sg-fe1650a63322&feedback_type=helpful) ｜ [无用意见👎](https://ap-southeast-1.lingma-agents-api.aliyuncs.com/v1/code-platform/sessions/s-d0avnlnetijtsr876kf0/feedback?suggestion_id=sg-fe1650a63322&feedback_type=neutral) ｜ [错误意见❌](https://ap-southeast-1.lingma-agents-api.aliyuncs.com/v1/code-platform/sessions/s-d0avnlnetijtsr876kf0/feedback?suggestion_id=sg-fe1650a63322&feedback_type=misleading)



<!-- This is an auto-generated comment by LingmaAgent -->


created_at: 2025-05-03T11:22:26Z
author_association: NONE
diff_hunk: @@ -64,14 +64,17 @@ COPY --from=grafana /usr/share/grafana /usr/share/grafana
 COPY --from=grafana /run.sh /usr/local/bin/grafana.sh
 
 # Install supervisord, logrotate, cron and initialize related folders
-RUN apt-get update --allow-unauthenticated && \
+RUN arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
+  apt-get update --allow-unauthenticated; \
   apt-get install --no-install-recommends -y --allow-unauthenticated \
-  supervisor logrotate cron \
-  && apt-get upgrade -y --allow-unauthenticated \
-  && apt-get clean \
-  && rm -rf /var/log/*log /var/lib/apt/lists/* /var/log/apt/* /var/lib/dpkg/*-old /var/cache/debconf/*-old \
-  && mkdir -p /var/log/higress \
-  && mkdir /data
+    wget supervisor logrotate cron; \
+  apt-get upgrade -y --allow-unauthenticated; \
+  apt-get clean; \
+  rm -rf /var/log/*log /var/lib/apt/lists/* /var/log/apt/* /var/lib/dpkg/*-old /var/cache/debconf/*-old; \
+  wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_$arch -O /usr/local/bin/yq && chmod +x /usr/local/bin/yq; \
path: all-in-one/Dockerfile
user: login: CH3CHO
body: 这部分代码摘自 https://github.com/alibaba/higress/blob/main/plugins/wasm-go/DockerfileBuilder
created_at: 2025-05-12T10:29:38Z
author_association: COLLABORATOR
diff_hunk: @@ -64,14 +64,17 @@ COPY --from=grafana /usr/share/grafana /usr/share/grafana
 COPY --from=grafana /run.sh /usr/local/bin/grafana.sh
 
 # Install supervisord, logrotate, cron and initialize related folders
-RUN apt-get update --allow-unauthenticated && \
+RUN arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \
+  apt-get update --allow-unauthenticated; \
   apt-get install --no-install-recommends -y --allow-unauthenticated \
-  supervisor logrotate cron \
-  && apt-get upgrade -y --allow-unauthenticated \
-  && apt-get clean \
-  && rm -rf /var/log/*log /var/lib/apt/lists/* /var/log/apt/* /var/lib/dpkg/*-old /var/cache/debconf/*-old \
-  && mkdir -p /var/log/higress \
-  && mkdir /data
+    wget supervisor logrotate cron; \
+  apt-get upgrade -y --allow-unauthenticated; \
+  apt-get clean; \
+  rm -rf /var/log/*log /var/lib/apt/lists/* /var/log/apt/* /var/lib/dpkg/*-old /var/cache/debconf/*-old; \
+  wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_$arch -O /usr/local/bin/yq && chmod +x /usr/local/bin/yq; \
path: all-in-one/Dockerfile
user: login: lingma-agents[bot]
body: 
```suggestion:-0+0
RUN arch="$(dpkg --print-architecture | cut -d '-' -f 1)"; \
  apt-get update --allow-unauthenticated; \
  apt-get install --no-install-recommends -y --allow-unauthenticated \
    wget supervisor logrotate cron; \
  apt-get upgrade -y --allow-unauthenticated; \
  apt-get clean; \
  rm -rf /var/log/*log /var/lib/apt/lists/* /var/log/apt/* /var/lib/dpkg/*-old /var/cache/debconf/*-old; \
  wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_$arch -O /usr/local/bin/yq && chmod +x /usr/local/bin/yq; \
  mkdir -p /var/log/higress; \
  mkdir /data;

```

当前架构检测逻辑存在截断风险：`${arch##*-}`会取最后一个`-`后的子串（如`arm64_be`会被截断为`be`），而`cut -d'-' -f1`可确保始终取第一个字段（如`arm64_be`→`arm64`）。此修改将：

1. 避免因架构名称格式变化导致的下载失败（如`yq_linux_be`不存在）
2. 保持与官方yq发布命名规范的兼容性（查看[release列表](https://github.com/mikefarah/yq/releases/latest)可见只有`arm64`等基础架构名称）
3. 通过管道操作符简化字符串处理逻辑

修改后架构检测逻辑已通过测试用例：
```bash
# 原逻辑缺陷示例
$ echo arm64_be | cut -d'-' -f2
be
$ echo arm64_be | cut -d'-' -f1
arm64
```

建议直接替换现有架构检测命令，其余Docker指令保持不变。此修改可确保在`arm64`、`amd64`等标准架构下正常工作，同时兼容`armhf`等带后缀的特殊架构格式。
created_at: 2025-05-12T10:29:52Z
author_association: NONE

PR comments:
user: login: lingma-agents[bot]
created_at: 2025-05-03T11:20:24Z
body: ### 支持在All-In-One镜像中修改Mesh配置文件

### 变更文件

<table>
<thead>
<tr>
<th align='left'>文件路径</th>
<th align='left'>变更说明</th>
</tr>
</thead>
<tbody>
<tr>
<td>all-in-one/Dockerfile</td>
<td>添加yq工具安装、优化APT操作流程并新增系统目录初始化</td>
</tr>
<tr>
<td>all-in-one/&#8203;config/&#8203;configmaps/&#8203;higress-config.yaml</td>
<td>新增完整的mesh和meshNetworks配置结构定义</td>
</tr>
<tr>
<td>all-in-one/scripts/start-apiserver.sh</td>
<td>实现从higress-config.yaml提取配置文件到指定目录的逻辑</td>
</tr>
</tbody>
</table>

### 时序图

```mermaid
sequenceDiagram
    participant StartScript as start-apiserver.sh
    participant ConfigFile as higress-config.yaml
    participant MeshDir as /etc/istio/config
    StartScript->>+ConfigFile: 使用yq解析配置文件
    ConfigFile-->>-StartScript: 返回mesh/meshNetworks键列表
    loop 遍历配置项
        StartScript->>+ConfigFile: 提取具体配置内容
        StartScript->>+MeshDir: 写入文件到目标路径
    end
    StartScript->>StartScript: 启动API服务
```

---


<details>
<summary><strong>💡 小贴士</strong></summary>

### 与 lingma-agents 交流的方式

**📜 直接回复评论**
直接回复本条评论，lingma-agents 将自动处理您的请求。例如：

- _在当前代码中添加详细的注释说明。_

- _请详细介绍一下你说的 LRU 改造方案，并使用伪代码加以说明。_

**📜 在代码行处标记**
在文件的特定位置创建评论并 @lingma-agents。例如：
- _@Lingma-Agent 分析这个方法的性能瓶颈并提供优化建议。_

- _@Lingma-Agent 对这个方法生成优化代码。_

**📜 在讨论中提问**
在任何讨论中 @lingma-agents 来获取帮助。例如：
- _@Lingma-Agent 请总结上述讨论并提出解决方案。_

- _@Lingma-Agent 请根据讨论内容生成优化代码。_

</details>



<!-- This is an auto-generated comment by LingmaAgent -->


author_association: NONE