Repository: istio/istio
File: pilot/pkg/features/pilot.go (Go)

Code before:
		v := env.Register("ENABLE_NATIVE_SIDECARS", "auto",
			"If set to true, use Kubernetes native sidecar container support. Requires SidecarContainer feature flag. "+
				"Set to true to unconditionally enable, false to unconditionally disable. "+
				"Set to auto to automatically enable for supported scenarios").Get()
		switch v {
		case "false":
			return NativeSidecarModeDisabled
		case "true":
			return NativeSidecarModeEnabled
		case "auto":
			return NativeSidecarModeAuto
		default:
			log.Warnf("Unknown value for ENABLE_NATIVE_SIDECARS: %s, defaulting to false", v)
			return NativeSidecarModeDisabled
		}
	}()

	DisableShadowHostSuffix = env.Register("DISABLE_SHADOW_HOST_SUFFIX", true,
		"If disabled, the shadow host suffix will be added to the hostnames of the mirrored requests.").Get()

	DisableTrackRemainingMetrics = env.Register("DISABLE_TRACK_REMAINING_CB_METRICS", true,
		"If disabled, the remaining metrics for circuit breakers will not be tracked.").Get()

	BlockedIpsInJWKURIs = func() sets.String {
		v := env.Register(
			"BLOCKED_IPS_IN_JWKS_URIS",
			"",
			"Comma separated list of IPs that are blocked in JWKS URIs.").Get()
		return sets.New(strings.Split(v, ",")...)
	}()
)

// UnsafeFeaturesEnabled returns true if any unsafe features are enabled.
func UnsafeFeaturesEnabled() bool {
	return EnableUnsafeAdminEndpoints || EnableUnsafeAssertions || EnableUnsafeDeltaTest
}

type NativeSidecarMode int

const (
	NativeSidecarModeEnabled  NativeSidecarMode = iota
	NativeSidecarModeDisabled                   = iota
	NativeSidecarModeAuto                       = iota
)


Review comment (suggestion):
I think jsurt raw IP is going to be too limiting. We probably need CIDR. For example, I may want to block localhost... `127.0.0.1` is NOT sufficient, you need `127.0.0.0/8`

Code after:
	EnableNativeSidecars = func() NativeSidecarMode {
		v := env.Register("ENABLE_NATIVE_SIDECARS", "auto",
			"If set to true, use Kubernetes native sidecar container support. Requires SidecarContainer feature flag. "+
				"Set to true to unconditionally enable, false to unconditionally disable. "+
				"Set to auto to automatically enable for supported scenarios").Get()
		switch v {
		case "false":
			return NativeSidecarModeDisabled
		case "true":
			return NativeSidecarModeEnabled
		case "auto":
			return NativeSidecarModeAuto
		default:
			log.Warnf("Unknown value for ENABLE_NATIVE_SIDECARS: %s, defaulting to false", v)
			return NativeSidecarModeDisabled
		}
	}()

	DisableShadowHostSuffix = env.Register("DISABLE_SHADOW_HOST_SUFFIX", true,
		"If disabled, the shadow host suffix will be added to the hostnames of the mirrored requests.").Get()

	DisableTrackRemainingMetrics = env.Register("DISABLE_TRACK_REMAINING_CB_METRICS", true,
		"If disabled, the remaining metrics for circuit breakers will not be tracked.").Get()

	BlockedCIDRsInJWKURIs = func() []*net.IPNet {
		v := env.Register(
			"BLOCKED_CIDRS_IN_JWKS_URIS",
			"",
			"Comma separated list of CIDR ranges that are blocked in JWKS URIs (e.g., 10.0.0.0/8,192.168.1.0/24).").Get()
		if v == "" {
			return nil
		}
		cidrs := strings.Split(v, ",")
		var blockedCIDRs []*net.IPNet
		for _, cidr := range cidrs {
			cidr = strings.TrimSpace(cidr)
			if cidr == "" {
				continue
			}
			_, ipNet, err := net.ParseCIDR(cidr)
			if err != nil {
				log.Warnf("Failed to parse CIDR range %q: %v", cidr, err)
				continue
			}
			blockedCIDRs = append(blockedCIDRs, ipNet)
		}
		return blockedCIDRs
	}()
)

// UnsafeFeaturesEnabled returns true if any unsafe features are enabled.