Repository: istio/istio
File: pilot/pkg/networking/grpcgen/cds.go (Go)

Code before:
	// 2. We cannot reach servers in PERMISSIVE mode; gRPC doesn't allow us to override the alpn to one of Istio's
	// 3. Once we support gRPC servers, we have no good way to detect if a server is implemented with xds.NewGrpcServer and will actually support our config
	// For these reasons, support only explicit tls configuration.
	switch policy.GetTls().GetMode() {
	case networking.ClientTLSSettings_DISABLE:
		// nothing to do
	case networking.ClientTLSSettings_SIMPLE:
		// TODO support this
	case networking.ClientTLSSettings_MUTUAL:
		// TODO support this
	case networking.ClientTLSSettings_ISTIO_MUTUAL:
		tlsCtx := buildUpstreamTLSContext(b.push.ServiceAccounts(b.hostname, b.svc.Attributes.Namespace))
		c.TransportSocket = &core.TransportSocket{
			Name:       transportSocketName,
			ConfigType: &core.TransportSocket_TypedConfig{TypedConfig: protoconv.MessageToAny(tlsCtx)},
		}
	}
}

// TransportSocket proto message has a `name` field which is expected to be set to exactly this value by the
// management server (see grpc/xds/internal/client/xds.go securityConfigFromCluster).
const transportSocketName = "envoy.transport_sockets.tls"

func buildUpstreamTLSContext(sans []string) *tls.UpstreamTlsContext {
	return &tls.UpstreamTlsContext{
		CommonTlsContext: buildCommonTLSContext(sans),
	}
}


Review comment (suggestion):
```suggestion
	// Per gRFC, only max_requests is supported; other fields are not applicable to gRPC.
	// https://github.com/grpc/proposal/blob/master/A32-xds-circuit-breaking.md
```

Code after:
		corexds.ApplyRingHashLoadBalancer(c, lb)
		return
	}

	switch lb.GetSimple() {
	case networking.LoadBalancerSettings_ROUND_ROBIN, networking.LoadBalancerSettings_UNSPECIFIED:
		// Default gRPC behavior (round_robin) so no explicit `lb_policy` needed.
	case networking.LoadBalancerSettings_LEAST_REQUEST:
		c.LbPolicy = cluster.Cluster_LEAST_REQUEST
	default:
		log.Warnf("cannot apply LbPolicy %s to %s", lb.GetSimple(), b.node.ID)
	}
}

func (b *clusterBuilder) applyCircuitBreakers(c *cluster.Cluster, policy *networking.TrafficPolicy) {
	if policy == nil {
		return
	}

	cp := policy.ConnectionPool
	if cp == nil {
		return
	}

	// Per gRFC [A32], only max_requests is supported; other fields are not applicable to gRPC.
	// [A32]: https://github.com/grpc/proposal/blob/master/A32-xds-circuit-breaking.md
	if cp.Http == nil || cp.Http.Http2MaxRequests <= 0 {
		return
	}

	c.CircuitBreakers = &cluster.CircuitBreakers{
		Thresholds: []*cluster.CircuitBreakers_Thresholds{
			{
				MaxRequests: wrapperspb.UInt32(uint32(cp.Http.Http2MaxRequests)),
			},
		},
	}
}

func (b *clusterBuilder) applyTLS(c *cluster.Cluster, policy *networking.TrafficPolicy) {
	// TODO for now, we leave mTLS *off* by default:
	// 1. We don't know if the client uses xds.NewClientCredentials; these settings will be ignored if not
	// 2. We cannot reach servers in PERMISSIVE mode; gRPC doesn't allow us to override the alpn to one of Istio's
	// 3. Once we support gRPC servers, we have no good way to detect if a server is implemented with xds.NewGrpcServer and will actually support our config
	// For these reasons, support only explicit tls configuration.
	switch policy.GetTls().GetMode() {
	case networking.ClientTLSSettings_DISABLE:
		// nothing to do
	case networking.ClientTLSSettings_SIMPLE:
		// TODO support this
	case networking.ClientTLSSettings_MUTUAL: