Repository: istio/istio
File: pilot/pkg/features/pilot.go (Go)

Code before:
	WorkloadEntryHealthChecks = env.Register("PILOT_ENABLE_WORKLOAD_ENTRY_HEALTHCHECKS", true,
		"Enables automatic health checks of WorkloadEntries based on the config provided in the associated WorkloadGroup").Get()

	WorkloadEntryCrossCluster = env.Register("PILOT_ENABLE_CROSS_CLUSTER_WORKLOAD_ENTRY", true,
		"If enabled, pilot will read WorkloadEntry from other clusters, selectable by Services in that cluster.").Get()

	WasmRemoteLoadConversion = env.Register("ISTIO_AGENT_ENABLE_WASM_REMOTE_LOAD_CONVERSION", true,
		"If enabled, Istio agent will intercept ECDS resource update, downloads Wasm module, "+
			"and replaces Wasm module remote load with downloaded local module file.").Get()

	PilotJwtPubKeyRefreshInterval = env.Register(
		"PILOT_JWT_PUB_KEY_REFRESH_INTERVAL",
		20*time.Minute,
		"The interval for istiod to fetch the jwks_uri for the jwks public key.",
	).Get()

	EnableNodeUntaintControllers = env.Register(
		"PILOT_ENABLE_NODE_UNTAINT_CONTROLLERS",
		false,
		"If enabled, controller that untaints nodes with cni pods ready will run. This should be enabled if you disabled ambient init containers.").Get()

	ConnectOriginateIdleTimeout = env.Register(
		"PILOT_CONNECT_ORIGINATE_IDLE_TIMEOUT",
		0*time.Second,
		"Idle timeout for HBONE connections to ztunnel. "+
			"Default is 0 (disabled), which uses Envoy's default 1-hour timeout. "+
			"To prevent stale connection reuse on IP churn, set this to half or less of your IP cooldown period. "+
			"Recommended: 15s for AWS VPC CNI (30s IP_COOLDOWN_PERIOD).").Get()

	EnableIPAutoallocate = env.Register(
		"PILOT_ENABLE_IP_AUTOALLOCATE",
		true,
		"If enabled, pilot will start a controller that assigns IP addresses to ServiceEntry which do not have a user-supplied IP. "+
			"This, when combined with DNS capture allows for tcp routing of traffic sent to the ServiceEntry.").Get()

	IPAutoallocateIPv4Prefix = env.Register(
		"PILOT_IP_AUTOALLOCATE_IPV4_PREFIX",
		"240.240.0.0/16",
		"The CIDR range/prefix to use for auto-allocated IPv4 addresses. "+
			"This should be a private range, and not conflict with any other IPs in the cluster.").Get()

	IPAutoallocateIPv6Prefix = env.Register(
		"PILOT_IP_AUTOALLOCATE_IPV6_PREFIX",
		"2001:2::/48",
		"The CIDR range/prefix to use for auto-allocated IPv6 addresses. "+
			"This should be a private range, and not conflict with any other IPs in the cluster.").Get()

	// EnableUnsafeAssertions enables runtime checks to test assertions in our code. This should never be enabled in
	// production; when assertions fail Istio will panic.
	EnableUnsafeAssertions = env.Register(
		"UNSAFE_PILOT_ENABLE_RUNTIME_ASSERTIONS",

Review comment (suggestion):
This is kinda a nit, but what do people think of having the default be 3600, that way we avoid that `if ConnectOriginateIdleTimeout > 0) logic, and people can set the ConnectionOriginateIdleTimeout to 0.

Code after:
	WorkloadEntryHealthChecks = env.Register("PILOT_ENABLE_WORKLOAD_ENTRY_HEALTHCHECKS", true,
		"Enables automatic health checks of WorkloadEntries based on the config provided in the associated WorkloadGroup").Get()

	WorkloadEntryCrossCluster = env.Register("PILOT_ENABLE_CROSS_CLUSTER_WORKLOAD_ENTRY", true,
		"If enabled, pilot will read WorkloadEntry from other clusters, selectable by Services in that cluster.").Get()

	WasmRemoteLoadConversion = env.Register("ISTIO_AGENT_ENABLE_WASM_REMOTE_LOAD_CONVERSION", true,
		"If enabled, Istio agent will intercept ECDS resource update, downloads Wasm module, "+
			"and replaces Wasm module remote load with downloaded local module file.").Get()

	PilotJwtPubKeyRefreshInterval = env.Register(
		"PILOT_JWT_PUB_KEY_REFRESH_INTERVAL",
		20*time.Minute,
		"The interval for istiod to fetch the jwks_uri for the jwks public key.",
	).Get()

	EnableNodeUntaintControllers = env.Register(
		"PILOT_ENABLE_NODE_UNTAINT_CONTROLLERS",
		false,
		"If enabled, controller that untaints nodes with cni pods ready will run. This should be enabled if you disabled ambient init containers.").Get()

	EnableIPAutoallocate = env.Register(
		"PILOT_ENABLE_IP_AUTOALLOCATE",
		true,
		"If enabled, pilot will start a controller that assigns IP addresses to ServiceEntry which do not have a user-supplied IP. "+
			"This, when combined with DNS capture allows for tcp routing of traffic sent to the ServiceEntry.").Get()

	IPAutoallocateIPv4Prefix = env.Register(
		"PILOT_IP_AUTOALLOCATE_IPV4_PREFIX",
		"240.240.0.0/16",
		"The CIDR range/prefix to use for auto-allocated IPv4 addresses. "+
			"This should be a private range, and not conflict with any other IPs in the cluster.").Get()

	IPAutoallocateIPv6Prefix = env.Register(
		"PILOT_IP_AUTOALLOCATE_IPV6_PREFIX",
		"2001:2::/48",
		"The CIDR range/prefix to use for auto-allocated IPv6 addresses. "+
			"This should be a private range, and not conflict with any other IPs in the cluster.").Get()

	// EnableUnsafeAssertions enables runtime checks to test assertions in our code. This should never be enabled in
	// production; when assertions fail Istio will panic.
	EnableUnsafeAssertions = env.Register(
		"UNSAFE_PILOT_ENABLE_RUNTIME_ASSERTIONS",
		false,
		"If enabled, addition runtime asserts will be performed. "+
			"These checks are both expensive and panic on failure. As a result, this should be used only for testing.",
	).Get()

	// EnableUnsafeDeltaTest enables runtime checks to test Delta XDS efficiency. This should never be enabled in
	// production.
	EnableUnsafeDeltaTest = env.Register(