1.15.5-airbnb1

authn: include trust domains from cacertificates in san validator

This CL includes the trust domains from the meshConfig caCertificates
in the SAN validator. Without this change, we need to completely
disable that validation with the PILOT_SKIP_VALIDATE_TRUST_DOMAIN env
var. Backported from: https://github.com/istio/istio/pull/43536.

Change-Id: If5e791b23d0ced48000995ac45ebcbdffd3447d4
Reviewed-on: https://gerrit.musta.ch/c/public/istio/+/4471
Reviewed-by: Ying Zhu <[email protected]>

1.13.5-dev15

capture

1.13.5-dev14

capture

1.13.5-dev13

fix

1.13.5-dev12

more logs

1.13.5-dev11

worker pool

1.13.5-dev9

fix wg

1.13.5-dev10

istio: add metric for debouncing (#40523)

* istio: add metric for debouncing

This CL adds metric for the delay between a first config change
enters deboucing until the final merged push request is pushed into
the push queue. This time plus the proxy convergence time give us
an upper bound on the total delay between a config change and the
change is pushed to proxies.

Also increased the buckets since logging shows that the debounce time
is pretty long (more than 1 minute).

Change-Id: I3220f9c3188824ea6925151ff6837f91aac5a15a
Reviewed-on: https://gerrit.musta.ch/c/public/istio/+/3512
Reviewed-by: Weibo He <[email protected]>
Reviewed-by: Ryan Smick <[email protected]>
Reviewed-by: Jungho Ahn <[email protected]>

* istio: fix debounceTime typo

Change-Id: I9977c597768360cc3dd485dbf21bd9afdb2f5151
Reviewed-on: https://gerrit.musta.ch/c/public/istio/+/3517
Reviewed-by: Weibo He <[email protected]>

* istio: handle debounce time entirely in the debounce() function

To address comments in https://github.com/istio/istio/pull/40523,
we will record after push finishes inside the debounce function.
We can actually remove the DebounceStart field in the push context
as a result.

Also change the buckets as discussed in the PR.

Change-Id: I3b7a7860590e7e5ed4f13282b4398527de089c81
Reviewed-on: https://gerrit.musta.ch/c/public/istio/+/3519
Reviewed-by: Jungho Ahn <[email protected]>
Reviewed-by: Weibo He <[email protected]>

1.13.5-dev8

parallel

1.14.4-airbnb2

istio: avoid copy virtual services for sidecar scope calculation

This CL patches commit e40f57e9f4b510267709db80a26e79265c4e47fd from
upstream istio into air-release-1.14.4 to improve propagation delay.

Original PR:
https://github.com/istio/istio/pull/41101

Change-Id: I7b0da42f591a6da9e20342235ccbf93f2741132b
Reviewed-on: https://gerrit.musta.ch/c/public/istio/+/3822
Reviewed-by: Weibo He <[email protected]>