EV-6388: L7 logging through Istio Waypoint Proxy by alexh-tigera · Pull Request #4769 · tigera/operator

alexh-tigera · 2026-05-01T17:55:51Z

Adds L7 logging for every Gateway that uses the istio-waypoint GatewayClass. The istio controller now creates five static resources in the Istio root namespace (calico-system) and Istio's deployment controller applies the class-default ones to all waypoints cluster-wide:

tigera-waypoint-l7-defaults ConfigMap injects the l7-collector sidecar (with --mode=waypoint on the existing ComponentL7Collector image) and the shared emptyDir + Felix CSI volumes into every waypoint pod.
tigera-waypoint-l7-als EnvoyFilter enables gRPC ALS on main_internal.
tigera-waypoint-l7-srcport EnvoyFilter captures the Forwarded header on connect_terminate and propagates the client IP as filter state.
tigera-waypoint-l7-envoyfilters Role and RoleBinding grant the operator ServiceAccount namespaced create/update/delete on EnvoyFilters in calico-system. The operator self-renders this writer grant (via escalate/bind) so the cluster-wide operator ClusterRole keeps only get/list/watch on EnvoyFilters.

A small typed EnvoyFilter struct is introduced so the component handler (which casts to metav1.ObjectMetaAccessor) can manage the resources without taking on the networking.istio.io client-go dependency.

Description

Release Note

Add L7 log collection for Istio ambient mode waypoint proxies.

For PR author

Tests for change.
If changing pkg/apis/, run make gen-files
If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

Milestone set according to targeted release.
Appropriate labels:
- kind/bug if this is a bugfix.
- kind/enhancement if this is a a new feature.
- enterprise if this PR applies to Calico Enterprise only.

Copilot

Pull request overview

Adds cluster-wide L7 access logging for Istio waypoint proxies by rendering class-level defaults (ConfigMap overlay) plus mesh-wide EnvoyFilters in the Istio root namespace, and introduces a new spec.waypointLogging toggle on the Istio CR (defaulting to enabled). The change also centralizes policySyncPathPrefix coordination logic between the Istio and ApplicationLayer controllers.

Changes:

Render and manage waypoint L7 logging resources (defaults ConfigMap + 2 EnvoyFilters) and add a minimal typed EnvoyFilter wrapper to avoid the Istio client-go dependency.
Add Istio.spec.waypointLogging (Enabled/Disabled) and wire it into rendering and image resolution.
Coordinate Felix policySyncPathPrefix ownership between Istio and ApplicationLayer controllers via shared utility predicates/helpers, and remove the waypoint pull-secret replication controller.

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pkg/render/istio/l7waypoint.go	New renderer for waypoint defaults ConfigMap + EnvoyFilters enabling ALS and forwarded-header propagation.
pkg/render/istio/l7waypoint_test.go	Unit tests validating rendered overlay YAML and EnvoyFilter specs.
pkg/render/istio/istio.go	Wires waypoint logging objects into Istio component rendering and resolves the l7-collector image.
pkg/render/istio/istio_test.go	Tests for Enterprise-only waypoint L7 resources and WaypointLogging enable/disable behavior.
pkg/render/istio/envoyfilter.go	Adds lightweight typed EnvoyFilter + scheme registration helper.
pkg/imports/crds/operator/operator.tigera.io_istios.yaml	CRD schema update adding `spec.waypointLogging`.
api/v1/istio_types.go	Adds `WaypointLogging` field to `IstioSpec`.
api/v1/zz_generated.deepcopy.go	Deepcopy support for the new `WaypointLogging` field.
pkg/controller/utils/utils.go	Adds `GetIstio()` helper to fetch the Istio CR (NotFound tolerated).
pkg/controller/utils/policy_sync.go	New shared policySyncPathPrefix coordination helpers/predicates.
pkg/controller/utils/policy_sync_test.go	Unit tests for the new policy-sync coordination helpers.
pkg/controller/istio/istio_controller.go	Registers EnvoyFilter + autoscaling/v2 into scheme; adds policySyncPathPrefix reconciliation; removes waypoint secrets controller hookup.
pkg/controller/istio/istio_controller_test.go	Adds tests covering policySyncPathPrefix coordination and updates scheme registration.
pkg/controller/applicationlayer/applicationlayer_controller.go	Updates Felix policySyncPathPrefix logic to coordinate with Istio state.
pkg/controller/applicationlayer/applicationlayer_controller_test.go	Updates/extends tests for policySyncPathPrefix behavior with Istio present.
internal/controller/istio_controller.go	Updates RBAC markers (gateway watch removed).
pkg/controller/istio/waypoint/waypoint_suite_test.go	Removed (waypoint secrets controller test suite).
pkg/controller/istio/waypoint/waypoint_secrets_controller.go	Removed (waypoint pull-secret replication controller).
pkg/controller/istio/waypoint/waypoint_secrets_controller_test.go	Removed (tests for waypoint pull-secret replication controller).

Files not reviewed (1)

api/v1/zz_generated.deepcopy.go: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

api/v1/zz_generated.deepcopy.go: Language not supported

Copilot

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

api/v1/zz_generated.deepcopy.go: Language not supported

Copilot

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

api/v1/zz_generated.deepcopy.go: Language not supported

Copilot

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

api/v1/zz_generated.deepcopy.go: Language not supported

Copilot

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

api/v1/zz_generated.deepcopy.go: Language not supported

Adds L7 logging for Gateways using the istio-waypoint GatewayClass. The istio controller now creates three static resources in the Istio root namespace (calico-system) and Istio's deployment controller applies them as class-level defaults to all waypoints cluster-wide: - tigera-waypoint-l7-defaults ConfigMap injects the l7-collector sidecar (with --mode=waypoint on the existing ComponentL7Collector image) and the shared emptyDir + Felix CSI volumes into every waypoint pod. - tigera-waypoint-l7-als EnvoyFilter enables gRPC ALS on main_internal. - tigera-waypoint-l7-srcport EnvoyFilter captures the Forwarded header on connect_terminate and propagates the client IP as filter state. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The operator's chart ClusterRole now grants only get/list/watch on envoyfilters (the controller-runtime cache lists/watches them cluster-wide). Render a namespace-scoped Role + RoleBinding in the Istio system namespace granting the operator create/update/delete, so its EnvoyFilter mutations are confined to the one namespace it manages them in. The grant is rendered operator-side (not in the Helm chart) because that namespace does not exist at chart-install time; creating it relies on the operator's existing escalate/bind RBAC verbs. Ordered before the EnvoyFilters so the write grant exists first. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

IstioRequiresPolicySync returned true for any Enterprise install with an Istio CR, so policySyncPathPrefix (and Felix's nodeagent socket) stayed set even when Istio.Spec.WaypointLogging was explicitly Disabled and the renderer omitted the waypoint l7-collector and EnvoyFilters. The predicate no longer matched the renderer gate. Add a nil-safe (*Istio).WaypointLoggingEnabled helper (default true when the field is unset) and use it from both IstioRequiresPolicySync and the renderer's waypointLoggingEnabled, so the policy-sync predicate and the render gate share one source of truth. Adds unit cases for the unset, Enabled, and Disabled paths. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

L7WaypointObjects renders five resources (the l7-collector defaults ConfigMap, the EnvoyFilter-writer Role and RoleBinding, and two EnvoyFilters), but the comment in Objects still said three. Update it so future maintainers reasoning about what gets created and deleted are not misled. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DesiredPolicySyncPathPrefix cleared policySyncPathPrefix when it held the operator-managed default and neither the applicationlayer nor istio controllers needed it. That field is shared: egressgateway and Gateway API also set the same default and never clear it, so an applicationlayer/istio cleanup reconcile could wipe a default another controller still relied on and break it. Restore the prior "leave as is" contract: preserve any non-empty existing value (custom override or the shared default) and only set the default into an empty field, never clearing a value this path may not own. Update the applicationlayer and istio controller tests, which had been changed to expect the regressive clearing, to assert preservation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

configureIstioDSCPMark wrote the DSCP annotation into fc.Annotations without checking for a nil map. configureIstioAmbientMode initializes the map only when it writes the mode annotation and can return without doing so, so the DSCP write could panic on a nil map during reconciliation. Initialize the map before writing, mirroring the ambient-mode path, and add a regression test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The waypoint L7 test still described "three" resources in two comments, but the renderer manages five (defaults ConfigMap, EnvoyFilter-writer Role and RoleBinding, and two EnvoyFilters). Update both comments so they do not mislead when extending the test or the feature surface area. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

rene-dekker · 2026-06-12T21:47:57Z

-)
+// DefaultPolicySyncPrefix is the operator-managed value for
+// FelixConfiguration.policySyncPathPrefix.
+const DefaultPolicySyncPrefix = utils.DefaultPolicySyncPrefix


This is declared and exported in 2 different files.

Removed it from pkg/controller/applicationlayer/applicationlayer_controller.go in b73dd61

rene-dekker · 2026-06-12T21:59:58Z

 func Add(mgr manager.Manager, opts options.ControllerOptions) error {
+	// Register the typed EnvoyFilter so the L7 waypoint resources rendered by
+	// pkg/render/istio can be created/updated via the controller-runtime client.
+	istio.AddEnvoyFilterToScheme(mgr.GetScheme())


What is the reason that we do this differently from other resources? Others are declared in pkg/apis/register.go. Can we add these here too?

No reason, moved it to pkg/apis/register.go in faedec2.

rene-dekker · 2026-06-12T22:06:11Z

+		if c.waypointLoggingEnabled() {
+			objs = append(objs, L7WaypointObjects(c.cfg.IstioNamespace, c.L7CollectorImage)...)
+		} else {
+			toDelete = append(toDelete, L7WaypointObjects(c.cfg.IstioNamespace, "")...)


Should the list be reversed seeing as the order matters according to l7waypoint.go?

Yes, you're right. I never noticed it went into a bad state if you had an active waypoint proxy, then disabled it.

Fixed in 7b5bf75.

The applicationlayer controller re-exported DefaultPolicySyncPrefix as an alias of utils.DefaultPolicySyncPrefix, but nothing referenced the alias. Remove it so utils.DefaultPolicySyncPrefix stays the single source of truth. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Move EnvoyFilter scheme registration out of the istio controller's Add and into pkg/apis, alongside the other third-party types. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Deleting the Role/RoleBinding before the EnvoyFilters removes permission to delete the EnvoyFilters. Reverse the delete slice so the EnvoyFilters are removed first. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- istio_test.go: three -> five resources - Register autoscaling/v2 centrally via pkg/apis AddToSchemes instead of a local AddToScheme call in the istio controller's Add (mirrors the EnvoyFilter scheme-registration change). - Remove the dead exported EnvoyFilterGVK() helper and its test; the render code builds the GVK inline and nothing else referenced it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

marvin-tigera added this to the v1.43.0 milestone May 1, 2026

marvin-tigera added docs-pr-required release-note-required labels May 1, 2026

alexh-tigera force-pushed the EV-6388-capture-l7-logs-through-waypoint-proxy branch from 96823e4 to 7514ec0 Compare May 1, 2026 20:16

alexh-tigera force-pushed the EV-6388-capture-l7-logs-through-waypoint-proxy branch from 739a32a to 17c75c9 Compare May 29, 2026 16:01

alexh-tigera requested a review from Copilot June 1, 2026 21:27

Copilot started reviewing on behalf of alexh-tigera June 1, 2026 21:28 View session

alexh-tigera marked this pull request as ready for review June 1, 2026 21:30

alexh-tigera requested a review from a team as a code owner June 1, 2026 21:30

Copilot AI reviewed Jun 1, 2026

View reviewed changes

Comment thread pkg/controller/utils/policy_sync.go

Comment thread pkg/controller/utils/policy_sync_test.go

Comment thread internal/controller/istio_controller.go

Comment thread pkg/controller/istio/istio_controller.go Outdated

alexh-tigera force-pushed the EV-6388-capture-l7-logs-through-waypoint-proxy branch from 0c571d7 to 654ba42 Compare June 2, 2026 16:37

alexh-tigera requested a review from Copilot June 2, 2026 16:52

Copilot started reviewing on behalf of alexh-tigera June 2, 2026 16:52 View session