Add Waypoint proxy L7 logging docs#2848
Conversation
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
There was a problem hiding this comment.
Pull request overview
Adds Calico Enterprise documentation for enabling and viewing L7 logs collected via Istio Ambient Mode Waypoint proxies (EV-6388), and updates the L7 data types page to list the Waypoint collector alongside existing collectors.
Changes:
- Publishes the previously-draft Waypoint collector page with enable/disable/remove steps and viewing guidance.
- Updates the L7 collector list in
datatypes.mdxto include the new Waypoint collector entry.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx | Adds end-user instructions for enabling Waypoint-based L7 logging and where to view logs. |
| calico-enterprise/observability/elastic/l7/datatypes.mdx | Adds Waypoint to the list of supported L7 collectors. |
| ## Prerequisites | ||
|
|
||
| This page is a placeholder. Content for L7 log collection via Istio Ambient Mode Waypoint proxies is pending. | ||
| - A workload running in an [Istio Service Mesh](compliance/istio/deploy-istio-ambient). |
| Once a workload is set up to be in the service mesh, L7 collection is enabled | ||
| by adding a [waypoint proxy](https://istio.io/latest/docs/ambient/usage/waypoint/), | ||
| and labeling the workload to use it. |
| L7 Ambient Mode logs are viewed in the [UI for L7 | ||
| logs](observability/elastic/l7/configure#view-l7-logs-in-the-web-console) along | ||
| with the other types of L7 logs. |
| They will be labeled with the `collector_type`: `envoy-access-log` and the | ||
| `collector_name`: `waypoint`. |
alexh-tigera
force-pushed
the
add-waypoint-l7-logging
branch
from
9b6bf1b to
b325f0b
Compare
| - **Envoy** — the legacy sidecar/proxy-based collector. See [Enable Envoy collector](configure.mdx). | ||
| - **eBPF** — kernel TCP-layer probes capturing HTTP request/response and TLS handshake metadata. See [Enable eBPF collector](enable-ebpf-collector.mdx). | ||
| {/* TODO: re-add the Waypoint collector bullet when the Waypoint PR lands. */} | ||
| - **Waypoint** — Istio Ambient Mode HTTP logging via the Waypoint Proxy. See [Enable Waypoint collector](enable-waypoint-collector.mdx). |
There was a problem hiding this comment.
nice.. one follow-on though: the table below still tags collector_type/collector_name as eBPF only (ebpf / ebpf-tcp), so someone landing here for the envoy-access-log / waypoint values won't find them. could we add waypoint to the Populated-by column? protocol/protocol_version look eBPF-only too.
| draft: true | ||
| --- | ||
|
|
||
| # Collect L7 logs using the Waypoint collector |
There was a problem hiding this comment.
now that this page exists, overview.mdx still has three placeholders pointing at it: lines 24, 31, 45 all say "re-add ... when the Waypoint PR lands" (the collector bullet, the comparison-table column, the Next steps link). since this is that PR, could we wire those up here too? otherwise the overview page has no path to this one.
| # Collect L7 logs using the Waypoint collector | ||
|
|
||
| Enable the Istio Ambient Mode Waypoint-based L7 collector to capture HTTP/1, HTTP/2, and gRPC traffic routed through a Waypoint proxy. For background on what the collector does and how it compares to other options, see [L7 logs overview](overview.mdx). | ||
| Enable the Istio Ambient Mode Waypoint-based L7 collector to capture HTTP traffic. |
There was a problem hiding this comment.
tiny: waypoint rides Envoy access logs so it also picks up HTTP/2 and gRPC, not just HTTP/1. the old draft on this line said "HTTP/1, HTTP/2, and gRPC".. worth keeping that (and matching the datatypes bullet)?
| ## Before you begin | ||
| Once a workload is set up to be in the service mesh, L7 collection is enabled | ||
| by adding a [waypoint proxy](https://istio.io/latest/docs/ambient/usage/waypoint/), | ||
| and labeling the workload to use it. |
There was a problem hiding this comment.
nit: this says label the workload, but the command below labels the namespace.. match the wording?
| ## Removing the L7 Ambient Mode Collector | ||
|
|
||
| ```bash | ||
| kubectl label namespace <namespace> istio.io/use-waypoint- 2>/dev/null |
There was a problem hiding this comment.
tiny: the 2>/dev/null here also swallows real errors, like a wrong context or missing RBAC. maybe drop it so failures show?
|
|
||
| ```bash | ||
| kubectl label namespace <namespace> istio.io/use-waypoint- 2>/dev/null | ||
| kubectl delete gateway -n <namespace> <waypoint-name> |
There was a problem hiding this comment.
heads up: kubectl delete gateway removes the waypoint proxy itself, so this tears down mesh L7 routing for the namespace, not just log collection. the Disabling section below is the logs-only path, might be worth a line on when to pick which.. also gateway can be ambiguous with istio's networking.istio.io Gateway in an ambient cluster, deploy-istio-ambient qualifies its delete as istio.operator.tigera.io.
| L7 Ambient Mode Collector sidecar can be disabled: | ||
|
|
||
| ```bash | ||
| kubectl patch istio default --type=merge -p '{"spec":{"waypointLogging":"Disabled"}}' |
There was a problem hiding this comment.
small thing: this patches the istio singleton (it has to be named default), so it turns the sidecar off on every istio-waypoint gateway, not just this namespace. worth saying it's cluster-wide so nobody expects it scoped..
Adds docs for Waypoint proxy L7 logging.
Product Version(s):
Issue:
https://tigera.atlassian.net/browse/EV-6388
Link to docs preview:
https://deploy-preview-2848--calico-docs-preview-next.netlify.app/calico-enterprise/next/observability/elastic/l7/enable-waypoint-collector
SME review:
DOCS review:
Additional information:
Merge checklist: