Replace misc. occurrences of whitelist/blacklist (istio#25479)

As part of istio#25381

Author: tbarrella

Diff for: codecov.threshold

@@ -2,13 +2,13 @@
 # unexpected drop of code coverage. And this supplements the packages specified
 # in codecov.skip.
 #
-# This is useful to temporarily whitelist the packages that have either non
+# This is useful to temporarily allowlist the packages that have either non
 # deterministic code path. (E.g. test may retry on failure. Some paths may not
 # be exercised when there is no error, but are hit when there is an error
 # before the test retries.)
 #
 # Ideally this file should contain only istio.io=x as the default. All other
-# whitelisted packages or files should eventually be removed when the tests
+# allowlisted packages or files should eventually be removed when the tests
 # are made deteministic.
 #
 # Format:

Diff for: manifests/charts/global.yaml

@@ -95,7 +95,7 @@ global:
     # The number of successive failed probes before indicating readiness failure.
     readinessFailureThreshold: 30
 
-    # istio egress capture whitelist
+    # istio egress capture allowlist
     # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
     # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
     # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
@@ -104,7 +104,7 @@ global:
     excludeIPRanges: ""
     excludeOutboundPorts: ""
 
-    # istio ingress capture whitelist
+    # istio ingress capture allowlist
     # examples:
     #     Redirect only selected ports:            --includeInboundPorts="80,8080"
     excludeInboundPorts: ""

Diff for: manifests/charts/istio-control/istio-discovery/values.yaml

@@ -410,12 +410,12 @@ global:
     # If set, newly injected sidecars will have core dumps enabled.
     enableCoreDump: false
 
-    # istio ingress capture whitelist
+    # istio ingress capture allowlist
     # examples:
     #     Redirect only selected ports:            --includeInboundPorts="80,8080"
     excludeInboundPorts: ""
 
-    # istio egress capture whitelist
+    # istio egress capture allowlist
     # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
     # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
     # would only capture egress traffic on those two IP Ranges, all other outbound traffic would

Diff for: operator/cmd/mesh/testdata/manifest-generate/data-snapshot/charts/global.yaml

@@ -97,7 +97,7 @@ global:
     # The number of successive failed probes before indicating readiness failure.
     readinessFailureThreshold: 30
 
-    # istio egress capture whitelist
+    # istio egress capture allowlist
     # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
     # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
     # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
@@ -106,7 +106,7 @@ global:
     excludeIPRanges: ""
     excludeOutboundPorts: ""
 
-    # istio ingress capture whitelist
+    # istio ingress capture allowlist
     # examples:
     #     Redirect only selected ports:            --includeInboundPorts="80,8080"
     excludeInboundPorts: ""

Diff for: operator/codecov.threshold

@@ -2,13 +2,13 @@
 # unexpected drop of code coverage. And this supplements the packages specified
 # in codecov.skip.
 #
-# This is useful to temporarily whitelist the packages that have either non
+# This is useful to temporarily allowlist the packages that have either non
 # deterministic code path. (E.g. test may retry on failure. Some paths may not
 # be exercised when there is no error, but are hit when there is an error
 # before the test retries.)
 #
 # Ideally this file should contain only istio.io=x as the default. All other
-# whitelisted packages or files should eventually be removed when the tests
+# allowlisted packages or files should eventually be removed when the tests
 # are made deteministic.
 #
 # Format:
@@ -18,4 +18,4 @@
 # or go file.
 
 # Istio wide default
-istio.io=5
+istio.io=5

Diff for: tests/binary/binaries_test.go

@@ -80,7 +80,7 @@ func TestVersion(t *testing.T) {
 
 var (
 	// If this flag is present, it means "testing" was imported by code that is built by the binary
-	blacklistedFlags = []string{
+	denylistedFlags = []string{
 		"--test.memprofilerate",
 	}
 )
@@ -104,8 +104,8 @@ func TestFlags(t *testing.T) {
 				t.Fatalf("--help failed with error: %v. Output: %v", err, string(out))
 			}
 
-			for _, blacklist := range blacklistedFlags {
-				if strings.Contains(string(out), blacklist) {
+			for _, denylist := range denylistedFlags {
+				if strings.Contains(string(out), denylist) {
 					t.Fatalf("binary contains unexpected flags: %v", string(out))
 				}
 			}

Diff for: tests/integration/security/authorization_test.go

@@ -396,15 +396,15 @@ func TestAuthorization_NegativeMatch(t *testing.T) {
 				// Test the policy with overlapped `paths` and `not_paths` on b.
 				// a and x should have the same results:
 				// - path with prefix `/prefix` should be denied explicitly.
-				// - path `/prefix/whitelist` should be excluded from the deny.
+				// - path `/prefix/allowlist` should be excluded from the deny.
 				// - path `/allow` should be allowed implicitly.
 				newTestCase(a, b, "/prefix", false),
 				newTestCase(a, b, "/prefix/other", false),
-				newTestCase(a, b, "/prefix/whitelist", true),
+				newTestCase(a, b, "/prefix/allowlist", true),
 				newTestCase(a, b, "/allow", true),
 				newTestCase(x, b, "/prefix", false),
 				newTestCase(x, b, "/prefix/other", false),
-				newTestCase(x, b, "/prefix/whitelist", true),
+				newTestCase(x, b, "/prefix/allowlist", true),
 				newTestCase(x, b, "/allow", true),
 
 				// Test the policy that denies other namespace on c.

Diff for: tests/integration/security/testdata/authz/v1beta1-negative-match.yaml.tmpl

@@ -1,4 +1,4 @@
-# The following policy denies access to path with prefix "/prefix" except "/prefix/whitelist" to workload b
+# The following policy denies access to path with prefix "/prefix" except "/prefix/allowlist" to workload b
 
 apiVersion: "security.istio.io/v1beta1"
 kind: AuthorizationPolicy
@@ -14,7 +14,7 @@ spec:
   - to:
     - operation:
         paths: ["/prefix*"]
-        notPaths: ["/prefix/whitelist"]
+        notPaths: ["/prefix/allowlist"]
 ---
 
 # The following policy denies access from other namespaces

Diff for: tools/istio-iptables/pkg/cmd/root.go

@@ -105,7 +105,7 @@ func constructConfig() *config.Config {
 		RunValidation:           viper.GetBool(constants.RunValidation),
 	}
 
-	// TODO: Make this more configurable, maybe with a whitelist of users to be captured for output instead of a blacklist.
+	// TODO: Make this more configurable, maybe with an allowlist of users to be captured for output instead of a denylist.
 	if cfg.ProxyUID == "" {
 		usr, err := user.Lookup(envoyUserVar.Get())
 		var userID string