Merge pull request istio-ecosystem#11 from openshift-service-mesh-bot…

…/none-main-merge_upstream_main-38a843ce Automator: merge upstream changes to openshift-service-mesh/sail-operator@main
FilipB · Apr 19, 2024 · e6a63c6 · e6a63c6
2 parents 3260bf8 + 5c546b3
commit e6a63c6
Show file tree

Hide file tree

Showing 38 changed files with 70 additions and 120 deletions.
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
@@ -1,6 +1,6 @@
 {
   "name": "istio build-tools",
-  "image": "gcr.io/istio-testing/build-tools:master-9460c357bef20580043ff07bef9a3a489431b380",
+  "image": "gcr.io/istio-testing/build-tools:master-f24be7b713480aab44d862ac839ead0b5324d593",
   "privileged": true,
   "remoteEnv": {
     "USE_GKE_GCLOUD_AUTH_PLUGIN": "True",

diff --git a/bundle/manifests/sailoperator.clusterserviceversion.yaml b/bundle/manifests/sailoperator.clusterserviceversion.yaml
@@ -34,7 +34,7 @@ metadata:
     capabilities: Seamless Upgrades
     categories: OpenShift Optional, Integration & Delivery, Networking, Security
     containerImage: quay.io/maistra-dev/sail-operator:3.0-latest
-    createdAt: "2024-04-17T23:16:21Z"
+    createdAt: "2024-04-18T23:02:03Z"
     description: Experimental operator for installing Istio service mesh
     features.operators.openshift.io/cnf: "false"
     features.operators.openshift.io/cni: "true"
@@ -288,7 +288,7 @@ spec:
     This version of the operator supports the following Istio versions:
 
     - v1.21.0
-    - latest (b794e4a4)
+    - latest (bf9fd612)
 
     [See this page](https://github.com/istio-ecosystem/sail-operator/blob/pre-main/bundle/README.md) for instructions on how to use it.
   displayName: Sail Operator

diff --git a/chart/values.yaml b/chart/values.yaml
@@ -17,7 +17,7 @@ csv:
     This version of the operator supports the following Istio versions:
 
     - v1.21.0
-    - latest (b794e4a4)
+    - latest (bf9fd612)
 
     [See this page](https://github.com/istio-ecosystem/sail-operator/blob/pre-main/bundle/README.md) for instructions on how to use it.
   support: Community based

diff --git a/common/.commonfiles.sha b/common/.commonfiles.sha
@@ -1 +1 @@
-71e0b2154c35851147dd86d1dd71a0fbdcb54662
+9088296b1343d1a3b2e3f822f6d7942ff2de7a15
diff --git a/common/scripts/setup_env.sh b/common/scripts/setup_env.sh
@@ -75,7 +75,7 @@ fi
 TOOLS_REGISTRY_PROVIDER=${TOOLS_REGISTRY_PROVIDER:-gcr.io}
 PROJECT_ID=${PROJECT_ID:-istio-testing}
 if [[ "${IMAGE_VERSION:-}" == "" ]]; then
-  IMAGE_VERSION=master-9460c357bef20580043ff07bef9a3a489431b380
+  IMAGE_VERSION=master-f24be7b713480aab44d862ac839ead0b5324d593
 fi
 if [[ "${IMAGE_NAME:-}" == "" ]]; then
   IMAGE_NAME=build-tools

diff --git a/resources/latest/charts/base/Chart.yaml b/resources/latest/charts/base/Chart.yaml
@@ -1,10 +1,10 @@
 apiVersion: v1
-appVersion: 1.22-alpha.b794e4a43a9bcd4eaa6067439f30a146cb798455
+appVersion: 1.22-alpha.bf9fd6127f5bebf2f0024362f3c687849f390749
 description: Helm chart for deploying Istio cluster resources and CRDs
 icon: https://istio.io/latest/favicons/android-192x192.png
 keywords:
 - istio
 name: base
 sources:
 - https://github.com/istio/istio
-version: 1.22-alpha.b794e4a43a9bcd4eaa6067439f30a146cb798455
+version: 1.22-alpha.bf9fd6127f5bebf2f0024362f3c687849f390749
diff --git a/resources/latest/charts/base/files/profile-ambient.yaml b/resources/latest/charts/base/files/profile-ambient.yaml
@@ -11,16 +11,9 @@ global:
   variant: distroless
 pilot:
   env:
-    # Setup more secure default that is off in 'default' only for backwards compatibility
-    VERIFY_CERTIFICATE_AT_CLIENT: "true"
-    ENABLE_AUTO_SNI: "true"
-
-    PILOT_ENABLE_HBONE: "true"
+    PILOT_ENABLE_AMBIENT: "true"
     CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
-    PILOT_ENABLE_AMBIENT_CONTROLLERS: "true"
-    PILOT_ENABLE_AMBIENT_WAYPOINTS: "true"
 cni:
-  logLevel: info
   ambient:
     enabled: true
 

diff --git a/resources/latest/charts/base/files/profile-openshift-ambient.yaml b/resources/latest/charts/base/files/profile-openshift-ambient.yaml
@@ -24,14 +24,11 @@ pilot:
     provider: "multus"
   variant: distroless
   env:
-    # Setup more secure default that is off in 'default' only for backwards compatibility
-    VERIFY_CERTIFICATE_AT_CLIENT: "true"
-    ENABLE_AUTO_SNI: "true"
-
-    PILOT_ENABLE_HBONE: "true"
+    PILOT_ENABLE_AMBIENT: "true"
+    # Allow sidecars/ingress to send/receive HBONE. This is required for interop.
+    PILOT_ENABLE_SENDING_HBONE: "true"
+    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
     CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
-    PILOT_ENABLE_AMBIENT_CONTROLLERS: "true"
-    PILOT_ENABLE_AMBIENT_WAYPOINTS: "true"
 variant: distroless
 seLinuxOptions:
   type: spc_t
diff --git a/resources/latest/charts/base/templates/default.yaml b/resources/latest/charts/base/templates/default.yaml
@@ -7,7 +7,7 @@ metadata:
     app: istiod
     release: {{ .Release.Name }}
     istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision }}
+    istio.io/rev: {{ .Values.defaultRevision | quote }}
 webhooks:
   - name: validation.istio.io
     clientConfig:

diff --git a/resources/latest/charts/cni/Chart.yaml b/resources/latest/charts/cni/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v1
-appVersion: 1.22-alpha.b794e4a43a9bcd4eaa6067439f30a146cb798455
+appVersion: 1.22-alpha.bf9fd6127f5bebf2f0024362f3c687849f390749
 description: Helm chart for istio-cni components
 icon: https://istio.io/latest/favicons/android-192x192.png
 keywords:
@@ -8,4 +8,4 @@ keywords:
 name: cni
 sources:
 - https://github.com/istio/istio/tree/master/cni
-version: 1.22-alpha.b794e4a43a9bcd4eaa6067439f30a146cb798455
+version: 1.22-alpha.bf9fd6127f5bebf2f0024362f3c687849f390749
diff --git a/resources/latest/charts/cni/files/profile-ambient.yaml b/resources/latest/charts/cni/files/profile-ambient.yaml
@@ -11,16 +11,9 @@ global:
   variant: distroless
 pilot:
   env:
-    # Setup more secure default that is off in 'default' only for backwards compatibility
-    VERIFY_CERTIFICATE_AT_CLIENT: "true"
-    ENABLE_AUTO_SNI: "true"
-
-    PILOT_ENABLE_HBONE: "true"
+    PILOT_ENABLE_AMBIENT: "true"
     CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
-    PILOT_ENABLE_AMBIENT_CONTROLLERS: "true"
-    PILOT_ENABLE_AMBIENT_WAYPOINTS: "true"
 cni:
-  logLevel: info
   ambient:
     enabled: true
 

diff --git a/resources/latest/charts/cni/files/profile-openshift-ambient.yaml b/resources/latest/charts/cni/files/profile-openshift-ambient.yaml
@@ -24,14 +24,11 @@ pilot:
     provider: "multus"
   variant: distroless
   env:
-    # Setup more secure default that is off in 'default' only for backwards compatibility
-    VERIFY_CERTIFICATE_AT_CLIENT: "true"
-    ENABLE_AUTO_SNI: "true"
-
-    PILOT_ENABLE_HBONE: "true"
+    PILOT_ENABLE_AMBIENT: "true"
+    # Allow sidecars/ingress to send/receive HBONE. This is required for interop.
+    PILOT_ENABLE_SENDING_HBONE: "true"
+    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
     CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
-    PILOT_ENABLE_AMBIENT_CONTROLLERS: "true"
-    PILOT_ENABLE_AMBIENT_WAYPOINTS: "true"
 variant: distroless
 seLinuxOptions:
   type: spc_t
diff --git a/resources/latest/charts/cni/values.yaml b/resources/latest/charts/cni/values.yaml
@@ -110,7 +110,7 @@ defaults:
     hub: gcr.io/istio-testing
 
     # Default tag for Istio images.
-    tag: 1.22-alpha.b794e4a43a9bcd4eaa6067439f30a146cb798455
+    tag: 1.22-alpha.bf9fd6127f5bebf2f0024362f3c687849f390749
 
     # Variant of the image to use.
     # Currently supported are: [debug, distroless]

diff --git a/resources/latest/charts/gateway/Chart.yaml b/resources/latest/charts/gateway/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 1.22-alpha.b794e4a43a9bcd4eaa6067439f30a146cb798455
+appVersion: 1.22-alpha.bf9fd6127f5bebf2f0024362f3c687849f390749
 description: Helm chart for deploying Istio gateways
 icon: https://istio.io/latest/favicons/android-192x192.png
 keywords:
@@ -9,4 +9,4 @@ name: gateway
 sources:
 - https://github.com/istio/istio
 type: application
-version: 1.22-alpha.b794e4a43a9bcd4eaa6067439f30a146cb798455
+version: 1.22-alpha.bf9fd6127f5bebf2f0024362f3c687849f390749
diff --git a/resources/latest/charts/gateway/files/profile-ambient.yaml b/resources/latest/charts/gateway/files/profile-ambient.yaml
@@ -11,16 +11,9 @@ global:
   variant: distroless
 pilot:
   env:
-    # Setup more secure default that is off in 'default' only for backwards compatibility
-    VERIFY_CERTIFICATE_AT_CLIENT: "true"
-    ENABLE_AUTO_SNI: "true"
-
-    PILOT_ENABLE_HBONE: "true"
+    PILOT_ENABLE_AMBIENT: "true"
     CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
-    PILOT_ENABLE_AMBIENT_CONTROLLERS: "true"
-    PILOT_ENABLE_AMBIENT_WAYPOINTS: "true"
 cni:
-  logLevel: info
   ambient:
     enabled: true
 

diff --git a/resources/latest/charts/gateway/files/profile-openshift-ambient.yaml b/resources/latest/charts/gateway/files/profile-openshift-ambient.yaml
@@ -24,14 +24,11 @@ pilot:
     provider: "multus"
   variant: distroless
   env:
-    # Setup more secure default that is off in 'default' only for backwards compatibility
-    VERIFY_CERTIFICATE_AT_CLIENT: "true"
-    ENABLE_AUTO_SNI: "true"
-
-    PILOT_ENABLE_HBONE: "true"
+    PILOT_ENABLE_AMBIENT: "true"
+    # Allow sidecars/ingress to send/receive HBONE. This is required for interop.
+    PILOT_ENABLE_SENDING_HBONE: "true"
+    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
     CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
-    PILOT_ENABLE_AMBIENT_CONTROLLERS: "true"
-    PILOT_ENABLE_AMBIENT_WAYPOINTS: "true"
 variant: distroless
 seLinuxOptions:
   type: spc_t
diff --git a/resources/latest/charts/gateway/templates/deployment.yaml b/resources/latest/charts/gateway/templates/deployment.yaml
@@ -25,7 +25,7 @@ spec:
       labels:
         sidecar.istio.io/inject: "true"
         {{- with .Values.revision }}
-        istio.io/rev: {{ . }}
+        istio.io/rev: {{ . | quote }}
         {{- end }}
         {{- include "gateway.podLabels" . | nindent 8 }}
     spec:

diff --git a/resources/latest/charts/istiod/Chart.yaml b/resources/latest/charts/istiod/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v1
-appVersion: 1.22-alpha.b794e4a43a9bcd4eaa6067439f30a146cb798455
+appVersion: 1.22-alpha.bf9fd6127f5bebf2f0024362f3c687849f390749
 description: Helm chart for istio control plane
 icon: https://istio.io/latest/favicons/android-192x192.png
 keywords:
@@ -9,4 +9,4 @@ keywords:
 name: istiod
 sources:
 - https://github.com/istio/istio
-version: 1.22-alpha.b794e4a43a9bcd4eaa6067439f30a146cb798455
+version: 1.22-alpha.bf9fd6127f5bebf2f0024362f3c687849f390749
diff --git a/resources/latest/charts/istiod/files/grpc-agent.yaml b/resources/latest/charts/istiod/files/grpc-agent.yaml
@@ -32,7 +32,7 @@ metadata:
     service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
     service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
   annotations: {
-    istio.io/rev: {{ .Revision | default "default" }},
+    istio.io/rev: {{ .Revision | default "default" | quote }},
     {{- if ge (len $containers) 1 }}
     {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
     kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",

diff --git a/resources/latest/charts/istiod/files/profile-ambient.yaml b/resources/latest/charts/istiod/files/profile-ambient.yaml
@@ -11,16 +11,9 @@ global:
   variant: distroless
 pilot:
   env:
-    # Setup more secure default that is off in 'default' only for backwards compatibility
-    VERIFY_CERTIFICATE_AT_CLIENT: "true"
-    ENABLE_AUTO_SNI: "true"
-
-    PILOT_ENABLE_HBONE: "true"
+    PILOT_ENABLE_AMBIENT: "true"
     CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
-    PILOT_ENABLE_AMBIENT_CONTROLLERS: "true"
-    PILOT_ENABLE_AMBIENT_WAYPOINTS: "true"
 cni:
-  logLevel: info
   ambient:
     enabled: true
 

diff --git a/resources/latest/charts/istiod/files/profile-openshift-ambient.yaml b/resources/latest/charts/istiod/files/profile-openshift-ambient.yaml
@@ -24,14 +24,11 @@ pilot:
     provider: "multus"
   variant: distroless
   env:
-    # Setup more secure default that is off in 'default' only for backwards compatibility
-    VERIFY_CERTIFICATE_AT_CLIENT: "true"
-    ENABLE_AUTO_SNI: "true"
-
-    PILOT_ENABLE_HBONE: "true"
+    PILOT_ENABLE_AMBIENT: "true"
+    # Allow sidecars/ingress to send/receive HBONE. This is required for interop.
+    PILOT_ENABLE_SENDING_HBONE: "true"
+    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
     CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
-    PILOT_ENABLE_AMBIENT_CONTROLLERS: "true"
-    PILOT_ENABLE_AMBIENT_WAYPOINTS: "true"
 variant: distroless
 seLinuxOptions:
   type: spc_t
diff --git a/resources/latest/charts/istiod/templates/autoscale.yaml b/resources/latest/charts/istiod/templates/autoscale.yaml
@@ -7,7 +7,7 @@ metadata:
   labels:
     app: istiod
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "Pilot"
 spec:
@@ -36,4 +36,4 @@ spec:
   behavior: {{ toYaml .Values.pilot.autoscaleBehavior | nindent 4 }}
   {{- end }}
 ---
-{{- end }}
+{{- end }}
diff --git a/resources/latest/charts/istiod/templates/configmap-jwks.yaml b/resources/latest/charts/istiod/templates/configmap-jwks.yaml
@@ -6,7 +6,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "Pilot"
 data:

diff --git a/resources/latest/charts/istiod/templates/configmap.yaml b/resources/latest/charts/istiod/templates/configmap.yaml
@@ -87,7 +87,7 @@ metadata:
   name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
   namespace: {{ .Release.Namespace }}
   labels:
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "Pilot"
     release: {{ .Release.Name }}

diff --git a/resources/latest/charts/istiod/templates/deployment.yaml b/resources/latest/charts/istiod/templates/deployment.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "Pilot"
     istio: pilot
@@ -27,15 +27,15 @@ spec:
     matchLabels:
       {{- if ne .Values.revision "" }}
       app: istiod
-      istio.io/rev: {{ .Values.revision | default "default" }}
+      istio.io/rev: {{ .Values.revision | default "default" | quote }}
       {{- else }}
       istio: pilot
       {{- end }}
   template:
     metadata:
       labels:
         app: istiod
-        istio.io/rev: {{ .Values.revision | default "default" }}
+        istio.io/rev: {{ .Values.revision | default "default" | quote }}
         install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
         sidecar.istio.io/inject: "false"
         operator.istio.io/component: "Pilot"

diff --git a/resources/latest/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/latest/charts/istiod/templates/istiod-injector-configmap.yaml
@@ -5,7 +5,7 @@ metadata:
   name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
   namespace: {{ .Release.Namespace }}
   labels:
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "Pilot"
     release: {{ .Release.Name }}

diff --git a/resources/latest/charts/istiod/templates/mutatingwebhook.yaml b/resources/latest/charts/istiod/templates/mutatingwebhook.yaml
@@ -45,7 +45,7 @@ metadata:
   name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
 {{- end }}
   labels:
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "Pilot"
     app: sidecar-injector

diff --git a/resources/latest/charts/istiod/templates/poddisruptionbudget.yaml b/resources/latest/charts/istiod/templates/poddisruptionbudget.yaml
@@ -6,7 +6,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "Pilot"
     release: {{ .Release.Name }}
@@ -17,7 +17,7 @@ spec:
     matchLabels:
       app: istiod
       {{- if ne .Values.revision "" }}
-      istio.io/rev: {{ .Values.revision }}
+      istio.io/rev: {{ .Values.revision | quote }}
       {{- else }}
       istio: pilot
       {{- end }}

diff --git a/resources/latest/charts/istiod/templates/revision-tags.yaml b/resources/latest/charts/istiod/templates/revision-tags.yaml
@@ -41,7 +41,7 @@ metadata:
 {{- end }}
   labels:
     istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ $.Values.ownerName | default "unknown" }}
     operator.istio.io/component: "Pilot"
     app: sidecar-injector
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		71e0b2154c35851147dd86d1dd71a0fbdcb54662
		9088296b1343d1a3b2e3f822f6d7942ff2de7a15