Merge pull request istio-ecosystem#64 from openshift-service-mesh-bot…

…/none-main-merge_upstream_main-38a843ce

Automator: merge upstream changes to openshift-service-mesh/sail-operator@main

Makefile.core.mk

@@ -251,68 +251,72 @@ docker-buildx: build-all ## Build and push docker image with cross-platform supp
 
 ##@ Deployment
 
+.PHONY: verify-kubeconfig
+verify-kubeconfig:
+	@kubectl get pods >/dev/null 2>&1 || (echo "Please verify that you have an active, running cluster and that KUBECONFIG is pointing to it." && exit 1)
+
 .PHONY: install
-install: gen-manifests ## Install CRDs into an existing cluster.
+install: verify-kubeconfig gen-manifests ## Install CRDs into an existing cluster.
 	kubectl create ns ${NAMESPACE} || echo "namespace ${NAMESPACE} already exists"
 	kubectl apply --server-side=true -f chart/crds
 
 .PHONY: uninstall
-uninstall: ## Uninstall CRDs from an existing cluster.
+uninstall: verify-kubeconfig ## Uninstall CRDs from an existing cluster.
 	kubectl delete --ignore-not-found -f chart/crds
 
 .PHONY: helm-package
-helm-package: helm ## Package the helm chart.
+helm-package: verify-kubeconfig helm ## Package the helm chart.
 	$(HELM) package chart
 
 .PHONY: deploy
-deploy: helm ## Deploy controller to an existing cluster.
+deploy: verify-kubeconfig helm ## Deploy controller to an existing cluster.
 	$(info NAMESPACE: $(NAMESPACE))
 	kubectl create ns ${NAMESPACE} || echo "namespace ${NAMESPACE} already exists"
 	$(HELM) template chart chart $(HELM_TEMPL_DEF_FLAGS) --set image='$(IMAGE)' --namespace $(NAMESPACE) | kubectl apply --server-side=true -f -
 
 .PHONY: deploy-yaml
-deploy-yaml: helm ## Output YAML manifests used by `deploy`.
+deploy-yaml: verify-kubeconfig helm ## Output YAML manifests used by `deploy`.
 	$(HELM) template chart chart $(HELM_TEMPL_DEF_FLAGS) --set image='$(IMAGE)' --namespace $(NAMESPACE)
 
 .PHONY: deploy-openshift # TODO: remove this target and use deploy-olm instead (when we fix the internal registry TLS issues when using operator-sdk run bundle)
-deploy-openshift: helm ## Deploy controller to an existing OCP cluster.
+deploy-openshift: verify-kubeconfig helm ## Deploy controller to an existing OCP cluster.
 	$(info NAMESPACE: $(NAMESPACE))
 	kubectl create ns ${NAMESPACE} || echo "namespace ${NAMESPACE} already exists"
 	$(HELM) template chart chart $(HELM_TEMPL_DEF_FLAGS) --set image='$(IMAGE)' --namespace $(NAMESPACE) --set platform="openshift" | kubectl apply --server-side=true -f -
 
 .PHONY: deploy-yaml-openshift
-deploy-yaml-openshift: helm ## Output YAML manifests used by `deploy-openshift`.
+deploy-yaml-openshift: verify-kubeconfig helm ## Output YAML manifests used by `deploy-openshift`.
 	$(HELM) template chart chart $(HELM_TEMPL_DEF_FLAGS) --set image='$(IMAGE)' --namespace $(NAMESPACE) --set platform="openshift"
 
 .PHONY: deploy-olm
-deploy-olm: bundle bundle-build bundle-push ## Build and push the operator OLM bundle and deploy the operator using OLM.
+deploy-olm: verify-kubeconfig bundle bundle-build bundle-push ## Build and push the operator OLM bundle and deploy the operator using OLM.
 	kubectl create ns ${NAMESPACE} || echo "namespace ${NAMESPACE} already exists"
 	$(OPERATOR_SDK) run bundle $(BUNDLE_IMG) -n ${NAMESPACE}
 
 .PHONY: undeploy
-undeploy: ## Undeploy controller from an existing cluster.
+undeploy: verify-kubeconfig ## Undeploy controller from an existing cluster.
 	kubectl delete istios.operator.istio.io --all --all-namespaces --wait=true
 	$(MAKE) -e HELM_TEMPL_DEF_FLAGS="$(HELM_TEMPL_DEF_FLAGS)" deploy-yaml | kubectl delete --ignore-not-found -f -
 	kubectl delete ns ${NAMESPACE} --ignore-not-found
 	$(HELM) template chart chart $(HELM_TEMPL_DEF_FLAGS) --set image='$(IMAGE)' --namespace $(NAMESPACE) | kubectl delete --ignore-not-found -f -
 
 .PHONY: undeploy-olm
-undeploy-olm: operator-sdk ## Undeploy the operator from an existing cluster (used only if operator was installed via OLM).
+undeploy-olm: verify-kubeconfig operator-sdk ## Undeploy the operator from an existing cluster (used only if operator was installed via OLM).
 	kubectl delete istios.operator.istio.io --all --all-namespaces --wait=true
 	$(OPERATOR_SDK) cleanup $(OPERATOR_NAME) --delete-all -n ${NAMESPACE}
 
 .PHONY: deploy-example
 deploy-example: deploy-example-openshift ## Deploy an example Istio resource to an existing OCP cluster. Same as `deploy-example-openshift`.
 
 .PHONY: deploy-example-openshift
-deploy-example-openshift: ## Deploy an example Istio and IstioCNI resource to an existing OCP cluster.
+deploy-example-openshift: verify-kubeconfig ## Deploy an example Istio and IstioCNI resource to an existing OCP cluster.
 	kubectl create ns istio-cni || echo "namespace istio-cni already exists"
 	kubectl apply -f chart/samples/istiocni-sample.yaml
 	kubectl create ns istio-system || echo "namespace istio-system already exists"
 	kubectl apply -f chart/samples/istio-sample-openshift.yaml
 
 .PHONY: deploy-example-kubernetes
-deploy-example-kubernetes: ## Deploy an example Istio resource on an existing cluster.
+deploy-example-kubernetes: verify-kubeconfig ## Deploy an example Istio resource on an existing cluster.
 	kubectl create ns istio-system || echo "namespace istio-system already exists"
 	kubectl apply -f chart/samples/istio-sample-kubernetes.yaml
 

README.md

@@ -117,6 +117,8 @@ kubectl apply -f chart/samples/istio-sample-openshift.yaml
 On OpenShift, you must also deploy the Istio CNI plugin by creating an instance of the `IstioCNI` resource:
 
 ```sh
+# Create the istio-cni namespace if it does not exist
+kubectl get ns istio-cni || kubectl create ns istio-cni
 kubectl apply -f chart/samples/istiocni-sample.yaml
 ```
 

bundle/manifests/servicemeshoperator3.clusterserviceversion.yaml

@@ -34,7 +34,7 @@ metadata:
     capabilities: Seamless Upgrades
     categories: OpenShift Optional, Integration & Delivery, Networking, Security
     containerImage: quay.io/maistra-dev/sail-operator:3.0.0-tp-latest
-    createdAt: "2024-06-24T09:05:07Z"
+    createdAt: "2024-06-25T18:07:01Z"
     description: The OpenShift Service Mesh Operator enables you to install, configure,
       and manage an instance of Red Hat OpenShift Service Mesh. OpenShift Service
       Mesh is based on the open source Istio project.

chart/values.yaml

@@ -21,7 +21,7 @@ csv:
     - v1.21.3
     - v1.21.2
     - v1.21.0
-    - latest (5579419b)
+    - latest (603e9024)
 
     [See this page](https://github.com/istio-ecosystem/sail-operator/blob/pre-main/bundle/README.md) for instructions on how to use it.
   support: Community based

docs/README.md

@@ -10,6 +10,8 @@ tbd
 
 ### Installation on OpenShift
 
+#### Installing through the web console
+
 1. In the OpenShift Console, navigate to the OperatorHub by clicking **Operator** -> **Operator Hub** in the left side-pane.
 
 1. Search for "sail".
@@ -23,6 +25,46 @@ tbd
 1. Click **Operators** -> **Installed Operators** to verify that the sail-operator 
 is installed. `Succeeded` should appear in the **Status** column.
 
+#### Installing using the CLI
+
+*Prerequisites*
+
+* You must have `admin` privileges.
+
+*Steps*
+
+1. Create the `openshift-operators` namespace (if it does not already exist).
+
+    ```bash
+    $ kubectl get ns openshift-operators --ignore-not-found || kubectl create namespace openshift-operators
+    ```
+
+1. Create the `Subscription` object with the desired `spec.channel`.
+
+    ```yaml
+    apiVersion: operators.coreos.com/v1alpha1
+    kind: Subscription
+    metadata:
+      name: sailoperator
+      namespace: openshift-operators
+    spec:
+      channel: "0.1-nightly"
+      installPlanApproval: Automatic
+      name: sailoperator
+      source: community-operators
+      sourceNamespace: openshift-marketplace
+    ```
+
+1. Verify that the installation succeeded by inspecting the CSV file.
+
+    ```bash
+    $ kubectl get csv -n openshift-operators
+    NAME                                     DISPLAY         VERSION                    REPLACES                                 PHASE
+    sailoperator.v0.1.0-nightly-2024-06-25   Sail Operator   0.1.0-nightly-2024-06-25   sailoperator.v0.1.0-nightly-2024-06-21   Succeeded
+    ```
+
+    `Succeeded` should appear in the sailoperator's `PHASE` column.
+
 ### Installation from Source
 
 If you're not using OpenShift or simply want to install from source, follow the [instructions in the Contributor Documentation](../README.md#deploying-the-operator).

go.mod

@@ -19,7 +19,7 @@ require (
 	gopkg.in/yaml.v3 v3.0.1
 	helm.sh/helm/v3 v3.15.1
 	istio.io/client-go v1.22.0-alpha.1.0.20240620154436-0945d7438eb2
-	istio.io/istio v0.0.0-20240621224720-5579419b80d6
+	istio.io/istio v0.0.0-20240624224518-603e90243120
 	k8s.io/api v0.30.1
 	k8s.io/apiextensions-apiserver v0.30.1
 	k8s.io/apimachinery v0.30.1

go.sum

@@ -495,8 +495,8 @@ istio.io/api v1.22.0-alpha.1.0.20240620154034-5b788fec62d2 h1:In1BXbQHMWmNn+wypv
 istio.io/api v1.22.0-alpha.1.0.20240620154034-5b788fec62d2/go.mod h1:THZA8sI/o2TXhmTM3P2EejCuE8VtWdMdrDQMD9FbdoU=
 istio.io/client-go v1.22.0-alpha.1.0.20240620154436-0945d7438eb2 h1:FrKxKJfaInf0odeq9INw4D4OmNmVlBPL5gaiE1J5Z/o=
 istio.io/client-go v1.22.0-alpha.1.0.20240620154436-0945d7438eb2/go.mod h1:OmCqmAHbNf4jkixGgDizSnTI5gpaJCVyKF7eWWuZq/A=
-istio.io/istio v0.0.0-20240621224720-5579419b80d6 h1:U2QO36XtYzn9BIhkoAVpIYvQBuX6q1uPwxsSn26Yklg=
-istio.io/istio v0.0.0-20240621224720-5579419b80d6/go.mod h1:qYijhwA483dgLirfCSXcZxcyegxCVRa3TTwJ6Az8piM=
+istio.io/istio v0.0.0-20240624224518-603e90243120 h1:TpY1nJeAlEW22PnqtRK6AcnQvBcY2z2EyEgIUSKRyAs=
+istio.io/istio v0.0.0-20240624224518-603e90243120/go.mod h1:iTBH6dELuLuLhn+GBM3eWP98RiMTftnHO6Eg0/W+rkM=
 k8s.io/api v0.30.1 h1:kCm/6mADMdbAxmIh0LBjS54nQBE+U4KmbCfIkF5CpJY=
 k8s.io/api v0.30.1/go.mod h1:ddbN2C0+0DIiPntan/bye3SW3PdwLa11/0yqwvuRrJM=
 k8s.io/apiextensions-apiserver v0.30.1 h1:4fAJZ9985BmpJG6PkoxVRpXv9vmPUOVzl614xarePws=

resources/latest/charts/base/Chart.yaml

@@ -1,10 +1,10 @@
 apiVersion: v2
-appVersion: 1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326
+appVersion: 1.23-alpha.603e9024312081703587fe9b118814f6a2b97524
 description: Helm chart for deploying Istio cluster resources and CRDs
 icon: https://istio.io/latest/favicons/android-192x192.png
 keywords:
 - istio
 name: base
 sources:
 - https://github.com/istio/istio
-version: 1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326
+version: 1.23-alpha.603e9024312081703587fe9b118814f6a2b97524

resources/latest/charts/cni/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326
+appVersion: 1.23-alpha.603e9024312081703587fe9b118814f6a2b97524
 description: Helm chart for istio-cni components
 icon: https://istio.io/latest/favicons/android-192x192.png
 keywords:
@@ -8,4 +8,4 @@ keywords:
 name: cni
 sources:
 - https://github.com/istio/istio
-version: 1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326
+version: 1.23-alpha.603e9024312081703587fe9b118814f6a2b97524

resources/latest/charts/cni/values.yaml

@@ -51,8 +51,8 @@ defaults:
       configDir: ""
       # If enabled, and ambient is enabled, DNS redirection will be enabled
       dnsCapture: false
-      # UNSTABLE: If enabled, and ambient is enabled, enables ipv6 support
-      ipv6: false
+      # If enabled, and ambient is enabled, enables ipv6 support
+      ipv6: true
 
 
     repair:
@@ -112,7 +112,7 @@ defaults:
     hub: gcr.io/istio-testing
 
     # Default tag for Istio images.
-    tag: 1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326
+    tag: 1.23-alpha.603e9024312081703587fe9b118814f6a2b97524
 
     # Variant of the image to use.
     # Currently supported are: [debug, distroless]

resources/latest/charts/gateway/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326
+appVersion: 1.23-alpha.603e9024312081703587fe9b118814f6a2b97524
 description: Helm chart for deploying Istio gateways
 icon: https://istio.io/latest/favicons/android-192x192.png
 keywords:
@@ -9,4 +9,4 @@ name: gateway
 sources:
 - https://github.com/istio/istio
 type: application
-version: 1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326
+version: 1.23-alpha.603e9024312081703587fe9b118814f6a2b97524

resources/latest/charts/istiod/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326
+appVersion: 1.23-alpha.603e9024312081703587fe9b118814f6a2b97524
 description: Helm chart for istio control plane
 icon: https://istio.io/latest/favicons/android-192x192.png
 keywords:
@@ -9,4 +9,4 @@ keywords:
 name: istiod
 sources:
 - https://github.com/istio/istio
-version: 1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326
+version: 1.23-alpha.603e9024312081703587fe9b118814f6a2b97524

resources/latest/charts/istiod/templates/istiod-injector-configmap.yaml

@@ -15,6 +15,8 @@ data:
 {{ $vals := pick .Values "global" "istio_cni" "sidecarInjectorWebhook" "revision" -}}
 {{ $pilotVals := pick .Values.pilot "cni" -}}
 {{ $vals = set $vals "pilot" $pilotVals -}}
+{{ $gatewayVals := pick .Values.gateways "securityContext" -}}
+{{ $vals = set $vals "gateways" $gatewayVals -}}
 {{ $vals | toPrettyJson | indent 4 }}
 
   # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching

resources/latest/charts/istiod/values.yaml

@@ -242,7 +242,7 @@ defaults:
     # Dev builds from prow are on gcr.io
     hub: gcr.io/istio-testing
     # Default tag for Istio images.
-    tag: 1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326
+    tag: 1.23-alpha.603e9024312081703587fe9b118814f6a2b97524
     # Variant of the image to use.
     # Currently supported are: [debug, distroless]
     variant: ""

resources/latest/charts/ztunnel/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326
+appVersion: 1.23-alpha.603e9024312081703587fe9b118814f6a2b97524
 description: Helm chart for istio ztunnel components
 icon: https://istio.io/latest/favicons/android-192x192.png
 keywords:
@@ -8,4 +8,4 @@ keywords:
 name: ztunnel
 sources:
 - https://github.com/istio/istio
-version: 1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326
+version: 1.23-alpha.603e9024312081703587fe9b118814f6a2b97524

resources/latest/charts/ztunnel/values.yaml

@@ -2,7 +2,7 @@ defaults:
   # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
   hub: gcr.io/istio-testing
   # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
-  tag: 1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326
+  tag: 1.23-alpha.603e9024312081703587fe9b118814f6a2b97524
   # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
   variant: ""
 

tests/e2e/README.md

@@ -2,7 +2,7 @@
 
 This end-to-end test suite utilizes Ginkgo, a testing framework known for its expressive specs (reference: https://onsi.github.io/ginkgo/). The setup for the test run is similar to the upstream Istio integration tests:
 * In the case of kind execution, it relies on the upstream script [`kind_provisioner.sh`](https://github.com/istio-ecosystem/sail-operator/blob/main/common/scripts/kind_provisioner.sh) and [`integ-suite-kind.sh`](https://github.com/istio-ecosystem/sail-operator/blob/main/tests/e2e/integ-suite-kind.sh), which are copied from the `github.com/istio/common-files` repository to set up the kind cluster used for the test.
-* In the case of OCP execution, it relies on the `inter-suite-ocp.sh` and `common-operator-integ-suite` scripts to setup the OCP cluster to be ready for the test.
+* In the case of OCP execution, it relies on the `integ-suite-ocp.sh` and `common-operator-integ-suite.sh` scripts to setup the OCP cluster to be ready for the test.
 
 ## Table of Contents
 
@@ -198,7 +198,7 @@ $ make BUILD_WITH_CONTAINER=0 test.e2e.kind
 ```
 or
 ```
-$ make BUILD_WITH_CONTAINER=0 test.2e2.ocp
+$ make BUILD_WITH_CONTAINER=0 test.e2e.ocp
 ```
 
 ### Settings for end-to-end test execution

versions.yaml

@@ -64,10 +64,10 @@ versions:
     version: 1.23-alpha
     repo: https://github.com/istio/istio
     branch: master
-    commit: 5579419b80d666203426b1f4ed41f71c364d0326
+    commit: 603e9024312081703587fe9b118814f6a2b97524
     charts:
-      - https://storage.googleapis.com/istio-build/dev/1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326/helm/base-1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326.tgz
-      - https://storage.googleapis.com/istio-build/dev/1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326/helm/cni-1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326.tgz
-      - https://storage.googleapis.com/istio-build/dev/1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326/helm/gateway-1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326.tgz
-      - https://storage.googleapis.com/istio-build/dev/1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326/helm/istiod-1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326.tgz
-      - https://storage.googleapis.com/istio-build/dev/1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326/helm/ztunnel-1.23-alpha.5579419b80d666203426b1f4ed41f71c364d0326.tgz
+      - https://storage.googleapis.com/istio-build/dev/1.23-alpha.603e9024312081703587fe9b118814f6a2b97524/helm/base-1.23-alpha.603e9024312081703587fe9b118814f6a2b97524.tgz
+      - https://storage.googleapis.com/istio-build/dev/1.23-alpha.603e9024312081703587fe9b118814f6a2b97524/helm/cni-1.23-alpha.603e9024312081703587fe9b118814f6a2b97524.tgz
+      - https://storage.googleapis.com/istio-build/dev/1.23-alpha.603e9024312081703587fe9b118814f6a2b97524/helm/gateway-1.23-alpha.603e9024312081703587fe9b118814f6a2b97524.tgz
+      - https://storage.googleapis.com/istio-build/dev/1.23-alpha.603e9024312081703587fe9b118814f6a2b97524/helm/istiod-1.23-alpha.603e9024312081703587fe9b118814f6a2b97524.tgz
+      - https://storage.googleapis.com/istio-build/dev/1.23-alpha.603e9024312081703587fe9b118814f6a2b97524/helm/ztunnel-1.23-alpha.603e9024312081703587fe9b118814f6a2b97524.tgz