bump istio version to 1.17.8 and prepare release v2.17.4

banzaicloud · Jan 31, 2024 · 8346d00 · 8346d00
1 parent 1fe1f99
commit 8346d00
Show file tree

Hide file tree

Showing 33 changed files with 54 additions and 51 deletions.
diff --git a/Makefile b/Makefile
@@ -20,7 +20,7 @@ GOLANGCI_VERSION = 1.54.2
 LICENSEI_VERSION = 0.9.0
 ENVTEST_K8S_VERSION = 1.26.0
 KUSTOMIZE_VERSION = 4.1.2
-ISTIO_VERSION = 1.17.1
+ISTIO_VERSION = 1.17.8
 BUF_VERSION = 1.7.0
 
 PATH := $(PWD)/bin:$(PATH)

diff --git a/api/v1alpha1/istiocontrolplane.gen.json b/api/v1alpha1/istiocontrolplane.gen.json
@@ -1583,7 +1583,7 @@
             "type": "string"
           },
           "credentialName": {
-            "description": "The name of the secret that holds the TLS certs for the client including the CA certificates. Secret must exist in the same namespace with the proxy using the certificates. The secret (of type `generic`)should contain the following keys and values: `key: \u003cprivateKey\u003e`, `cert: \u003cclientCert\u003e`, `cacert: \u003cCACertificate\u003e`. Here CACertificate is used to verify the server certificate. Secret of type tls for client certificates along with ca.crt key for CA certificates is also supported. Only one of client certificates and CA certificate or credentialName can be specified. **NOTE:** This field is applicable at sidecars only if `DestinationRule` has a `workloadSelector` specified. Otherwise the field will be applicable only at gateways, and sidecars will continue to use the certificate paths.",
+            "description": "The name of the secret that holds the TLS certs for the client including the CA certificates. Secret must exist in the same namespace with the proxy using the certificates. The secret (of type `generic`)should contain the following keys and values: `key: \u003cprivateKey\u003e`, `cert: \u003cclientCert\u003e`, `cacert: \u003cCACertificate\u003e`. Here CACertificate is used to verify the server certificate. For mutual TLS, `cacert: \u003cCACertificate\u003e` can be provided in the same secret or a separate secret named `\u003csecret\u003e-cacert`. Secret of type tls for client certificates along with ca.crt key for CA certificates is also supported. Only one of client certificates and CA certificate or credentialName can be specified. **NOTE:** This field is applicable at sidecars only if `DestinationRule` has a `workloadSelector` specified. Otherwise the field will be applicable only at gateways, and sidecars will continue to use the certificate paths.",
             "type": "string"
           },
           "subjectAltNames": {

diff --git a/api/v1alpha1/istiomesh.gen.json b/api/v1alpha1/istiomesh.gen.json
@@ -1583,7 +1583,7 @@
             "type": "string"
           },
           "credentialName": {
-            "description": "The name of the secret that holds the TLS certs for the client including the CA certificates. Secret must exist in the same namespace with the proxy using the certificates. The secret (of type `generic`)should contain the following keys and values: `key: \u003cprivateKey\u003e`, `cert: \u003cclientCert\u003e`, `cacert: \u003cCACertificate\u003e`. Here CACertificate is used to verify the server certificate. Secret of type tls for client certificates along with ca.crt key for CA certificates is also supported. Only one of client certificates and CA certificate or credentialName can be specified. **NOTE:** This field is applicable at sidecars only if `DestinationRule` has a `workloadSelector` specified. Otherwise the field will be applicable only at gateways, and sidecars will continue to use the certificate paths.",
+            "description": "The name of the secret that holds the TLS certs for the client including the CA certificates. Secret must exist in the same namespace with the proxy using the certificates. The secret (of type `generic`)should contain the following keys and values: `key: \u003cprivateKey\u003e`, `cert: \u003cclientCert\u003e`, `cacert: \u003cCACertificate\u003e`. Here CACertificate is used to verify the server certificate. For mutual TLS, `cacert: \u003cCACertificate\u003e` can be provided in the same secret or a separate secret named `\u003csecret\u003e-cacert`. Secret of type tls for client certificates along with ca.crt key for CA certificates is also supported. Only one of client certificates and CA certificate or credentialName can be specified. **NOTE:** This field is applicable at sidecars only if `DestinationRule` has a `workloadSelector` specified. Otherwise the field will be applicable only at gateways, and sidecars will continue to use the certificate paths.",
             "type": "string"
           },
           "subjectAltNames": {

diff --git a/config/crd/bases/istio-operator-crds.gen.yaml b/config/crd/bases/istio-operator-crds.gen.yaml
@@ -6,7 +6,7 @@ metadata:
     "helm.sh/resource-policy": keep
   name: istiocontrolplanes.servicemesh.cisco.com
   labels:
-    resource.alpha.banzaicloud.io/revision: 1.17.1
+    resource.alpha.banzaicloud.io/revision: 1.17.8
 spec:
   group: servicemesh.cisco.com
   names:
@@ -9434,7 +9434,7 @@ metadata:
     "helm.sh/resource-policy": keep
   name: peeristiocontrolplanes.servicemesh.cisco.com
   labels:
-    resource.alpha.banzaicloud.io/revision: 1.17.1
+    resource.alpha.banzaicloud.io/revision: 1.17.8
 spec:
   group: servicemesh.cisco.com
   names:
@@ -18859,7 +18859,7 @@ metadata:
     "helm.sh/resource-policy": keep
   name: istiomeshes.servicemesh.cisco.com
   labels:
-    resource.alpha.banzaicloud.io/revision: 1.17.1
+    resource.alpha.banzaicloud.io/revision: 1.17.8
 spec:
   group: servicemesh.cisco.com
   names:
@@ -20043,7 +20043,7 @@ metadata:
     "helm.sh/resource-policy": keep
   name: istiomeshgateways.servicemesh.cisco.com
   labels:
-    resource.alpha.banzaicloud.io/revision: 1.17.1
+    resource.alpha.banzaicloud.io/revision: 1.17.8
 spec:
   group: servicemesh.cisco.com
   names:

diff --git a/config/samples/servicemesh_v1alpha1_istiocontrolplane.yaml b/config/samples/servicemesh_v1alpha1_istiocontrolplane.yaml
@@ -3,7 +3,7 @@ kind: IstioControlPlane
 metadata:
   name: icp-v117x-sample
 spec:
-  version: 1.17.1
+  version: 1.17.8
   mode: ACTIVE
   meshID: mesh1
   networkName: network1
@@ -18,7 +18,7 @@ spec:
         min: 1
         max: 5
         count: 1
-      image: "gcr.io/istio-release/pilot:1.17.1"
+      image: "gcr.io/istio-release/pilot:1.17.8"
       resources:
         requests:
           cpu: 500m
@@ -42,7 +42,7 @@ spec:
       operatorEndpoints:
         enabled: false
   proxy:
-    image: "gcr.io/istio-release/proxyv2:1.17.1"
+    image: "gcr.io/istio-release/proxyv2:1.17.8"
     privileged: false
     enableCoreDump: false
     logLevel: "WARNING"
@@ -62,7 +62,7 @@ spec:
     excludeInboundPorts: ""
     excludeOutboundPorts: ""
   proxyInit:
-    image: "gcr.io/istio-release/proxyv2:1.17.1"
+    image: "gcr.io/istio-release/proxyv2:1.17.8"
     resources:
       limits:
         cpu: 2000m

diff --git a/controllers/version_test.go b/controllers/version_test.go
@@ -36,9 +36,9 @@ var _ = Describe("IsIstioVersionSupported()", func() {
 		Expect(controllers.IsIstioVersionSupported("1.17-dev")).To(BeTrue())
 	})
 	It("should accept micro versions", func() {
-		Expect(controllers.IsIstioVersionSupported("1.17.1")).To(BeTrue())
+		Expect(controllers.IsIstioVersionSupported("1.17.8")).To(BeTrue())
 	})
 	It("should accept micro versions with qualifier", func() {
-		Expect(controllers.IsIstioVersionSupported("1.17.1-dev")).To(BeTrue())
+		Expect(controllers.IsIstioVersionSupported("1.17.8-dev")).To(BeTrue())
 	})
 })
diff --git a/deploy/charts/istio-operator/Chart.yaml b/deploy/charts/istio-operator/Chart.yaml
@@ -11,5 +11,5 @@ icon: https://istio.io/latest/img/istio-whitelogo-bluebackground-framed.svg
 # Based on support status of Istio releases: https://istio.io/latest/docs/releases/supported-releases/#support-status-of-istio-releases
 kubeVersion: ">= 1.23.0-0 < 1.27.0-0"
 
-version: 2.1.5
-appVersion: "v2.17.3"
+version: 2.1.6
+appVersion: "v2.17.4"
diff --git a/deploy/charts/istio-operator/README.md b/deploy/charts/istio-operator/README.md
@@ -33,7 +33,7 @@ The following table lists the configurable parameters of the Banzaicloud Istio O
 | Parameter                                      | Description                                                                                                                                                                                         | Default                                                                                  |
 |------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------|
 | `image.repository`                             | Operator container image repository                                                                                                                                                                 | `ghcr.io/banzaicloud/istio-operator`                                                     |
-| `image.tag`                                    | Operator container image tag                                                                                                                                                                        | `v2.17.3`                                                                                |
+| `image.tag`                                    | Operator container image tag                                                                                                                                                                        | `v2.17.4`                                                                                |
 | `image.pullPolicy`                             | Operator container image pull policy                                                                                                                                                                | `IfNotPresent`                                                                           |
 | `replicaCount`                                 | Operator deployment replica count                                                                                                                                                                   | `1`                                                                                      |
 | `extraArgs`                                    | Operator deployment arguments                                                                                                                                                                       | `[]`                                                                                     |

diff --git a/deploy/charts/istio-operator/crds/istio-operator-crds.gen.yaml b/deploy/charts/istio-operator/crds/istio-operator-crds.gen.yaml
@@ -6,7 +6,7 @@ metadata:
     "helm.sh/resource-policy": keep
   name: istiocontrolplanes.servicemesh.cisco.com
   labels:
-    resource.alpha.banzaicloud.io/revision: 1.17.1
+    resource.alpha.banzaicloud.io/revision: 1.17.8
 spec:
   group: servicemesh.cisco.com
   names:
@@ -9434,7 +9434,7 @@ metadata:
     "helm.sh/resource-policy": keep
   name: peeristiocontrolplanes.servicemesh.cisco.com
   labels:
-    resource.alpha.banzaicloud.io/revision: 1.17.1
+    resource.alpha.banzaicloud.io/revision: 1.17.8
 spec:
   group: servicemesh.cisco.com
   names:
@@ -18859,7 +18859,7 @@ metadata:
     "helm.sh/resource-policy": keep
   name: istiomeshes.servicemesh.cisco.com
   labels:
-    resource.alpha.banzaicloud.io/revision: 1.17.1
+    resource.alpha.banzaicloud.io/revision: 1.17.8
 spec:
   group: servicemesh.cisco.com
   names:
@@ -20043,7 +20043,7 @@ metadata:
     "helm.sh/resource-policy": keep
   name: istiomeshgateways.servicemesh.cisco.com
   labels:
-    resource.alpha.banzaicloud.io/revision: 1.17.1
+    resource.alpha.banzaicloud.io/revision: 1.17.8
 spec:
   group: servicemesh.cisco.com
   names:

diff --git a/deploy/charts/istio-operator/values.yaml b/deploy/charts/istio-operator/values.yaml
@@ -1,6 +1,6 @@
 image:
   repository: ghcr.io/banzaicloud/istio-operator
-  tag: "v2.17.3"
+  tag: "v2.17.4"
   pullPolicy: IfNotPresent
 replicaCount: 1
 extraArgs: []

diff --git a/docs/multi-cluster-mesh/active-active/active-icp-1.yaml b/docs/multi-cluster-mesh/active-active/active-icp-1.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     controlplane.istio.servicemesh.cisco.com/namespace-injection-source: "true"
 spec:
-  version: 1.17.1
+  version: 1.17.8
   mode: ACTIVE
   networkName: network1
   meshExpansion:

diff --git a/docs/multi-cluster-mesh/active-active/active-icp-2.yaml b/docs/multi-cluster-mesh/active-active/active-icp-2.yaml
@@ -4,7 +4,7 @@ metadata:
   name: icp-v117x
   namespace: istio-system
 spec:
-  version: 1.17.1
+  version: 1.17.8
   mode: ACTIVE
   networkName: network2
   meshExpansion:

diff --git a/docs/multi-cluster-mesh/active-passive/active-icp.yaml b/docs/multi-cluster-mesh/active-passive/active-icp.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
    controlplane.istio.servicemesh.cisco.com/namespace-injection-source: "true"
 spec:
-  version: 1.17.1
+  version: 1.17.8
   mode: ACTIVE
   networkName: network1
   meshExpansion:

diff --git a/docs/multi-cluster-mesh/active-passive/passive-icp.yaml b/docs/multi-cluster-mesh/active-passive/passive-icp.yaml
@@ -4,7 +4,7 @@ metadata:
   name: icp-v117x
   namespace: istio-system
 spec:
-  version: 1.17.1
+  version: 1.17.8
   mode: PASSIVE
   networkName: network2
   meshExpansion:

diff --git a/go.mod b/go.mod
@@ -25,8 +25,8 @@ require (
 	github.com/onsi/ginkgo v1.16.5
 	github.com/onsi/gomega v1.24.1
 	go.uber.org/zap v1.24.0
-	istio.io/api v0.0.0-20230217221049-9d422bf48675
-	istio.io/client-go v1.17.1
+	istio.io/api v0.0.0-20231011001129-b6bd6cd1b885
+	istio.io/client-go v1.17.8
 	k8s.io/api v0.26.1
 	k8s.io/apiextensions-apiserver v0.26.1
 	k8s.io/apimachinery v0.26.1
@@ -41,6 +41,7 @@ require (
 	github.com/cisco-open/cluster-registry-controller v0.2.9
 	github.com/hexops/gotextdiff v1.0.3
 	github.com/iancoleman/strcase v0.2.0
+	google.golang.org/genproto v0.0.0-20221018160656-63c7b68cfc55
 	google.golang.org/protobuf v1.28.1
 	gotest.tools/v3 v3.0.3
 )
@@ -166,7 +167,6 @@ require (
 	golang.org/x/time v0.3.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20221018160656-63c7b68cfc55 // indirect
 	google.golang.org/grpc v1.50.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect

diff --git a/go.sum b/go.sum
@@ -1194,10 +1194,10 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-istio.io/api v0.0.0-20230217221049-9d422bf48675 h1:dxHqYbJwurfq+x2OOG4WP+NkbyjURgcP9PQTsxh7HXM=
-istio.io/api v0.0.0-20230217221049-9d422bf48675/go.mod h1:owGDRg9uqMob8CN1gxaOzk6nJxnbT8wrP7PmggpJHHY=
-istio.io/client-go v1.17.1 h1:W0kQXYCzIluA/20zLzxeNF7bNMJXXArmGYRt/MIg2io=
-istio.io/client-go v1.17.1/go.mod h1:mLTRYYFxHctzUbt8Iclgj+Sueq34+qC2ZEJTn6BxRuE=
+istio.io/api v0.0.0-20231011001129-b6bd6cd1b885 h1:I8mtxnP4kp8leqQ4sel2AxWON5gw18W6h13aE9O5g7M=
+istio.io/api v0.0.0-20231011001129-b6bd6cd1b885/go.mod h1:owGDRg9uqMob8CN1gxaOzk6nJxnbT8wrP7PmggpJHHY=
+istio.io/client-go v1.17.8 h1:RtP3G8uPaFm+Q+NYXFcdiRSj5GwSZnh/WnhHOJmsp10=
+istio.io/client-go v1.17.8/go.mod h1:rW8Lj0iHDvB0rXbryn6PNfYh3cK6ueeO47cm+Y23NCg=
 k8s.io/api v0.24.3/go.mod h1:elGR/XSZrS7z7cSZPzVWaycpJuGIw57j9b95/1PdJNI=
 k8s.io/api v0.26.1 h1:f+SWYiPd/GsiWwVRz+NbFyCgvv75Pk9NK6dlkZgpCRQ=
 k8s.io/api v0.26.1/go.mod h1:xd/GBNgR0f707+ATNyPmQ1oyKSgndzXij81FzWGsejg=

diff --git a/internal/assets/manifests/istio-discovery/resources/grpc-simple.yaml b/internal/assets/manifests/istio-discovery/resources/grpc-simple.yaml
@@ -1,5 +1,6 @@
 metadata:
-  sidecar.istio.io/rewriteAppHTTPProbers: "false"
+  annotations:
+    sidecar.istio.io/rewriteAppHTTPProbers: "false"
 spec:
   initContainers:
     - name: grpc-bootstrap-init

diff --git a/internal/assets/manifests/istio-discovery/values.yaml b/internal/assets/manifests/istio-discovery/values.yaml
@@ -249,7 +249,7 @@ global:
   # Dev builds from prow are on gcr.io
   hub: istio
   # Default tag for Istio images.
-  tag: "1.17.1"
+  tag: "1.17.8"
   # Variant of the image to use.
   # Currently supported are: [debug, distroless]
   variant: ""

diff --git a/internal/components/base/base_test.go b/internal/components/base/base_test.go
@@ -60,7 +60,7 @@ func TestICPBaseResourceDump(t *testing.T) {
 			reconciler.NativeReconcilerSetControllerRef(),
 		}),
 		logger.NewWithLogrLogger(logr.NewTestLogger(t)),
-		"1.17.1",
+		"1.17.8",
 	)
 
 	dd, err := reconciler.GetManifest(icp)

diff --git a/internal/components/base/testdata/icp-test-cr.yaml b/internal/components/base/testdata/icp-test-cr.yaml
@@ -4,5 +4,5 @@ metadata:
   name: cp-v117x
   namespace: istio-system
 spec:
-  version: "1.17.1"
+  version: "1.17.8"
   mode: ACTIVE
diff --git a/internal/components/cni/testdata/icp-test-cr.yaml b/internal/components/cni/testdata/icp-test-cr.yaml
@@ -4,7 +4,7 @@ metadata:
   name: cp-v117x
   namespace: istio-system
 spec:
-  version: "1.17.1"
+  version: "1.17.8"
   mode: ACTIVE
   containerImageConfiguration:
     hub: gcr.io/istio-testing

diff --git a/internal/components/discovery/testdata/icp-expected-resource-dump.yaml b/internal/components/discovery/testdata/icp-expected-resource-dump.yaml
@@ -858,7 +858,8 @@ data:
           {{- end }}
       grpc-simple: |
         metadata:
-          sidecar.istio.io/rewriteAppHTTPProbers: "false"
+          annotations:
+            sidecar.istio.io/rewriteAppHTTPProbers: "false"
         spec:
           initContainers:
             - name: grpc-bootstrap-init

diff --git a/internal/components/discovery/testdata/icp-passive-expected-resource-dump.yaml b/internal/components/discovery/testdata/icp-passive-expected-resource-dump.yaml
@@ -829,7 +829,8 @@ data:
           {{- end }}
       grpc-simple: |
         metadata:
-          sidecar.istio.io/rewriteAppHTTPProbers: "false"
+          annotations:
+            sidecar.istio.io/rewriteAppHTTPProbers: "false"
         spec:
           initContainers:
             - name: grpc-bootstrap-init
@@ -1330,7 +1331,7 @@ data:
         "sts": {
           "servicePort": 0
         },
-        "tag": "1.17.1",
+        "tag": "1.17.8",
         "tracer": {
           "datadog": {
             "address": "$(HOST_IP):8126"

diff --git a/internal/components/discovery/testdata/icp-passive-test-cr.yaml b/internal/components/discovery/testdata/icp-passive-test-cr.yaml
@@ -39,7 +39,7 @@ spec:
                   value: custom-passive2
   meshID: mesh1
   clusterID: demo-cluster2
-  version: "1.17.1"
+  version: "1.17.8"
   mode: PASSIVE
   networkName: network1
   caProvider: Citadel
diff --git a/internal/components/discovery/testdata/icp-test-cr.yaml b/internal/components/discovery/testdata/icp-test-cr.yaml
@@ -39,7 +39,7 @@ spec:
                   value: custom2
   meshID: mesh1
   clusterID: demo-cluster1
-  version: "1.17.1"
+  version: "1.17.8"
   mode: ACTIVE
   networkName: network1
   containerImageConfiguration:

diff --git a/internal/components/istiomeshgateway/testdata/icp-test-cr.yaml b/internal/components/istiomeshgateway/testdata/icp-test-cr.yaml
@@ -6,7 +6,7 @@ metadata:
 spec:
   meshID: mesh1
   clusterID: demo-cluster1
-  version: "1.17.1"
+  version: "1.17.8"
   mode: ACTIVE
   containerImageConfiguration:
     hub: gcr.io/istio-testing

diff --git a/internal/components/meshexpansion/testdata/icp-test-cr.yaml b/internal/components/meshexpansion/testdata/icp-test-cr.yaml
@@ -4,7 +4,7 @@ metadata:
   name: cp-v117x
   namespace: istio-system
 spec:
-  version: "1.17.1"
+  version: "1.17.8"
   mode: ACTIVE
   networkName: network-bogus
   distribution: cisco

diff --git a/internal/components/resourcesyncrule/testdata/icp-active-test-cr.yaml b/internal/components/resourcesyncrule/testdata/icp-active-test-cr.yaml
@@ -4,7 +4,7 @@ metadata:
   name: cp-v117x
   namespace: istio-system
 spec:
-  version: "1.17.1"
+  version: "1.17.8"
   mode: ACTIVE
   distribution: cisco
   meshID: mesh1
diff --git a/internal/components/resourcesyncrule/testdata/icp-passive-test-cr.yaml b/internal/components/resourcesyncrule/testdata/icp-passive-test-cr.yaml
@@ -4,7 +4,7 @@ metadata:
   name: cp-v117x
   namespace: istio-system
 spec:
-  version: "1.17.1"
+  version: "1.17.8"
   mode: PASSIVE
   distribution: cisco
   meshID: mesh1
diff --git a/internal/components/sidecarinjector/testdata/icp-expected-resource-dump.yaml b/internal/components/sidecarinjector/testdata/icp-expected-resource-dump.yaml
@@ -175,7 +175,7 @@ spec:
               value: "true"
             - name: CNI_ANOTHER_ENV_NAME
               value: standard
-          image: banzaicloud/istio-sidecar-injector:v1.17.1-bzc.0
+          image: banzaicloud/istio-sidecar-injector:v1.17.8-bzc.0
           imagePullPolicy: Always
           livenessProbe:
             exec:

diff --git a/internal/components/sidecarinjector/testdata/icp-expected-values.yaml b/internal/components/sidecarinjector/testdata/icp-expected-values.yaml
@@ -1,6 +1,6 @@
 revision: cp-v117x
 deployment:
-  image: banzaicloud/istio-sidecar-injector:v1.17.1-bzc.0
+  image: banzaicloud/istio-sidecar-injector:v1.17.8-bzc.0
   metadata:
     annotations:
       daemonset-annotation: value