Bump to OSSM 3.0.3 and Istio 1.24.4#1239
Conversation
This commit resolves NE-2022. https://issues.redhat.com/browse/NE-2022 * cmd/ingress-operator/start.go (defaultGatewayAPIOperatorVersion): * manifests/02-deployment-ibm-cloud-managed.yaml (GATEWAY_API_OPERATOR_VERSION): * manifests/02-deployment.yaml (GATEWAY_API_OPERATOR_VERSION): Bump from OSSM v3.0.0 to v3.0.3. * pkg/operator/controller/gatewayclass/istio.go (desiredIstio): Bump from Istio v1.24.3 to v1.24.4.
Avoid conflict with a user control plane by setting a custom CA Bundle CM name for the Gateway Control plane and enable istio to only inject CA Bundle CMs in namespaces where Gateways exist to avoid poluting the whole cluster. Two new Env variables set for the Istio control plane deployment CR; PILOT_CA_CERT_CONFIGMAP PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY Related to OSSM-9076
Configure Istiod not to copy annotations or labels from gateways onto associated resources, such as the proxy deployment and load-balancer service for a gateway. This copying behavior is Istio-specific, not part of the Gateway API spec, and could be used to inject unsupported configuration. For example, an end-user could set a service annotation on the gateway in order to configure a load-balancer. Setting annotations on the gateway to configure the load-balancer would not be portable to other Gateway API implementations and would complicate product support. This commit is related to OSSM-8989. https://issues.redhat.com/browse/OSSM-8989 * pkg/operator/controller/gatewayclass/istio.go (desiredIstio): Set the "PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS" to "false".
Delete the obsolete PILOT_ENABLE_GATEWAY_CONTROLLER_MODE environment variable from the Istiod configuration. This environment variable is no longer recognized in OSSM 3, and the variable has been superseded by EnhancedResourceScoping. * pkg/operator/controller/gatewayclass/istio.go (desiredIstio): Delete PILOT_ENABLE_GATEWAY_CONTROLLER_MODE.
Increase the timeout in assertDNSRecord for polling for the DNSRecord CR from 1 minute to 10 minutes. The cloud provider can easily take over a minute to provision the load balancer, and the operator cannot create the DNSRecord CR before the load balancer has been provisioned and assigned a host name or address. Consequently, the polling loop could easily reach the 1-minute timeout just on account of the time that it takes to provision the load balancer. * test/e2e/util_gatewayapi_test.go (assertDNSRecord): Increase timeout for the DNSRecord CR polling loop from 1m to 10m.
Increase the timeout for polling the gateway, and dump the gateway if the test fails. * test/e2e/gateway_api_test.go (testGatewayAPIManualDeployment): Increase the timeout for polling the gateway from 1m to 5m. Dump the gateway if the test fails.
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@Miciah: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Did pre-merge test with the PR but seems gateway Programmed status is false and pod complains And OSSM and istio looks good |
|
And connot find configmap |
I was using this PR to explore the errors I was observing on #1227. I believe that the issue you are describing has been resolved in #1227; quoting #1227 (comment):
#1227 is passing the /close |
|
@Miciah: Closed this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
3 participants
Bump to OSSM 3.0.3 and Istio 1.24.4
Bump from OSSM v3.0.0 to v3.0.3 and from Istio v1.24.3 to v1.24.4.
Enable Gateway only CA Bundles and custom CA CM name
Avoid conflict with a user control plane by setting a custom CA Bundle CM name for the Gateway Control plane and enable Istio to only inject CA Bundle CMs in namespaces where Gateways exist to avoid polluting the whole cluster.
Two new environment variables are set for the Istio control plane deployment CR:
This change is related to OSSM-9076.
This change incorporates #1209.
Don't copy labels or annotations
Configure Istiod not to copy annotations or labels from gateways onto associated resources, such as the proxy deployment and load-balancer service for a gateway.
This copying behavior is Istio-specific, not part of the Gateway API spec, and could be used to inject unsupported configuration. For example, an end-user could set a service annotation on the gateway in order to configure a load-balancer. Setting annotations on the gateway to configure the load-balancer would not be portable to other Gateway API implementations and would complicate product support.
One new environment variable is set:
This change is related to OSSM-8989.
Delete old controller-mode setting
Delete the obsolete
PILOT_ENABLE_GATEWAY_CONTROLLER_MODEenvironment variable from the Istiod configuration. This environment variable is no longer recognized in OSSM 3, and the variable has been superseded by EnhancedResourceScoping.assertDNSRecord: Increase timeout to 10mIncrease the timeout in
assertDNSRecordfor polling for the DNSRecord CR from 1 minute to 10 minutes.The cloud provider can easily take over a minute to provision the load balancer, and the operator cannot create the DNSRecord CR before the load balancer has been provisioned and assigned a host name or address. Consequently, the polling loop could easily reach the 1-minute timeout just on account of the time that it takes to provision the load balancer.
testGatewayAPIManualDeployment: Increase timeoutIncrease the timeout for polling the gateway, and dump the gateway if the test fails.