[release-4.19] NE-2103: Bump to OSSM 3.0.1 and Istio 1.24.4#1244
Conversation
Also, explicitly set ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT to "false" on the Istio CR. For Istio 1.24.3, OSSM has a vendor override that sets this option[1]. However, for Istio 1.24.4, the option must be explicitly set. 1. https://github.com/openshift-service-mesh/sail-operator/blob/3bf27ee3c4fb4494ffe6028c7f72034c5a7a1e60/pkg/istiovalues/vendor_defaults.yaml#L11-L14 This commit resolves NE-2103. https://issues.redhat.com/browse/NE-2103 * cmd/ingress-operator/start.go (defaultGatewayAPIOperatorVersion): * manifests/02-deployment-ibm-cloud-managed.yaml (GATEWAY_API_OPERATOR_VERSION): * manifests/02-deployment.yaml (GATEWAY_API_OPERATOR_VERSION): Bump from OSSM v3.0.0 to v3.0.1. * pkg/operator/controller/gatewayclass/istio.go (desiredIstio): Bump from Istio v1.24.3 to v1.24.4. Set ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT to "false". (cherry picked from commit 47d4152)
Configure Istio to inject the configmaps only into namespaces where
gateways exist in order to avoid polluting the whole cluster.
Set one new environment variable in the Istio CR:
PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY
In the future, we will set the Istio CR's trustBundleName global value
to specify a custom configmap name. However, we cannot do that yet as
the trustBundleName field only exists in OSSM 3.1.
This commit is related to OSSM-9076.
* pkg/operator/controller/gatewayclass/istio.go (desiredIstio): Set the
new environment variable.
* pkg/operator/controller/names.go (OpenShiftGatewayCARootCertName): New
const for future use.
Modified-by: Miciah Masters <miciah.masters@gmail.com>
(cherry picked from commit 41d7add)
Configure Istiod not to copy annotations or labels from gateways onto associated resources, such as the proxy deployment and load-balancer service for a gateway. This copying behavior is Istio-specific, not part of the Gateway API spec, and could be used to inject unsupported configuration. For example, an end-user could set a service annotation on the gateway in order to configure a load-balancer. Setting annotations on the gateway to configure the load-balancer would not be portable to other Gateway API implementations and would complicate product support. This commit is related to OSSM-8989. https://issues.redhat.com/browse/OSSM-8989 * pkg/operator/controller/gatewayclass/istio.go (desiredIstio): Set the "PILOT_ENABLE_GATEWAY_API_COPY_LABELS_ANNOTATIONS" to "false". (cherry picked from commit 05417af)
Delete the obsolete PILOT_ENABLE_GATEWAY_CONTROLLER_MODE environment variable from the Istiod configuration. This environment variable is no longer recognized in OSSM 3, and the variable has been superseded by EnhancedResourceScoping. * pkg/operator/controller/gatewayclass/istio.go (desiredIstio): Delete PILOT_ENABLE_GATEWAY_CONTROLLER_MODE. (cherry picked from commit e05309e)
Increase the timeout in assertDNSRecord for polling for the DNSRecord CR from 1 minute to 10 minutes. The cloud provider can easily take over a minute to provision the load balancer, and the operator cannot create the DNSRecord CR before the load balancer has been provisioned and assigned a host name or address. Consequently, the polling loop could easily reach the 1-minute timeout just on account of the time that it takes to provision the load balancer. * test/e2e/util_gatewayapi_test.go (assertDNSRecord): Increase timeout for the DNSRecord CR polling loop from 1m to 10m. (cherry picked from commit 2f7da77)
Increase the timeout for polling the gateway, and dump the gateway if the test fails. * test/e2e/gateway_api_test.go (testGatewayAPIManualDeployment): Increase the timeout for polling the gateway from 1m to 5m. Dump the gateway if the test fails. (cherry picked from commit f1e445d)
|
@Miciah: This pull request references NE-2103 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.z" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
|
/assign |
|
/test e2e-aws-gatewayapi-conformance cc @rhamini3 |
|
This is a medium-risk backport that bumps OSSM 3.0.0 to 3.0.1 and Istio v1.24.3 to v1.24.4 to get some CVE fixes as well as a fix not to copy labels from gateways to associated resources (such as the service) and a fix not to inject Istio's CA certificate configmap into namespaces other than the gateway's. /label backport-risk-assessed |
openshift-ci
bot
added
the
backport-risk-assessed
|
e2e-hypershift failed because Let's see if the same error occurs twice. |
|
Pre-merge-verified on a 4.19 cluster, Gatewayclass installs OSSM 3.0.1 and Istio 1.24.4 /label qe-approved |
openshift-ci
bot
added
the
qe-approved
|
@Miciah: This pull request references NE-2103 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.z" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: alebedev87 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
Had some DNS timing failures. /test e2e-aws-operator-techpreview |
Miciah
added
the
jira/valid-bug
openshift-merge-bot
bot
merged commit 97e023f
into
openshift:release-4.19
|
[ART PR BUILD NOTIFIER] Distgit: ose-cluster-ingress-operator |
10 participants
Bump to OSSM 3.0.1 and Istio 1.24.4
Bump from OSSM v3.0.0 to v3.0.1 and from Istio v1.24.3 to v1.24.4.
Also, explicitly set
ENABLE_GATEWAY_API_MANUAL_DEPLOYMENTto "false" on the Istio CR. For Istio 1.24.3, OSSM has a vendor override that sets this option. However, for Istio 1.24.4, the option must be explicitly set.(cherry picked from 47d4152)
Enable Gateway only CA Bundles
Configure Istio to inject the configmaps only into namespaces where gateways exist in order to avoid polluting the whole cluster.
Set one new environment variable in the Istio CR:
In the future, we will set the Istio CR's
trustBundleNameglobal value to specify a custom configmap name. However, we cannot do that yet as thetrustBundleNamefield only exists in OSSM 3.1.This change is related to OSSM-9076.
Modified-by: Miciah Masters miciah.masters@gmail.com
(cherry picked from 41d7add)
Don't copy labels or annotations
Configure Istiod not to copy annotations or labels from gateways onto associated resources, such as the proxy deployment and load-balancer service for a gateway.
This copying behavior is Istio-specific, not part of the Gateway API spec, and could be used to inject unsupported configuration. For example, an end-user could set a service annotation on the gateway in order to configure a load-balancer. Setting annotations on the gateway to configure the load-balancer would not be portable to other Gateway API implementations and would complicate product support.
One new environment variable is set:
This change is related to OSSM-8989.
(cherry picked from 05417af)
Delete old controller-mode setting
Delete the obsolete
PILOT_ENABLE_GATEWAY_CONTROLLER_MODEenvironment variable from the Istiod configuration. This environment variable is no longer recognized in OSSM 3, and the variable has been superseded by EnhancedResourceScoping.(cherry picked from e05309e)
assertDNSRecord: Increase timeout to 10mIncrease the timeout in
assertDNSRecordfor polling for the DNSRecord CR from 1 minute to 10 minutes.The cloud provider can easily take over a minute to provision the load balancer, and the operator cannot create the DNSRecord CR before the load balancer has been provisioned and assigned a host name or address. Consequently, the polling loop could easily reach the 1-minute timeout just on account of the time that it takes to provision the load balancer.
(cherry picked from 2f7da77)
testGatewayAPIManualDeployment: Increase timeoutIncrease the timeout for polling the gateway, and dump the gateway if the test fails.
(cherry picked from f1e445d)
This is manual cherry-pick of #1227 that incorporates #1243 and drops the sailv1 vendor bump, which would bring in a dependency on Go 1.24.