Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added ambient profile installation for istio #2822

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Added ambient profile installation for istio #2822

wants to merge 6 commits into from
+17,496 −54

Conversation

biswajit-9776
Copy link
Contributor

@biswajit-9776 biswajit-9776 commented Jul 28, 2024 •
edited by juliusvonkohout
Loading

Pull Request Template for Kubeflow manifests Issues

✏️ A brief description of the changes

I added common/istio-ambient-1-22 directory that introduces ambient profile installation for istio.

📦 List any dependencies that are required for this change

My PR depends on #

🐛 If this PR is related to an issue, please put the link to the issue here.

#2676

✅ Contributor checklist

You can join the CNCF Slack and access our meetings at the Kubeflow Community website. Our channel on the CNCF Slack is here #kubeflow-platform.

@google-oss-prow Google OSS Prow
Copy link

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kimwnasptd for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@juliusvonkohout
Copy link
Member

Please add a script in /hack
Do you know whether the architecture works? Where do you want to have the L7 proxies based in the discussion in #2676 ?

@peterj can you help here?

@juliusvonkohout juliusvonkohout linked an issue Jul 28, 2024 that may be closed by this pull request
Istio Ambient support #2676
Open
@biswajit-9776
Fixed yaml formats
32b500d 
Signed-off-by: biswajit-9776 <[email protected]>
@biswajit-9776
Fixed yaml formats
2a8bf87 
Signed-off-by: biswajit-9776 <[email protected]>
juliusvonkohout
juliusvonkohout reviewed Jul 29, 2024
View reviewed changes
common/istio-1-22/cluster-local-gateway/base/cluster-local-gateway.yaml
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@hansinikarunarathne can you help here? We should allow to have multiple yamls in a single file separated by "---"

@biswajit-9776
Copy link
Contributor Author

biswajit-9776 commented Jul 29, 2024 •
edited
Loading

As per #2676, we could maybe focus on static namespaces for which a waypoint proxy would get created and we may need to configure a few stuffs. As for dynamic namespaces, I'm not sure if to proceed but as per @peterj we could just use sidecar mode before figuring out the L7 processing...

@juliusvonkohout
Copy link
Member

As per #2676, we could maybe focus on static namespaces for which a waypoint proxy would get created and we may need to configure a few stuffs. As for dynamic namespaces, I'm not sure if to proceed but as per @peterj we could just use sidecar mode before figuring out the L7 processing...

If we can run it in parallel, yes let's do so.

@peterj
Copy link

peterj commented Jul 29, 2024

As I suggested in #2676, I think it would be safer to follow these steps first as a preparation for a move to ambient:

  1. Migrate to Kubernetes Gateway API - this would involve installing K8s gateway API and replacing VirtualService resources with HTTPRoutes.
  2. Move to the latest istio (1.22.3), continue with profile: default (or whichever was used).

After this, you could commence the move to ambient by identifying the components needing L7 proxies, deploying them and then moving to ambient (profile=ambient).

@biswajit-9776
Copy link
Contributor Author

Yes, @juliusvonkohout should I migrate to Gateway API in this PR or make another one?

@juliusvonkohout
Copy link
Member

Yes, @juliusvonkohout should I migrate to Gateway API in this PR or make another one?

If it works also with the legacy and istio-cni i prefer a separate PR.

@juliusvonkohout
Copy link
Member

juliusvonkohout commented Jul 30, 2024 •
edited
Loading

As I suggested in #2676, I think it would be safer to follow these steps first as a preparation for a move to ambient:

1. Migrate to Kubernetes Gateway API - this would involve installing K8s gateway API and replacing VirtualService resources with HTTPRoutes.

2. Move to the latest istio (1.22.3), continue with profile: default (or whichever was used).

After this, you could commence the move to ambient by identifying the components needing L7 proxies, deploying them and then moving to ambient (profile=ambient).

Yes lets do so. That means

  1. in a separate PR the istio upgrade
  2. Afterwards ina nother PR the k8s gateway API
  3. adding the ambient option

@juliusvonkohout juliusvonkohout self-assigned this Jul 30, 2024
@kimwnasptd
Copy link
Member

Hey @biswajit-9776 @peterj, could you also add instructions in the description of the PR on how to also test this PR?

@biswajit-9776
Copy link
Contributor Author

Hey @kimwnasptd thanks for hopping in, apologies from my side as I have been working on PSS workflows since last week.
As for the testing of this PR, the pipelines and m2m tests in our present workflow need to be modified for Istio using ambient profile.
Istio with ambient profile doesn't use the ingress gateway and would be using the Kubernetes Gateway API. So, the port forwarding tests in current github workflows need to be modified accordingly and I will post the findings in my local system accordingly.

@kimwnasptd kimwnasptd mentioned this pull request Oct 10, 2024
Open
@github-actions GitHub Actions
Copy link

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@juliusvonkohout
Copy link
Member

/lifecycle frozen

@google-oss-prow Google OSS Prow
Copy link

@juliusvonkohout: The lifecycle/frozen label cannot be applied to Pull Requests.

In response to this:

/lifecycle frozen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@juliusvonkohout juliusvonkohout juliusvonkohout left review comments

@kimwnasptd kimwnasptd Awaiting requested review from kimwnasptd

Assignees

@juliusvonkohout juliusvonkohout

Labels
size/XXL
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Istio Ambient support
4 participants
@biswajit-9776 @juliusvonkohout @peterj @kimwnasptd