Skip to content

Commit e53470d

Browse files
stefanprodangithub-actions[bot]therealmitchconnors
authored
Update Istio to 1.19.3 (#73)
* Update Istio to 1.19.3 * upgrade sidecar patch * update volumes to match latest istio * update loadtester proxy patch --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Mitch Connors <[email protected]>
1 parent dc05372 commit e53470d

File tree

4 files changed

+75
-27
lines changed

4 files changed

+75
-27
lines changed

‎apps/backend/deployment.patch.yaml‎

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,6 @@
4242
- --proxyLogLevel=warning
4343
- --proxyComponentLogLevel=misc:error
4444
- --log_output_level=default:info
45-
- --concurrency
46-
- "2"
4745
env:
4846
- name: JWT_POLICY
4947
value: third-party-jwt
@@ -71,6 +69,11 @@
7169
valueFrom:
7270
fieldRef:
7371
fieldPath: status.hostIP
72+
- name: ISTIO_CPU_LIMIT
73+
valueFrom:
74+
resourceFieldRef:
75+
divisor: '0'
76+
resource: limits.cpu
7477
- name: PROXY_CONFIG
7578
value: |
7679
{}
@@ -83,6 +86,11 @@
8386
value: backend
8487
- name: ISTIO_META_CLUSTER_ID
8588
value: Kubernetes
89+
- name: ISTIO_META_NODE_NAME
90+
valueFrom:
91+
fieldRef:
92+
apiVersion: v1
93+
fieldPath: spec.nodeName
8694
- name: ISTIO_META_INTERCEPTION_MODE
8795
value: REDIRECT
8896
- name: ISTIO_META_WORKLOAD_NAME
@@ -127,6 +135,12 @@
127135
runAsNonRoot: true
128136
runAsUser: 1337
129137
volumeMounts:
138+
- mountPath: /var/run/secrets/workload-spiffe-uds
139+
name: workload-socket
140+
- mountPath: /var/run/secrets/credential-uds
141+
name: credential-socket
142+
- mountPath: /var/run/secrets/workload-spiffe-credentials
143+
name: workload-certs
130144
- mountPath: /var/run/secrets/istio
131145
name: istiod-ca-cert
132146
- mountPath: /var/lib/istio/data
@@ -158,6 +172,7 @@
158172
- '*'
159173
- -d
160174
- 15090,15021,15020
175+
- --log_output_level=default:info
161176
image: docker.io/istio/proxyv2:1.18.5
162177
name: istio-init
163178
resources:
@@ -180,13 +195,15 @@
180195
runAsGroup: 0
181196
runAsNonRoot: false
182197
runAsUser: 0
183-
- op: add
184-
path: /spec/template/spec/securityContext
185-
value:
186-
fsGroup: 1337
187198
- op: add
188199
path: /spec/template/spec/volumes
189200
value:
201+
- emptyDir: {}
202+
name: workload-socket
203+
- emptyDir: {}
204+
name: credential-socket
205+
- emptyDir: {}
206+
name: workload-certs
190207
- emptyDir:
191208
medium: Memory
192209
name: istio-envoy

‎apps/frontend/deployment.patch.yaml‎

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,6 @@
4242
- --proxyLogLevel=warning
4343
- --proxyComponentLogLevel=misc:error
4444
- --log_output_level=default:info
45-
- --concurrency
46-
- "2"
4745
env:
4846
- name: JWT_POLICY
4947
value: third-party-jwt
@@ -71,6 +69,11 @@
7169
valueFrom:
7270
fieldRef:
7371
fieldPath: status.hostIP
72+
- name: ISTIO_CPU_LIMIT
73+
valueFrom:
74+
resourceFieldRef:
75+
divisor: '0'
76+
resource: limits.cpu
7477
- name: PROXY_CONFIG
7578
value: |
7679
{}
@@ -83,6 +86,11 @@
8386
value: frontend
8487
- name: ISTIO_META_CLUSTER_ID
8588
value: Kubernetes
89+
- name: ISTIO_META_NODE_NAME
90+
valueFrom:
91+
fieldRef:
92+
apiVersion: v1
93+
fieldPath: spec.nodeName
8694
- name: ISTIO_META_INTERCEPTION_MODE
8795
value: REDIRECT
8896
- name: ISTIO_META_WORKLOAD_NAME
@@ -127,6 +135,12 @@
127135
runAsNonRoot: true
128136
runAsUser: 1337
129137
volumeMounts:
138+
- mountPath: /var/run/secrets/workload-spiffe-uds
139+
name: workload-socket
140+
- mountPath: /var/run/secrets/credential-uds
141+
name: credential-socket
142+
- mountPath: /var/run/secrets/workload-spiffe-credentials
143+
name: workload-certs
130144
- mountPath: /var/run/secrets/istio
131145
name: istiod-ca-cert
132146
- mountPath: /var/lib/istio/data
@@ -158,6 +172,7 @@
158172
- '*'
159173
- -d
160174
- 15090,15021,15020
175+
- --log_output_level=default:info
161176
image: docker.io/istio/proxyv2:1.18.5
162177
name: istio-init
163178
resources:
@@ -180,13 +195,15 @@
180195
runAsGroup: 0
181196
runAsNonRoot: false
182197
runAsUser: 0
183-
- op: add
184-
path: /spec/template/spec/securityContext
185-
value:
186-
fsGroup: 1337
187198
- op: add
188199
path: /spec/template/spec/volumes
189200
value:
201+
- emptyDir: {}
202+
name: workload-socket
203+
- emptyDir: {}
204+
name: credential-socket
205+
- emptyDir: {}
206+
name: workload-certs
190207
- emptyDir:
191208
medium: Memory
192209
name: istio-envoy

‎apps/loadtest/deployment.patch.yaml‎

Lines changed: 28 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
- op: add
22
path: /metadata/creationTimestamp
33
value: null
4-
- op: add
5-
path: /spec/strategy
6-
value: {}
74
- op: add
85
path: /spec/template/metadata/annotations/kubectl.kubernetes.io~1default-container
96
value: loadtester
@@ -27,13 +24,13 @@
2724
value: istio
2825
- op: add
2926
path: /spec/template/metadata/labels/service.istio.io~1canonical-name
30-
value: flagger-loadtester
27+
value: loadtester
3128
- op: add
3229
path: /spec/template/metadata/labels/service.istio.io~1canonical-revision
3330
value: latest
3431
- op: replace
3532
path: /spec/template/spec/containers/0/resources/limits/cpu
36-
value: "1"
33+
value: "2"
3734
- op: add
3835
path: /spec/template/spec/containers/1
3936
value:
@@ -45,8 +42,6 @@
4542
- --proxyLogLevel=warning
4643
- --proxyComponentLogLevel=misc:error
4744
- --log_output_level=default:info
48-
- --concurrency
49-
- "2"
5045
env:
5146
- name: JWT_POLICY
5247
value: third-party-jwt
@@ -74,24 +69,34 @@
7469
valueFrom:
7570
fieldRef:
7671
fieldPath: status.hostIP
72+
- name: ISTIO_CPU_LIMIT
73+
valueFrom:
74+
resourceFieldRef:
75+
divisor: '0'
76+
resource: limits.cpu
7777
- name: PROXY_CONFIG
7878
value: |
7979
{}
8080
- name: ISTIO_META_POD_PORTS
8181
value: |-
8282
[
83-
{"name":"http","containerPort":8080}
83+
{"name":"http","containerPort":9898,"protocol":"TCP"}
8484
]
8585
- name: ISTIO_META_APP_CONTAINERS
8686
value: loadtester
8787
- name: ISTIO_META_CLUSTER_ID
8888
value: Kubernetes
89+
- name: ISTIO_META_NODE_NAME
90+
valueFrom:
91+
fieldRef:
92+
apiVersion: v1
93+
fieldPath: spec.nodeName
8994
- name: ISTIO_META_INTERCEPTION_MODE
9095
value: REDIRECT
9196
- name: ISTIO_META_WORKLOAD_NAME
92-
value: flagger-loadtester
97+
value: loadtester
9398
- name: ISTIO_META_OWNER
94-
value: kubernetes://apis/apps/v1/namespaces/prod/deployments/flagger-loadtester
99+
value: kubernetes://apis/apps/v1/namespaces/prod/deployments/loadtester
95100
- name: ISTIO_META_MESH_ID
96101
value: cluster.local
97102
- name: TRUST_DOMAIN
@@ -130,6 +135,12 @@
130135
runAsNonRoot: true
131136
runAsUser: 1337
132137
volumeMounts:
138+
- mountPath: /var/run/secrets/workload-spiffe-uds
139+
name: workload-socket
140+
- mountPath: /var/run/secrets/credential-uds
141+
name: credential-socket
142+
- mountPath: /var/run/secrets/workload-spiffe-credentials
143+
name: workload-certs
133144
- mountPath: /var/run/secrets/istio
134145
name: istiod-ca-cert
135146
- mountPath: /var/lib/istio/data
@@ -161,6 +172,7 @@
161172
- '*'
162173
- -d
163174
- 15090,15021,15020
175+
- --log_output_level=default:info
164176
image: docker.io/istio/proxyv2:1.18.5
165177
name: istio-init
166178
resources:
@@ -183,13 +195,15 @@
183195
runAsGroup: 0
184196
runAsNonRoot: false
185197
runAsUser: 0
186-
- op: add
187-
path: /spec/template/spec/securityContext
188-
value:
189-
fsGroup: 1337
190198
- op: add
191199
path: /spec/template/spec/volumes
192200
value:
201+
- emptyDir: {}
202+
name: workload-socket
203+
- emptyDir: {}
204+
name: credential-socket
205+
- emptyDir: {}
206+
name: workload-certs
193207
- emptyDir:
194208
medium: Memory
195209
name: istio-envoy

‎clusters/my-cluster/istio-version.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ metadata:
66
annotations:
77
kustomize.toolkit.fluxcd.io/ssa: merge
88
data:
9-
version: 1.18.5
9+
version: 1.19.3

0 commit comments

Comments
 (0)