Skip to content

Commit 1e93ad7

Browse files
thegridmanthegridman
authored
Fix bug where Operator fails to connecting to Coherence Pods when using Istio (#691)
1 parent 1d62e05 commit 1e93ad7

23 files changed

+254
-54
lines changed

‎.dockerignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11

2+
.github/
3+
.idea/
4+
artifacts/
25
build/
36
converter/
47
dashboards/

‎.github/workflows/istio-tests.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,7 @@ jobs:
130130
make deploy
131131
ISTIO_VERSION=${{ matrix.istioVersion }} make install-istio
132132
make e2e-client-test
133+
make e2e-test
133134
make undeploy
134135
ISTIO_VERSION=${{ matrix.istioVersion }} make uninstall-istio
135136

‎.github/workflows/release.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,17 @@ jobs:
9797
asset_name: coherence-operator.yaml
9898
asset_content_type: text/plain
9999

100+
- name: Upload Restricted Release Yaml
101+
id: upload-release-yaml
102+
uses: actions/upload-release-asset@v1
103+
env:
104+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
105+
with:
106+
upload_url: ${{ github.event.release.upload_url }}
107+
asset_path: /tmp/coherence-operator/_output/coherence-operator-restricted.yaml
108+
asset_name: coherence-operator-restricted.yaml
109+
asset_content_type: text/plain
110+
100111
- name: Upload Release CRD
101112
id: upload-release-crd
102113
uses: actions/upload-release-asset@v1

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ bin/
2626
bundle/
2727
temp/
2828

29+
# OpenShift pre-flight
30+
artifacts/
31+
preflight.log
32+
2933
# licensed
3034
.licenses/
3135
meta/

‎Makefile

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -773,6 +773,7 @@ copyright: ## Check copyright headers
773773
@java -cp hack/glassfish-copyright-maven-plugin-2.1.jar \
774774
org.glassfish.copyright.Copyright -C hack/copyright.txt \
775775
-X .adoc \
776+
-X artifacts/ \
776777
-X bin/ \
777778
-X build/ \
778779
-X clientset/ \
@@ -812,6 +813,7 @@ copyright: ## Check copyright headers
812813
-X mvnw \
813814
-X mvnw.cmd \
814815
-X .png \
816+
-X preflight.log \
815817
-X PROJECT \
816818
-X .sh \
817819
-X tanzu/package/package.yml \
@@ -1612,6 +1614,9 @@ $(BUILD_MANIFESTS_PKG): $(TOOLS_BIN)/kustomize $(TOOLS_BIN)/yq
16121614
cp config/namespace/namespace.yaml $(BUILD_OUTPUT)/coherence-operator.yaml
16131615
$(KUSTOMIZE) build $(BUILD_DEPLOY)/default >> $(BUILD_OUTPUT)/coherence-operator.yaml
16141616
$(SED) -e 's/name: coherence-operator-env-vars-.*/name: coherence-operator-env-vars/g' $(BUILD_OUTPUT)/coherence-operator.yaml
1617+
$(KUSTOMIZE) build $(BUILD_DEPLOY)/overlays/restricted >> $(BUILD_OUTPUT)/coherence-operator-restricted.yaml
1618+
$(SED) -e 's/name: coherence-operator-env-vars-.*/name: coherence-operator-env-vars/g' $(BUILD_OUTPUT)//coherence-operator-restricted.yaml
1619+
$(SED) -e 's/ClusterRole/Role/g' $(BUILD_OUTPUT)//coherence-operator-restricted.yaml
16151620
cd $(BUILD_MANIFESTS)/crd && $(TOOLS_BIN)/yq --no-doc -s '.metadata.name + ".yaml"' temp.yaml
16161621
rm $(BUILD_MANIFESTS)/crd/temp.yaml
16171622
mv $(BUILD_MANIFESTS)/crd/coherence.coherence.oracle.com.yaml $(BUILD_MANIFESTS)/crd/coherence.oracle.com_coherence.yaml
@@ -2404,15 +2409,23 @@ uninstall-metallb: ## Uninstall MetalLB
24042409
# ----------------------------------------------------------------------------------------------------------------------
24052410
.PHONY: install-istio
24062411
install-istio: delete-istio-config get-istio ## Install the latest version of Istio into k8s (or override the version using the ISTIO_VERSION env var)
2412+
ifeq (true,$(ISTIO_USE_CONFIG))
24072413
$(ISTIO_HOME)/bin/istioctl install -f $(BUILD_OUTPUT)/istio-config.yaml -y
24082414
kubectl -n istio-system wait --for condition=available deployment.apps/istiod-$(ISTIO_REVISION)
2415+
else
2416+
$(ISTIO_HOME)/bin/istioctl install --set profile=demo -y
2417+
kubectl -n istio-system wait --for condition=available deployment.apps/istiod
2418+
endif
24092419
kubectl -n istio-system wait --for condition=available deployment.apps/istio-ingressgateway
24102420
kubectl -n istio-system wait --for condition=available deployment.apps/istio-egressgateway
24112421
kubectl apply -f $(SCRIPTS_DIR)/istio-strict.yaml
24122422
kubectl -n $(OPERATOR_NAMESPACE) apply -f $(SCRIPTS_DIR)/istio-operator.yaml
24132423
kubectl label namespace $(OPERATOR_NAMESPACE) istio-injection=enabled --overwrite=true
2424+
kubectl label namespace $(OPERATOR_NAMESPACE) istio.io/rev=$(ISTIO_REVISION) --overwrite=true
24142425
kubectl label namespace $(OPERATOR_NAMESPACE_CLIENT) istio-injection=enabled --overwrite=true
2426+
kubectl label namespace $(OPERATOR_NAMESPACE_CLIENT) istio.io/rev=$(ISTIO_REVISION) --overwrite=true
24152427
kubectl label namespace $(CLUSTER_NAMESPACE) istio-injection=enabled --overwrite=true
2428+
kubectl label namespace $(CLUSTER_NAMESPACE) istio.io/rev=$(ISTIO_REVISION) --overwrite=true
24162429
kubectl apply -f $(ISTIO_HOME)/samples/addons
24172430

24182431
# ----------------------------------------------------------------------------------------------------------------------

‎api/v1/coherenceresourcespec_types.go

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2020, 2024, Oracle and/or its affiliates.
2+
* Copyright (c) 2020, 2025, Oracle and/or its affiliates.
33
* Licensed under the Universal Permissive License v 1.0 as shown at
44
* http://oss.oracle.com/licenses/upl.
55
*/
@@ -671,20 +671,16 @@ func (in *CoherenceResourceSpec) CreatePodTemplateSpec(deployment CoherenceResou
671671
podLabels[k] = v
672672
}
673673

674-
var annotations map[string]string
674+
annotations := make(map[string]string)
675+
// Add the default Istio config annotation.
676+
// Adding this first allows it to be overridden in Coherence or CoherenceJob spec
677+
annotations[AnnotationIstioConfig] = DefaultIstioConfigAnnotationValue
678+
675679
globalAnnotations := deployment.CreateGlobalAnnotations()
676-
if globalAnnotations != nil {
677-
if annotations == nil {
678-
annotations = make(map[string]string)
679-
}
680-
for k, v := range globalAnnotations {
681-
annotations[k] = v
682-
}
680+
for k, v := range globalAnnotations {
681+
annotations[k] = v
683682
}
684683
if in.Annotations != nil {
685-
if annotations == nil {
686-
annotations = make(map[string]string)
687-
}
688684
for k, v := range in.Annotations {
689685
annotations[k] = v
690686
}

‎api/v1/common_test.go

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -450,9 +450,13 @@ func createMinimalExpectedPodSpec(deployment coh.CoherenceResource) corev1.PodTe
450450
initContainer.Image = *operatorImage
451451
}
452452

453+
annotations := make(map[string]string)
454+
annotations[coh.AnnotationIstioConfig] = coh.DefaultIstioConfigAnnotationValue
455+
453456
podTemplate := corev1.PodTemplateSpec{
454457
ObjectMeta: metav1.ObjectMeta{
455-
Labels: podLabels,
458+
Labels: podLabels,
459+
Annotations: annotations,
456460
},
457461
Spec: corev1.PodSpec{
458462
InitContainers: []corev1.Container{initContainer},

‎api/v1/constants.go

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2020, 2024, Oracle and/or its affiliates.
2+
* Copyright (c) 2020, 2025, Oracle and/or its affiliates.
33
* Licensed under the Universal Permissive License v 1.0 as shown at
44
* http://oss.oracle.com/licenses/upl.
55
*/
@@ -64,6 +64,12 @@ const (
6464
AnnotationFeatureSuspend = "com.oracle.coherence.operator/feature.suspend"
6565
// AnnotationOperatorVersion is the Operator version annotations
6666
AnnotationOperatorVersion = "com.oracle.coherence.operator/version"
67+
// AnnotationIstioConfig is the Istio config annotation applied to Pods.
68+
AnnotationIstioConfig = "proxy.istio.io/config"
69+
// DefaultIstioConfigAnnotationValue is the default for the istio config annotation.
70+
// This makes the Istio Sidecar the first container in the Pod to allow it to ideally
71+
// be started before the Coherence container
72+
DefaultIstioConfigAnnotationValue = "{ \"holdApplicationUntilProxyStarts\": true }"
6773

6874
// DefaultServiceAccount is the default k8s service account name.
6975
DefaultServiceAccount = "default"

‎config/manager/no-jobs-patch.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
- op: add
2+
path: /spec/template/spec/containers/0/args/-
3+
value:
4+
- --install-job-crd=false

‎config/overlays/restricted/cluster_role.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# -------------------------------------------------------------
2+
# This is the Cluster Roles required by the Coherence Operator
3+
# to self-manage its CRDs and Web-Hooks.
4+
# -------------------------------------------------------------
5+
apiVersion: rbac.authorization.k8s.io/v1
6+
kind: ClusterRole
7+
metadata:
8+
name: crd-webhook-install-role
9+
$patch: delete

0 commit comments

Comments
 (0)