Skip to content

Commit 451cacb

Browse files
author
github-actions
committed
Merge tag '1.24.5' into tetratefips-release-1.24
Istio release 1.24.5
2 parents adfa49e + 8348c27 commit 451cacb

File tree

46 files changed

+416
-53
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+416
-53
lines changed

‎.devcontainer/devcontainer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "istio build-tools",
3-
"image": "gcr.io/istio-testing/build-tools:release-1.24-7d1c19cf1d83ca3cfdb7cc7b90dd807fe41653da",
3+
"image": "gcr.io/istio-testing/build-tools:release-1.24-bccd228953b7abf90170da1419699d38e95329fb",
44
"privileged": true,
55
"remoteEnv": {
66
"USE_GKE_GCLOUD_AUTH_PLUGIN": "True",

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,3 +63,4 @@ var/
6363
.DS_Store
6464
/manifests/charts/**/charts/
6565
/manifests/charts/**/Chart.lock
66+
/cni/pkg/plugin/istio-cni.log

‎Makefile.core.mk

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ endif
4949
export VERSION
5050

5151
# Base version of Istio image to use
52-
BASE_VERSION ?= 1.24-2025-03-04T19-01-29
52+
BASE_VERSION ?= 1.24-2025-04-04T19-02-09
5353
ISTIO_BASE_REGISTRY ?= gcr.io/istio-release
5454

5555
export GO111MODULE ?= on

‎cni/pkg/cmd/root.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -262,6 +262,7 @@ func constructConfig() (*config.Config, error) {
262262
MonitoringPort: viper.GetInt(constants.MonitoringPort),
263263

264264
ExcludeNamespaces: viper.GetString(constants.ExcludeNamespaces),
265+
PodNamespace: viper.GetString(constants.PodNamespace),
265266
ZtunnelUDSAddress: viper.GetString(constants.ZtunnelUDSAddress),
266267

267268
AmbientEnabled: viper.GetBool(constants.AmbientEnabled),

‎cni/pkg/config/config.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,9 @@ type InstallConfig struct {
4848
// Comma-separated list of K8S namespaces that CNI should ignore
4949
ExcludeNamespaces string
5050

51+
// Singular namespace that the istio CNI node agent resides in
52+
PodNamespace string
53+
5154
// KUBERNETES_SERVICE_PROTOCOL
5255
K8sServiceProtocol string
5356
// KUBERNETES_SERVICE_HOST
@@ -130,6 +133,7 @@ func (c InstallConfig) String() string {
130133
b.WriteString("SkipTLSVerify: " + fmt.Sprint(c.SkipTLSVerify) + "\n")
131134

132135
b.WriteString("ExcludeNamespaces: " + fmt.Sprint(c.ExcludeNamespaces) + "\n")
136+
b.WriteString("PodNamespace: " + fmt.Sprint(c.PodNamespace) + "\n")
133137
b.WriteString("K8sServiceProtocol: " + c.K8sServiceProtocol + "\n")
134138
b.WriteString("K8sServiceHost: " + c.K8sServiceHost + "\n")
135139
b.WriteString("K8sServicePort: " + fmt.Sprint(c.K8sServicePort) + "\n")

‎cni/pkg/constants/constants.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ const (
3232
CNIEventSocket = "cni-event-address"
3333
CNIAgentRunDir = "cni-agent-run-dir"
3434
ExcludeNamespaces = "exclude-namespaces"
35+
PodNamespace = "pod-namespace"
3536
AmbientEnabled = "ambient-enabled"
3637
AmbientDNSCapture = "ambient-dns-capture"
3738
AmbientIPv6 = "ambient-ipv6"
@@ -62,6 +63,8 @@ const (
6263
UDSLogPath = "/log"
6364
CNIEventSocketName = "pluginevent.sock"
6465
LogUDSSocketName = "log.sock"
66+
LocalRollingLogName = "istio-cni.log"
67+
RollingLogMaxSizeMB = 10
6568
CNIPluginKubeconfName = "istio-cni-kubeconfig"
6669
// K8s liveness and readiness endpoints
6770
LivenessEndpoint = "/healthz"

‎cni/pkg/install/cniconfig.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ func createCNIConfigFile(ctx context.Context, cfg *config.InstallConfig) (string
3737
CNIAgentRunDir: cfg.CNIAgentRunDir,
3838
AmbientEnabled: cfg.AmbientEnabled,
3939
ExcludeNamespaces: strings.Split(cfg.ExcludeNamespaces, ","),
40+
PodNamespace: cfg.PodNamespace,
4041
}
4142

4243
pluginConfig.Name = "istio-cni"

‎cni/pkg/install/cniconfig_test.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -366,6 +366,7 @@ const (
366366
"name": "istio-cni",
367367
"type": "istio-cni",
368368
"plugin_log_level": "__LOG_LEVEL__",
369+
"pod_namespace": "__POD_NAMESPACE__",
369370
"kubernetes": {
370371
"kubeconfig": "__KUBECONFIG_FILENAME__",
371372
"cni_bin_dir": "/path/cni/bin"
@@ -451,13 +452,15 @@ func TestCreateCNIConfigFile(t *testing.T) {
451452
ChainedCNIPlugin: c.chainedCNIPlugin,
452453
PluginLogLevel: "debug",
453454
CNIAgentRunDir: kubeconfigFilename,
455+
PodNamespace: "my-namespace",
454456
}
455457

456458
cfg := config.InstallConfig{
457459
CNIConfName: c.specifiedConfName,
458460
ChainedCNIPlugin: c.chainedCNIPlugin,
459461
PluginLogLevel: "debug",
460462
CNIAgentRunDir: kubeconfigFilename,
463+
PodNamespace: "my-namespace",
461464
}
462465
test := func(cfg config.InstallConfig) func(t *testing.T) {
463466
return func(t *testing.T) {

‎cni/pkg/install/testdata/bridge.conf.golden

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
"ipam": {},
2828
"name": "istio-cni",
2929
"plugin_log_level": "debug",
30+
"pod_namespace": "my-namespace",
3031
"type": "istio-cni"
3132
}
3233
]

‎cni/pkg/install/testdata/istio-cni.conf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,6 @@
99
"ambient_enabled": false,
1010
"exclude_namespaces": [
1111
""
12-
]
12+
],
13+
"pod_namespace": "my-namespace"
1314
}

‎cni/pkg/install/testdata/list-with-istio.conflist.golden

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
"ipam": {},
3838
"name": "istio-cni",
3939
"plugin_log_level": "debug",
40+
"pod_namespace": "my-namespace",
4041
"type": "istio-cni"
4142
}
4243
]

‎cni/pkg/install/testdata/list.conflist.golden

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
"ipam": {},
3838
"name": "istio-cni",
3939
"plugin_log_level": "debug",
40+
"pod_namespace": "my-namespace",
4041
"type": "istio-cni"
4142
}
4243
]

‎cni/pkg/plugin/plugin.go

Lines changed: 39 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
"path/filepath"
2525
"runtime/debug"
2626
"strconv"
27+
"strings"
2728
"time"
2829

2930
"github.com/containernetworking/cni/pkg/skel"
@@ -66,6 +67,7 @@ type Config struct {
6667
CNIAgentRunDir string `json:"cni_agent_run_dir"`
6768
AmbientEnabled bool `json:"ambient_enabled"`
6869
ExcludeNamespaces []string `json:"exclude_namespaces"`
70+
PodNamespace string `json:"pod_namespace"`
6971
}
7072

7173
// K8sArgs is the valid CNI_ARGS used for Kubernetes
@@ -109,6 +111,8 @@ func parseConfig(stdin []byte) (*Config, error) {
109111
return &conf, nil
110112
}
111113

114+
// Logging with CNI plugins is special - we *cannot* log to stdout, as the CNI spec uses stdin/stdout to pass context between invoked plugins.
115+
// So, we log to a rolling logfile, and also forward logs via UDS to the node agent (if available)
112116
func GetLoggingOptions(cfg *Config) *log.Options {
113117
loggingOptions := log.DefaultOptions()
114118
loggingOptions.OutputPaths = []string{"stderr"}
@@ -120,6 +124,10 @@ func GetLoggingOptions(cfg *Config) *log.Options {
120124
if file.Exists(udsAddr) {
121125
loggingOptions.WithTeeToUDS(udsAddr, constants.UDSLogPath)
122126
}
127+
128+
// Also tee to a rolling log on the node's local filesystem, in case the UDS server is down.
129+
loggingOptions.WithTeeToRollingLocal(filepath.Join(cfg.CNIAgentRunDir, constants.LocalRollingLogName), constants.RollingLogMaxSizeMB)
130+
123131
// Override plugin log level based on their config. Not we use "all" (OverrideScopeName) since there is no scoping in the plugin.
124132
if cfg.PluginLogLevel != "" {
125133
loggingOptions.SetDefaultOutputLevel(log.OverrideScopeName, log.StringToLevel(cfg.PluginLogLevel))
@@ -222,15 +230,18 @@ func doAddRun(args *skel.CmdArgs, conf *Config, kClient kubernetes.Interface, ru
222230
cniEventAddr := filepath.Join(conf.CNIAgentRunDir, constants.CNIEventSocketName)
223231
cniClient := newCNIClient(cniEventAddr, constants.CNIAddEventPath)
224232
if err = PushCNIEvent(cniClient, args, prevResIps, podName, podNamespace); err != nil {
225-
log.Errorf("istio-cni cmdAdd failed to signal node Istio CNI agent: %s", err)
226-
return err
233+
// return a more informative error in the pod event log if CNI plugin fails
234+
wrapErr := fmt.Errorf("istio-cni cmdAdd failed to contact node Istio CNI agent: %s", err)
235+
return wrapErr
227236
}
228237
return nil
229238
}
230239
log.Debugf("istio-cni ambient cmdAdd podName: %s - not ambient enabled, ignoring", podName)
231240
}
232241
// End ambient plugin logic
233242

243+
maybeCNIPod := string(k8sArgs.K8S_POD_NAME)
244+
maybeCNINS := string(k8sArgs.K8S_POD_NAMESPACE)
234245
pi := &PodInfo{}
235246
var k8sErr error
236247
for attempt := 1; attempt <= podRetrievalMaxRetries; attempt++ {
@@ -239,6 +250,32 @@ func doAddRun(args *skel.CmdArgs, conf *Config, kClient kubernetes.Interface, ru
239250
break
240251
}
241252
log.Debugf("Failed to get %s/%s pod info: %v", podNamespace, podName, k8sErr)
253+
254+
// Failsafe - if we get here, we could be in a state where
255+
// 1. We are being upgraded - `istio-cni` node agent pod is gone
256+
// 2. This plugin was left in place to stall pod spawns until the
257+
// replacement arrives.
258+
// 3. This plugin can't contact the K8S API server (creds expired/invalid)
259+
// 4. The pod this plugin would be blocking by returning this error
260+
// *is* our replacement `istio-cni` pod (which would refresh our creds)
261+
//
262+
// So, if we can't contact the K8S API server at all, fall back to checking the
263+
// K8S_POD/K8S_NAMESPACE values from the CNI layer, and let this pod through
264+
// if it looks like it might be our `istio-cni` node agent.
265+
//
266+
// We could do this check unconditionally above, but it seems smarter to only
267+
// fall back to this (lightly) relaxed check when we know we are in a degraded state.
268+
//
269+
// Is this fail open? Not really, the K8S args come from the cluster's CNI and are as-authoritative
270+
// as the hard query we would otherwise make against the API.
271+
//
272+
// TODO NRI could probably give us more identifying information here OOB from k8s.
273+
if strings.HasPrefix(maybeCNIPod, "istio-cni-node-") &&
274+
maybeCNINS == conf.PodNamespace {
275+
log.Infof("in a degraded state and %v looks like our own agent pod, skipping", maybeCNIPod)
276+
return nil
277+
}
278+
242279
time.Sleep(podRetrievalInterval)
243280
}
244281
if k8sErr != nil {

‎cni/test/testdata/expected/10-calico.conflist-istioconfig

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
"ipam": {},
3535
"name": "istio-cni",
3636
"plugin_log_level": "debug",
37+
"pod_namespace": "",
3738
"type": "istio-cni"
3839
}
3940
]

‎cni/test/testdata/expected/YYY-istio-cni.conf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,6 @@
99
"ambient_enabled": false,
1010
"exclude_namespaces": [
1111
"istio-system"
12-
]
12+
],
13+
"pod_namespace": ""
1314
}

‎cni/test/testdata/expected/minikube_cni.conflist.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
"ipam": {},
3232
"name": "istio-cni",
3333
"plugin_log_level": "debug",
34+
"pod_namespace": "",
3435
"type": "istio-cni"
3536
}
3637
]

‎common/.commonfiles.sha

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
6d1ea5c54f7aad9c31e8ff058772f9f44cbe08e0
1+
2a57949e8949678850564daef685829ceb137ed5

‎common/scripts/setup_env.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ fi
7575
TOOLS_REGISTRY_PROVIDER=${TOOLS_REGISTRY_PROVIDER:-gcr.io}
7676
PROJECT_ID=${PROJECT_ID:-istio-testing}
7777
if [[ "${IMAGE_VERSION:-}" == "" ]]; then
78-
IMAGE_VERSION=release-1.24-7d1c19cf1d83ca3cfdb7cc7b90dd807fe41653da
78+
IMAGE_VERSION=release-1.24-bccd228953b7abf90170da1419699d38e95329fb
7979
fi
8080
if [[ "${IMAGE_NAME:-}" == "" ]]; then
8181
IMAGE_NAME=build-tools

‎go.mod

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,11 +90,12 @@ require (
9090
google.golang.org/genproto/googleapis/rpc v0.0.0-20240930140551-af27646dc61f
9191
google.golang.org/grpc v1.67.1
9292
google.golang.org/protobuf v1.34.2
93+
gopkg.in/natefinch/lumberjack.v2 v2.2.1
9394
gopkg.in/yaml.v2 v2.4.0
9495
gopkg.in/yaml.v3 v3.0.1
9596
helm.sh/helm/v3 v3.16.1
96-
istio.io/api v1.24.4-0.20250310185707-46b0c1b3e4e4
97-
istio.io/client-go v1.24.4-0.20250310190306-37b46c6daa9d
97+
istio.io/api v1.24.5-0.20250409200717-4933c1da972e
98+
istio.io/client-go v1.24.5-0.20250409201417-1715c4db04bc
9899
k8s.io/api v0.31.1
99100
k8s.io/apiextensions-apiserver v0.31.1
100101
k8s.io/apimachinery v0.31.1

‎go.sum

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -598,6 +598,8 @@ gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
598598
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
599599
gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
600600
gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
601+
gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
602+
gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
601603
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
602604
gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
603605
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
@@ -612,10 +614,10 @@ helm.sh/helm/v3 v3.16.1 h1:cER6tI/8PgUAsaJaQCVBUg3VI9KN4oVaZJgY60RIc0c=
612614
helm.sh/helm/v3 v3.16.1/go.mod h1:r+xBHHP20qJeEqtvBXMf7W35QDJnzY/eiEBzt+TfHps=
613615
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
614616
honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
615-
istio.io/api v1.24.4-0.20250310185707-46b0c1b3e4e4 h1:0ZgJiQUNTGbgGQtJ9sfWctqDbMaLutruYXtkAl9gLQI=
616-
istio.io/api v1.24.4-0.20250310185707-46b0c1b3e4e4/go.mod h1:MQnRok7RZ20/PE56v0LxmoWH0xVxnCQPNuf9O7PAN1I=
617-
istio.io/client-go v1.24.4-0.20250310190306-37b46c6daa9d h1:ZQ4yFn1BwC4id6WXl6oTtKgFO47wcOFe8OBaLJBMII4=
618-
istio.io/client-go v1.24.4-0.20250310190306-37b46c6daa9d/go.mod h1:LTWLnhwfH/AZGJtdlzpWy4YdTAv7E0qGKtECN0c4aeM=
617+
istio.io/api v1.24.5-0.20250409200717-4933c1da972e h1:5LzLnhNQtSAfK/rsW5h+hlJtUM0LCFJwQwqwtR3UiD4=
618+
istio.io/api v1.24.5-0.20250409200717-4933c1da972e/go.mod h1:MQnRok7RZ20/PE56v0LxmoWH0xVxnCQPNuf9O7PAN1I=
619+
istio.io/client-go v1.24.5-0.20250409201417-1715c4db04bc h1:9GZ8yyhY6Q5ozjMO51yt3eAgor+uoEDsVUVfGmAfP1M=
620+
istio.io/client-go v1.24.5-0.20250409201417-1715c4db04bc/go.mod h1:2Gx1QpUyGeB58ndq28yHcWV4fIHeO8F5T+ox2sPT2+E=
619621
k8s.io/api v0.31.1 h1:Xe1hX/fPW3PXYYv8BlozYqw63ytA92snr96zMW9gWTU=
620622
k8s.io/api v0.31.1/go.mod h1:sbN1g6eY6XVLeqNsZGLnI5FwVseTrZX7Fv3O26rhAaI=
621623
k8s.io/apiextensions-apiserver v0.31.1 h1:L+hwULvXx+nvTYX/MKM3kKMZyei+UiSXQWciX/N6E40=

‎istio.deps

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
"name": "PROXY_REPO_SHA",
55
"repoName": "proxy",
66
"file": "",
7-
"lastStableSHA": "edcc8c366932f463850cb2f2e5f862ebbeee7914"
7+
"lastStableSHA": "f72dcc1d00fe08bfbf57d6603fd8424d2fb362ca"
88
},
99
{
1010
"_comment": "",
1111
"name": "ZTUNNEL_REPO_SHA",
1212
"repoName": "ztunnel",
1313
"file": "",
14-
"lastStableSHA": "9d2fe78f022f4616e43feb006f077310ef21b932"
14+
"lastStableSHA": "70c638ecb14a7b4e161af6a3d275f774e87630ef"
1515
}
1616
]

‎istioctl/pkg/writer/ztunnel/configdump/api.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,7 @@ type CertsDump struct {
119119
Identity string `json:"identity"`
120120
State string `json:"state"`
121121
CertChain []*Cert `json:"certChain"`
122+
RootCert []*Cert `json:"rootCerts"`
122123
}
123124

124125
type Cert struct {

‎istioctl/pkg/writer/ztunnel/configdump/certificates.go

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,18 +63,26 @@ func (c *ConfigWriter) PrintSecretSummary() error {
6363
fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%v\t%v\t%v\n",
6464
secret.Identity, valueOrNA(""), secret.State, false, valueOrNA(""), valueOrNA(""), valueOrNA(""))
6565
} else {
66+
// Before, the root was part of the certChain.
67+
legacyFormat := len(secret.RootCert) == 0
6668
for i, ca := range secret.CertChain {
6769
t := "Intermediate"
6870
if i == 0 {
6971
t = "Leaf"
70-
} else if i == len(secret.CertChain)-1 {
72+
} else if i == len(secret.CertChain)-1 && legacyFormat {
7173
t = "Root"
7274
}
7375
n := new(big.Int)
7476
n, _ = n.SetString(ca.SerialNumber, 10)
7577
fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%x\t%v\t%v\n",
7678
secret.Identity, t, secret.State, certNotExpired(ca), n, valueOrNA(ca.ExpirationTime), valueOrNA(ca.ValidFrom))
7779
}
80+
for _, ca := range secret.RootCert {
81+
n := new(big.Int)
82+
n, _ = n.SetString(ca.SerialNumber, 10)
83+
fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%x\t%v\t%v\n",
84+
secret.Identity, "Root", secret.State, certNotExpired(ca), n, valueOrNA(ca.ExpirationTime), valueOrNA(ca.ValidFrom))
85+
}
7886
}
7987
}
8088
return w.Flush()

‎licenses/gopkg.in/natefinch/lumberjack.v2/LICENSE

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
The MIT License (MIT)
2+
3+
Copyright (c) 2014 Nate Finch
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎manifests/charts/istio-cni/templates/configmap-cni.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ data:
2020
CNI_CONF_NAME: {{ .Values.cniConfFileName }} # Name of the CNI config file to create. Only override if you know the exact path your CNI requires..
2121
{{- end }}
2222
CHAINED_CNI_PLUGIN: {{ .Values.chained | quote }}
23-
EXCLUDED_NAMESPACES: "{{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
24-
REPAIR_ENABLED: {{ .Values.chained | quote }}
23+
EXCLUDE_NAMESPACES: "{{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
24+
REPAIR_ENABLED: {{ .Values.repair.enabled | quote }}
2525
REPAIR_LABEL_PODS: {{ .Values.repair.labelPods | quote }}
2626
REPAIR_DELETE_PODS: {{ .Values.repair.deletePods | quote }}
2727
REPAIR_REPAIR_PODS: {{ .Values.repair.repairPods | quote }}

‎manifests/charts/istio-cni/templates/daemonset.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@
99
kind: DaemonSet
1010
apiVersion: apps/v1
1111
metadata:
12+
# Note that this is templated but evaluates to a fixed name
13+
# which the CNI plugin may fall back onto in some failsafe scenarios.
14+
# if this name is changed, CNI plugin logic that checks for this name
15+
# format should also be updated.
1216
name: {{ template "name" . }}-node
1317
namespace: {{ .Release.Namespace }}
1418
labels:

‎pilot/pkg/networking/core/httproute.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ func (configgen *ConfigGeneratorImpl) BuildHTTPRoutes(
116116
// TODO: trace decorators, inbound timeouts
117117
func buildSidecarInboundHTTPRouteConfig(lb *ListenerBuilder, cc inboundChainConfig) *route.RouteConfiguration {
118118
traceOperation := telemetry.TraceOperation(string(cc.telemetryMetadata.InstanceHostname), cc.port.Port)
119-
defaultRoute := istio_route.BuildDefaultHTTPInboundRoute(lb.node, cc.clusterName, traceOperation)
119+
defaultRoute := istio_route.BuildDefaultHTTPInboundRoute(lb.node, cc.clusterName, traceOperation, cc.port.Protocol)
120120

121121
inboundVHost := &route.VirtualHost{
122122
Name: inboundVirtualHostPrefix + strconv.Itoa(cc.port.Port), // Format: "inbound|http|%d"

0 commit comments

Comments
 (0)