Upgraded istio to v1.19.10 (kubeflow#2743)

* Upgraded istio to v1.19.10

Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com>

* Upgraded istio-cni to v1.19.10

Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com>

---------

Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com>

.github/workflows/kserve_cni_test.yaml

@@ -6,7 +6,7 @@ on:
       - tests/gh-actions/kind-cluster.yaml
       - tests/gh-actions/install_kind.sh
       - tests/gh-actions/install_kustomize.sh
-      - common/istio-cni-1-18/**
+      - common/istio-cni-1-19/**
       - tests/gh-actions/install_cert_manager.sh
       - common/cert-manager/**
       - tests/gh-actions/install_knative-cni.sh

.github/workflows/notebook_controller_m2m_test.yaml

@@ -38,7 +38,7 @@ jobs:
       run: ./tests/gh-actions/install_istio_with_ext_auth.sh*
 
     - name: Install kubeflow-istio-resources
-      run: kustomize build common/istio-1-18/kubeflow-istio-resources/base | kubectl apply -f -
+      run: kustomize build common/istio-1-19/kubeflow-istio-resources/base | kubectl apply -f -
 
     - name: Install KF Multi Tenancy
       run: ./tests/gh-actions/install_multi_tenancy.sh

.github/workflows/pipeline_test.yaml

@@ -49,7 +49,7 @@ jobs:
         run: ./tests/gh-actions/install_multi_tenancy.sh
 
       - name: Install kubeflow-istio-resources
-        run: kustomize build common/istio-1-18/kubeflow-istio-resources/base | kubectl apply -f -
+        run: kustomize build common/istio-1-19/kubeflow-istio-resources/base | kubectl apply -f -
 
       - name: Create KF Profile
         run: kustomize build common/user-namespace/base | kubectl apply -f -

README.md

@@ -64,7 +64,7 @@ used from the different projects of Kubeflow:
 
 | Component | Local Manifests Path | Upstream Revision |
 | - | - | - |
-| Istio | common/istio-1-18 | [1.18.7](https://github.com/istio/istio/releases/tag/1.18.7) |
+| Istio | common/istio-1-19 | [1.19.10](https://github.com/istio/istio/releases/tag/1.19.10) |
 | Knative | common/knative/knative-serving <br /> common/knative/knative-eventing | [v1.12.4](https://github.com/knative/serving/releases/tag/knative-v1.12.4) <br /> [v1.12.6](https://github.com/knative/eventing/releases/tag/knative-v1.12.6) |
 | Cert Manager | common/cert-manager | [1.14.5](https://github.com/cert-manager/cert-manager/releases/tag/v1.12.2) |
 
@@ -208,10 +208,10 @@ Install Istio:
 
 ```sh
 echo "Installing Istio configured with external authorization..."
-cd common/istio-1-18
-kustomize build common/istio-1-18/istio-crds/base | kubectl apply -f -
-kustomize build common/istio-1-18/istio-namespace/base | kubectl apply -f -
-kustomize build common/istio-1-18/istio-install/overlays/oauth2-proxy | kubectl apply -f -
+cd common/istio-1-19
+kustomize build common/istio-1-19/istio-crds/base | kubectl apply -f -
+kustomize build common/istio-1-19/istio-namespace/base | kubectl apply -f -
+kustomize build common/istio-1-19/istio-install/overlays/oauth2-proxy | kubectl apply -f -
 
 echo "Waiting for all Istio Pods to become ready..."
 kubectl wait --for=condition=Ready pods --all -n istio-system --timeout 300s
@@ -247,7 +247,7 @@ Install Knative Serving:
 
 ```sh
 kustomize build common/knative/knative-serving/overlays/gateways | kubectl apply -f -
-kustomize build common/istio-1-18/cluster-local-gateway/base | kubectl apply -f -
+kustomize build common/istio-1-19/cluster-local-gateway/base | kubectl apply -f -
 ```
 
 Optionally, you can install Knative Eventing which can be used for inference request logging:

common/istio-1-18/README.md → common/istio-1-19/README.md

@@ -46,7 +46,7 @@ old version is `X1.Y1.Z1`:
         $ export PATH="$MANIFESTS_SRC/scripts:$PATH"
         $ cd $ISTIO_NEW
         $ istioctl manifest generate --cluster-specific -f profile.yaml -f profile-overlay.yaml > dump.yaml
-        $ split-istio-packages -f dump.yaml
+        $ ./split-istio-packages -f dump.yaml
         $ mv $ISTIO_NEW/crd.yaml $ISTIO_NEW/istio-crds/base
         $ mv $ISTIO_NEW/install.yaml $ISTIO_NEW/istio-install/base
         $ mv $ISTIO_NEW/cluster-local-gateway.yaml $ISTIO_NEW/cluster-local-gateway/base

common/istio-cni-1-18/cluster-local-gateway/base/cluster-local-gateway.yaml → common/istio-1-19/cluster-local-gateway/base/cluster-local-gateway.yaml

@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: cluster-local-gateway-service-account
-  namespace: istio-system
   labels:
     app: cluster-local-gateway
+    install.operator.istio.io/owning-resource: unknown
     istio: cluster-local-gateway
-    release: istio
     istio.io/rev: default
-    install.operator.istio.io/owning-resource: unknown
     operator.istio.io/component: IngressGateways
+    release: istio
+  name: cluster-local-gateway-service-account
+  namespace: istio-system
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -125,7 +125,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: docker.io/istio/proxyv2:1.18.7
+        image: docker.io/istio/proxyv2:1.19.10
         name: istio-proxy
         ports:
         - containerPort: 15020
@@ -237,15 +237,15 @@ spec:
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
-  name: cluster-local-gateway
-  namespace: istio-system
   labels:
     app: cluster-local-gateway
+    install.operator.istio.io/owning-resource: unknown
     istio: cluster-local-gateway
-    release: istio
     istio.io/rev: default
-    install.operator.istio.io/owning-resource: unknown
     operator.istio.io/component: IngressGateways
+    release: istio
+  name: cluster-local-gateway
+  namespace: istio-system
 spec:
   minAvailable: 1
   selector:
@@ -256,28 +256,33 @@ spec:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: cluster-local-gateway-sds
-  namespace: istio-system
   labels:
-    release: istio
-    istio.io/rev: default
     install.operator.istio.io/owning-resource: unknown
+    istio.io/rev: default
     operator.istio.io/component: IngressGateways
+    release: istio
+  name: cluster-local-gateway-sds
+  namespace: istio-system
 rules:
-- apiGroups: ['']
-  resources: [secrets]
-  verbs: [get, watch, list]
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  verbs:
+  - get
+  - watch
+  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: cluster-local-gateway-sds
-  namespace: istio-system
   labels:
-    release: istio
-    istio.io/rev: default
     install.operator.istio.io/owning-resource: unknown
+    istio.io/rev: default
     operator.istio.io/component: IngressGateways
+    release: istio
+  name: cluster-local-gateway-sds
+  namespace: istio-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role