bump istio v1.19.6 (#1239)

knative-extensions · Jan 15, 2024 · 2b8acf2 · 2b8acf2
1 parent 230378a
commit 2b8acf2
Show file tree

Hide file tree

Showing 9 changed files with 124 additions and 50 deletions.
diff --git a/go.mod b/go.mod
@@ -16,8 +16,8 @@ require (
 	go.uber.org/zap v1.26.0
 	golang.org/x/sync v0.4.0
 	google.golang.org/protobuf v1.31.0
-	istio.io/api v1.19.3
-	istio.io/client-go v1.19.3
+	istio.io/api v1.19.6
+	istio.io/client-go v1.19.6
 	k8s.io/api v0.28.0
 	k8s.io/apimachinery v0.28.0
 	k8s.io/client-go v0.28.0

diff --git a/go.sum b/go.sum
@@ -661,10 +661,10 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-istio.io/api v1.19.3 h1:+Sxwn0IqoAXHcUJVCwigILxOo4yVXzmLamWATxNqhRk=
-istio.io/api v1.19.3/go.mod h1:KstZe4bKbXouALUJ5PqpjNEhu5nj90HrDFitZfpNhlU=
-istio.io/client-go v1.19.3 h1:nxNcBhtpJJmSoiTbCzO4Ay4Y1qve4Uct6oiqPSJVNMg=
-istio.io/client-go v1.19.3/go.mod h1:ra3fVlXcquh7EuQnNssuLxfp6lFv/nx5314PvNEzOUs=
+istio.io/api v1.19.6 h1:xG5EKIy66WvlOg+UvfjK9nRiQTeuAm38avzUkvrGep0=
+istio.io/api v1.19.6/go.mod h1:KstZe4bKbXouALUJ5PqpjNEhu5nj90HrDFitZfpNhlU=
+istio.io/client-go v1.19.6 h1:Vp7gO7b8XaWle5s3ffNKTltn7Qdm3Cmf23C42X641ms=
+istio.io/client-go v1.19.6/go.mod h1:1tGWtt3atGGsGH1Lc3KcFDL2yMu6lNbsFRm1r8hVhdg=
 k8s.io/api v0.27.6 h1:PBWu/lywJe2qQcshMjubzcBg7+XDZOo7O8JJAWuYtUo=
 k8s.io/api v0.27.6/go.mod h1:AQYj0UsFCp3qJE7bOVnUuy4orCsXVkvHefnbYQiNWgk=
 k8s.io/apiextensions-apiserver v0.27.6 h1:mOwSBJtThZhpJr+8gEkc3wFDIjq87E3JspR5mtZxIg8=

diff --git a/third_party/istio-latest/generate-manifests.sh b/third_party/istio-latest/generate-manifests.sh
@@ -16,4 +16,4 @@
 
 source "$(dirname $0)/../library.sh"
 
-generate "1.19.3" "$(dirname $0)"
+generate "1.19.6" "$(dirname $0)"
diff --git a/third_party/istio-latest/istio-ci-ambient/istio.yaml b/third_party/istio-latest/istio-ci-ambient/istio.yaml
@@ -85,31 +85,48 @@ metadata:
     istio.io/rev: default
     operator.istio.io/component: Cni
     release: istio
-  name: istio-cni-repair-role
+  name: istio-cni-ambient
 rules:
   - apiGroups:
       - ""
     resources:
-      - pods
+      - pods/status
     verbs:
-      - get
-      - list
-      - watch
-      - delete
       - patch
       - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: istio-cni
+    install.operator.istio.io/owning-resource: unknown
+    istio.io/rev: default
+    operator.istio.io/component: Cni
+    release: istio
+  name: istio-cni-repair-role
+rules:
   - apiGroups:
       - ""
     resources:
       - events
     verbs:
+      - create
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - watch
       - get
       - list
-      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
       - delete
-      - patch
-      - update
-      - create
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -466,6 +483,24 @@ subjects:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
+metadata:
+  labels:
+    install.operator.istio.io/owning-resource: unknown
+    istio.io/rev: default
+    k8s-app: istio-cni-repair
+    operator.istio.io/component: Cni
+  name: istio-cni-ambient
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istio-cni-ambient
+subjects:
+  - kind: ServiceAccount
+    name: istio-cni
+    namespace: istio-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
 metadata:
   labels:
     install.operator.istio.io/owning-resource: unknown
@@ -9385,7 +9420,7 @@ data:
         "sts": {
           "servicePort": 0
         },
-        "tag": "1.19.3",
+        "tag": "1.19.6",
         "tracer": {
           "datadog": {},
           "lightstep": {},
@@ -9535,7 +9570,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
-          image: docker.io/istio/proxyv2:1.19.3
+          image: docker.io/istio/proxyv2:1.19.6
           name: istio-proxy
           ports:
             - containerPort: 15021
@@ -9742,7 +9777,7 @@ spec:
                   resource: limits.cpu
             - name: PLATFORM
               value: ""
-          image: docker.io/istio/pilot:1.19.3
+          image: docker.io/istio/pilot:1.19.6
           name: discovery
           ports:
             - containerPort: 8080
@@ -10194,9 +10229,11 @@ spec:
                 fieldRef:
                   fieldPath: spec.nodeName
             - name: REPAIR_LABEL_PODS
-              value: "true"
+              value: "false"
             - name: REPAIR_DELETE_PODS
               value: "true"
+            - name: REPAIR_REPAIR_PODS
+              value: "false"
             - name: REPAIR_RUN_AS_DAEMON
               value: "true"
             - name: REPAIR_SIDECAR_ANNOTATION
@@ -10224,7 +10261,7 @@ spec:
               valueFrom:
                 resourceFieldRef:
                   resource: limits.cpu
-          image: docker.io/istio/install-cni:1.19.3
+          image: docker.io/istio/install-cni:1.19.6
           name: install-cni
           readinessProbe:
             httpGet:
@@ -10335,7 +10372,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.serviceAccountName
-          image: docker.io/istio/ztunnel:1.19.3
+          image: docker.io/istio/ztunnel:1.19.6
           name: istio-proxy
           ports:
             - containerPort: 15020

diff --git a/third_party/istio-latest/istio-ci-mesh/istio.yaml b/third_party/istio-latest/istio-ci-mesh/istio.yaml
@@ -9241,7 +9241,7 @@ data:
         "sts": {
           "servicePort": 0
         },
-        "tag": "1.19.3",
+        "tag": "1.19.6",
         "tracer": {
           "datadog": {},
           "lightstep": {},
@@ -9389,7 +9389,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
-          image: docker.io/istio/proxyv2:1.19.3
+          image: docker.io/istio/proxyv2:1.19.6
           name: istio-proxy
           ports:
             - containerPort: 15021
@@ -9586,7 +9586,7 @@ spec:
                   resource: limits.cpu
             - name: PLATFORM
               value: ""
-          image: docker.io/istio/pilot:1.19.3
+          image: docker.io/istio/pilot:1.19.6
           name: discovery
           ports:
             - containerPort: 8080

diff --git a/third_party/istio-latest/istio-ci-no-mesh/istio.yaml b/third_party/istio-latest/istio-ci-no-mesh/istio.yaml
@@ -9241,7 +9241,7 @@ data:
         "sts": {
           "servicePort": 0
         },
-        "tag": "1.19.3",
+        "tag": "1.19.6",
         "tracer": {
           "datadog": {},
           "lightstep": {},
@@ -9389,7 +9389,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
-          image: docker.io/istio/proxyv2:1.19.3
+          image: docker.io/istio/proxyv2:1.19.6
           name: istio-proxy
           ports:
             - containerPort: 15021
@@ -9586,7 +9586,7 @@ spec:
                   resource: limits.cpu
             - name: PLATFORM
               value: ""
-          image: docker.io/istio/pilot:1.19.3
+          image: docker.io/istio/pilot:1.19.6
           name: discovery
           ports:
             - containerPort: 8080

diff --git a/third_party/istio-latest/istio-kind-ambient/istio.yaml b/third_party/istio-latest/istio-kind-ambient/istio.yaml
@@ -85,31 +85,48 @@ metadata:
     istio.io/rev: default
     operator.istio.io/component: Cni
     release: istio
-  name: istio-cni-repair-role
+  name: istio-cni-ambient
 rules:
   - apiGroups:
       - ""
     resources:
-      - pods
+      - pods/status
     verbs:
-      - get
-      - list
-      - watch
-      - delete
       - patch
       - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: istio-cni
+    install.operator.istio.io/owning-resource: unknown
+    istio.io/rev: default
+    operator.istio.io/component: Cni
+    release: istio
+  name: istio-cni-repair-role
+rules:
   - apiGroups:
       - ""
     resources:
       - events
     verbs:
+      - create
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - watch
       - get
       - list
-      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
       - delete
-      - patch
-      - update
-      - create
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -466,6 +483,24 @@ subjects:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
+metadata:
+  labels:
+    install.operator.istio.io/owning-resource: unknown
+    istio.io/rev: default
+    k8s-app: istio-cni-repair
+    operator.istio.io/component: Cni
+  name: istio-cni-ambient
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istio-cni-ambient
+subjects:
+  - kind: ServiceAccount
+    name: istio-cni
+    namespace: istio-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
 metadata:
   labels:
     install.operator.istio.io/owning-resource: unknown
@@ -9385,7 +9420,7 @@ data:
         "sts": {
           "servicePort": 0
         },
-        "tag": "1.19.3",
+        "tag": "1.19.6",
         "tracer": {
           "datadog": {},
           "lightstep": {},
@@ -9535,7 +9570,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
-          image: docker.io/istio/proxyv2:1.19.3
+          image: docker.io/istio/proxyv2:1.19.6
           name: istio-proxy
           ports:
             - containerPort: 15021
@@ -9742,7 +9777,7 @@ spec:
                   resource: limits.cpu
             - name: PLATFORM
               value: ""
-          image: docker.io/istio/pilot:1.19.3
+          image: docker.io/istio/pilot:1.19.6
           name: discovery
           ports:
             - containerPort: 8080
@@ -10194,9 +10229,11 @@ spec:
                 fieldRef:
                   fieldPath: spec.nodeName
             - name: REPAIR_LABEL_PODS
-              value: "true"
+              value: "false"
             - name: REPAIR_DELETE_PODS
               value: "true"
+            - name: REPAIR_REPAIR_PODS
+              value: "false"
             - name: REPAIR_RUN_AS_DAEMON
               value: "true"
             - name: REPAIR_SIDECAR_ANNOTATION
@@ -10224,7 +10261,7 @@ spec:
               valueFrom:
                 resourceFieldRef:
                   resource: limits.cpu
-          image: docker.io/istio/install-cni:1.19.3
+          image: docker.io/istio/install-cni:1.19.6
           name: install-cni
           readinessProbe:
             httpGet:
@@ -10335,7 +10372,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.serviceAccountName
-          image: docker.io/istio/ztunnel:1.19.3
+          image: docker.io/istio/ztunnel:1.19.6
           name: istio-proxy
           ports:
             - containerPort: 15020

diff --git a/third_party/istio-latest/istio-kind-no-mesh/istio.yaml b/third_party/istio-latest/istio-kind-no-mesh/istio.yaml
@@ -9241,7 +9241,7 @@ data:
         "sts": {
           "servicePort": 0
         },
-        "tag": "1.19.3",
+        "tag": "1.19.6",
         "tracer": {
           "datadog": {},
           "lightstep": {},
@@ -9389,7 +9389,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
-          image: docker.io/istio/proxyv2:1.19.3
+          image: docker.io/istio/proxyv2:1.19.6
           name: istio-proxy
           ports:
             - containerPort: 15021
@@ -9586,7 +9586,7 @@ spec:
                   resource: limits.cpu
             - name: PLATFORM
               value: ""
-          image: docker.io/istio/pilot:1.19.3
+          image: docker.io/istio/pilot:1.19.6
           name: discovery
           ports:
             - containerPort: 8080