Upgraded isito to v1.20.6

Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com>
kubeflow · Jun 4, 2024 · e8a26e3 · e8a26e3
1 parent de39a52
commit e8a26e3
Show file tree

Hide file tree

Showing 40 changed files with 1,876 additions and 658 deletions.
diff --git a/.github/workflows/notebook_controller_m2m_test.yaml b/.github/workflows/notebook_controller_m2m_test.yaml
@@ -38,7 +38,7 @@ jobs:
       run: ./tests/gh-actions/install_istio_with_ext_auth.sh*
 
     - name: Install kubeflow-istio-resources
-      run: kustomize build common/istio-1-19/kubeflow-istio-resources/base | kubectl apply -f -
+      run: kustomize build common/istio-1-20/kubeflow-istio-resources/base | kubectl apply -f -
 
     - name: Install KF Multi Tenancy
       run: ./tests/gh-actions/install_multi_tenancy.sh

diff --git a/.github/workflows/pipeline_test.yaml b/.github/workflows/pipeline_test.yaml
@@ -49,7 +49,7 @@ jobs:
         run: ./tests/gh-actions/install_multi_tenancy.sh
 
       - name: Install kubeflow-istio-resources
-        run: kustomize build common/istio-1-19/kubeflow-istio-resources/base | kubectl apply -f -
+        run: kustomize build common/istio-1-20/kubeflow-istio-resources/base | kubectl apply -f -
 
       - name: Create KF Profile
         run: kustomize build common/user-namespace/base | kubectl apply -f -

diff --git a/README.md b/README.md
@@ -64,7 +64,7 @@ used from the different projects of Kubeflow:
 
 | Component | Local Manifests Path | Upstream Revision |
 | - | - | - |
-| Istio | common/istio-1-19 | [1.19.10](https://github.com/istio/istio/releases/tag/1.19.10) |
+| Istio | common/istio-1-20 | [1.19.10](https://github.com/istio/istio/releases/tag/1.19.10) |
 | Knative | common/knative/knative-serving <br /> common/knative/knative-eventing | [v1.12.4](https://github.com/knative/serving/releases/tag/knative-v1.12.4) <br /> [v1.12.6](https://github.com/knative/eventing/releases/tag/knative-v1.12.6) |
 | Cert Manager | common/cert-manager | [1.14.5](https://github.com/cert-manager/cert-manager/releases/tag/v1.12.2) |
 
@@ -208,10 +208,10 @@ Install Istio:
 
 ```sh
 echo "Installing Istio configured with external authorization..."
-cd common/istio-1-19
-kustomize build common/istio-1-19/istio-crds/base | kubectl apply -f -
-kustomize build common/istio-1-19/istio-namespace/base | kubectl apply -f -
-kustomize build common/istio-1-19/istio-install/overlays/oauth2-proxy | kubectl apply -f -
+cd common/istio-1-20
+kustomize build common/istio-1-20/istio-crds/base | kubectl apply -f -
+kustomize build common/istio-1-20/istio-namespace/base | kubectl apply -f -
+kustomize build common/istio-1-20/istio-install/overlays/oauth2-proxy | kubectl apply -f -
 
 echo "Waiting for all Istio Pods to become ready..."
 kubectl wait --for=condition=Ready pods --all -n istio-system --timeout 300s
@@ -247,7 +247,7 @@ Install Knative Serving:
 
 ```sh
 kustomize build common/knative/knative-serving/overlays/gateways | kubectl apply -f -
-kustomize build common/istio-1-19/cluster-local-gateway/base | kubectl apply -f -
+kustomize build common/istio-1-20/cluster-local-gateway/base | kubectl apply -f -
 ```
 
 Optionally, you can install Knative Eventing which can be used for inference request logging:

diff --git a/common/istio-1-19/README.md → common/istio-1-20/README.md b/common/istio-1-19/README.md → common/istio-1-20/README.md
diff --git a/...l-gateway/base/cluster-local-gateway.yaml → ...l-gateway/base/cluster-local-gateway.yaml b/...l-gateway/base/cluster-local-gateway.yaml → ...l-gateway/base/cluster-local-gateway.yaml
@@ -125,7 +125,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: docker.io/istio/proxyv2:1.19.10
+        image: docker.io/istio/proxyv2:1.20.6
         name: istio-proxy
         ports:
         - containerPort: 15020
@@ -186,7 +186,6 @@ spec:
           name: ingressgateway-ca-certs
           readOnly: true
       securityContext:
-        fsGroup: 1337
         runAsGroup: 1337
         runAsNonRoot: true
         runAsUser: 1337

diff --git a/...way/base/gateway-authorizationpolicy.yaml → ...way/base/gateway-authorizationpolicy.yaml b/...way/base/gateway-authorizationpolicy.yaml → ...way/base/gateway-authorizationpolicy.yaml
diff --git a/...9/cluster-local-gateway/base/gateway.yaml → ...0/cluster-local-gateway/base/gateway.yaml b/...9/cluster-local-gateway/base/gateway.yaml → ...0/cluster-local-gateway/base/gateway.yaml
diff --git a/...ter-local-gateway/base/kustomization.yaml → ...ter-local-gateway/base/kustomization.yaml b/...ter-local-gateway/base/kustomization.yaml → ...ter-local-gateway/base/kustomization.yaml
diff --git a/...ocal-gateway/base/patches/remove-pdb.yaml → ...ocal-gateway/base/patches/remove-pdb.yaml b/...ocal-gateway/base/patches/remove-pdb.yaml → ...ocal-gateway/base/patches/remove-pdb.yaml
diff --git a/common/istio-1-19/istio-crds/base/crd.yaml → common/istio-1-20/istio-crds/base/crd.yaml b/common/istio-1-19/istio-crds/base/crd.yaml → common/istio-1-20/istio-crds/base/crd.yaml
diff --git a/...o-1-19/istio-crds/base/kustomization.yaml → ...o-1-20/istio-crds/base/kustomization.yaml b/...o-1-19/istio-crds/base/kustomization.yaml → ...o-1-20/istio-crds/base/kustomization.yaml
diff --git a/...ll/base/deny_all_authorizationpolicy.yaml → ...ll/base/deny_all_authorizationpolicy.yaml b/...ll/base/deny_all_authorizationpolicy.yaml → ...ll/base/deny_all_authorizationpolicy.yaml
diff --git a/...stio-1-19/istio-install/base/gateway.yaml → ...stio-1-20/istio-install/base/gateway.yaml b/...stio-1-19/istio-install/base/gateway.yaml → ...stio-1-20/istio-install/base/gateway.yaml
diff --git a/...all/base/gateway_authorizationpolicy.yaml → ...all/base/gateway_authorizationpolicy.yaml b/...all/base/gateway_authorizationpolicy.yaml → ...all/base/gateway_authorizationpolicy.yaml
diff --git a/...stio-1-19/istio-install/base/install.yaml → ...stio-1-20/istio-install/base/install.yaml b/...stio-1-19/istio-install/base/install.yaml → ...stio-1-20/istio-install/base/install.yaml
@@ -583,7 +583,7 @@ data:
             - "-z"
             - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
             - "-u"
-            - "1337"
+            - {{ .ProxyUID | default "1337" | quote }}
             - "-m"
             - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
             - "-i"
@@ -650,8 +650,8 @@ data:
               runAsUser: 0
             {{- else }}
               readOnlyRootFilesystem: true
-              runAsGroup: 1337
-              runAsUser: 1337
+              runAsGroup: {{ .ProxyGID | default "1337" }}
+              runAsUser: {{ .ProxyUID | default "1337" }}
               runAsNonRoot: true
             {{- end }}
           {{ end -}}
@@ -838,11 +838,17 @@ data:
             {{- end }}
             {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
             {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-          {{ if $nativeSidecar }}
+          {{ if .Values.global.proxy.startupProbe.enabled }}
             startupProbe:
-          {{ else }}
-            readinessProbe:
+              httpGet:
+                path: /healthz/ready
+                port: 15021
+              initialDelaySeconds: 0
+              periodSeconds: 1
+              timeoutSeconds: 3
+              failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
           {{ end }}
+            readinessProbe:
               httpGet:
                 path: /healthz/ready
                 port: 15021
@@ -861,7 +867,7 @@ data:
                 - ALL
               privileged: true
               readOnlyRootFilesystem: {{ ne (annotation .ObjectMeta `sidecar.istio.io/enableCoreDump` .Values.global.proxy.enableCoreDump) "true" }}
-              runAsGroup: 1337
+              runAsGroup: {{ .ProxyGID | default "1337" }}
               runAsNonRoot: false
               runAsUser: 0
               {{- else }}
@@ -880,13 +886,13 @@ data:
                 - ALL
               privileged: {{ .Values.global.proxy.privileged }}
               readOnlyRootFilesystem: {{ ne (annotation .ObjectMeta `sidecar.istio.io/enableCoreDump` .Values.global.proxy.enableCoreDump) "true" }}
-              runAsGroup: 1337
+              runAsGroup: {{ .ProxyGID | default "1337" }}
               {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
               runAsNonRoot: false
               runAsUser: 0
               {{- else -}}
               runAsNonRoot: true
-              runAsUser: 1337
+              runAsUser: {{ .ProxyUID | default "1337" }}
               {{- end }}
               {{- end }}
             resources:
@@ -1040,6 +1046,10 @@ data:
             {{ end }}
           }
         spec:
+          securityContext:
+            sysctls:
+            - name: net.ipv4.ip_unprivileged_port_start
+              value: "0"
           containers:
           - name: istio-proxy
           {{- if contains "/" .Values.global.proxy.image }}
@@ -1069,6 +1079,9 @@ data:
             lifecycle:
               {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
           {{- end }}
+            securityContext:
+              runAsUser: {{ .ProxyUID | default "1337" }}
+              runAsGroup: {{ .ProxyGID | default "1337" }}
             env:
             - name: JWT_POLICY
               value: {{ .Values.global.jwtPolicy }}
@@ -1715,7 +1728,11 @@ data:
                 - containerPort: 15090
                   protocol: TCP
                   name: http-envoy-prom
-                image: {{.ProxyImage}}
+                {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+                image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+                {{- else }}
+                image: "{{ .ProxyImage }}"
+                {{- end }}
                 {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
                 args:
                 - proxy
@@ -1789,6 +1806,11 @@ data:
                       resource: limits.cpu
                 - name: ISTIO_META_CLUSTER_ID
                   value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+                {{- $network := valueOrDefault (index .Labels `topology.istio.io/network`) .Values.global.network }}
+                {{- if $network }}
+                - name: ISTIO_META_NETWORK
+                  value: "{{ $network }}"
+                {{- end }}
                 - name: ISTIO_META_INTERCEPTION_MODE
                   value: REDIRECT
                 - name: ISTIO_META_WORKLOAD_NAME
@@ -1970,7 +1992,11 @@ data:
               serviceAccountName: {{.ServiceAccount | quote}}
               containers:
               - name: istio-proxy
+              {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+                image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+              {{- else }}
                 image: "{{ .ProxyImage }}"
+              {{- end }}
                 {{- if .Values.global.proxy.resources }}
                 resources:
                   {{- toYaml .Values.global.proxy.resources | nindent 10 }}
@@ -1985,8 +2011,8 @@ data:
                   allowPrivilegeEscalation: false
                   privileged: false
                   readOnlyRootFilesystem: true
-                  runAsUser: 1337
-                  runAsGroup: 1337
+                  runAsUser: {{ .ProxyUID | default "1337" }}
+                  runAsGroup: {{ .ProxyGID | default "1337" }}
                   runAsNonRoot: true
                 {{- else }}
                   capabilities:
@@ -2299,9 +2325,9 @@ data:
           "includeOutboundPorts": "",
           "logLevel": "warning",
           "privileged": false,
-          "readinessFailureThreshold": 30,
-          "readinessInitialDelaySeconds": 1,
-          "readinessPeriodSeconds": 2,
+          "readinessFailureThreshold": 4,
+          "readinessInitialDelaySeconds": 0,
+          "readinessPeriodSeconds": 15,
           "resources": {
             "limits": {
               "cpu": "2000m",
@@ -2312,6 +2338,10 @@ data:
               "memory": "128Mi"
             }
           },
+          "startupProbe": {
+            "enabled": true,
+            "failureThreshold": 600
+          },
           "statusPort": 15020,
           "tracer": "zipkin"
         },
@@ -2327,7 +2357,7 @@ data:
         "sts": {
           "servicePort": 0
         },
-        "tag": "1.19.10",
+        "tag": "1.20.6",
         "tracer": {
           "datadog": {},
           "lightstep": {},
@@ -2631,7 +2661,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: docker.io/istio/proxyv2:1.19.10
+        image: docker.io/istio/proxyv2:1.20.6
         name: istio-proxy
         ports:
         - containerPort: 15021
@@ -2694,7 +2724,6 @@ spec:
           name: ingressgateway-ca-certs
           readOnly: true
       securityContext:
-        fsGroup: 1337
         runAsGroup: 1337
         runAsNonRoot: true
         runAsUser: 1337
@@ -2812,8 +2841,6 @@ spec:
           value: /var/run/secrets/remote/config
         - name: PILOT_TRACE_SAMPLING
           value: '1'
-        - name: ISTIOD_ADDR
-          value: istiod.istio-system.svc:15012
         - name: PILOT_ENABLE_ANALYSIS
           value: 'false'
         - name: CLUSTER_ID
@@ -2828,7 +2855,7 @@ spec:
               resource: limits.cpu
         - name: PLATFORM
           value: ''
-        image: docker.io/istio/pilot:1.19.10
+        image: docker.io/istio/pilot:1.20.6
         name: discovery
         ports:
         - containerPort: 8080
@@ -2854,9 +2881,7 @@ spec:
             drop:
             - ALL
           readOnlyRootFilesystem: true
-          runAsGroup: 1337
           runAsNonRoot: true
-          runAsUser: 1337
         volumeMounts:
         - mountPath: /var/run/secrets/tokens
           name: istio-token
@@ -2875,8 +2900,6 @@ spec:
         - mountPath: /var/run/secrets/istiod/ca
           name: istio-csr-ca-configmap
           readOnly: true
-      securityContext:
-        fsGroup: 1337
       serviceAccountName: istiod
       volumes:
       - emptyDir:

diff --git a/...-19/istio-install/base/kustomization.yaml → ...-20/istio-install/base/kustomization.yaml b/...-19/istio-install/base/kustomization.yaml → ...-20/istio-install/base/kustomization.yaml
diff --git a/...stall/base/patches/disable-debugging.yaml → ...stall/base/patches/disable-debugging.yaml b/...stall/base/patches/disable-debugging.yaml → ...stall/base/patches/disable-debugging.yaml
diff --git a/...ches/istio-configmap-disable-tracing.yaml → ...ches/istio-configmap-disable-tracing.yaml b/...ches/istio-configmap-disable-tracing.yaml → ...ches/istio-configmap-disable-tracing.yaml
diff --git a/...ches/istio-ingressgateway-remove-pdb.yaml → ...ches/istio-ingressgateway-remove-pdb.yaml b/...ches/istio-ingressgateway-remove-pdb.yaml → ...ches/istio-ingressgateway-remove-pdb.yaml
diff --git a/...stall/base/patches/istiod-remove-pdb.yaml → ...stall/base/patches/istiod-remove-pdb.yaml b/...stall/base/patches/istiod-remove-pdb.yaml → ...stall/base/patches/istiod-remove-pdb.yaml
diff --git a/...9/istio-install/base/patches/service.yaml → ...0/istio-install/base/patches/service.yaml b/...9/istio-install/base/patches/service.yaml → ...0/istio-install/base/patches/service.yaml
diff --git a/.../istio-install/base/x-forwarded-host.yaml → .../istio-install/base/x-forwarded-host.yaml b/.../istio-install/base/x-forwarded-host.yaml → .../istio-install/base/x-forwarded-host.yaml
diff --git a/.../overlays/oauth2-proxy/kustomization.yaml → .../overlays/oauth2-proxy/kustomization.yaml b/.../overlays/oauth2-proxy/kustomization.yaml → .../overlays/oauth2-proxy/kustomization.yaml
diff --git a/...9/istio-namespace/base/kustomization.yaml → ...0/istio-namespace/base/kustomization.yaml b/...9/istio-namespace/base/kustomization.yaml → ...0/istio-namespace/base/kustomization.yaml
diff --git a/...-1-19/istio-namespace/base/namespace.yaml → ...-1-20/istio-namespace/base/namespace.yaml b/...-1-19/istio-namespace/base/namespace.yaml → ...-1-20/istio-namespace/base/namespace.yaml
diff --git a/...w-istio-resources/base/cluster-roles.yaml → ...w-istio-resources/base/cluster-roles.yaml b/...w-istio-resources/base/cluster-roles.yaml → ...w-istio-resources/base/cluster-roles.yaml
diff --git a/...io-resources/base/kf-istio-resources.yaml → ...io-resources/base/kf-istio-resources.yaml b/...io-resources/base/kf-istio-resources.yaml → ...io-resources/base/kf-istio-resources.yaml
diff --git a/...w-istio-resources/base/kustomization.yaml → ...w-istio-resources/base/kustomization.yaml b/...w-istio-resources/base/kustomization.yaml → ...w-istio-resources/base/kustomization.yaml
diff --git a/common/istio-1-19/profile-overlay.yaml → common/istio-1-20/profile-overlay.yaml b/common/istio-1-19/profile-overlay.yaml → common/istio-1-20/profile-overlay.yaml
diff --git a/common/istio-1-19/profile.yaml → common/istio-1-20/profile.yaml b/common/istio-1-19/profile.yaml → common/istio-1-20/profile.yaml
@@ -22,7 +22,7 @@ spec:
       proxyMetadata: {}
     enablePrometheusMerge: true
   profile: default
-  tag: 1.19.10
+  tag: 1.20.6
   values:
     base:
       enableCRDTemplates: false
@@ -93,16 +93,19 @@ spec:
         includeIPRanges: '*'
         logLevel: warning
         privileged: false
-        readinessFailureThreshold: 30
-        readinessInitialDelaySeconds: 1
-        readinessPeriodSeconds: 2
+        readinessFailureThreshold: 4
+        readinessInitialDelaySeconds: 0
+        readinessPeriodSeconds: 15
         resources:
           limits:
             cpu: 2000m
             memory: 1024Mi
           requests:
             cpu: 100m
             memory: 128Mi
+        startupProbe:
+          enabled: true
+          failureThreshold: 600
         statusPort: 15020
         tracer: zipkin
       proxy_init:

diff --git a/common/istio-1-19/split-istio-packages → common/istio-1-20/split-istio-packages b/common/istio-1-19/split-istio-packages → common/istio-1-20/split-istio-packages
diff --git a/common/oidc-client/oauth2-proxy/README.md b/common/oidc-client/oauth2-proxy/README.md
@@ -169,9 +169,9 @@ make the following changes to the `example/kustomization.yaml` file:
 * use `oauth2-proxy` overlay for istio-install
   ```
   # from
-  - ../common/istio-1-19/istio-install/base
+  - ../common/istio-1-20/istio-install/base
   # to
-  - ../common/istio-1-19/istio-install/overlays/oauth2-proxy
+  - ../common/istio-1-20/istio-install/overlays/oauth2-proxy
   ```
 * change `OIDC Authservice` to `oauth2-proxy for OIDC` and use overlay for m2m
   bearer tokens with self-signed in-cluster issuer
@@ -204,12 +204,12 @@ index c1a85789..4a50440c 100644
 +++ b/example/kustomization.yaml
 @@ -38,11 +38,11 @@ resources:
  # Istio
- - ../common/istio-1-19/istio-crds/base
- - ../common/istio-1-19/istio-namespace/base
--- ../common/istio-1-19/istio-install/base
+ - ../common/istio-1-20/istio-crds/base
+ - ../common/istio-1-20/istio-namespace/base
+-- ../common/istio-1-20/istio-install/base
 -# OIDC Authservice
 -- ../common/oidc-client/oidc-authservice/base
-+- ../common/istio-1-19/istio-install/overlays/oauth2-proxy
++- ../common/istio-1-20/istio-install/overlays/oauth2-proxy
 +# oauth2-proxy for OIDC
 +- ../common/oidc-client/oauth2-proxy/overlays/m2m-self-signed
  # Dex

diff --git a/contrib/kserve/README.md b/contrib/kserve/README.md
@@ -61,15 +61,15 @@ For upgrading see [UPGRADE.md](UPGRADE.md)
    ```
 5. Install Istio
    ```sh
-   kubectl apply -k ../../common/istio-1-19/istio-crds/base
-   kubectl apply -k ../../common/istio-1-19/istio-namespace/base
-   kubectl apply -k ../../common/istio-1-19/istio-install/base
+   kubectl apply -k ../../common/istio-1-20/istio-crds/base
+   kubectl apply -k ../../common/istio-1-20/istio-namespace/base
+   kubectl apply -k ../../common/istio-1-20/istio-install/base
    ```
 6. Install knative
    ```sh
    kubectl apply -k ../../common/knative/knative-serving/overlays/gateways
-   kubectl apply -k ../../common/istio-1-19/cluster-local-gateway/base
-   kubectl apply -k ../../common/istio-1-19/kubeflow-istio-resources/base
+   kubectl apply -k ../../common/istio-1-20/cluster-local-gateway/base
+   kubectl apply -k ../../common/istio-1-20/kubeflow-istio-resources/base
    ```
 7. Install kserve
    ```sh