Skip to content

Commit d8d975d

Browse files
author
robot
committed
robot: project cni chart upgrades from 1.17.1 to 1.24.0
Signed-off-by: robot <[email protected]>
1 parent 88c224b commit d8d975d

32 files changed

+956
-385
lines changed

‎charts/cni/cni/Chart.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
1-
apiVersion: v1
2-
appVersion: 1.17.1
1+
apiVersion: v2
2+
appVersion: 1.24.0
33
description: Helm chart for istio-cni components
44
icon: https://istio.io/latest/favicons/android-192x192.png
55
keywords:
66
- istio-cni
77
- istio
88
name: cni
99
sources:
10-
- https://github.com/istio/istio/tree/master/cni
11-
version: 1.17.1
10+
- https://github.com/istio/istio
11+
version: 1.24.0
1212
dependencies:
1313
- name: cni
14-
version: "1.17.1"
14+
version: "1.24.0"
1515
repository: "https://istio-release.storage.googleapis.com/charts"

‎charts/cni/cni/README.md‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,45 @@ helm install istio-cni istio/cni -n kube-system
2121
```
2222

2323
Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
24-
`priorityClassName` can be used.
24+
`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
25+
'system-node-critical' outside of kube-system.
26+
27+
## Configuration
28+
29+
To view support configuration options and documentation, run:
30+
31+
```console
32+
helm show values istio/istio-cni
33+
```
34+
35+
### Profiles
36+
37+
Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
38+
These can be set with `--set profile=<profile>`.
39+
For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
40+
41+
For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
42+
43+
Explicitly set values have highest priority, then profile settings, then chart defaults.
44+
45+
As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
46+
When configuring the chart, you should not include this.
47+
That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
48+
49+
### Ambient
50+
51+
To enable ambient, you can use the ambient profile: `--set profile=ambient`.
52+
53+
#### Calico
54+
55+
For Calico, you must also modify the settings to allow source spoofing:
56+
57+
- if deployed by operator, `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
58+
- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )
59+
60+
### GKE notes
61+
62+
On GKE, 'kube-system' is required.
63+
64+
If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`
65+
it is auto-detected.

‎charts/cni/cni/charts/cni/Chart.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
apiVersion: v1
2-
appVersion: 1.17.1
1+
apiVersion: v2
2+
appVersion: 1.24.0
33
description: Helm chart for istio-cni components
44
icon: https://istio.io/latest/favicons/android-192x192.png
55
keywords:
66
- istio-cni
77
- istio
88
name: cni
99
sources:
10-
- https://github.com/istio/istio/tree/master/cni
11-
version: 1.17.1
10+
- https://github.com/istio/istio
11+
version: 1.24.0

‎charts/cni/cni/charts/cni/README.md‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,45 @@ helm install istio-cni istio/cni -n kube-system
2121
```
2222

2323
Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
24-
`priorityClassName` can be used.
24+
`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
25+
'system-node-critical' outside of kube-system.
26+
27+
## Configuration
28+
29+
To view support configuration options and documentation, run:
30+
31+
```console
32+
helm show values istio/istio-cni
33+
```
34+
35+
### Profiles
36+
37+
Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
38+
These can be set with `--set profile=<profile>`.
39+
For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
40+
41+
For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
42+
43+
Explicitly set values have highest priority, then profile settings, then chart defaults.
44+
45+
As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
46+
When configuring the chart, you should not include this.
47+
That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
48+
49+
### Ambient
50+
51+
To enable ambient, you can use the ambient profile: `--set profile=ambient`.
52+
53+
#### Calico
54+
55+
For Calico, you must also modify the settings to allow source spoofing:
56+
57+
- if deployed by operator, `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
58+
- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )
59+
60+
### GKE notes
61+
62+
On GKE, 'kube-system' is required.
63+
64+
If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`
65+
it is auto-detected.

‎charts/cni/cni/charts/cni/files/profile-ambient.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
2+
# The original version of this file is located at /manifests/helm-profiles directory.
3+
# If you want to make a change in this file, edit the original one and run "make gen".
4+
5+
# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
6+
meshConfig:
7+
defaultConfig:
8+
proxyMetadata:
9+
ISTIO_META_ENABLE_HBONE: "true"
10+
global:
11+
variant: distroless
12+
pilot:
13+
env:
14+
PILOT_ENABLE_AMBIENT: "true"
15+
cni:
16+
ambient:
17+
enabled: true

‎charts/cni/cni/charts/cni/files/profile-compatibility-version-1.21.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
2+
# The original version of this file is located at /manifests/helm-profiles directory.
3+
# If you want to make a change in this file, edit the original one and run "make gen".
4+
5+
pilot:
6+
env:
7+
# 1.22 behavioral changes
8+
ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
9+
ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
10+
11+
# 1.23 behavioral changes
12+
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
13+
14+
# 1.24 behavioral changes
15+
ENABLE_INBOUND_RETRY_POLICY: "false"
16+
EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
17+
PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
18+
ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
19+
PILOT_UNIFIED_SIDECAR_SCOPE: "false"
20+
21+
meshConfig:
22+
# 1.22 behavioral changes
23+
defaultConfig:
24+
proxyMetadata:
25+
ISTIO_DELTA_XDS: "false"
26+
# 1.23 behavioral changes
27+
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
28+
# 1.24 behaviour changes
29+
ENABLE_DEFERRED_STATS_CREATION: "false"
30+
BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
31+
tracing:
32+
zipkin:
33+
address: zipkin.istio-system:9411

‎charts/cni/cni/charts/cni/files/profile-compatibility-version-1.22.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
2+
# The original version of this file is located at /manifests/helm-profiles directory.
3+
# If you want to make a change in this file, edit the original one and run "make gen".
4+
5+
pilot:
6+
env:
7+
# 1.23 behavioral changes
8+
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
9+
10+
# 1.24 behavioral changes
11+
ENABLE_INBOUND_RETRY_POLICY: "false"
12+
EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
13+
PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
14+
ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
15+
PILOT_UNIFIED_SIDECAR_SCOPE: "false"
16+
17+
meshConfig:
18+
defaultConfig:
19+
proxyMetadata:
20+
# 1.22 behavioral changes
21+
ENABLE_DEFERRED_CLUSTER_CREATION: "false"
22+
# 1.23 behavioral changes
23+
ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
24+
# 1.24 behaviour changes
25+
ENABLE_DEFERRED_STATS_CREATION: "false"
26+
BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"

‎charts/cni/cni/charts/cni/files/profile-compatibility-version-1.23.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
2+
# The original version of this file is located at /manifests/helm-profiles directory.
3+
# If you want to make a change in this file, edit the original one and run "make gen".
4+
5+
pilot:
6+
env:
7+
# 1.24 behavioral changes
8+
ENABLE_INBOUND_RETRY_POLICY: "false"
9+
EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
10+
PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
11+
ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
12+
PILOT_UNIFIED_SIDECAR_SCOPE: "false"
13+
14+
meshConfig:
15+
defaultConfig:
16+
proxyMetadata:
17+
# 1.24 behaviour changes
18+
ENABLE_DEFERRED_STATS_CREATION: "false"
19+
BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"

‎charts/cni/cni/charts/cni/files/profile-demo.yaml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
2+
# The original version of this file is located at /manifests/helm-profiles directory.
3+
# If you want to make a change in this file, edit the original one and run "make gen".
4+
5+
# The demo profile enables a variety of things to try out Istio in non-production environments.
6+
# * Lower resource utilization.
7+
# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
8+
# * More ports enabled on the ingress, which is used in some tasks.
9+
meshConfig:
10+
accessLogFile: /dev/stdout
11+
extensionProviders:
12+
- name: otel
13+
envoyOtelAls:
14+
service: opentelemetry-collector.observability.svc.cluster.local
15+
port: 4317
16+
- name: skywalking
17+
skywalking:
18+
service: tracing.istio-system.svc.cluster.local
19+
port: 11800
20+
- name: otel-tracing
21+
opentelemetry:
22+
port: 4317
23+
service: opentelemetry-collector.observability.svc.cluster.local
24+
25+
cni:
26+
resources:
27+
requests:
28+
cpu: 10m
29+
memory: 40Mi
30+
31+
ztunnel:
32+
resources:
33+
requests:
34+
cpu: 10m
35+
memory: 40Mi
36+
37+
global:
38+
proxy:
39+
resources:
40+
requests:
41+
cpu: 10m
42+
memory: 40Mi
43+
waypoint:
44+
resources:
45+
requests:
46+
cpu: 10m
47+
memory: 40Mi
48+
49+
pilot:
50+
autoscaleEnabled: false
51+
traceSampling: 100
52+
resources:
53+
requests:
54+
cpu: 10m
55+
memory: 100Mi
56+
57+
gateways:
58+
istio-egressgateway:
59+
autoscaleEnabled: false
60+
resources:
61+
requests:
62+
cpu: 10m
63+
memory: 40Mi
64+
istio-ingressgateway:
65+
autoscaleEnabled: false
66+
ports:
67+
## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
68+
# Note that AWS ELB will by default perform health checks on the first port
69+
# on this list. Setting this to the health check port will ensure that health
70+
# checks always work. https://github.com/istio/istio/issues/12503
71+
- port: 15021
72+
targetPort: 15021
73+
name: status-port
74+
- port: 80
75+
targetPort: 8080
76+
name: http2
77+
- port: 443
78+
targetPort: 8443
79+
name: https
80+
- port: 31400
81+
targetPort: 31400
82+
name: tcp
83+
# This is the port where sni routing happens
84+
- port: 15443
85+
targetPort: 15443
86+
name: tls
87+
resources:
88+
requests:
89+
cpu: 10m
90+
memory: 40Mi

‎charts/cni/cni/charts/cni/files/profile-platform-k3d.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
2+
# The original version of this file is located at /manifests/helm-profiles directory.
3+
# If you want to make a change in this file, edit the original one and run "make gen".
4+
5+
cni:
6+
cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
7+
cniBinDir: /bin

0 commit comments

Comments
 (0)