test: Update CI to Istio 1.5.0

Signed-off-by: Jarno Rajahalme <jarno@covalent.io>
cilium · Mar 16, 2020 · ab5f506 · ab5f506
1 parent fb105d9
commit ab5f506
Show file tree

Hide file tree

Showing 6 changed files with 4,346 additions and 3,746 deletions.
diff --git a/Documentation/gettingstarted/istio.rst b/Documentation/gettingstarted/istio.rst
@@ -31,29 +31,28 @@ Step 2: Install Istio
 
 Install the `Helm client <https://docs.helm.sh/using_helm/#installing-helm>`_.
 
-Download `Istio version 1.4.6
-<https://github.com/istio/istio/releases/tag/1.4.6>`_:
+Download `Istio version 1.5.0
+<https://github.com/istio/istio/releases/tag/1.5.0>`_:
 
 ::
 
-   export ISTIO_VERSION=1.4.6
+   export ISTIO_VERSION=1.5.0
    curl -L https://git.io/getLatestIstio | sh -
    export ISTIO_HOME=`pwd`/istio-${ISTIO_VERSION}
    export PATH="$PATH:${ISTIO_HOME}/bin"
+   istioctl verify-install
 
 .. note::
 
    Cilium integration, as presented in this Getting Started Guide, has
    been tested with Kubernetes releases 1.14, 1.15, 1.16, and
-   1.17. Note that this does *not* work with K8s 1.13, and that Istio
-   1.4 has *not* been officially tested with Kubernetes releases 1.16,
-   1.17.
-
+   1.17. Note that this does *not* work with K8s 1.13.
 
 Create a copy of Istio's Helm charts in order to customize them:
 
 ::
 
+    rm -rf istio-cilium-helm
     cp -r ${ISTIO_HOME}/install/kubernetes/helm/istio istio-cilium-helm
 
 Configure the Cilium-specific variant of Pilot to inject the
@@ -144,7 +143,7 @@ Deploy Istio onto Kubernetes:
      kubectl create namespace istio-system
      helm template istio-init ${ISTIO_HOME}/install/kubernetes/helm/istio-init --namespace istio-system | kubectl apply -f -
 
-Verify that 23 Istio CRDs have been created:
+Verify that 25 Istio CRDs have been created:
 
 ::
 
@@ -154,7 +153,7 @@ Verify that 23 Istio CRDs have been created:
 
    This will get stuck at 0 if Cilium is not running in your cluster!
 
-When the above returns '23', you can stop it with ``CTRL-c`` and deploy Istio:
+When the above returns '25', you can stop it with ``CTRL-c`` and deploy Istio:
 
 ::
 

diff --git a/test/k8sT/istio.go b/test/k8sT/istio.go
@@ -103,7 +103,7 @@ var _ = Describe("K8sIstioTest", func() {
 		res.ExpectSuccess("unable to create Istio CRDs")
 
 		By("Waiting for Istio CRDs to be ready")
-		err := kubectl.WaitForCRDCount("istio.io|certmanager.k8s.io", 23, helpers.HelperTimeout)
+		err := kubectl.WaitForCRDCount("istio.io|certmanager.k8s.io", 25, helpers.HelperTimeout)
 		Expect(err).To(BeNil(),
 			"Istio CRDs are not ready after timeout")
 

diff --git a/test/k8sT/manifests/bookinfo-v1-istio.yaml b/test/k8sT/manifests/bookinfo-v1-istio.yaml
@@ -46,7 +46,7 @@ spec:
     metadata:
       annotations:
         sidecar.istio.io/interceptionMode: TPROXY
-        sidecar.istio.io/status: '{"version":"45fd8869cfbf8375ea44be15a0156f5850b1789428501a78c16a8490fd325b06","initContainers":["sleep","istio-init"],"containers":["istio-proxy"],"volumes":["cilium-unix-sock-dir","istio-envoy","istio-certs"],"imagePullSecrets":null}'
+        sidecar.istio.io/status: '{"version":"8fed0d2ecbb139209c0b5e642d71dd80e5d965609ad504099c0857b565898242","initContainers":["sleep","istio-init"],"containers":["istio-proxy"],"volumes":["cilium-unix-sock-dir","istio-envoy","istio-certs"],"imagePullSecrets":null}'
         traffic.sidecar.istio.io/excludeInboundPorts: "15020"
         traffic.sidecar.istio.io/includeInboundPorts: "9080"
         traffic.sidecar.istio.io/includeOutboundIPRanges: '*'
@@ -96,8 +96,6 @@ spec:
         - MUTUAL_TLS
         - --statusPort
         - "15020"
-        - --applicationPorts
-        - "9080"
         env:
         - name: POD_NAME
           valueFrom:
@@ -122,6 +120,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.serviceAccountName
+        - name: ISTIO_AUTO_MTLS_ENABLED
+          value: "true"
         - name: ISTIO_META_POD_NAME
           valueFrom:
             fieldRef:
@@ -134,16 +134,14 @@ spec:
           value: "false"
         - name: ISTIO_META_INTERCEPTION_MODE
           value: TPROXY
-        - name: ISTIO_META_INCLUDE_INBOUND_PORTS
-          value: "9080"
         - name: ISTIO_METAJSON_LABELS
           value: |
             {"app":"details","track":"stable","version":"v1","zgroup":"bookinfo"}
         - name: ISTIO_META_WORKLOAD_NAME
           value: details-v1
         - name: ISTIO_META_OWNER
           value: kubernetes://apis/apps/v1/namespaces/default/deployments/details-v1
-        image: docker.io/cilium/istio_proxy:1.4.6
+        image: docker.io/cilium/istio_proxy:1.5.0
         imagePullPolicy: IfNotPresent
         name: istio-proxy
         ports:
@@ -213,7 +211,7 @@ spec:
         - '*'
         - -d
         - "15020"
-        image: docker.io/cilium/istio_proxy:1.4.6
+        image: docker.io/cilium/istio_proxy:1.5.0
         imagePullPolicy: IfNotPresent
         name: istio-init
         resources:
@@ -284,7 +282,7 @@ spec:
     metadata:
       annotations:
         sidecar.istio.io/interceptionMode: TPROXY
-        sidecar.istio.io/status: '{"version":"45fd8869cfbf8375ea44be15a0156f5850b1789428501a78c16a8490fd325b06","initContainers":["sleep","istio-init"],"containers":["istio-proxy"],"volumes":["cilium-unix-sock-dir","istio-envoy","istio-certs"],"imagePullSecrets":null}'
+        sidecar.istio.io/status: '{"version":"8fed0d2ecbb139209c0b5e642d71dd80e5d965609ad504099c0857b565898242","initContainers":["sleep","istio-init"],"containers":["istio-proxy"],"volumes":["cilium-unix-sock-dir","istio-envoy","istio-certs"],"imagePullSecrets":null}'
         traffic.sidecar.istio.io/excludeInboundPorts: "15020"
         traffic.sidecar.istio.io/includeInboundPorts: "9080"
         traffic.sidecar.istio.io/includeOutboundIPRanges: '*'
@@ -334,8 +332,6 @@ spec:
         - MUTUAL_TLS
         - --statusPort
         - "15020"
-        - --applicationPorts
-        - "9080"
         env:
         - name: POD_NAME
           valueFrom:
@@ -360,6 +356,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.serviceAccountName
+        - name: ISTIO_AUTO_MTLS_ENABLED
+          value: "true"
         - name: ISTIO_META_POD_NAME
           valueFrom:
             fieldRef:
@@ -372,16 +370,14 @@ spec:
           value: "false"
         - name: ISTIO_META_INTERCEPTION_MODE
           value: TPROXY
-        - name: ISTIO_META_INCLUDE_INBOUND_PORTS
-          value: "9080"
         - name: ISTIO_METAJSON_LABELS
           value: |
             {"app":"reviews","track":"stable","version":"v1","zgroup":"bookinfo"}
         - name: ISTIO_META_WORKLOAD_NAME
           value: reviews-v1
         - name: ISTIO_META_OWNER
           value: kubernetes://apis/apps/v1/namespaces/default/deployments/reviews-v1
-        image: docker.io/cilium/istio_proxy:1.4.6
+        image: docker.io/cilium/istio_proxy:1.5.0
         imagePullPolicy: IfNotPresent
         name: istio-proxy
         ports:
@@ -451,7 +447,7 @@ spec:
         - '*'
         - -d
         - "15020"
-        image: docker.io/cilium/istio_proxy:1.4.6
+        image: docker.io/cilium/istio_proxy:1.5.0
         imagePullPolicy: IfNotPresent
         name: istio-init
         resources:
@@ -522,7 +518,7 @@ spec:
     metadata:
       annotations:
         sidecar.istio.io/interceptionMode: TPROXY
-        sidecar.istio.io/status: '{"version":"45fd8869cfbf8375ea44be15a0156f5850b1789428501a78c16a8490fd325b06","initContainers":["sleep","istio-init"],"containers":["istio-proxy"],"volumes":["cilium-unix-sock-dir","istio-envoy","istio-certs"],"imagePullSecrets":null}'
+        sidecar.istio.io/status: '{"version":"8fed0d2ecbb139209c0b5e642d71dd80e5d965609ad504099c0857b565898242","initContainers":["sleep","istio-init"],"containers":["istio-proxy"],"volumes":["cilium-unix-sock-dir","istio-envoy","istio-certs"],"imagePullSecrets":null}'
         traffic.sidecar.istio.io/excludeInboundPorts: "15020"
         traffic.sidecar.istio.io/includeInboundPorts: "9080"
         traffic.sidecar.istio.io/includeOutboundIPRanges: '*'
@@ -572,8 +568,6 @@ spec:
         - MUTUAL_TLS
         - --statusPort
         - "15020"
-        - --applicationPorts
-        - "9080"
         env:
         - name: POD_NAME
           valueFrom:
@@ -598,6 +592,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.serviceAccountName
+        - name: ISTIO_AUTO_MTLS_ENABLED
+          value: "true"
         - name: ISTIO_META_POD_NAME
           valueFrom:
             fieldRef:
@@ -610,16 +606,14 @@ spec:
           value: "false"
         - name: ISTIO_META_INTERCEPTION_MODE
           value: TPROXY
-        - name: ISTIO_META_INCLUDE_INBOUND_PORTS
-          value: "9080"
         - name: ISTIO_METAJSON_LABELS
           value: |
             {"app":"productpage","track":"stable","version":"v1","zgroup":"bookinfo"}
         - name: ISTIO_META_WORKLOAD_NAME
           value: productpage-v1
         - name: ISTIO_META_OWNER
           value: kubernetes://apis/apps/v1/namespaces/default/deployments/productpage-v1
-        image: docker.io/cilium/istio_proxy:1.4.6
+        image: docker.io/cilium/istio_proxy:1.5.0
         imagePullPolicy: IfNotPresent
         name: istio-proxy
         ports:
@@ -689,7 +683,7 @@ spec:
         - '*'
         - -d
         - "15020"
-        image: docker.io/cilium/istio_proxy:1.4.6
+        image: docker.io/cilium/istio_proxy:1.5.0
         imagePullPolicy: IfNotPresent
         name: istio-init
         resources:

diff --git a/test/k8sT/manifests/bookinfo-v2-istio.yaml b/test/k8sT/manifests/bookinfo-v2-istio.yaml
@@ -45,7 +45,7 @@ spec:
     metadata:
       annotations:
         sidecar.istio.io/interceptionMode: TPROXY
-        sidecar.istio.io/status: '{"version":"45fd8869cfbf8375ea44be15a0156f5850b1789428501a78c16a8490fd325b06","initContainers":["sleep","istio-init"],"containers":["istio-proxy"],"volumes":["cilium-unix-sock-dir","istio-envoy","istio-certs"],"imagePullSecrets":null}'
+        sidecar.istio.io/status: '{"version":"8fed0d2ecbb139209c0b5e642d71dd80e5d965609ad504099c0857b565898242","initContainers":["sleep","istio-init"],"containers":["istio-proxy"],"volumes":["cilium-unix-sock-dir","istio-envoy","istio-certs"],"imagePullSecrets":null}'
         traffic.sidecar.istio.io/excludeInboundPorts: "15020"
         traffic.sidecar.istio.io/includeInboundPorts: "9080"
         traffic.sidecar.istio.io/includeOutboundIPRanges: '*'
@@ -94,8 +94,6 @@ spec:
         - MUTUAL_TLS
         - --statusPort
         - "15020"
-        - --applicationPorts
-        - "9080"
         env:
         - name: POD_NAME
           valueFrom:
@@ -120,6 +118,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.serviceAccountName
+        - name: ISTIO_AUTO_MTLS_ENABLED
+          value: "true"
         - name: ISTIO_META_POD_NAME
           valueFrom:
             fieldRef:
@@ -132,16 +132,14 @@ spec:
           value: "false"
         - name: ISTIO_META_INTERCEPTION_MODE
           value: TPROXY
-        - name: ISTIO_META_INCLUDE_INBOUND_PORTS
-          value: "9080"
         - name: ISTIO_METAJSON_LABELS
           value: |
             {"app":"ratings","version":"v1","zgroup":"bookinfo"}
         - name: ISTIO_META_WORKLOAD_NAME
           value: ratings-v1
         - name: ISTIO_META_OWNER
           value: kubernetes://apis/apps/v1/namespaces/default/deployments/ratings-v1
-        image: docker.io/cilium/istio_proxy:1.4.6
+        image: docker.io/cilium/istio_proxy:1.5.0
         imagePullPolicy: IfNotPresent
         name: istio-proxy
         ports:
@@ -211,7 +209,7 @@ spec:
         - '*'
         - -d
         - "15020"
-        image: docker.io/cilium/istio_proxy:1.4.6
+        image: docker.io/cilium/istio_proxy:1.5.0
         imagePullPolicy: IfNotPresent
         name: istio-init
         resources:
@@ -265,7 +263,7 @@ spec:
     metadata:
       annotations:
         sidecar.istio.io/interceptionMode: TPROXY
-        sidecar.istio.io/status: '{"version":"45fd8869cfbf8375ea44be15a0156f5850b1789428501a78c16a8490fd325b06","initContainers":["sleep","istio-init"],"containers":["istio-proxy"],"volumes":["cilium-unix-sock-dir","istio-envoy","istio-certs"],"imagePullSecrets":null}'
+        sidecar.istio.io/status: '{"version":"8fed0d2ecbb139209c0b5e642d71dd80e5d965609ad504099c0857b565898242","initContainers":["sleep","istio-init"],"containers":["istio-proxy"],"volumes":["cilium-unix-sock-dir","istio-envoy","istio-certs"],"imagePullSecrets":null}'
         traffic.sidecar.istio.io/excludeInboundPorts: "15020"
         traffic.sidecar.istio.io/includeInboundPorts: "9080"
         traffic.sidecar.istio.io/includeOutboundIPRanges: '*'
@@ -314,8 +312,6 @@ spec:
         - MUTUAL_TLS
         - --statusPort
         - "15020"
-        - --applicationPorts
-        - "9080"
         env:
         - name: POD_NAME
           valueFrom:
@@ -340,6 +336,8 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.serviceAccountName
+        - name: ISTIO_AUTO_MTLS_ENABLED
+          value: "true"
         - name: ISTIO_META_POD_NAME
           valueFrom:
             fieldRef:
@@ -352,16 +350,14 @@ spec:
           value: "false"
         - name: ISTIO_META_INTERCEPTION_MODE
           value: TPROXY
-        - name: ISTIO_META_INCLUDE_INBOUND_PORTS
-          value: "9080"
         - name: ISTIO_METAJSON_LABELS
           value: |
             {"app":"reviews","version":"v2","zgroup":"bookinfo"}
         - name: ISTIO_META_WORKLOAD_NAME
           value: reviews-v2
         - name: ISTIO_META_OWNER
           value: kubernetes://apis/apps/v1/namespaces/default/deployments/reviews-v2
-        image: docker.io/cilium/istio_proxy:1.4.6
+        image: docker.io/cilium/istio_proxy:1.5.0
         imagePullPolicy: IfNotPresent
         name: istio-proxy
         ports:
@@ -431,7 +427,7 @@ spec:
         - '*'
         - -d
         - "15020"
-        image: docker.io/cilium/istio_proxy:1.4.6
+        image: docker.io/cilium/istio_proxy:1.5.0
         imagePullPolicy: IfNotPresent
         name: istio-init
         resources: