backport istiod-remote discoveryAddress

istio · Mar 15, 2020 · 52f2e33 · 52f2e33
1 parent a079671
commit 52f2e33
Show file tree

Hide file tree

Showing 4 changed files with 36 additions and 18 deletions.
diff --git a/manifests/gateways/istio-egress/templates/deployment.yaml b/manifests/gateways/istio-egress/templates/deployment.yaml
@@ -117,10 +117,13 @@ spec:
           - --controlPlaneAuthPolicy
           - NONE
           - --discoveryAddress
-          {{- if .Values.global.configNamespace }}
-          - istio-pilot.{{ .Values.global.configNamespace }}.svc:15012
+          {{- $namespace := .Values.global.configNamespace | default "istio-system" }}
+          {{- if .Values.global.remotePilotAddress }}
+          # Use the DNS hostname instead of the IP address. The discovery address needs to match the
+          # SAN in istiod's cert. The istiod-remote.<namespace>.svc will resolve to the remotePilotAddress.
+          - istiod-remote.{{ $namespace }}.svc:15012
           {{- else }}
-          - istio-pilot.istio-system.svc:15012
+          - istio-pilot.{{ $namespace }}.svc:15012
           {{- end }}
         {{- else if .Values.global.controlPlaneSecurityEnabled }}
           - --controlPlaneAuthPolicy

diff --git a/manifests/gateways/istio-ingress/templates/deployment.yaml b/manifests/gateways/istio-ingress/templates/deployment.yaml
@@ -160,10 +160,13 @@ spec:
           - --controlPlaneAuthPolicy
           - NONE
           - --discoveryAddress
-          {{- if .Values.global.configNamespace }}
-          - istio-pilot.{{ .Values.global.configNamespace }}.svc:15012
+          {{- $namespace := .Values.global.configNamespace | default "istio-system" }}
+          {{- if .Values.global.remotePilotAddress }}
+          # Use the DNS hostname instead of the IP address. The discovery address needs to match the
+          # SAN in istiod's cert. The istiod-remote.<namespace>.svc will resolve to the remotePilotAddress.
+          - istiod-remote.{{ $namespace }}.svc:15012
           {{- else }}
-          - istio-pilot.istio-system.svc:15012
+          - istio-pilot.{{ $namespace }}.svc:15012
           {{- end }}
           {{- else if .Values.global.controlPlaneSecurityEnabled }}
           - --controlPlaneAuthPolicy

diff --git a/manifests/istio-telemetry/prometheus/templates/deployment.yaml b/manifests/istio-telemetry/prometheus/templates/deployment.yaml
@@ -79,10 +79,13 @@ spec:
             - --parentShutdownDuration
             - "1m0s"
             - --discoveryAddress
-            {{- if .Values.global.configNamespace }}
-            - istio-pilot.{{ .Values.global.configNamespace }}.svc:15012
+            {{- $namespace := .Values.global.configNamespace | default "istio-system" }}
+            {{- if .Values.global.remotePilotAddress }}
+            # Use the DNS hostname instead of the IP address. The discovery address needs to match the
+            # SAN in istiod's cert. The istiod-remote.<namespace>.svc will resolve to the remotePilotAddress.
+            - istiod-remote.{{ $namespace }}.svc:15012
             {{- else }}
-            - istio-pilot.istio-system.svc:15012
+            - istio-pilot.{{ $namespace }}.svc:15012
             {{- end }}
             {{- if .Values.global.proxy.logLevel }}
             - --proxyLogLevel={{ .Values.global.proxy.logLevel }}

diff --git a/operator/pkg/vfs/assets.gen.go b/operator/pkg/vfs/assets.gen.go