CNI charts are outdated

[jwendell]

Previously (or currently) CNI components can be - and are - encouraged to be installed on kube-system namespace:

$ helm template install/kubernetes/helm/istio-cni --name=istio-cni --namespace=kube-system | kubectl apply -f -

This way users can setup additional priorities for pod scheduling like system-node-critical.

With the istioctl manifest method, those components are installed in istio-system namespace.

Is there an way to install them in a different namespace like it's possible with helm?

[jwendell]

cc @sdake @ostromart @rlenglet

[rlenglet]

This is incorrect. It had to be created in kube-system due to using the system-node-critical priority class. This is no longer required in 1.4, where we use the system-cluster-critical priority class.

[rlenglet]

cc @ruigulala

[rlenglet]

That said, for some reason, istio/installer has forked the Helm chart seemingly months ago and never sinced again: https://github.com/istio/installer/blob/release-1.4/istio-cni/templates/daemonset.yaml It does even have the priorityClass. This is a recipe for disaster. @jwendell I'd recommend rewording the issue about istio/installer being way out of sync with upstream istio/cni.

[rlenglet]

istio/installer CNI charts being out of sync with istio/cni is a release blocker IMHO. @istio/release-managers-1-4

[jwendell]

@rlenglet Do you know who is the source of truth when we talk about charts? It's confusing to me.

So, we have charts in istio/cni, then install/cni. We also have istio/operator. Where does istioctl manifest copy them from? Which one does it use?

[howardjohn]

istioctl imports the operator as go code. The operator has the charts built into the go code using the vfsgen stuff. Those charts are from istio/installer. istio/cni also has charts that are shipped as part of the helm install

…

On Sat, Nov 2, 2019, 8:42 AM Jonh Wendell ***@***.***> wrote: @rlenglet <https://github.com/rlenglet> Do you know who is the source of truth when we talk about charts? It's confusing to me. So, we have charts in istio/cni, then install/cni. We also have istio/operator. Where does istioctl manifest copy them from? Which one does it use? — You are receiving this because you are on a team that was mentioned. Reply to this email directly, view it on GitHub <#18576?email_source=notifications&email_token=AAEYGXJVS7GX5IPBIQ2FDFDQRWNXBA5CNFSM4JIGE5CKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEC46V2Q#issuecomment-549055210>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEYGXIRY4A7MQ4HVJWZRDDQRWNXBANCNFSM4JIGE5CA> .

[jwendell]

I've created istio/installer#477

Could someone from CNI team please verify if it's enough?

[sdake]

@rlenglet Do you know who is the source of truth when we talk about charts? It's confusing to me.

So, we have charts in istio/cni, then install/cni. We also have istio/operator. Where does istioctl manifest copy them from? Which one does it use?

The source of truth, for the time being, is istio/installer repo. We plan to delete charts from other repositories including this one to centralize the installation charts. In istio/istio, the install directory has taken a hard line on merging changes to installer first. Sadly that was not done with this repo.

Cheers
-steve