istioctl manifest has many unnecessary destination rule just for the tls.DISABLE

[incfly]

Bug description

➜  istio.io git:(automtls) ✗ kubectl get destinationrules.networking.istio.io --all-namespaces                       
NAMESPACE      NAME                                 HOST                                             AGE
istio-system   api-server                           kubernetes.default.svc.cluster.local             17m
istio-system   default                              *.local                                          7m
istio-system   grafana                              grafana.istio-system                             17m
istio-system   istio-multicluster-destinationrule   *.global                                         17m
istio-system   istio-policy                         istio-policy.istio-system.svc.cluster.local      17m
istio-system   istio-telemetry                      istio-telemetry.istio-system.svc.cluster.local   17m
istio-system   prometheus-full                      prometheus.istio-system.svc.cluster.local        17m
istio-system   prometheys                           prometheus.istio-system                          17m

Many of them are just for setting the TLS, which I don't think is needed.

kubectl get destinationrules.networking.istio.io --all-namespaces -oyaml | grep mode
        {"apiVersion":"networking.istio.io/v1alpha3","kind":"DestinationRule","metadata":{"annotations":{},"labels":{"operator.istio.io/component":"Pilot","operator.istio.io/managed":"Reconcile","operator.istio.io/version":"1.4.0","release":"istio"},"name":"api-server","namespace":"istio-system"},"spec":{"host":"kubernetes.default.svc.cluster.local","trafficPolicy":{"tls":{"mode":"DISABLE"}}}}
        mode: DISABLE
        {"apiVersion":"networking.istio.io/v1alpha3","kind":"DestinationRule","metadata":{"annotations":{},"labels":{"operator.istio.io/component":"Pilot","operator.istio.io/managed":"Reconcile","operator.istio.io/version":"1.4.0","release":"istio"},"name":"default","namespace":"istio-system"},"spec":{"host":"*.local","trafficPolicy":{"tls":{"mode":"DISABLE"}}}}
        mode: DISABLE
        {"apiVersion":"networking.istio.io/v1alpha3","kind":"DestinationRule","metadata":{"annotations":{},"labels":{"operator.istio.io/component":"Grafana","operator.istio.io/managed":"Reconcile","operator.istio.io/version":"1.4.0"},"name":"grafana","namespace":"istio-system"},"spec":{"host":"grafana.istio-system","trafficPolicy":{"tls":{"mode":"DISABLE"}}}}
        mode: DISABLE
        {"apiVersion":"networking.istio.io/v1alpha3","kind":"DestinationRule","metadata":{"annotations":{},"labels":{"app":"istio-egressgateway","operator.istio.io/component":"EgressGateway","operator.istio.io/managed":"Reconcile","operator.istio.io/version":"1.4.0","release":"istio"},"name":"istio-multicluster-destinationrule","namespace":"istio-system"},"spec":{"host":"*.global","trafficPolicy":{"tls":{"mode":"ISTIO_MUTUAL"}}}}
        mode: ISTIO_MUTUAL
        {"apiVersion":"networking.istio.io/v1alpha3","kind":"DestinationRule","metadata":{"annotations":{},"labels":{"app":"istio-policy","operator.istio.io/component":"Policy","operator.istio.io/managed":"Reconcile","operator.istio.io/version":"1.4.0","release":"istio"},"name":"istio-policy","namespace":"istio-system"},"spec":{"host":"istio-policy.istio-system.svc.cluster.local","trafficPolicy":{"connectionPool":{"http":{"http2MaxRequests":10000,"maxRequestsPerConnection":10000}},"portLevelSettings":[{"port":{"number":15004},"tls":{"mode":"ISTIO_MUTUAL"}},{"port":{"number":9091},"tls":{"mode":"DISABLE"}}]}}}
          mode: ISTIO_MUTUAL
          mode: DISABLE
        {"apiVersion":"networking.istio.io/v1alpha3","kind":"DestinationRule","metadata":{"annotations":{},"labels":{"app":"istio-telemetry","operator.istio.io/component":"Telemetry","operator.istio.io/managed":"Reconcile","operator.istio.io/version":"1.4.0","release":"istio"},"name":"istio-telemetry","namespace":"istio-system"},"spec":{"host":"istio-telemetry.istio-system.svc.cluster.local","trafficPolicy":{"connectionPool":{"http":{"http2MaxRequests":10000,"maxRequestsPerConnection":10000}},"portLevelSettings":[{"port":{"number":15004},"tls":{"mode":"ISTIO_MUTUAL"}},{"port":{"number":9091},"tls":{"mode":"DISABLE"}}]}}}
          mode: ISTIO_MUTUAL
          mode: DISABLE
        {"apiVersion":"networking.istio.io/v1alpha3","kind":"DestinationRule","metadata":{"annotations":{},"labels":{"operator.istio.io/component":"Prometheus","operator.istio.io/managed":"Reconcile","operator.istio.io/version":"1.4.0"},"name":"prometheus-full","namespace":"istio-system"},"spec":{"host":"prometheus.istio-system.svc.cluster.local","trafficPolicy":{"tls":{"mode":"DISABLE"}}}}
        mode: DISABLE
        {"apiVersion":"networking.istio.io/v1alpha3","kind":"DestinationRule","metadata":{"annotations":{},"labels":{"operator.istio.io/component":"Prometheus","operator.istio.io/managed":"Reconcile","operator.istio.io/version":"1.4.0"},"name":"prometheys","namespace":"istio-system"},"spec":{"host":"prometheus.istio-system","trafficPolicy":{"tls":{"mode":"DISABLE"}}}}

I didn't see that in previous demo profile and helm install, I haven't verified in 1.4.

[ X] Installation

Expected behavior

Steps to reproduce the bug

Version (include the output of istioctl version --remote and kubectl version)

How was Istio installed?
istioctl manifest apply --set profile=demo

[incfly]

istio-1.4-alpha.4c58b3d2f32c715f2188f227774256e2f81d865b build.

[incfly]

I confirmed the old helm yaml does not have this issue

k apply -f install/kubernetes/istio-demo.yaml
kubectl get destinationrules.networking.istio.io --all-namespaces
NAMESPACE      NAME              HOST                                             AGE
istio-system   istio-policy      istio-policy.istio-system.svc.cluster.local      4m
istio-system   istio-telemetry   istio-telemetry.istio-system.svc.cluster.local   4m

[howardjohn]

@incfly noticed this as well, I am going to send a change to delete them

[howardjohn]

Done