bump istio to v1.18.7 (#1240)

knative-extensions · Jan 15, 2024 · 9934a3e · 9934a3e
1 parent 0a2e1cc
commit 9934a3e
Show file tree

Hide file tree

Showing 6 changed files with 100 additions and 44 deletions.
diff --git a/third_party/istio-latest/generate-manifests.sh b/third_party/istio-latest/generate-manifests.sh
@@ -16,4 +16,4 @@
 
 source "$(dirname $0)/../library.sh"
 
-generate "1.18.5" "$(dirname $0)"
+generate "1.18.7" "$(dirname $0)"
diff --git a/third_party/istio-latest/istio-ci-ambient/istio.yaml b/third_party/istio-latest/istio-ci-ambient/istio.yaml
@@ -88,7 +88,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: istio-cni-repair-role
+  name: istio-cni-ambient
   labels:
     app: istio-cni
     release: istio
@@ -99,26 +99,36 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - pods
+      - pods/status
     verbs:
-      - get
-      - list
-      - watch
-      - delete
       - patch
       - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istio-cni-repair-role
+  labels:
+    app: istio-cni
+    release: istio
+    istio.io/rev: default
+    install.operator.istio.io/owning-resource: unknown
+    operator.istio.io/component: Cni
+rules:
   - apiGroups:
       - ""
     resources:
-      - events
+      - pods
     verbs:
+      - watch
       - get
       - list
-      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
       - delete
-      - patch
-      - update
-      - create
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -762,6 +772,24 @@ subjects:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
+metadata:
+  name: istio-cni-ambient
+  labels:
+    k8s-app: istio-cni-repair
+    istio.io/rev: default
+    install.operator.istio.io/owning-resource: unknown
+    operator.istio.io/component: Cni
+subjects:
+  - kind: ServiceAccount
+    name: istio-cni
+    namespace: istio-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istio-cni-ambient
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
 metadata:
   name: istio-cni-repair-rolebinding
   labels:
@@ -7937,7 +7965,7 @@ data:
         "sts": {
           "servicePort": 0
         },
-        "tag": "1.18.5",
+        "tag": "1.18.7",
         "tracer": {
           "datadog": {},
           "lightstep": {},
@@ -9778,7 +9806,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
-          image: docker.io/istio/proxyv2:1.18.5
+          image: docker.io/istio/proxyv2:1.18.7
           name: istio-proxy
           ports:
             - containerPort: 15021
@@ -9929,7 +9957,7 @@ spec:
         fsGroup: 1337
       containers:
         - name: discovery
-          image: docker.io/istio/pilot:1.18.5
+          image: docker.io/istio/pilot:1.18.7
           args:
             - discovery
             - --monitoringAddr=:15014
@@ -10428,7 +10456,7 @@ spec:
       terminationGracePeriodSeconds: 5
       containers:
         - name: install-cni
-          image: docker.io/istio/install-cni:1.18.5
+          image: docker.io/istio/install-cni:1.18.7
           readinessProbe:
             httpGet:
               path: /readyz
@@ -10459,7 +10487,7 @@ spec:
                 fieldRef:
                   fieldPath: spec.nodeName
             - name: REPAIR_LABEL_PODS
-              value: "true"
+              value: "false"
             - name: REPAIR_DELETE_PODS
               value: "true"
             - name: REPAIR_RUN_AS_DAEMON
@@ -10551,7 +10579,7 @@ spec:
           operator: Exists
       containers:
         - name: istio-proxy
-          image: docker.io/istio/ztunnel:1.18.5
+          image: docker.io/istio/ztunnel:1.18.7
           resources:
             requests:
               cpu: 500m

diff --git a/third_party/istio-latest/istio-ci-mesh/istio.yaml b/third_party/istio-latest/istio-ci-mesh/istio.yaml
@@ -7793,7 +7793,7 @@ data:
         "sts": {
           "servicePort": 0
         },
-        "tag": "1.18.5",
+        "tag": "1.18.7",
         "tracer": {
           "datadog": {},
           "lightstep": {},
@@ -9632,7 +9632,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
-          image: docker.io/istio/proxyv2:1.18.5
+          image: docker.io/istio/proxyv2:1.18.7
           name: istio-proxy
           ports:
             - containerPort: 15021
@@ -9783,7 +9783,7 @@ spec:
         fsGroup: 1337
       containers:
         - name: discovery
-          image: docker.io/istio/pilot:1.18.5
+          image: docker.io/istio/pilot:1.18.7
           args:
             - discovery
             - --monitoringAddr=:15014

diff --git a/third_party/istio-latest/istio-ci-no-mesh/istio.yaml b/third_party/istio-latest/istio-ci-no-mesh/istio.yaml
@@ -7793,7 +7793,7 @@ data:
         "sts": {
           "servicePort": 0
         },
-        "tag": "1.18.5",
+        "tag": "1.18.7",
         "tracer": {
           "datadog": {},
           "lightstep": {},
@@ -9632,7 +9632,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
-          image: docker.io/istio/proxyv2:1.18.5
+          image: docker.io/istio/proxyv2:1.18.7
           name: istio-proxy
           ports:
             - containerPort: 15021
@@ -9783,7 +9783,7 @@ spec:
         fsGroup: 1337
       containers:
         - name: discovery
-          image: docker.io/istio/pilot:1.18.5
+          image: docker.io/istio/pilot:1.18.7
           args:
             - discovery
             - --monitoringAddr=:15014

diff --git a/third_party/istio-latest/istio-kind-ambient/istio.yaml b/third_party/istio-latest/istio-kind-ambient/istio.yaml
@@ -88,7 +88,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: istio-cni-repair-role
+  name: istio-cni-ambient
   labels:
     app: istio-cni
     release: istio
@@ -99,26 +99,36 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - pods
+      - pods/status
     verbs:
-      - get
-      - list
-      - watch
-      - delete
       - patch
       - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istio-cni-repair-role
+  labels:
+    app: istio-cni
+    release: istio
+    istio.io/rev: default
+    install.operator.istio.io/owning-resource: unknown
+    operator.istio.io/component: Cni
+rules:
   - apiGroups:
       - ""
     resources:
-      - events
+      - pods
     verbs:
+      - watch
       - get
       - list
-      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
       - delete
-      - patch
-      - update
-      - create
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -762,6 +772,24 @@ subjects:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
+metadata:
+  name: istio-cni-ambient
+  labels:
+    k8s-app: istio-cni-repair
+    istio.io/rev: default
+    install.operator.istio.io/owning-resource: unknown
+    operator.istio.io/component: Cni
+subjects:
+  - kind: ServiceAccount
+    name: istio-cni
+    namespace: istio-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istio-cni-ambient
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
 metadata:
   name: istio-cni-repair-rolebinding
   labels:
@@ -7937,7 +7965,7 @@ data:
         "sts": {
           "servicePort": 0
         },
-        "tag": "1.18.5",
+        "tag": "1.18.7",
         "tracer": {
           "datadog": {},
           "lightstep": {},
@@ -9778,7 +9806,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
-          image: docker.io/istio/proxyv2:1.18.5
+          image: docker.io/istio/proxyv2:1.18.7
           name: istio-proxy
           ports:
             - containerPort: 15021
@@ -9929,7 +9957,7 @@ spec:
         fsGroup: 1337
       containers:
         - name: discovery
-          image: docker.io/istio/pilot:1.18.5
+          image: docker.io/istio/pilot:1.18.7
           args:
             - discovery
             - --monitoringAddr=:15014
@@ -10428,7 +10456,7 @@ spec:
       terminationGracePeriodSeconds: 5
       containers:
         - name: install-cni
-          image: docker.io/istio/install-cni:1.18.5
+          image: docker.io/istio/install-cni:1.18.7
           readinessProbe:
             httpGet:
               path: /readyz
@@ -10459,7 +10487,7 @@ spec:
                 fieldRef:
                   fieldPath: spec.nodeName
             - name: REPAIR_LABEL_PODS
-              value: "true"
+              value: "false"
             - name: REPAIR_DELETE_PODS
               value: "true"
             - name: REPAIR_RUN_AS_DAEMON
@@ -10551,7 +10579,7 @@ spec:
           operator: Exists
       containers:
         - name: istio-proxy
-          image: docker.io/istio/ztunnel:1.18.5
+          image: docker.io/istio/ztunnel:1.18.7
           resources:
             requests:
               cpu: 500m

diff --git a/third_party/istio-latest/istio-kind-no-mesh/istio.yaml b/third_party/istio-latest/istio-kind-no-mesh/istio.yaml
@@ -7793,7 +7793,7 @@ data:
         "sts": {
           "servicePort": 0
         },
-        "tag": "1.18.5",
+        "tag": "1.18.7",
         "tracer": {
           "datadog": {},
           "lightstep": {},
@@ -9632,7 +9632,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
-          image: docker.io/istio/proxyv2:1.18.5
+          image: docker.io/istio/proxyv2:1.18.7
           name: istio-proxy
           ports:
             - containerPort: 15021
@@ -9783,7 +9783,7 @@ spec:
         fsGroup: 1337
       containers:
         - name: discovery
-          image: docker.io/istio/pilot:1.18.5
+          image: docker.io/istio/pilot:1.18.7
           args:
             - discovery
             - --monitoringAddr=:15014