Skip to content

Latest commit

 

History

History
146 lines (98 loc) · 13.4 KB

ossm-rn-fixed-issues.adoc

File metadata and controls

146 lines (98 loc) · 13.4 KB
Raw

Fixed issues

The following issues been resolved in the current release:

{SMProductShortName} fixed issues

  • OSSM-2053 Using {SMProductName} Operator 2.2 or 2.3, during SMCP reconciliation, the SMMR controller removed the member namespaces from SMMR.status.configuredMembers. This caused the services in the member namespaces to become unavailable for a few moments.

    Using {SMProductName} Operator 2.2 or 2.3, the SMMR controller no longer removes the namespaces from SMMR.status.configuredMembers. Instead, the controller adds the namespaces to SMMR.status.pendingMembers to indicate that they are not up-to-date. During reconciliation, as each namespace synchronizes with the SMCP, the namespace is automatically removed from SMMR.status.pendingMembers.

  • OSSM-1962 Use EndpointSlices in federation controller. The federation controller now uses EndpointSlices, which improves scalability and performance in large deployments. The PILOT_USE_ENDPOINT_SLICE flag is enabled by default. Disabling the flag prevents use of federation deployments.

  • OSSM-1668 A new field spec.security.jwksResolverCA was added to the Version 2.1 SMCP but was missing in the 2.2.0 and 2.2.1 releases. When upgrading from an Operator version where this field was present to an Operator version that was missing this field, the .spec.security.jwksResolverCA field was not available in the SMCP.

  • OSSM-1325 istiod pod crashes and displays the following error message: fatal error: concurrent map iteration and map write.

  • OSSM-1211 Configuring Federated service meshes for failover does not work as expected.

    The Istiod pilot log displays the following error: envoy connection [C289] TLS error: 337047686:SSL routines:tls_process_server_certificate:certificate verify failed

  • OSSM-1099 The Kiali console displayed the message Sorry, there was a problem. Try a refresh or navigate to a different page.

  • OSSM-1074 Pod annotations defined in SMCP are not injected in the pods.

  • OSSM-999 Kiali retention did not work as expected. Calendar times were greyed out in the dashboard graph.

  • OSSM-797 Kiali Operator pod generates CreateContainerConfigError while installing or updating the operator.

  • OSSM-722 Namespace starting with kube is hidden from Kiali.

  • OSSM-569 There is no CPU memory limit for the Prometheus istio-proxy container. The Prometheus istio-proxy sidecar now uses the resource limits defined in spec.proxy.runtime.container.

  • OSSM-449 VirtualService and Service causes an error "Only unique values for domains are permitted. Duplicate entry of domain."

  • OSSM-419 Namespaces with similar names will all show in Kiali namespace list, even though namespaces may not be defined in Service Mesh Member Role.

  • OSSM-296 When adding health configuration to the Kiali custom resource (CR) is it not being replicated to the Kiali configmap.

  • OSSM-291 In the Kiali console, on the Applications, Services, and Workloads pages, the "Remove Label from Filters" function is not working.

  • OSSM-289 In the Kiali console, on the Service Details pages for the 'istio-ingressgateway' and 'jaeger-query' services there are no Traces being displayed. The traces exist in Jaeger.

  • OSSM-287 In the Kiali console there are no traces being displayed on the Graph Service.

  • OSSM-285 When trying to access the Kiali console, receive the following error message "Error trying to get OAuth Metadata".

    Workaround: Restart the Kiali pod.

  • MAISTRA-2735 The resources that the Service Mesh Operator deletes when reconciling the SMCP changed in {SMProductName} version 2.1. Previously, the Operator deleted a resource with the following labels:

    • maistra.io/owner

    • app.kubernetes.io/version

    Now, the Operator ignores resources that does not also include the app.kubernetes.io/managed-by=maistra-istio-operator label. If you create your own resources, you should not add the app.kubernetes.io/managed-by=maistra-istio-operator label to them.

  • MAISTRA-2687 {SMProductName} 2.1 federation gateway does not send the full certificate chain when using external certificates. The {SMProductShortName} federation egress gateway only sends the client certificate. Because the federation ingress gateway only knows about the root certificate, it cannot verify the client certificate unless you add the root certificate to the federation import ConfigMap.

  • MAISTRA-2635 Replace deprecated Kubernetes API. To remain compatible with {product-title} 4.8, the apiextensions.k8s.io/v1beta1 API was deprecated as of {SMProductName} 2.0.8.

  • MAISTRA-2631 The WASM feature is not working because podman is failing due to nsenter binary not being present. {SMProductName} generates the following error message: Error: error configuring CNI network plugin exec: "nsenter": executable file not found in $PATH. The container image now contains nsenter and WASM works as expected.

  • MAISTRA-2534 When istiod attempted to fetch the JWKS for an issuer specified in a JWT rule, the issuer service responded with a 502. This prevented the proxy container from becoming ready and caused deployments to hang. The fix for the community bug has been included in the {SMProductShortName} 2.0.7 release.

  • MAISTRA-2411 When the Operator creates a new ingress gateway using spec.gateways.additionaIngress in the ServiceMeshControlPlane, Operator is not creating a NetworkPolicy for the additional ingress gateway like it does for the default istio-ingressgateway. This is causing a 503 response from the route of the new gateway.

    Workaround: Manually create the NetworkPolicy in the <istio-system> namespace.

  • MAISTRA-2401 CVE-2021-3586 servicemesh-operator: NetworkPolicy resources incorrectly specified ports for ingress resources. The NetworkPolicy resources installed for {SMProductName} did not properly specify which ports could be accessed. This allowed access to all ports on these resources from any pod. Network policies applied to the following resources are affected:

    • Galley

    • Grafana

    • Istiod

    • Jaeger

    • Kiali

    • Prometheus

    • Sidecar injector

  • MAISTRA-2378 When the cluster is configured to use OpenShift SDN with ovs-multitenant and the mesh contains a large number of namespaces (200+), the {product-title} networking plug-in is unable to configure the namespaces quickly. {SMProductShortName} times out causing namespaces to be continuously dropped from the service mesh and then reenlisted.

  • MAISTRA-2370 Handle tombstones in listerInformer. The updated cache codebase was not handling tombstones when translating the events from the namespace caches to the aggregated cache, leading to a panic in the go routine.

  • MAISTRA-2117 Add optional ConfigMap mount to operator. The CSV now contains an optional ConfigMap volume mount, which mounts the smcp-templates ConfigMap if it exists. If the smcp-templates ConfigMap does not exist, the mounted directory is empty. When you create the ConfigMap, the directory is populated with the entries from the ConfigMap and can be referenced in SMCP.spec.profiles. No restart of the Service Mesh operator is required.

    Customers using the 2.0 operator with a modified CSV to mount the smcp-templates ConfigMap can upgrade to {SMProductName} 2.1. After upgrading, you can continue using an existing ConfigMap, and the profiles it contains, without editing the CSV. Customers that previously used ConfigMap with a different name will either have to rename the ConfigMap or update the CSV after upgrading.

  • MAISTRA-2010 AuthorizationPolicy does not support request.regex.headers field. The validatingwebhook rejects any AuthorizationPolicy with the field, and even if you disable that, Pilot tries to validate it using the same code, and it does not work.

  • MAISTRA-1979 Migration to 2.0 The conversion webhook drops the following important fields when converting SMCP.status from v2 to v1:

    • conditions

    • components

    • observedGeneration

    • annotations

      Upgrading the operator to 2.0 might break client tools that read the SMCP status using the maistra.io/v1 version of the resource.

      This also causes the READY and STATUS columns to be empty when you run oc get servicemeshcontrolplanes.v1.maistra.io.

  • MAISTRA-1947 Technology Preview Updates to ServiceMeshExtensions are not applied.

    Workaround: Remove and recreate the ServiceMeshExtensions.

  • MAISTRA-1983 Migration to 2.0 Upgrading to 2.0.0 with an existing invalid ServiceMeshControlPlane cannot easily be repaired. The invalid items in the ServiceMeshControlPlane resource caused an unrecoverable error. The fix makes the errors recoverable. You can delete the invalid resource and replace it with a new one or edit the resource to fix the errors. For more information about editing your resource, see [Configuring the Red Hat OpenShift Service Mesh installation].

  • MAISTRA-1502 As a result of CVEs fixes in version 1.0.10, the Istio dashboards are not available from the Home Dashboard menu in Grafana. To access the Istio dashboards, click the Dashboard menu in the navigation panel and select the Manage tab.

  • MAISTRA-1399 {SMProductName} no longer prevents you from installing unsupported CNI protocols. The supported network configurations has not changed.

  • MAISTRA-1089 Migration to 2.0 Gateways created in a non-control plane namespace are automatically deleted. After removing the gateway definition from the SMCP spec, you need to manually delete these resources.

  • MAISTRA-858 The following Envoy log messages describing deprecated options and configurations associated with Istio 1.1.x are expected:

    • [2019-06-03 07:03:28.943][19][warning][misc] [external/envoy/source/common/protobuf/utility.cc:129] Using deprecated option 'envoy.api.v2.listener.Filter.config'. This configuration will be removed from Envoy soon.

    • [2019-08-12 22:12:59.001][13][warning][misc] [external/envoy/source/common/protobuf/utility.cc:174] Using deprecated option 'envoy.api.v2.Listener.use_original_dst' from file lds.proto. This configuration will be removed from Envoy soon.

  • MAISTRA-806 Evicted Istio Operator Pod causes mesh and CNI not to deploy.

    Workaround: If the istio-operator pod is evicted while deploying the control pane, delete the evicted istio-operator pod.

  • MAISTRA-681 When the {SMProductShortName} control plane has many namespaces, it can lead to performance issues.

  • MAISTRA-193 Unexpected console info messages are visible when health checking is enabled for citadel.

  • Bugzilla 1821432 The toggle controls in {product-title} Custom Resource details page does not update the CR correctly. UI Toggle controls in the {SMProductShortName} Control Plane (SMCP) Overview page in the {product-title} web console sometimes updates the wrong field in the resource. To update a SMCP, edit the YAML content directly or update the resource from the command line instead of clicking the toggle controls.