Add Istio 1.5.X

~~Istio 1.5.0 is planned to be released 2/18 at the time of this writing (see https://github.com/istio/istio/wiki/Istio-Release-1.5). We need to start working on bumping to this version.~~

Rancher's 1.5 will use the original helm chart and not support istioD. We will support a migration path from the original helm chart to the operator helm chart with 1.5->1.6, which will come at a later date.

Based on our current roadmap/timelines I'm guessing this should be for v2.4.0 release so have tagged that milestone for now.

Istio was released today 3/5. After 2.4.0 we should start looking into our options.
Originally I suggested we do this immediately but after doing some more research looks like deprecation MAY happen much after 1.5.0 -- istioctl is the recommended install method.
If you read thru slack comments you'll see statements about this.

This may require large updates to UI with istioD replacing Pilot, Citadel, Galley. Also, depending on how helm vs istioctl treat istiod install, it also may necessitate we handle helm deprecation at same time.

I tested out istio 1.5.0 default install on one of our test clusters, it seems these feature gates are not turned on in rancher although default should be true

I need to do some further research. Currently istiod fails with
MountVolume.SetUp failed for volume "istio-token" : failed to fetch token: the API server does not have TokenRequest endpoints enabled

I am on rancher 2.3.5 and the cluster is on 1.17.4-rancher1-1

Edit:

Got this working fine yesterday by adding proper flags to the api-server.

@LinAnt

@LinAnt could you please tell us what you did in your workaround?

You just need to confitgure the API server to enable the endpoints:
extra_args:
        service-account-issuer: <example-name>
        service-account-signing-key-file: /etc/kubernetes/ssl/kube-service-account-token-key.pem

Hi @LinAnt
Do you know if there is a way to add this extra_args with a rancher/rancher-agent:v2.4.2 --server command?

I'm also having this issue while trying to install kubeflow with dex authentication. It seems service-account-signing-key-file is already set in the config. I tried adding service-account-issuer with and without service-account-signing-key-file under services.kube-api.extra_args and I get the following error.

Error: --service-account-signing-key-file, --service-account-issuer, and --api-audiences should be specified together

I am using a custom cluster so I am unsure where in Rancher I can change the required setting to deploy the cluster successfully.

@davidspek

I'm having the same problem as @davidspek.

Navigation Menu

Repository navigation

Add Istio 1.5.X #25098

11 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Add Istio 1.5.X #25098

Description

Activity

davidnuzik commented on Jan 24, 2020

davidnuzik commented on Mar 5, 2020

cbron commented on Mar 13, 2020

LinAnt commented on Mar 19, 2020

11 remaining items

FrimIdan commented on May 5, 2020

davidspek commented on Jun 22, 2020

lomori commented on Sep 21, 2020

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions