Skip to content

Commit ce2b45b

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authoredMar 28, 2025
Merge pull request #330 from openshift-service-mesh-bot/none-master-merge_upstream_istio_master-6253864e
Automator: merge upstream changes to openshift-service-mesh/istio@master
2 parents 1851980 + 06358b0 commit ce2b45b

File tree

30 files changed

+1185
-94
lines changed

30 files changed

+1185
-94
lines changed
 

‎manifests/charts/istio-control/istio-discovery/files/kube-gateway.yaml

+48
Original file line numberDiff line numberDiff line change
@@ -343,3 +343,51 @@ spec:
343343
{{- end }}
344344
type: {{ .ServiceType | quote }}
345345
---
346+
apiVersion: autoscaling/v2
347+
kind: HorizontalPodAutoscaler
348+
metadata:
349+
name: {{.DeploymentName | quote}}
350+
namespace: {{.Namespace | quote}}
351+
annotations:
352+
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
353+
labels:
354+
{{- toJsonMap
355+
.InfrastructureLabels
356+
(strdict
357+
"gateway.networking.k8s.io/gateway-name" .Name
358+
) | nindent 4 }}
359+
ownerReferences:
360+
- apiVersion: gateway.networking.k8s.io/v1beta1
361+
kind: Gateway
362+
name: {{.Name}}
363+
uid: "{{.UID}}"
364+
spec:
365+
scaleTargetRef:
366+
apiVersion: apps/v1
367+
kind: Deployment
368+
name: {{.DeploymentName | quote}}
369+
maxReplicas: 1
370+
---
371+
apiVersion: policy/v1
372+
kind: PodDisruptionBudget
373+
metadata:
374+
name: {{.DeploymentName | quote}}
375+
namespace: {{.Namespace | quote}}
376+
annotations:
377+
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
378+
labels:
379+
{{- toJsonMap
380+
.InfrastructureLabels
381+
(strdict
382+
"gateway.networking.k8s.io/gateway-name" .Name
383+
) | nindent 4 }}
384+
ownerReferences:
385+
- apiVersion: gateway.networking.k8s.io/v1beta1
386+
kind: Gateway
387+
name: {{.Name}}
388+
uid: "{{.UID}}"
389+
spec:
390+
selector:
391+
matchLabels:
392+
gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
393+

‎manifests/charts/istio-control/istio-discovery/files/waypoint.yaml

+48
Original file line numberDiff line numberDiff line change
@@ -338,3 +338,51 @@ spec:
338338
{{- end }}
339339
type: {{ .ServiceType | quote }}
340340
---
341+
apiVersion: autoscaling/v2
342+
kind: HorizontalPodAutoscaler
343+
metadata:
344+
name: {{.DeploymentName | quote}}
345+
namespace: {{.Namespace | quote}}
346+
annotations:
347+
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
348+
labels:
349+
{{- toJsonMap
350+
.InfrastructureLabels
351+
(strdict
352+
"gateway.networking.k8s.io/gateway-name" .Name
353+
) | nindent 4 }}
354+
ownerReferences:
355+
- apiVersion: gateway.networking.k8s.io/v1beta1
356+
kind: Gateway
357+
name: {{.Name}}
358+
uid: "{{.UID}}"
359+
spec:
360+
scaleTargetRef:
361+
apiVersion: apps/v1
362+
kind: Deployment
363+
name: {{.DeploymentName | quote}}
364+
maxReplicas: 1
365+
---
366+
apiVersion: policy/v1
367+
kind: PodDisruptionBudget
368+
metadata:
369+
name: {{.DeploymentName | quote}}
370+
namespace: {{.Namespace | quote}}
371+
annotations:
372+
{{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
373+
labels:
374+
{{- toJsonMap
375+
.InfrastructureLabels
376+
(strdict
377+
"gateway.networking.k8s.io/gateway-name" .Name
378+
) | nindent 4 }}
379+
ownerReferences:
380+
- apiVersion: gateway.networking.k8s.io/v1beta1
381+
kind: Gateway
382+
name: {{.Name}}
383+
uid: "{{.UID}}"
384+
spec:
385+
selector:
386+
matchLabels:
387+
gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
388+

‎manifests/charts/istio-control/istio-discovery/templates/clusterrole.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,12 @@ rules:
177177
- apiGroups: ["apps"]
178178
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
179179
resources: [ "deployments" ]
180+
- apiGroups: ["autoscaling"]
181+
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
182+
resources: [ "horizontalpodautoscalers" ]
183+
- apiGroups: ["policy"]
184+
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
185+
resources: [ "poddisruptionbudgets" ]
180186
- apiGroups: [""]
181187
verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
182188
resources: [ "services" ]

‎manifests/charts/istio-control/istio-discovery/templates/gateway-class-configmap.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{ range $key, $value := .Values.gatewayClasses }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: istio-{{ $.Values.revision | default "default" }}-gatewayclass-{{$key}}
6+
namespace: {{ $.Release.Namespace }}
7+
labels:
8+
istio.io/rev: {{ $.Values.revision | default "default" | quote }}
9+
install.operator.istio.io/owning-resource: {{ $.Values.ownerName | default "unknown" }}
10+
operator.istio.io/component: "Pilot"
11+
release: {{ $.Release.Name }}
12+
app.kubernetes.io/name: "istiod"
13+
gateway.istio.io/defaults-for-class: {{$key|quote}}
14+
{{- include "istio.labels" $ | nindent 4 }}
15+
data:
16+
{{ range $kind, $overlay := $value }}
17+
{{$kind}}: |
18+
{{$overlay|toYaml|trim|indent 4}}
19+
{{ end }}
20+
---
21+
{{ end }}

‎manifests/charts/istio-control/istio-discovery/values.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -539,3 +539,13 @@ _internal_defaults_do_not_set:
539539

540540
# Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
541541
seccompProfile: {}
542+
543+
# gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
544+
# For example:
545+
# gatewayClasses:
546+
# istio:
547+
# service:
548+
# spec:
549+
# type: ClusterIP
550+
# Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
551+
gatewayClasses: {}

‎operator/pkg/apis/values_types.pb.go

+33-19
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎operator/pkg/apis/values_types.proto

+3
Original file line numberDiff line numberDiff line change
@@ -1412,6 +1412,9 @@ message Values {
14121412

14131413
// Specifies experimental helm fields that could be removed or changed in the future
14141414
ExperimentalConfig experimental = 44;
1415+
1416+
// Configuration for Gateway Classes
1417+
google.protobuf.Value gatewayClasses = 45;
14151418
}
14161419

14171420
// ZeroVPNConfig enables cross-cluster access using SNI matching.

‎pilot/pkg/bootstrap/configcontroller.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,7 @@ func (s *Server) initK8SConfigStore(args *PilotArgs) error {
193193
if s.kubeClient.CrdWatcher().WaitForCRD(gvr.KubernetesGateway, leaderStop) {
194194
tagWatcher := revisions.NewTagWatcher(s.kubeClient, args.Revision)
195195
controller := gateway.NewDeploymentController(s.kubeClient, s.clusterID, s.environment,
196-
s.webhookInfo.getWebhookConfig, s.webhookInfo.addHandler, tagWatcher, args.Revision)
196+
s.webhookInfo.getWebhookConfig, s.webhookInfo.addHandler, tagWatcher, args.Revision, args.Namespace)
197197
// Start informers again. This fixes the case where informers for namespace do not start,
198198
// as we create them only after acquiring the leader lock
199199
// Note: stop here should be the overall pilot stop, NOT the leader election stop. We are

‎pilot/pkg/bootstrap/server.go

+7-4
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,8 @@ type Server struct {
153153
RA ra.RegistrationAuthority
154154
caServer *caserver.Server
155155

156-
// TrustAnchors for workload to workload mTLS
156+
// TrustAnchors for workload to workload mTLS and proxy to istiod TLS
157+
// Only initiated when `ISTIO_MULTIROOT_MESH` = true
157158
workloadTrustBundle *tb.TrustBundle
158159
certMu sync.RWMutex
159160
istiodCert *tls.Certificate
@@ -298,9 +299,11 @@ func NewServer(args *PilotArgs, initFuncs ...func(*Server)) (*Server, error) {
298299
return nil, err
299300
}
300301

301-
// Initialize trust bundle after mesh config which it depends on
302-
s.workloadTrustBundle = tb.NewTrustBundle(nil, e.Watcher)
303-
e.TrustBundle = s.workloadTrustBundle
302+
if features.MultiRootMesh {
303+
// Initialize trust bundle after mesh config which it depends on
304+
s.workloadTrustBundle = tb.NewTrustBundle(nil, e.Watcher)
305+
e.TrustBundle = s.workloadTrustBundle
306+
}
304307

305308
// Options based on the current 'defaults' in istio.
306309
caOpts := &caOptions{

‎pilot/pkg/config/kube/crdclient/types.gen.go

+40
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)
Please sign in to comment.