Skip to content

Commit 4b9452f

Browse files
author
robot
committed
robot: project cni chart upgrades from 1.17.1 to 1.30.3
Signed-off-by: robot <robot@example.com>
1 parent 49a55b8 commit 4b9452f

36 files changed

Lines changed: 1326 additions & 395 deletions

‎charts/cni/cni/Chart.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
1-
apiVersion: v1
2-
appVersion: 1.17.1
1+
apiVersion: v2
2+
appVersion: 1.30.3
33
description: Helm chart for istio-cni components
44
icon: https://istio.io/latest/favicons/android-192x192.png
55
keywords:
66
- istio-cni
77
- istio
88
name: cni
99
sources:
10-
- https://github.com/istio/istio/tree/master/cni
11-
version: 1.17.1
10+
- https://github.com/istio/istio
11+
version: 1.30.3
1212
dependencies:
1313
- name: cni
14-
version: "1.17.1"
14+
version: "1.30.3"
1515
repository: "https://istio-release.storage.googleapis.com/charts"

‎charts/cni/cni/README.md‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,45 @@ helm install istio-cni istio/cni -n kube-system
2121
```
2222

2323
Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
24-
`priorityClassName` can be used.
24+
`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
25+
'system-node-critical' outside of kube-system.
26+
27+
## Configuration
28+
29+
To view supported configuration options and documentation, run:
30+
31+
```console
32+
helm show values istio/istio-cni
33+
```
34+
35+
### Profiles
36+
37+
Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
38+
These can be set with `--set profile=<profile>`.
39+
For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
40+
41+
For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
42+
43+
Explicitly set values have highest priority, then profile settings, then chart defaults.
44+
45+
As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
46+
When configuring the chart, you should not include this.
47+
That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
48+
49+
### Ambient
50+
51+
To enable ambient, you can use the ambient profile: `--set profile=ambient`.
52+
53+
#### Calico
54+
55+
For Calico, you must also modify the settings to allow source spoofing:
56+
57+
- if deployed by operator, `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
58+
- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )
59+
60+
### GKE notes
61+
62+
On GKE, 'kube-system' is required.
63+
64+
If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`
65+
it is auto-detected.

‎charts/cni/cni/charts/cni/Chart.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
apiVersion: v1
2-
appVersion: 1.17.1
1+
apiVersion: v2
2+
appVersion: 1.30.3
33
description: Helm chart for istio-cni components
44
icon: https://istio.io/latest/favicons/android-192x192.png
55
keywords:
66
- istio-cni
77
- istio
88
name: cni
99
sources:
10-
- https://github.com/istio/istio/tree/master/cni
11-
version: 1.17.1
10+
- https://github.com/istio/istio
11+
version: 1.30.3

‎charts/cni/cni/charts/cni/README.md‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,45 @@ helm install istio-cni istio/cni -n kube-system
2121
```
2222

2323
Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
24-
`priorityClassName` can be used.
24+
`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
25+
'system-node-critical' outside of kube-system.
26+
27+
## Configuration
28+
29+
To view supported configuration options and documentation, run:
30+
31+
```console
32+
helm show values istio/istio-cni
33+
```
34+
35+
### Profiles
36+
37+
Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
38+
These can be set with `--set profile=<profile>`.
39+
For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
40+
41+
For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
42+
43+
Explicitly set values have highest priority, then profile settings, then chart defaults.
44+
45+
As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
46+
When configuring the chart, you should not include this.
47+
That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
48+
49+
### Ambient
50+
51+
To enable ambient, you can use the ambient profile: `--set profile=ambient`.
52+
53+
#### Calico
54+
55+
For Calico, you must also modify the settings to allow source spoofing:
56+
57+
- if deployed by operator, `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
58+
- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )
59+
60+
### GKE notes
61+
62+
On GKE, 'kube-system' is required.
63+
64+
If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`
65+
it is auto-detected.

‎charts/cni/cni/charts/cni/files/profile-ambient.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
2+
# The original version of this file is located at /manifests/helm-profiles directory.
3+
# If you want to make a change in this file, edit the original one and run "make gen".
4+
5+
# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
6+
meshConfig:
7+
defaultConfig:
8+
proxyMetadata:
9+
ISTIO_META_ENABLE_HBONE: "true"
10+
serviceScopeConfigs:
11+
- servicesSelector:
12+
matchExpressions:
13+
- key: istio.io/global
14+
operator: In
15+
values: ["true"]
16+
scope: GLOBAL
17+
global:
18+
variant: distroless
19+
pilot:
20+
env:
21+
PILOT_ENABLE_AMBIENT: "true"
22+
cni:
23+
ambient:
24+
enabled: true

‎charts/cni/cni/charts/cni/files/profile-compatibility-version-1.25.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
2+
# The original version of this file is located at /manifests/helm-profiles directory.
3+
# If you want to make a change in this file, edit the original one and run "make gen".
4+
5+
pilot:
6+
env:
7+
# 1.27 behavioral changes
8+
ENABLE_NATIVE_SIDECARS: "false"
9+
# 1.28 behavioral changes
10+
DISABLE_SHADOW_HOST_SUFFIX: "false"
11+
PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
12+
# 1.29 behavioral changes
13+
DISABLE_TRACK_REMAINING_CB_METRICS: "false"
14+
# 1.30 behavioral changes
15+
PILOT_SIDECAR_PICK_BEST_SERVICE_NAMESPACE: "false"
16+
17+
cni:
18+
ambient:
19+
# 1.29 behavioral changes - reconcileIptablesOnStartup was false by default in 1.25
20+
reconcileIptablesOnStartup: false
21+
22+
ambient:
23+
# 1.26 behavioral changes
24+
shareHostNetworkNamespace: true

‎charts/cni/cni/charts/cni/files/profile-compatibility-version-1.26.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
2+
# The original version of this file is located at /manifests/helm-profiles directory.
3+
# If you want to make a change in this file, edit the original one and run "make gen".
4+
5+
pilot:
6+
env:
7+
# 1.27 behavioral changes
8+
ENABLE_NATIVE_SIDECARS: "false"
9+
# 1.28 behavioral changes
10+
DISABLE_SHADOW_HOST_SUFFIX: "false"
11+
PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
12+
# 1.29 behavioral changes
13+
DISABLE_TRACK_REMAINING_CB_METRICS: "false"
14+
# 1.30 behavioral changes
15+
PILOT_SIDECAR_PICK_BEST_SERVICE_NAMESPACE: "false"
16+
17+
cni:
18+
ambient:
19+
# 1.29 behavioral changes - reconcileIptablesOnStartup was false by default in 1.26
20+
reconcileIptablesOnStartup: false

‎charts/cni/cni/charts/cni/files/profile-compatibility-version-1.27.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
2+
# The original version of this file is located at /manifests/helm-profiles directory.
3+
# If you want to make a change in this file, edit the original one and run "make gen".
4+
5+
pilot:
6+
env:
7+
# 1.28 behavioral changes
8+
DISABLE_SHADOW_HOST_SUFFIX: "false"
9+
PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
10+
# 1.29 behavioral changes
11+
DISABLE_TRACK_REMAINING_CB_METRICS: "false"
12+
# 1.30 behavioral changes
13+
PILOT_SIDECAR_PICK_BEST_SERVICE_NAMESPACE: "false"
14+
15+
cni:
16+
ambient:
17+
# 1.29 behavioral changes - reconcileIptablesOnStartup was false by default in 1.27
18+
reconcileIptablesOnStartup: false

‎charts/cni/cni/charts/cni/files/profile-compatibility-version-1.28.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
2+
# The original version of this file is located at /manifests/helm-profiles directory.
3+
# If you want to make a change in this file, edit the original one and run "make gen".
4+
5+
pilot:
6+
env:
7+
# 1.29 behavioral changes
8+
DISABLE_TRACK_REMAINING_CB_METRICS: "false"
9+
# 1.30 behavioral changes
10+
PILOT_SIDECAR_PICK_BEST_SERVICE_NAMESPACE: "false"
11+
12+
cni:
13+
ambient:
14+
# 1.29 behavioral changes - reconcileIptablesOnStartup was false by default in 1.28
15+
reconcileIptablesOnStartup: false

‎charts/cni/cni/charts/cni/files/profile-compatibility-version-1.29.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
2+
# The original version of this file is located at /manifests/helm-profiles directory.
3+
# If you want to make a change in this file, edit the original one and run "make gen".
4+
5+
pilot:
6+
env:
7+
# 1.30 behavioral changes
8+
PILOT_SIDECAR_PICK_BEST_SERVICE_NAMESPACE: "false"

0 commit comments

Comments
 (0)