[release-0.22] precompute istio manifests (#589)

* precompute istio manifests

* don't label namespace that doesn't exist

* use proper mesh configuration

* quote the selector so kubectl try to install extra resources

* fix codegen scripts to work with run_go_tool

* fix github action runs

* apply the required config-istio

* ensure correct config-istio is applied for the test

* speed up e2e by building only linux/amd64 images

* disable conformance tests in mesh mode

* fix comment and link tracking issue

* disable enable-virtualservice-status for istio-latest

* move ytt invocation to a function so it's clear what's going on

* inline install-config-istio script in e2e-common.sh and github workflows

Co-authored-by: Dave Protasowski <dprotaso@gmail.com>

Author: knative-prow-robot

.github/workflows/kind-e2e.yaml

@@ -132,15 +132,20 @@ jobs:
         set -o pipefail
 
         # Replace cluster.local with random suffix.
-        sed -ie "s/cluster\.local/${CLUSTER_SUFFIX}/g" third_party/istio-${{ matrix.istio-version }}/istio-kind-no-mesh.yaml
+        sed -ie "s/cluster\.local/${CLUSTER_SUFFIX}/g" third_party/istio-${{ matrix.istio-version }}/istio-kind-no-mesh/istio.yaml
 
         # Deploy Istio
-        ./third_party/istio-${{ matrix.istio-version }}/install-istio.sh istio-kind-no-mesh.yaml
+        ./third_party/istio-${{ matrix.istio-version }}/install-istio.sh istio-kind-no-mesh
 
         # Build and Publish our containers to the docker daemon (including test assets)
         export GO111MODULE=on
         export GOFLAGS=-mod=vendor
-        ko resolve -f test/config/ -f config/ | kubectl apply -f -
+        ko resolve --platform=linux/amd64 -f test/config/ -f config/ | kubectl apply -f -
+
+        CONFIG_ISTIO="./third_party/istio-${{ matrix.istio-version }}/istio-kind-no-mesh/config-istio.yaml"
+        if [[ -f "${CONFIG_ISTIO}" ]]; then
+           kubectl apply -f "${CONFIG_ISTIO}"
+        fi
 
         echo "GATEWAY_NAMESPACE_OVERRIDE=istio-system" >> $GITHUB_ENV
 

DEVELOPMENT.md

@@ -74,7 +74,7 @@ described below.
 Run the following command to install Istio for development purpose:
 
 ```shell
-third_party/istio-stable/install-istio.sh istio-ci-no-mesh.yaml
+third_party/istio-stable/install-istio.sh istio-ci-no-mesh
 ```
 
 ### Install Knative Serving

hack/release.sh

@@ -18,7 +18,6 @@
 # at https://github.com/knative/hack#using-the-releasesh-helper-script
 
 source $(dirname $0)/../vendor/knative.dev/hack/release.sh
-source $(dirname $0)/../third_party/download-istio.sh
 
 # Yaml files to generate, and the source config dir for them.
 declare -A COMPONENTS
@@ -66,18 +65,8 @@ function build_release() {
   done
 
   # Build Istio YAML
-  ISTIO_STABLE="$(dirname $0)/../third_party/istio-stable"
-  ISTIO_VERSION=$(awk '/download_istio/ {print $2}' ${ISTIO_STABLE}/install-istio.sh)
-  ISTIO_YAML="istio.yaml"
-
-  echo "Downloading Istio"
-  download_istio $ISTIO_VERSION
-  trap cleanup_istio EXIT
-
-  echo "Assembling istio.yaml"
-  # `istiocl manifest generate` doesn't create the `istio-system` namespace
-  cat "${ISTIO_STABLE}/extra/istio-namespace.yaml" > ${ISTIO_YAML}
-  ${ISTIO_DIR}/bin/istioctl manifest generate -f $(realpath "${ISTIO_STABLE}/istio-ci-no-mesh.yaml") >> ${ISTIO_YAML}
+  ISTIO_YAML="$(dirname $0)/../third_party/istio-stable/istio-ci-no-mesh/istio.yaml"
+  ISTIO_YAML="$(realpath $ISTIO_YAML)"
   all_yamls+=(${ISTIO_YAML})
 
   ARTIFACTS_TO_PUBLISH="${all_yamls[@]}"

hack/update-codegen.sh

@@ -22,6 +22,10 @@ source $(dirname $0)/../vendor/knative.dev/hack/codegen-library.sh
 
 # If we run with -mod=vendor here, then generate-groups.sh looks for vendor files in the wrong place.
 export GOFLAGS=-mod=
+# hack's codegen shell library overrides GOBIN
+# we need it on the path so run_go_tool works
+export PATH="${PATH}:${GOBIN}"
+
 
 echo "=== Update Codegen for $MODULE_NAME"
 
@@ -55,3 +59,19 @@ group "Update deps post-codegen"
 # Make sure our dependencies are up-to-date
 ${REPO_ROOT_DIR}/hack/update-deps.sh
 
+group "Update istio generated manifests"
+
+# We don't update HEAD since it changes regularly and we don't
+# want our presubmit checks to fail because a diff occurred
+# ${REPO_ROOT_DIR}/third_party/istio-head/generate_manifests.sh
+
+# We don't update stable - manifest generate (1.8.4) seems to have
+# bugs where it outputs duplicate resources in a non-deterministic order.
+# So re-running the command will produce a diff.
+#
+# Renable this once we reach a version # where that is fixed (ie. 1.9 seems fine)
+# ${REPO_ROOT_DIR}/third_party/istio-stable/generate-manifests.sh
+
+# Update latest cause the istioctl version seems to generate
+# reproducible yaml. So let's check for unexpected diffs
+${REPO_ROOT_DIR}/third_party/istio-latest/generate-manifests.sh

test/e2e-common.sh

@@ -53,20 +53,28 @@ function test_setup() {
   echo ">> Publishing test images"
   $(dirname $0)/upload-test-images.sh || fail_test "Error uploading test images"
   echo ">> Creating test resources (test/config/)"
-  ko apply --platform=all ${KO_FLAGS} -f test/config/ || return 1
+  ko apply --platform=linux/amd64 ${KO_FLAGS} -f test/config/ || return 1
   if (( MESH )); then
     kubectl label namespace serving-tests istio-injection=enabled
-    kubectl label namespace serving-tests-alt istio-injection=enabled
   fi
 
   # Bringing up controllers.
   echo ">> Bringing up Istio"
   local istio_dir=third_party/istio-${ISTIO_VERSION}
-  #kubectl apply -f ${istio_dir}/istio-crds.yaml || return 1
-  #echo ">> Running Istio"
-  ${istio_dir}/install-istio.sh istio-ci-no-mesh.yaml || return 1
+  local istio_profile=istio-ci-no-mesh
+
+  if (( MESH )); then
+    istio_profile=istio-ci-mesh
+  fi
+
+  ${istio_dir}/install-istio.sh ${istio_profile} || return 1
+
   echo ">> Bringing up net-istio Ingress Controller"
-  ko apply --platform=all -f config/ || return 1
+  ko apply --platform=linux/amd64 -f config/ || return 1
+
+  if [[ -f "${istio_dir}/${istio_profile}/config-istio.yaml" ]]; then
+    kubectl apply -f "${istio_dir}/${istio_profile}/config-istio.yaml"
+  fi
 
   scale_controlplane networking-istio istio-webhook
 

test/e2e-tests.sh

@@ -20,8 +20,12 @@ source $(dirname $0)/e2e-common.sh
 # Script entry point.
 initialize $@  --skip-istio-addon
 
-go_test_e2e -timeout=60m ./test/conformance --parallel 12 \
-  --enable-beta --enable-alpha || fail_test
+# TODO Re-enable conformance tests for mesh when everything's been fixed
+# https://github.com/knative-sandbox/net-istio/issues/584
+if [[ $MESH -eq 0 ]]; then
+  go_test_e2e -timeout=60m ./test/conformance --parallel 12 \
+    --enable-beta --enable-alpha || fail_test
+fi
 
 go_test_e2e -timeout=10m \
   ./test/e2e || fail_test

test/upload-test-images.sh

@@ -33,7 +33,7 @@ function upload_test_images() {
       sed "s@knative.dev/networking@knative.dev/net-istio/vendor/knative.dev/networking@g" $yaml \
         `# ko resolve is being used for the side-effect of publishing images,` \
         `# so the resulting yaml produced is ignored.` \
-        | ko resolve --platform=all ${tag_option} -RBf- > /dev/null
+        | ko resolve --platform=linux/amd64 ${tag_option} -RBf- > /dev/null
     done
   )
 }

third_party/download-istio.sh

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-istio
+  namespace: knative-serving
+  labels:
+    serving.knative.dev/release: devel
+    networking.knative.dev/ingress-provider: istio
+data:
+  local-gateway.mesh: "mesh"
+  enable-virtualservice-status: "true"

third_party/istio-head/extra/config-istio-mesh.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-istio
+  namespace: knative-serving
+  labels:
+    serving.knative.dev/release: devel
+    networking.knative.dev/ingress-provider: istio
+data:
+  enable-virtualservice-status: "true"