+ambientTopology |
+BoolValue |
+
+ ambientTopology deploys and configures an ambient topology
+
|
No
diff --git a/api/v1alpha1/istiocontrolplane.proto b/api/v1alpha1/istiocontrolplane.proto
index 9641a19ac..6493a801c 100644
--- a/api/v1alpha1/istiocontrolplane.proto
+++ b/api/v1alpha1/istiocontrolplane.proto
@@ -122,6 +122,8 @@ message IstioControlPlaneSpec {
string networkName = 23;
// Standalone sidecar injector configuration.
SidecarInjectorConfiguration sidecarInjector = 24;
+ // ambientTopology deploys and configures an ambient topology
+ google.protobuf.BoolValue ambientTopology = 25;
}
enum ModeType {
diff --git a/build/fixup_structs/main.go b/build/fixup_structs/main.go
index 90e8825a6..798554c56 100644
--- a/build/fixup_structs/main.go
+++ b/build/fixup_structs/main.go
@@ -76,7 +76,7 @@ var (
regexJSONTagIllegal = regexp.MustCompile(`json\:"_`)
)
-//nolint: gocognit
+// nolint: gocognit
func main() {
var filePath string
diff --git a/config/crd/bases/istio-operator-crds.gen.yaml b/config/crd/bases/istio-operator-crds.gen.yaml
index 150aa5e5a..dc8e41752 100644
--- a/config/crd/bases/istio-operator-crds.gen.yaml
+++ b/config/crd/bases/istio-operator-crds.gen.yaml
@@ -54,6 +54,9 @@ spec:
properties:
spec:
properties:
+ ambientTopology:
+ nullable: true
+ type: boolean
caAddress:
type: string
caProvider:
@@ -9184,6 +9187,9 @@ spec:
properties:
spec:
properties:
+ ambientTopology:
+ nullable: true
+ type: boolean
caAddress:
type: string
caProvider:
diff --git a/config/manager/kustomization.yaml b/config/manager/kustomization.yaml
index 9eab1e60d..12067ab35 100644
--- a/config/manager/kustomization.yaml
+++ b/config/manager/kustomization.yaml
@@ -5,3 +5,4 @@ kind: Kustomization
images:
- name: controller
newName: ghcr.io/banzaicloud/istio-operator
+ newTag: v2.16.0
diff --git a/controllers/istiocontrolplane_controller.go b/controllers/istiocontrolplane_controller.go
index 5cfab0f9d..35c14d8a4 100644
--- a/controllers/istiocontrolplane_controller.go
+++ b/controllers/istiocontrolplane_controller.go
@@ -1,6 +1,5 @@
/*
Copyright 2021 Cisco Systems, Inc. and/or its affiliates.
-
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
@@ -64,6 +63,7 @@ import (
"github.com/banzaicloud/istio-operator/v2/internal/components/meshexpansion"
"github.com/banzaicloud/istio-operator/v2/internal/components/resourcesyncrule"
"github.com/banzaicloud/istio-operator/v2/internal/components/sidecarinjector"
+ "github.com/banzaicloud/istio-operator/v2/internal/components/ztunnel"
"github.com/banzaicloud/istio-operator/v2/internal/models"
"github.com/banzaicloud/istio-operator/v2/internal/util"
"github.com/banzaicloud/istio-operator/v2/pkg/k8sutil"
@@ -289,6 +289,12 @@ func (r *IstioControlPlaneReconciler) reconcile(ctx context.Context, icp *servic
}
componentReconcilers = append(componentReconcilers, cniReconciler)
+ ztunnelReconciler, err := NewComponentReconciler(r, ztunnel.NewChartReconciler, r.Log.WithName("ztunnel"))
+ if err != nil {
+ return ctrl.Result{}, err
+ }
+ componentReconcilers = append(componentReconcilers, ztunnelReconciler)
+
meshExpansionReconciler, err := NewComponentReconciler(r, meshexpansion.NewChartReconciler, r.Log.WithName("meshexpansion"))
if err != nil {
return ctrl.Result{}, err
diff --git a/deploy/charts/istio-operator/crds/istio-operator-crds.gen.yaml b/deploy/charts/istio-operator/crds/istio-operator-crds.gen.yaml
index 150aa5e5a..dc8e41752 100644
--- a/deploy/charts/istio-operator/crds/istio-operator-crds.gen.yaml
+++ b/deploy/charts/istio-operator/crds/istio-operator-crds.gen.yaml
@@ -54,6 +54,9 @@ spec:
properties:
spec:
properties:
+ ambientTopology:
+ nullable: true
+ type: boolean
caAddress:
type: string
caProvider:
@@ -9184,6 +9187,9 @@ spec:
properties:
spec:
properties:
+ ambientTopology:
+ nullable: true
+ type: boolean
caAddress:
type: string
caProvider:
diff --git a/docs/ambient/ambient.md b/docs/ambient/ambient.md
new file mode 100644
index 000000000..0b80ae2c2
--- /dev/null
+++ b/docs/ambient/ambient.md
@@ -0,0 +1,52 @@
+# Ambient topology with the istio-operator
+This guide will walk through the process of configuring an ambient topology
+with this repo's istio-operator similar to what is described in the upstream
+documentation [Istio documentation](https://preliminary.istio.io/latest/docs/ops/ambient/getting-started/)
+Most of the steps in this guide just reference the upstream guide.
+
+## Setup:
+
+### Create a multinode cluster
+### Build and Install the Istio Operator:
+1. Pull the branch with teh ambient changes
+2. Build the image
+```
+make docker-build
+```
+3. Deploy the Operator
+```
+make deploy
+```
+4. Apply ambient `IstioControlPlane` Custom Resource to the `istio-system` namespace:
+```
+kubectl -n=istio-system apply -f docs/ambient/icp-ambient.yaml
+```
+### Install the bookinfo application:
+Follow the same steps as the upstream guide.
+#### Label the namespace
+Follow the same steps as the upstream guide.
+#### Test connection using the ingress gateway on the ACTIVE-1 cluster:
+Follow the same steps as the upstream guide.
+
+## Debugging
+Ambient replace the envoy proxy with a purpose built Rust proxy so debugging is quite different. Here are some commands and links:
+```
+istioctl pc workload ztunnel-8cvt2.istio-system
+```
+```
+kubectl exec -it ztunnel-xn2tl -n istio-system curl localhost:15000/config_dump
+```
+```
+kubectl exec -it ztunnel-xn2tl -n istio-system curl localhost:15020/metrics
+```
+Link to Istio blog [Ztunnel debug](https://istio.io/latest/blog/2023/rust-based-ztunnel/)
+
+Note:
+With ambient it is not uncommon to think everything is working because communication is happening entirely within Kubernetes networking with no traffic being
+redirected to the ztunnels pods or handled by Istio at all.
+
+## Issues
+There seem to be some race conditions as traffic is not always blocked
+appropriately by the L4 authorization policy. This commonly
+occurs on the initial install. Deleting the bookinfo application
+and re-installing fixes the issue.
diff --git a/docs/ambient/icp-ambient.yaml b/docs/ambient/icp-ambient.yaml
new file mode 100644
index 000000000..22e87fb86
--- /dev/null
+++ b/docs/ambient/icp-ambient.yaml
@@ -0,0 +1,127 @@
+# A sample ICP that can be used to test ambient with the
+# istio-operator. Search for Ambient to see key parameters
+apiVersion: servicemesh.cisco.com/v1alpha1
+kind: IstioControlPlane
+metadata:
+ name: icp-v116x-sample
+ namespace: istio-system
+spec:
+ version: 1.16.1
+ mode: ACTIVE
+ meshID: mesh1
+ networkName: network1
+ logging:
+ level: "default:info"
+ mountMtlsCerts: false
+ meshExpansion:
+ enabled: false
+ istiod:
+ deployment:
+ replicas:
+ min: 1
+ max: 5
+ count: 1
+ resources:
+ requests:
+ cpu: 500m
+ memory: 2048Mi
+ nodeSelector: {}
+ affinity: {}
+ tolerations: []
+ podMetadata:
+ labels: {}
+ annotations: {ambient.istio.io/redirection: disabled}
+ securityContext: {}
+ enableAnalysis: false
+ enableStatus: false
+ externalIstiod:
+ enabled: false
+ traceSampling: 1.0
+ enableProtocolSniffingOutbound: true
+ enableProtocolSniffingInbound: true
+ certProvider: ISTIOD
+ spiffe:
+ operatorEndpoints:
+ enabled: false
+ proxy:
+ privileged: false
+ enableCoreDump: false
+ logLevel: "WARNING"
+ componentLogLevel: "misc:error"
+ clusterDomain: "cluster.local"
+ holdApplicationUntilProxyStarts: false
+ lifecycle: {}
+ resources:
+ requests:
+ cpu: 100m
+ memory: 128Mi
+ limits:
+ cpu: 2000m
+ memory: 1024Mi
+ includeIPRanges: "*"
+ excludeIPRanges: ""
+ excludeInboundPorts: ""
+ excludeOutboundPorts: ""
+ proxyInit:
+ cni:
+ enabled: true
+ daemonset:
+ resources:
+ limits:
+ cpu: 2000m
+ memory: 1024Mi
+ requests:
+ cpu: 10m
+ memory: 10Mi
+ telemetryV2:
+ enabled: true
+ # Ambient notes - Setting this to true is primary trigger
+ # Important that the correct istio service name is passed
+ # to ztunnel pod - may require manual override.
+ ambientTopology: true
+ sds:
+ tokenAudience: "istio-ca"
+ proxyWasm:
+ enabled: false
+ watchOneNamespace: false
+ caAddress: ""
+ distribution: "official"
+ containerImageConfiguration:
+ # Ambient notes - need to use images that include ambient support
+ hub: docker.io/istio
+ tag: 1.18.0-alpha.0
+ imagePullPolicy: IfNotPresent
+ httpProxyEnvs:
+ httpProxy: ""
+ httpsProxy: ""
+ noProxy: ""
+ meshConfig:
+ proxyListenPort: 15001
+ connectTimeout: 10s
+ protocolDetectionTimeout: 5s
+ ingressClass: istio
+ ingressService: imgw-sample
+ ingressControllerMode: STRICT
+ ingressSelector: imgw-sample
+ enableTracing: false
+ accessLogFile: /dev/stdout
+ accessLogFormat: ""
+ accessLogEncoding: TEXT
+ enableEnvoyAccessLogService: false
+ disableEnvoyListenerLog: false
+ defaultConfig:
+ configPath: ./etc/istio/proxy
+ binaryPath: /usr/local/bin/envoy
+ serviceCluster: istio-proxy
+ drainDuration: 45s
+ parentShutdownDuration: 60s
+ proxyAdminPort: 15000
+ controlPlaneAuthPolicy: MUTUAL_TLS
+ concurrency: 2
+ outboundTrafficPolicy:
+ mode: ALLOW_ANY
+ enableAutoMtls: true
+ trustDomain: cluster.local
+ trustDomainAliases: []
+ rootNamespace: istio-system
+ dnsRefreshRate: 5s
diff --git a/go.mod b/go.mod
index 05287a927..cbb08afe6 100644
--- a/go.mod
+++ b/go.mod
@@ -41,6 +41,7 @@ require (
github.com/Masterminds/semver/v3 v3.1.1
github.com/hexops/gotextdiff v1.0.3
github.com/iancoleman/strcase v0.2.0
+ google.golang.org/genproto v0.0.0-20220628213854-d9e0b6570c03
google.golang.org/protobuf v1.28.0
gotest.tools/v3 v3.0.3
)
@@ -167,7 +168,6 @@ require (
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
google.golang.org/appengine v1.6.7 // indirect
- google.golang.org/genproto v0.0.0-20220628213854-d9e0b6570c03 // indirect
google.golang.org/grpc v1.47.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
diff --git a/internal/assets/assets.go b/internal/assets/assets.go
index f09adbe40..f3aef4a3b 100644
--- a/internal/assets/assets.go
+++ b/internal/assets/assets.go
@@ -56,6 +56,11 @@ var (
//go:embed manifests/resource-sync-rule/templates/_helpers.tpl
resourceSyncRule embed.FS
ResourceSyncRule = GetSubFS(resourceSyncRule, "manifests/resource-sync-rule")
+
+ //go:embed manifests/ztunnel
+ //go:embed manifests/ztunnel/templates/_helpers.tpl
+ ztunnelChart embed.FS
+ ZtunnelChart = GetSubFS(ztunnelChart, "manifests/ztunnel")
)
func GetSubFS(fsys fs.FS, dir string) (subFS fs.FS) {
diff --git a/internal/assets/manifests/istio-cni/templates/clusterrole.yaml b/internal/assets/manifests/istio-cni/templates/clusterrole.yaml
index ac3c55d80..997383bac 100644
--- a/internal/assets/manifests/istio-cni/templates/clusterrole.yaml
+++ b/internal/assets/manifests/istio-cni/templates/clusterrole.yaml
@@ -14,6 +14,8 @@ rules:
- nodes
verbs:
- get
+ - list
+ - watch
---
{{- if .Values.cni.repair.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
diff --git a/internal/assets/manifests/istio-cni/templates/configmap-cni.yaml b/internal/assets/manifests/istio-cni/templates/configmap-cni.yaml
index 0afa940f3..0bcbaa3bd 100644
--- a/internal/assets/manifests/istio-cni/templates/configmap-cni.yaml
+++ b/internal/assets/manifests/istio-cni/templates/configmap-cni.yaml
@@ -22,6 +22,7 @@ data:
"type": "istio-cni",
"log_level": {{ quote .Values.cni.logLevel }},
"log_uds_address": "__LOG_UDS_ADDRESS__",
+ {{if .Values.cni.ambient.enabled}}"ambient_enabled": true,{{end}}
"kubernetes": {
"kubeconfig": "__KUBECONFIG_FILEPATH__",
"cni_bin_dir": {{ .Values.cni.cniBinDir | default $defaultBinDir | quote }},
diff --git a/internal/assets/manifests/istio-cni/templates/daemonset.yaml b/internal/assets/manifests/istio-cni/templates/daemonset.yaml
index e9de7a9cf..4412495e1 100644
--- a/internal/assets/manifests/istio-cni/templates/daemonset.yaml
+++ b/internal/assets/manifests/istio-cni/templates/daemonset.yaml
@@ -37,7 +37,11 @@ spec:
prometheus.io/port: "15014"
prometheus.io/path: '/metrics'
{{- include "toYamlIf" (dict "value" .Values.cni.podMetadata.annotations) | indent 8 }}
+ {{if .Values.cni.ambient.enabled }}
+ ambient.istio.io/redirection: "disabled"
+ {{ end }}
spec:
+ {{if .Values.cni.ambient.enabled }}hostNetwork: true{{ end }}
{{- if .Values.cni.priorityClassName }}
priorityClassName: {{ .Values.cni.priorityClassName }}
{{- end }}
@@ -113,6 +117,15 @@ spec:
value: "{{ .Values.cni.repair.brokenPodLabelKey }}"
- name: REPAIR_BROKEN_POD_LABEL_VALUE
value: "{{ .Values.cni.repair.brokenPodLabelValue }}"
+ - name: NODE_NAME
+ valueFrom:
+ fieldRef:
+ apiVersion: v1
+ fieldPath: spec.nodeName
+ {{- if .Values.cni.ambient.enabled }}
+ - name: AMBIENT_ENABLED
+ value: "true"
+ {{- end }}
{{ include "toYamlIf" (dict "value" .Values.cni.env) | indent 12 }}
volumeMounts:
- mountPath: /host/opt/cni/bin
@@ -121,6 +134,13 @@ spec:
name: cni-net-dir
- mountPath: /var/run/istio-cni
name: cni-log-dir
+ {{- if .Values.cni.ambient.enabled }}
+ - mountPath: /etc/ambient-config
+ name: cni-ambientconfig
+ - mountPath: /var/run/netns
+ mountPropagation: HostToContainer
+ name: cni-netns-dir
+ {{ end }}
{{ include "toYamlIf" (dict "value" .Values.cni.volumeMounts) | indent 12 }}
{{ include "toYamlIf" (dict "value" .Values.cni.resources "key" "resources" "indent" 2) | indent 10 }}
{{- if .Values.cni.taint.enabled }}
@@ -158,9 +178,19 @@ spec:
- name: cni-bin-dir
hostPath:
path: {{ .Values.cni.cniBinDir | default $defaultBinDir }}
+ {{- if .Values.cni.ambient.enabled }}
+ - name: cni-ambientconfig
+ hostPath:
+ path: /etc/ambient-config
+ {{- end }}
- name: cni-net-dir
hostPath:
path: {{ default "/etc/cni/net.d" .Values.cni.cniConfDir }}
+ {{- if .Values.cni.ambient.enabled }}
+ - name: cni-netns-dir
+ hostPath:
+ path: /var/run/netns
+ {{- end }}
# Used for UDS log
- name: cni-log-dir
hostPath:
diff --git a/internal/assets/manifests/istio-cni/values.yaml b/internal/assets/manifests/istio-cni/values.yaml
index cdff37f67..61f65a4fe 100644
--- a/internal/assets/manifests/istio-cni/values.yaml
+++ b/internal/assets/manifests/istio-cni/values.yaml
@@ -21,7 +21,8 @@ cni:
cniConfFileName: ""
excludeNamespaces:
- - istio-system
+ # TODO JAJ - recheck this is commented out in working diffs
+ # - istio-system
- kube-system
includeNamespaces: []
@@ -36,6 +37,13 @@ cni:
# Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
chained: true
+ # Configure ambient settings
+ ambient:
+ # If enabled, ambient redirection will be enabled
+ enabled: false
+ # Set ambient redirection mode: "iptables" or "ebpf"
+ redirectMode: "iptables"
+
repair:
enabled: true
@@ -63,7 +71,6 @@ cni:
annotations: {}
podMetadata:
labels: {}
- annotations: {}
deploymentStrategy:
type: RollingUpdate
rollingUpdate:
@@ -86,6 +93,9 @@ cni:
priorityClassName: system-node-critical
+ # TODO Shouldn't this always be privileged
+ privileged: true
+
# Revision is set as 'version' label and part of the resource names when installing multiple control planes.
revision: ""
diff --git a/internal/assets/manifests/istio-cni/values.yaml.tpl b/internal/assets/manifests/istio-cni/values.yaml.tpl
index eb5237cf8..349c4a86c 100644
--- a/internal/assets/manifests/istio-cni/values.yaml.tpl
+++ b/internal/assets/manifests/istio-cni/values.yaml.tpl
@@ -16,7 +16,19 @@
{{ valueIf (dict "key" "brokenPodLabelValue" "value" .GetBrokenPodLabelValue ) }}
{{- end }}
+{{- define "ambient" }}
+{{- with .GetSpec }}
+{{ valueIf (dict "key" "enabled" "value" .GetAmbientTopology ) }}
+{{ end }}
+{{ end }}
+
{{- define "cni" }}
+{{- $x := (include "ambient" .) | reformatYaml }}
+{{- if ne $x "" }}
+ambient:
+{{ $x | indent 2 }}
+{{- end }}
+
{{- with .GetSpec.GetProxyInit.GetCni }}
{{ valueIf (dict "key" "enabled" "value" .GetEnabled ) }}
diff --git a/internal/assets/manifests/istio-discovery/values.yaml b/internal/assets/manifests/istio-discovery/values.yaml
index 4e49322d3..fae71b490 100644
--- a/internal/assets/manifests/istio-discovery/values.yaml
+++ b/internal/assets/manifests/istio-discovery/values.yaml
@@ -60,6 +60,7 @@ pilot:
# Additional labels to apply to the deployment.
deploymentLabels: {}
+ # TODO need an annotation for ambient. Set in CR for testing
deploymentAnnotations: {}
## Mesh config settings
diff --git a/internal/assets/manifests/istio-discovery/values.yaml.tpl b/internal/assets/manifests/istio-discovery/values.yaml.tpl
index 4eee7de32..d051c5f2e 100644
--- a/internal/assets/manifests/istio-discovery/values.yaml.tpl
+++ b/internal/assets/manifests/istio-discovery/values.yaml.tpl
@@ -24,6 +24,18 @@ env:
{{ else }}
value: "false"
{{ end }}
+{{ if .GetSpec.GetAmbientTopology }}
+ - name: PILOT_ENABLE_AMBIENT_CONTROLLERS
+ value: "true"
+ - name: PILOT_ENABLE_HBONE
+ value: "true"
+ - name: VERIFY_CERTIFICATE_AT_CLIENT
+ value: "true"
+ - name: ENABLE_AUTO_SNI
+ value: "true"
+ - name: CA_TRUSTED_NODE_ACCOUNTS
+ value: "istio-system/ztunnel,kube-system/ztunnel"
+{{ end }}
{{ if eq .GetSpec.GetDistribution "cisco" }}
- name: INJECTION_WEBHOOK_CONFIG_NAME
value: {{ .WithNamespacedRevision "istio-sidecar-injector" }}
diff --git a/internal/assets/manifests/ztunnel/Chart.yaml b/internal/assets/manifests/ztunnel/Chart.yaml
new file mode 100644
index 000000000..a315bfe34
--- /dev/null
+++ b/internal/assets/manifests/ztunnel/Chart.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+name: ztunnel
+# This version is never actually shipped. istio/release-builder will replace it at build-time
+# with the appropriate version
+version: 1.0.0
+appVersion: 1.0.0
+description: Helm chart for istio ztunnel components
+keywords:
+ - istio-ztunnel
+ - istio
+sources:
+ - http://github.com/istio/istio
+engine: gotpl
+icon: https://istio.io/latest/favicons/android-192x192.png
diff --git a/internal/assets/manifests/ztunnel/README.md b/internal/assets/manifests/ztunnel/README.md
new file mode 100644
index 000000000..f8887a126
--- /dev/null
+++ b/internal/assets/manifests/ztunnel/README.md
@@ -0,0 +1,36 @@
+# Istio Ztunnel Helm Chart
+
+This chart installs an Istio ztunnel.
+
+## Setup Repo Info
+
+```console
+helm repo add istio https://istio-release.storage.googleapis.com/charts
+helm repo update
+```
+
+_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
+
+## Installing the Chart
+
+To install the chart:
+
+```console
+helm install ztunnel istio/ztunnel
+```
+
+## Uninstalling the Chart
+
+To uninstall/delete the chart:
+
+```console
+helm delete ztunnel
+```
+
+## Configuration
+
+To view support configuration options and documentation, run:
+
+```console
+helm show values istio/ztunnel
+```
diff --git a/internal/assets/manifests/ztunnel/templates/NOTES.txt b/internal/assets/manifests/ztunnel/templates/NOTES.txt
new file mode 100644
index 000000000..93297520e
--- /dev/null
+++ b/internal/assets/manifests/ztunnel/templates/NOTES.txt
@@ -0,0 +1,5 @@
+ztunnel successfully installed!
+
+To learn more about the release, try:
+ $ helm status {{ .Release.Name }}
+ $ helm get all {{ .Release.Name }}
diff --git a/internal/assets/manifests/ztunnel/templates/_helpers.tpl b/internal/assets/manifests/ztunnel/templates/_helpers.tpl
new file mode 100644
index 000000000..a57569b78
--- /dev/null
+++ b/internal/assets/manifests/ztunnel/templates/_helpers.tpl
@@ -0,0 +1,41 @@
+{{- define "revision" -}}
+{{- default "default" (.Values.revision | replace "." "-") -}}
+{{- end -}}
+
+{{- define "namespaced-revision" -}}
+{{- $revision := (include "revision" .) -}}
+{{- if eq $revision "default" -}}
+{{- printf "%s" $revision -}}
+{{- else -}}
+{{- printf "%s.%s" $revision .Release.Namespace -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "name-with-revision" -}}
+{{- if .context.Values.revision -}}
+{{- printf "%s-%s" .name (include "revision" .context) -}}
+{{- else -}}
+{{- .name -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "name-with-namespaced-revision" -}}
+{{- if .context.Values.revision -}}
+{{- printf "%s-%s" (include "name-with-revision" .) .context.Release.Namespace -}}
+{{- else -}}
+{{- .name -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "toYamlIf" }}
+{{- if .value }}
+{{- if .key }}
+{{ .key }}:
+{{- end }}
+{{- if gt (.indent | int) 0 }}
+{{ .value | toYaml | indent .indent }}
+{{- else }}
+{{ .value | toYaml }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/internal/assets/manifests/ztunnel/templates/daemonset.yaml b/internal/assets/manifests/ztunnel/templates/daemonset.yaml
new file mode 100644
index 000000000..1f031f8be
--- /dev/null
+++ b/internal/assets/manifests/ztunnel/templates/daemonset.yaml
@@ -0,0 +1,116 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+ name: ztunnel
+ namespace: {{ .Release.Namespace }}
+ labels:
+ {{- .Values.labels | toYaml | nindent 4}}
+ annotations:
+ {{- .Values.annotations | toYaml | nindent 4 }}
+spec:
+ updateStrategy:
+ rollingUpdate:
+ maxSurge: 1
+ maxUnavailable: 0
+ selector:
+ matchLabels:
+ app: ztunnel
+ template:
+ metadata:
+ labels:
+ sidecar.istio.io/inject: "false"
+ app: ztunnel
+{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
+ annotations:
+ ambient.istio.io/redirection: disabled
+ sidecar.istio.io/inject: "false"
+{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
+ spec:
+ serviceAccountName: ztunnel
+ tolerations:
+ - effect: NoSchedule
+ operator: Exists
+ - key: CriticalAddonsOnly
+ operator: Exists
+ - effect: NoExecute
+ operator: Exists
+ containers:
+ - name: istio-proxy
+{{- if contains "/" .Values.image }}
+ image: "{{ .Values.image }}"
+{{- else }}
+ image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
+{{- end }}
+{{- with .Values.imagePullPolicy }}
+ imagePullPolicy: {{ . }}
+{{- end }}
+ securityContext:
+ allowPrivilegeEscalation: false
+ privileged: false
+ capabilities:
+ drop:
+ - ALL
+ add:
+ - NET_ADMIN
+ readOnlyRootFilesystem: true
+ runAsGroup: 1337
+ runAsNonRoot: false
+ runAsUser: 0
+ readinessProbe:
+ httpGet:
+ port: 15021
+ path: /healthz/ready
+ args:
+ - proxy
+ - ztunnel
+ env:
+ - name: CLUSTER_ID
+ value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
+ - name: POD_NAME
+ valueFrom:
+ fieldRef:
+ fieldPath: metadata.name
+ - name: POD_NAMESPACE
+ valueFrom:
+ fieldRef:
+ fieldPath: metadata.namespace
+ - name: NODE_NAME
+ valueFrom:
+ fieldRef:
+ fieldPath: spec.nodeName
+ - name: INSTANCE_IP
+ valueFrom:
+ fieldRef:
+ fieldPath: status.podIP
+ - name: SERVICE_ACCOUNT
+ valueFrom:
+ fieldRef:
+ fieldPath: spec.serviceAccountName
+ {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
+ {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
+ - name: {{ $key }}
+ value: "{{ $value }}"
+ {{- end }}
+ {{- end }}
+ {{- with .Values.env }}
+ {{- range $key, $val := . }}
+ - name: {{ $key }}
+ value: "{{ $val }}"
+ {{- end }}
+ {{- end }}
+ volumeMounts:
+ - mountPath: /var/run/secrets/istio
+ name: istiod-ca-cert
+ - mountPath: /var/run/secrets/tokens
+ name: istio-token
+ volumes:
+ - name: istio-token
+ projected:
+ sources:
+ - serviceAccountToken:
+ path: istio-token
+ expirationSeconds: 43200
+ audience: istio-ca
+ - name: istiod-ca-cert
+ configMap:
+ name: istio-ca-root-cert
diff --git a/internal/assets/manifests/ztunnel/templates/rbac.yaml b/internal/assets/manifests/ztunnel/templates/rbac.yaml
new file mode 100644
index 000000000..5a569b647
--- /dev/null
+++ b/internal/assets/manifests/ztunnel/templates/rbac.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ServiceAccount
+ {{- with .Values.imagePullSecrets }}
+imagePullSecrets:
+ {{- range . }}
+ - name: {{ . }}
+ {{- end }}
+ {{- end }}
+metadata:
+ name: ztunnel
+ namespace: {{ .Release.Namespace }}
+ labels:
+ {{- .Values.labels | toYaml | nindent 4}}
+ annotations:
+ {{- .Values.annotations | toYaml | nindent 4 }}
+---
diff --git a/internal/assets/manifests/ztunnel/values.yaml b/internal/assets/manifests/ztunnel/values.yaml
new file mode 100644
index 000000000..31eb0d37e
--- /dev/null
+++ b/internal/assets/manifests/ztunnel/values.yaml
@@ -0,0 +1,55 @@
+# Hub to pull from. Image will be `Hub/Image:Tag-Variant`
+hub: "gcr.io/istio-testing"
+#JAJ hub: "docker.io/istio"
+# Tag to pull from. Image will be `Hub/Image:Tag-Variant`
+tag: "latest"
+#JAJ tag: "1.18.0-alpha.0"
+# Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
+variant: ""
+
+# Image name to pull from. Image will be `Hub/Image:Tag-Variant`
+# If Image contains a "/", it will replace the entire `image` in the pod.
+image: ztunnel
+#OLD image: proxyv2
+
+# Labels to apply to all top level resources
+labels: {}
+# Annotations to apply to all top level resources
+annotations: {}
+
+# Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
+podAnnotations:
+ prometheus.io/port: "15020"
+ prometheus.io/scrape: "true"
+
+# Additional labels to apply on the pod level
+podLabels: {}
+
+# Pod resource configuration
+resources:
+ requests:
+ cpu: 500m
+ memory: 2048Mi
+
+# List of secret names to add to the service account as image pull secrets
+imagePullSecrets: []
+
+# A `key: value` mapping of environment variables to add to the pod
+env: {}
+
+# Override for the pod imagePullPolicy
+imagePullPolicy: ""
+
+# Settings for multicluster
+multiCluster:
+ # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
+ # with Istiod configuration.
+ clusterName: ""
+
+# meshConfig defines runtime configuration of components.
+# For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
+# components.
+# TODO: https://github.com/istio/istio/issues/43248
+meshConfig:
+ defaultConfig:
+ proxyMetadata: {}
diff --git a/internal/assets/manifests/ztunnel/values.yaml.tpl b/internal/assets/manifests/ztunnel/values.yaml.tpl
new file mode 100644
index 000000000..4aedefbfd
--- /dev/null
+++ b/internal/assets/manifests/ztunnel/values.yaml.tpl
@@ -0,0 +1,57 @@
+{{ valueIf (dict "key" "hub" "value" .GetSpec.GetContainerImageConfiguration.GetHub) }}
+{{ valueIf (dict "key" "tag" "value" .GetSpec.GetContainerImageConfiguration.GetTag) }}
+
+# Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
+variant: ""
+
+# Image name to pull from. Image will be `Hub/Image:Tag-Variant`
+# If Image contains a "/", it will replace the entire `image` in the pod.
+image: ztunnel
+
+# Labels to apply to all top level resources
+labels: {}
+# Annotations to apply to all top level resources
+annotations: {}
+
+# Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
+podAnnotations:
+ prometheus.io/port: "15020"
+ prometheus.io/scrape: "true"
+
+# Additional labels to apply on the pod level
+podLabels: {}
+
+# Pod resource configuration
+resources:
+ requests:
+ cpu: 500m
+ memory: 2048Mi
+
+# List of secret names to add to the service account as image pull secrets
+imagePullSecrets: []
+
+# A `key: value` mapping of environment variables to add to the pod
+env: {}
+
+# Override for the pod imagePullPolicy
+imagePullPolicy: ""
+
+# Settings for multicluster
+multiCluster:
+ # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
+ # with Istiod configuration.
+ clusterName: ""
+
+# meshConfig defines runtime configuration of components.
+# For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
+# components.
+# TODO: https://github.com/istio/istio/issues/43248
+meshConfig:
+ defaultConfig:
+ {{ if .GetSpec.GetAmbientTopology }}
+ # TODO change this to match name-with-revision and namespace
+ # needs to match the installed environment
+ proxyMetadata: {XDS_ADDRESS: https://istiod-icp-v116x-sample.istio-system.svc:15012, CA_ADDRESS: https://istiod-icp-v116x-sample.istio-system.svc:15012}
+ {{ else }}
+ proxyMetadata: {}
+ {{ end }}
diff --git a/internal/components/cni/cni_test.go b/internal/components/cni/cni_test.go
index 9c8ee3bbe..d32334684 100644
--- a/internal/components/cni/cni_test.go
+++ b/internal/components/cni/cni_test.go
@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
+ http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/internal/components/cni/testdata/icp-expected-resource-dump.yaml b/internal/components/cni/testdata/icp-expected-resource-dump.yaml
index adc53b660..d3c818321 100644
--- a/internal/components/cni/testdata/icp-expected-resource-dump.yaml
+++ b/internal/components/cni/testdata/icp-expected-resource-dump.yaml
@@ -99,6 +99,8 @@ rules:
- nodes
verbs:
- get
+ - list
+ - watch
---
apiVersion: rbac.authorization.k8s.io/v1
@@ -340,6 +342,11 @@ spec:
value: cni.istio.io/uninitialized
- name: REPAIR_BROKEN_POD_LABEL_VALUE
value: "true"
+ - name: NODE_NAME
+ valueFrom:
+ fieldRef:
+ apiVersion: v1
+ fieldPath: spec.nodeName
- name: CNI_ENV_NAME
value: "true"
- name: CNI_ANOTHER_ENV_NAME
@@ -362,7 +369,7 @@ spec:
runAsGroup: 0
runAsNonRoot: false
runAsUser: 0
- privileged: null
+ privileged: true
volumeMounts:
- mountPath: /host/opt/cni/bin
name: cni-bin-dir
diff --git a/internal/components/discovery/discovery_test.go b/internal/components/discovery/discovery_test.go
index 16df4e7c6..1764cfdfe 100644
--- a/internal/components/discovery/discovery_test.go
+++ b/internal/components/discovery/discovery_test.go
@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
+ http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/internal/components/istiomeshgateway/istiomeshgateway_test.go b/internal/components/istiomeshgateway/istiomeshgateway_test.go
index d3fd78b81..8d6a3e2fa 100644
--- a/internal/components/istiomeshgateway/istiomeshgateway_test.go
+++ b/internal/components/istiomeshgateway/istiomeshgateway_test.go
@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
+ http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/internal/components/meshexpansion/meshexpansion_test.go b/internal/components/meshexpansion/meshexpansion_test.go
index 9cdd4ba3b..248a6c5c3 100644
--- a/internal/components/meshexpansion/meshexpansion_test.go
+++ b/internal/components/meshexpansion/meshexpansion_test.go
@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
+ http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/internal/components/resourcesyncrule/resourcesyncrule_test.go b/internal/components/resourcesyncrule/resourcesyncrule_test.go
index a3ed59cc0..5e41eeb04 100644
--- a/internal/components/resourcesyncrule/resourcesyncrule_test.go
+++ b/internal/components/resourcesyncrule/resourcesyncrule_test.go
@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
+ http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/internal/components/sidecarinjector/sidecarinjector_test.go b/internal/components/sidecarinjector/sidecarinjector_test.go
index e83c86c8a..cb4eb8dfa 100644
--- a/internal/components/sidecarinjector/sidecarinjector_test.go
+++ b/internal/components/sidecarinjector/sidecarinjector_test.go
@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
+ http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/internal/components/ztunnel/reconcile.go b/internal/components/ztunnel/reconcile.go
new file mode 100644
index 000000000..374064e95
--- /dev/null
+++ b/internal/components/ztunnel/reconcile.go
@@ -0,0 +1,104 @@
+/*
+Copyright 2023 Cisco Systems, Inc. and/or its affiliates.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ztunnel
+
+import (
+ "net/http"
+
+ "emperror.dev/errors"
+ "k8s.io/apimachinery/pkg/runtime"
+
+ "github.com/banzaicloud/istio-operator/api/v2/v1alpha1"
+ assets "github.com/banzaicloud/istio-operator/v2/internal/assets"
+ "github.com/banzaicloud/istio-operator/v2/internal/components"
+ "github.com/banzaicloud/istio-operator/v2/internal/util"
+ "github.com/banzaicloud/operator-tools/pkg/helm"
+ "github.com/banzaicloud/operator-tools/pkg/helm/templatereconciler"
+)
+
+const (
+ componentName = "Ztunnel"
+ chartName = "ztunnel"
+ releaseName = "ztunnel"
+
+ valuesTemplateFileName = "values.yaml.tpl"
+)
+
+var _ components.MinimalComponent = &Component{}
+
+type Component struct{}
+
+func NewChartReconciler(helmReconciler *templatereconciler.HelmReconciler) components.ComponentReconciler {
+ return &components.Base{
+ HelmReconciler: helmReconciler,
+ Component: &Component{},
+ }
+}
+
+func (rec *Component) Name() string {
+ return componentName
+}
+
+func (rec *Component) Enabled(object runtime.Object) bool {
+ if controlPlane, ok := object.(*v1alpha1.IstioControlPlane); ok {
+ getZtunnelEnabled := controlPlane.GetSpec().GetAmbientTopology()
+ enabled := getZtunnelEnabled.GetValue()
+ return controlPlane.DeletionTimestamp.IsZero() && enabled
+ }
+
+ return true
+}
+
+func (rec *Component) ReleaseData(object runtime.Object) (*templatereconciler.ReleaseData, error) {
+ icp, ok := object.(*v1alpha1.IstioControlPlane)
+ if !ok {
+ return nil, errors.WrapIff(errors.NewPlain("object cannot be converted to an IstioControlPlane"), "%+v", object)
+ }
+
+ values, err := rec.values(object)
+ if err != nil {
+ return nil, errors.WithStackIf(err)
+ }
+
+ overlays, err := util.ConvertK8sOverlays(icp.GetSpec().GetK8SResourceOverlays())
+ if err != nil {
+ return nil, errors.WrapIf(err, "could not convert k8s resource overlays")
+ }
+
+ return &templatereconciler.ReleaseData{
+ Chart: http.FS(assets.ZtunnelChart),
+ Values: values,
+ Namespace: icp.Namespace,
+ ChartName: chartName,
+ ReleaseName: releaseName,
+ Layers: overlays,
+ }, nil
+}
+
+func (rec *Component) values(object runtime.Object) (helm.Strimap, error) {
+ icp, ok := object.(*v1alpha1.IstioControlPlane)
+ if !ok {
+ return nil, errors.WrapIff(errors.NewPlain("object cannot be converted to an IstioControlPlane"), "%+v", object)
+ }
+
+ values, err := util.TransformStructToStriMapWithTemplate(icp, assets.ZtunnelChart, valuesTemplateFileName)
+ if err != nil {
+ return nil, errors.WrapIff(err, "IstioControlPlane spec cannot be converted into a map[string]interface{}: %+v", icp.Spec)
+ }
+
+ return values, nil
+}
|