diff --git a/README.md b/README.md index 734e524b46..fa96bc082b 100644 --- a/README.md +++ b/README.md @@ -79,7 +79,7 @@ This repository periodically synchronizes all official Kubeflow components from | Kubeflow Pipelines | applications/pipeline/upstream | [2.16.1](https://github.com/kubeflow/pipelines/tree/2.16.1/manifests/kustomize) | 970m | 3552Mi | 35GB | | Kubeflow Hub | applications/hub/upstream | [v0.3.9](https://github.com/kubeflow/hub/tree/v0.3.9/manifests/kustomize) | 510m | 2112Mi | 20GB | | Spark Operator | applications/spark/spark-operator | [2.5.0](https://github.com/kubeflow/spark-operator/tree/v2.5.0) | 9m | 41Mi | 0GB | -| Istio | common/istio | [1.29.2](https://github.com/istio/istio/releases/tag/1.29.2) | 750m | 2364Mi | 0GB | +| Istio | common/istio | [1.30.0](https://github.com/istio/istio/releases/tag/1.30.0) | 750m | 2364Mi | 0GB | | Knative | common/knative/knative-serving
common/knative/knative-eventing | [v1.21.1](https://github.com/knative/serving/releases/tag/knative-v1.21.1)
[v1.21.0](https://github.com/knative/eventing/releases/tag/knative-v1.21.0) | 1450m | 1038Mi | 0GB | | Cert Manager | common/cert-manager | [1.19.4](https://github.com/cert-manager/cert-manager/releases/tag/v1.19.4) | 3m | 128Mi | 0GB | | Dex | common/dex | [2.45.0](https://github.com/dexidp/dex/releases/tag/v2.45.0) | 3m | 27Mi | 0GB | diff --git a/common/istio/cluster-local-gateway/base/cluster-local-gateway.yaml b/common/istio/cluster-local-gateway/base/cluster-local-gateway.yaml index 819d192842..0b2945c171 100644 --- a/common/istio/cluster-local-gateway/base/cluster-local-gateway.yaml +++ b/common/istio/cluster-local-gateway/base/cluster-local-gateway.yaml @@ -7,8 +7,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: cluster-local-gateway istio.io/rev: default @@ -26,8 +26,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: cluster-local-gateway istio.io/dataplane-mode: none @@ -59,9 +59,9 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 + app.kubernetes.io/version: 1.30.0 chart: gateways - helm.sh/chart: istio-ingress-1.29.2 + helm.sh/chart: istio-ingress-1.30.0 heritage: Tiller install.operator.istio.io/owning-resource: unknown istio: cluster-local-gateway @@ -144,7 +144,7 @@ spec: valueFrom: fieldRef: fieldPath: spec.nodeName - image: registry.istio.io/release/proxyv2:1.29.2 + image: registry.istio.io/release/proxyv2:1.30.0 name: istio-proxy ports: - containerPort: 15020 @@ -260,8 +260,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: IngressGateways @@ -286,8 +286,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: IngressGateways @@ -311,8 +311,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: cluster-local-gateway istio.io/rev: default @@ -345,8 +345,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: cluster-local-gateway istio.io/rev: default diff --git a/common/istio/istio-crds/base/crd.yaml b/common/istio/istio-crds/base/crd.yaml index 4e9e21f5d4..47b328672b 100644 --- a/common/istio/istio-crds/base/crd.yaml +++ b/common/istio/istio-crds/base/crd.yaml @@ -7,8 +7,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: authorizationpolicies.security.istio.io spec: group: security.istio.io @@ -125,6 +125,11 @@ spec: type: string maxItems: 16 type: array + notTrustDomains: + description: Optional. + items: + type: string + type: array principals: description: Optional. items: @@ -147,6 +152,11 @@ spec: type: string maxItems: 16 type: array + trustDomains: + description: Optional. + items: + type: string + type: array type: object x-kubernetes-validations: - message: Cannot set serviceAccounts with @@ -506,6 +516,11 @@ spec: type: string maxItems: 16 type: array + notTrustDomains: + description: Optional. + items: + type: string + type: array principals: description: Optional. items: @@ -528,6 +543,11 @@ spec: type: string maxItems: 16 type: array + trustDomains: + description: Optional. + items: + type: string + type: array type: object x-kubernetes-validations: - message: Cannot set serviceAccounts with @@ -797,8 +817,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: destinationrules.networking.istio.io spec: group: networking.istio.io @@ -7107,8 +7127,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: envoyfilters.networking.istio.io spec: group: networking.istio.io @@ -7373,7 +7393,7 @@ spec: type: integer x-kubernetes-validations: - message: port must be between 1-65535 - rule: 0 < self && self <= 6553 + rule: 0 < self && self <= 65535 route: description: Match a specific route. properties: @@ -7581,8 +7601,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: gateways.networking.istio.io spec: group: networking.istio.io @@ -8470,8 +8490,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: peerauthentications.security.istio.io spec: group: security.istio.io @@ -8832,8 +8852,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: proxyconfigs.networking.istio.io spec: group: networking.istio.io @@ -8990,8 +9010,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: requestauthentications.security.istio.io spec: group: security.istio.io @@ -9628,8 +9648,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: serviceentries.networking.istio.io spec: group: networking.istio.io @@ -10586,8 +10606,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: sidecars.networking.istio.io spec: group: networking.istio.io @@ -12424,8 +12444,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: telemetries.telemetry.istio.io spec: group: telemetry.istio.io @@ -12780,6 +12800,12 @@ spec: type: object description: Optional. type: object + disableContextPropagation: + description: Controls whether trace context headers (e.g., + `traceparent`/`tracestate` for W3C, `X-B3-*` for Zipkin) + are propagated in forwarded requests. + nullable: true + type: boolean disableSpanReporting: description: Controls span reporting. nullable: true @@ -13258,6 +13284,12 @@ spec: type: object description: Optional. type: object + disableContextPropagation: + description: Controls whether trace context headers (e.g., + `traceparent`/`tracestate` for W3C, `X-B3-*` for Zipkin) + are propagated in forwarded requests. + nullable: true + type: boolean disableSpanReporting: description: Controls span reporting. nullable: true @@ -13408,8 +13440,380 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 + name: trafficextensions.extensions.istio.io +spec: + group: extensions.istio.io + names: + categories: + - istio-io + - extensions-istio-io + kind: TrafficExtension + listKind: TrafficExtensionList + plural: trafficextensions + singular: trafficextension + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Extend the functionality provided by the Istio proxy through + WebAssembly or Lua filters. See more details at: https://istio.io/docs/reference/config/proxy_extensions/traffic_extension.html' + oneOf: + - not: + anyOf: + - required: + - wasm + - required: + - lua + - required: + - wasm + - required: + - lua + properties: + lua: + description: Lua filter configuration. + properties: + inlineCode: + description: The inline Lua code to be executed. + maxLength: 65536 + minLength: 1 + type: string + required: + - inlineCode + type: object + match: + description: Specifies the criteria to determine which traffic + is passed to TrafficExtension. + items: + properties: + mode: + description: |- + Criteria for selecting traffic by their direction. + + Valid Options: CLIENT, SERVER, CLIENT_AND_SERVER + enum: + - UNDEFINED + - CLIENT + - SERVER + - CLIENT_AND_SERVER + type: string + ports: + description: Criteria for selecting traffic by their + destination port. + items: + properties: + number: + maximum: 65535 + minimum: 1 + type: integer + required: + - number + type: object + type: array + x-kubernetes-list-map-keys: + - number + x-kubernetes-list-type: map + type: object + type: array + phase: + description: |- + Determines where in the filter chain this `TrafficExtension` is to be injected. + + Valid Options: AUTHN, AUTHZ, STATS + enum: + - UNSPECIFIED + - AUTHN + - AUTHZ + - STATS + type: string + priority: + description: Determines ordering of `TrafficExtensions` in the + same `phase`. + format: int32 + nullable: true + type: integer + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set + of pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: + ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently + supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + wasm: + description: WebAssembly filter configuration. + properties: + failStrategy: + description: |- + Specifies the failure behavior for the plugin due to fatal errors. + + Valid Options: FAIL_CLOSE, FAIL_OPEN, FAIL_RELOAD + enum: + - FAIL_CLOSE + - FAIL_OPEN + - FAIL_RELOAD + type: string + imagePullPolicy: + description: |- + The pull behaviour to be applied when fetching Wasm module by either OCI image or `http/https`. + + Valid Options: IfNotPresent, Always + enum: + - UNSPECIFIED_POLICY + - IfNotPresent + - Always + type: string + imagePullSecret: + description: Credentials to use for OCI image pulling. + maxLength: 253 + minLength: 1 + type: string + pluginConfig: + description: The configuration that will be passed on to the + plugin. + type: object + x-kubernetes-preserve-unknown-fields: true + pluginName: + description: The plugin name to be used in the Envoy + configuration (used to be called `rootID`). + maxLength: 256 + minLength: 1 + type: string + sha256: + description: SHA256 checksum that will be used to verify + Wasm module or OCI container. + pattern: (^$|^[a-f0-9]{64}$) + type: string + type: + description: |- + Specifies the type of Wasm Extension to be used. + + Valid Options: HTTP, NETWORK + enum: + - UNSPECIFIED_PLUGIN_TYPE + - HTTP + - NETWORK + type: string + url: + description: URL of a Wasm module or OCI container. + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have schema one of [http, https, file, + oci] + rule: |- + isURL(self) ? (url(self).getScheme() in ["", "http", "https", "file", "oci"]) : (isURL("http://" + self) && + url("http://" + self).getScheme() in ["", "http", "https", "file", "oci"]) + verificationKey: + type: string + vmConfig: + description: Configuration for a Wasm VM. + properties: + env: + description: Specifies environment variables to be + injected to this VM. + items: + properties: + name: + description: Name of the environment variable. + maxLength: 256 + minLength: 1 + type: string + value: + description: Value for the environment variable. + maxLength: 2048 + type: string + valueFrom: + description: |- + Source for the environment variable's value. + + Valid Options: INLINE, HOST + enum: + - INLINE + - HOST + type: string + required: + - name + type: object + x-kubernetes-validations: + - message: value may only be set when valueFrom is + INLINE + rule: '(has(self.valueFrom) ? self.valueFrom : "") != + "HOST" || !has(self.value)' + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + required: + - url + type: object + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) + <= 1' + - message: exactly one of wasm or lua must be set + rule: has(self.wasm) != has(self.lua) + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one + status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details + about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition + refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the + condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's + analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for + this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching + `^IST[0-9]{4}$` intended to uniquely identify the + message type. + type: string + name: + description: A human-readable name for the message + type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: istio + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/part-of: istio + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: virtualservices.networking.istio.io spec: group: networking.istio.io @@ -16694,8 +17098,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: wasmplugins.extensions.istio.io spec: group: extensions.istio.io @@ -17067,8 +17471,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: workloadentries.networking.istio.io spec: group: networking.istio.io @@ -17593,8 +17997,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: workloadgroups.networking.istio.io spec: group: networking.istio.io diff --git a/common/istio/istio-install/base/install.yaml b/common/istio/istio-install/base/install.yaml index 6b48932dc4..12a9a6fece 100644 --- a/common/istio/istio-install/base/install.yaml +++ b/common/istio/istio-install/base/install.yaml @@ -7,8 +7,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Cni @@ -25,8 +25,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: ingressgateway istio.io/rev: default @@ -44,8 +44,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-reader app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 release: istio name: istio-reader-service-account namespace: istio-system @@ -59,8 +59,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istiod namespace: istio-system @@ -74,8 +74,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Cni @@ -102,8 +102,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Cni @@ -135,8 +135,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-reader app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istio-reader-clusterrole-istio-system rules: @@ -250,8 +250,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istiod-clusterrole-istio-system rules: @@ -415,7 +415,6 @@ rules: - gateway.networking.x-k8s.io resources: - xbackendtrafficpolicies/status - - xlistenersets/status verbs: - update - patch @@ -431,6 +430,7 @@ rules: - tcproutes/status - tlsroutes/status - udproutes/status + - listenersets/status verbs: - update - patch @@ -494,8 +494,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istiod-gateway-controller-istio-system rules: @@ -569,8 +569,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Cni @@ -593,8 +593,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default k8s-app: istio-cni-repair @@ -619,8 +619,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-reader app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istio-reader-clusterrole-istio-system roleRef: @@ -641,8 +641,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istiod-clusterrole-istio-system roleRef: @@ -663,8 +663,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istiod-gateway-controller-istio-system roleRef: @@ -685,8 +685,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 istio: istiod istio.io/rev: default release: istio @@ -745,8 +745,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -774,7 +774,7 @@ data: AMBIENT_IPV6: 'true' AMBIENT_RECONCILE_POD_RULES_ON_STARTUP: 'true' CHAINED_CNI_PLUGIN: 'true' - CURRENT_AGENT_VERSION: 1.29.2 + CURRENT_AGENT_VERSION: 1.30.0 ENABLE_AMBIENT_DETECTION_RETRY: 'false' EXCLUDE_NAMESPACES: kube-system ISTIO_OWNED_CNI_CONFIG: 'false' @@ -794,8 +794,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Cni @@ -1164,6 +1164,11 @@ data: value: "{{ $value }}" {{- end }} {{- end }} + {{- $otelResAttrs := otelResourceAttributes .MeshConfig .ObjectMeta.Annotations .ObjectMeta.Labels .DeploymentMeta.Namespace .Spec.Containers }} + {{- if $otelResAttrs }} + - name: OTEL_RESOURCE_ATTRIBUTES + value: "{{ $otelResAttrs }}" + {{- end }} {{- range $key, $value := .ProxyConfig.ProxyMetadata }} - name: {{ $key }} value: "{{ $value }}" @@ -3015,6 +3020,12 @@ data: {{- end }} - name: XDS_ADDRESS value: {{ .ProxyConfig.DiscoveryAddress | quote }} + - name: CA_ADDRESS + {{- if .Values.global.caAddress }} + value: {{ .Values.global.caAddress }} + {{- else }} + value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012 + {{- end }} startupProbe: failureThreshold: 30 httpGet: @@ -3039,19 +3050,30 @@ data: - mountPath: /var/run/secrets/xds name: istiod-ca-cert - mountPath: /var/run/secrets/xds-tokens - name: istio-token + name: xds-token - mountPath: /tmp name: tmp + - mountPath: /var/run/secrets/istio + name: istiod-ca-cert + - mountPath: /var/run/secrets/tokens + name: istio-token volumes: - emptyDir: {} name: tmp - - name: istio-token + - name: xds-token projected: sources: - serviceAccountToken: path: xds-token expirationSeconds: 43200 audience: {{ .Values.global.sds.token.aud }} + - name: istio-token + projected: + sources: + - serviceAccountToken: + path: istio-token + expirationSeconds: 43200 + audience: {{ .Values.global.sds.token.aud }} {{- if eq .Values.global.pilotCertProvider "istiod" }} - name: istiod-ca-cert {{- if eq ((.Values.pilot).env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }} @@ -3254,7 +3276,7 @@ data: "sts": { "servicePort": 0 }, - "tag": "1.29.2", + "tag": "1.30.0", "variant": "", "waypoint": { "affinity": {}, @@ -3299,8 +3321,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -3437,7 +3459,7 @@ data: "sts": { "servicePort": 0 }, - "tag": "1.29.2", + "tag": "1.30.0", "variant": "", "waypoint": { "affinity": {}, @@ -3561,7 +3583,7 @@ data: "configValidation": true, "hub": "registry.istio.io/release", "istioNamespace": "istio-system", - "tag": "1.29.2" + "tag": "1.30.0" }, "meshConfig": { "tcpKeepalive": { @@ -3591,8 +3613,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -3609,8 +3631,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -3766,8 +3788,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default k8s-app: istio-cni-node @@ -3792,8 +3814,8 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 istio.io/dataplane-mode: none k8s-app: istio-cni-node sidecar.istio.io/inject: 'false' @@ -3840,7 +3862,7 @@ spec: envFrom: - configMapRef: name: istio-cni-config - image: registry.istio.io/release/install-cni:1.29.2 + image: registry.istio.io/release/install-cni:1.30.0 name: install-cni ports: - containerPort: 15014 @@ -3922,8 +3944,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: ingressgateway istio.io/dataplane-mode: none @@ -3955,9 +3977,9 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 + app.kubernetes.io/version: 1.30.0 chart: gateways - helm.sh/chart: istio-ingress-1.29.2 + helm.sh/chart: istio-ingress-1.30.0 heritage: Tiller install.operator.istio.io/owning-resource: unknown istio: ingressgateway @@ -4038,7 +4060,7 @@ spec: valueFrom: fieldRef: fieldPath: spec.nodeName - image: registry.istio.io/release/proxyv2:1.29.2 + image: registry.istio.io/release/proxyv2:1.30.0 name: istio-proxy ports: - containerPort: 15021 @@ -4157,8 +4179,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/rev: default @@ -4186,8 +4208,8 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/dataplane-mode: none @@ -4243,7 +4265,7 @@ spec: resource: limits.cpu - name: PLATFORM value: '' - image: registry.istio.io/release/pilot:1.29.2 + image: registry.istio.io/release/pilot:1.30.0 name: discovery ports: - containerPort: 8080 @@ -4338,8 +4360,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: IngressGateways @@ -4365,8 +4387,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istiod namespace: istio-system @@ -4412,8 +4434,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: IngressGateways @@ -4437,8 +4459,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istiod namespace: istio-system @@ -4460,8 +4482,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: ingressgateway istio.io/rev: default @@ -4493,8 +4515,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -4526,8 +4548,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: ingressgateway istio.io/rev: default @@ -4563,8 +4585,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/rev: default diff --git a/common/istio/istio-install/base/patches/istio-sidecar-injector-patch.yaml b/common/istio/istio-install/base/patches/istio-sidecar-injector-patch.yaml index ab3254cd4a..c6611514e9 100644 --- a/common/istio/istio-install/base/patches/istio-sidecar-injector-patch.yaml +++ b/common/istio/istio-install/base/patches/istio-sidecar-injector-patch.yaml @@ -113,7 +113,7 @@ data: "sts": { "servicePort": 0 }, - "tag": "1.29.2", + "tag": "1.30.0", "variant": "", "waypoint": { "affinity": {}, diff --git a/common/istio/istio-install/components/ambient-mode/ztunnel.yaml b/common/istio/istio-install/components/ambient-mode/ztunnel.yaml index fb94200620..be028c8534 100644 --- a/common/istio/istio-install/components/ambient-mode/ztunnel.yaml +++ b/common/istio/istio-install/components/ambient-mode/ztunnel.yaml @@ -7,8 +7,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ztunnel app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: ztunnel-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: ztunnel-1.30.0 name: ztunnel namespace: istio-system --- @@ -21,8 +21,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ztunnel app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: ztunnel-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: ztunnel-1.30.0 name: ztunnel namespace: istio-system spec: @@ -41,8 +41,8 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ztunnel app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: ztunnel-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: ztunnel-1.30.0 istio.io/dataplane-mode: none sidecar.istio.io/inject: 'false' spec: @@ -90,7 +90,7 @@ spec: resourceFieldRef: divisor: '1' resource: limits.cpu - image: registry.istio.io/release/ztunnel:1.29.2 + image: registry.istio.io/release/ztunnel:1.30.0 name: istio-proxy ports: - containerPort: 15020 diff --git a/common/istio/istio-install/overlays/insecure/configmap-patch.yaml b/common/istio/istio-install/overlays/insecure/configmap-patch.yaml index 00b67e9a52..103857ea30 100644 --- a/common/istio/istio-install/overlays/insecure/configmap-patch.yaml +++ b/common/istio/istio-install/overlays/insecure/configmap-patch.yaml @@ -79,7 +79,7 @@ data: aud: istio-ca sts: servicePort: 0 - tag: "1.29.2" + tag: "1.30.0" variant: "" waypoint: affinity: {} diff --git a/common/istio/profile.yaml b/common/istio/profile.yaml index 4cdb25f13f..52c40dfab4 100644 --- a/common/istio/profile.yaml +++ b/common/istio/profile.yaml @@ -18,7 +18,7 @@ spec: value: "true" hub: registry.istio.io/release profile: default - tag: 1.29.2 + tag: 1.30.0 values: defaultRevision: "" gateways: diff --git a/scripts/synchronize-istio-manifests.sh b/scripts/synchronize-istio-manifests.sh index 4ffd4204dc..de9ecc6767 100755 --- a/scripts/synchronize-istio-manifests.sh +++ b/scripts/synchronize-istio-manifests.sh @@ -5,8 +5,8 @@ source "${SCRIPT_DIRECTORY}/library.sh" setup_error_handling COMPONENT_NAME="istio" REPOSITORY_NAME="istio/istio" -COMMIT="1.29.2" -PREVIOUS_COMMIT="1.29.1" +COMMIT="1.30.0" +PREVIOUS_COMMIT="1.29.2" SOURCE_DIRECTORY=${SOURCE_DIRECTORY:=/tmp/kubeflow-${COMPONENT_NAME}} BRANCH_NAME=${BRANCH_NAME:=synchronize-${COMPONENT_NAME}-manifests-${COMMIT?}} MANIFESTS_DIRECTORY=$(dirname $SCRIPT_DIRECTORY)