Skip to content

Commit cae9013

Browse files
author
github-actions
committed
Merge tag '1.23.3' into tetrate-release-1.23
Istio release 1.23.3
2 parents 8cccad1 + 33af1b6 commit cae9013

File tree

65 files changed

+714
-130
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+714
-130
lines changed

.devcontainer/devcontainer.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "istio build-tools",
3-
"image": "gcr.io/istio-testing/build-tools:release-1.23-d82829888b6f4a2b2b2644fe481d72ced2e402aa",
3+
"image": "gcr.io/istio-testing/build-tools:release-1.23-d2ac9017a4c8dfb928bbfddd064833427afc0524",
44
"privileged": true,
55
"remoteEnv": {
66
"USE_GKE_GCLOUD_AUTH_PLUGIN": "True",

Makefile.core.mk

+1-1
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ endif
4949
export VERSION
5050

5151
# Base version of Istio image to use
52-
BASE_VERSION ?= 1.23-2024-09-04T19-02-13
52+
BASE_VERSION ?= 1.23-2024-09-17T19-01-11
5353
ISTIO_BASE_REGISTRY ?= gcr.io/istio-release
5454

5555
export GO111MODULE ?= on

common/.commonfiles.sha

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
e6bbccc51a140216fb669986e89602881002553d
1+
037289f69e8291490f4c780762ecb07986d9998a

common/scripts/setup_env.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ fi
7575
TOOLS_REGISTRY_PROVIDER=${TOOLS_REGISTRY_PROVIDER:-gcr.io}
7676
PROJECT_ID=${PROJECT_ID:-istio-testing}
7777
if [[ "${IMAGE_VERSION:-}" == "" ]]; then
78-
IMAGE_VERSION=release-1.23-d82829888b6f4a2b2b2644fe481d72ced2e402aa
78+
IMAGE_VERSION=release-1.23-d2ac9017a4c8dfb928bbfddd064833427afc0524
7979
fi
8080
if [[ "${IMAGE_NAME:-}" == "" ]]; then
8181
IMAGE_NAME=build-tools

go.mod

+4-4
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ require (
1919
github.com/containernetworking/plugins v1.5.0
2020
github.com/coreos/go-oidc/v3 v3.10.0
2121
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
22-
github.com/docker/cli v26.1.4+incompatible
22+
github.com/docker/cli v26.1.5+incompatible
2323
github.com/envoyproxy/go-control-plane v0.12.1-0.20240719165848-f888b4f71207
2424
github.com/evanphx/json-patch/v5 v5.9.0
2525
github.com/fatih/color v1.17.0
@@ -98,8 +98,8 @@ require (
9898
gopkg.in/yaml.v2 v2.4.0
9999
gopkg.in/yaml.v3 v3.0.1
100100
helm.sh/helm/v3 v3.15.1
101-
istio.io/api v1.23.1-0.20240906150629-ba126bb830f0
102-
istio.io/client-go v1.23.1-0.20240906150928-c84358ed0e43
101+
istio.io/api v1.23.3-0.20241007150425-eb56b2cffca7
102+
istio.io/client-go v1.23.3-0.20241007150824-1455e2e0ee0a
103103
k8s.io/api v0.30.1
104104
k8s.io/apiextensions-apiserver v0.30.1
105105
k8s.io/apimachinery v0.30.1
@@ -135,7 +135,7 @@ require (
135135
github.com/cyphar/filepath-securejoin v0.2.4 // indirect
136136
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
137137
github.com/docker/distribution v2.8.3+incompatible // indirect
138-
github.com/docker/docker v26.1.4+incompatible // indirect
138+
github.com/docker/docker v26.1.5+incompatible // indirect
139139
github.com/docker/docker-credential-helpers v0.8.1 // indirect
140140
github.com/emicklei/go-restful/v3 v3.12.0 // indirect
141141
github.com/envoyproxy/protoc-gen-validate v1.0.4 // indirect

go.sum

+8-8
Original file line numberDiff line numberDiff line change
@@ -137,13 +137,13 @@ github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 h1:8UrgZ3GkP4i/CLijOJx79Yu+etly
137137
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
138138
github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
139139
github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
140-
github.com/docker/cli v26.1.4+incompatible h1:I8PHdc0MtxEADqYJZvhBrW9bo8gawKwwenxRM7/rLu8=
141-
github.com/docker/cli v26.1.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
140+
github.com/docker/cli v26.1.5+incompatible h1:NxXGSdz2N+Ibdaw330TDO3d/6/f7MvHuiMbuFaIQDTk=
141+
github.com/docker/cli v26.1.5+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
142142
github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
143143
github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
144144
github.com/docker/docker v0.7.3-0.20190327010347-be7ac8be2ae0/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
145-
github.com/docker/docker v26.1.4+incompatible h1:vuTpXDuoga+Z38m1OZHzl7NKisKWaWlhjQk7IDPSLsU=
146-
github.com/docker/docker v26.1.4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
145+
github.com/docker/docker v26.1.5+incompatible h1:NEAxTwEjxV6VbBMBoGG3zPqbiJosIApZjxlbrG9q3/g=
146+
github.com/docker/docker v26.1.5+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
147147
github.com/docker/docker-credential-helpers v0.8.1 h1:j/eKUktUltBtMzKqmfLB0PAgqYyMHOp5vfsD1807oKo=
148148
github.com/docker/docker-credential-helpers v0.8.1/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
149149
github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
@@ -1009,10 +1009,10 @@ helm.sh/helm/v3 v3.15.1/go.mod h1:fvfoRcB8UKRUV5jrIfOTaN/pG1TPhuqSb56fjYdTKXg=
10091009
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
10101010
honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
10111011
honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
1012-
istio.io/api v1.23.1-0.20240906150629-ba126bb830f0 h1:utRdmZryJWw71X1flREUJFLk56QCl2JdVuP3xsvDcMI=
1013-
istio.io/api v1.23.1-0.20240906150629-ba126bb830f0/go.mod h1:QPSTGXuIQdnZFEm3myf9NZ5uBMwCdJWUvfj9ZZ+2oBM=
1014-
istio.io/client-go v1.23.1-0.20240906150928-c84358ed0e43 h1:/HbrtBiDEiTsQRrzkdcfNgKr+GUp/JFWc5U3ZL/QUmk=
1015-
istio.io/client-go v1.23.1-0.20240906150928-c84358ed0e43/go.mod h1:E08wpMtUulJk2tlWOCUVakjy1bKFxUNm22tM1R1QY0Y=
1012+
istio.io/api v1.23.3-0.20241007150425-eb56b2cffca7 h1:c8RwLi4qSqCn36t5B2WFkwRDY+qPZ1XhlLMEIoJDCcs=
1013+
istio.io/api v1.23.3-0.20241007150425-eb56b2cffca7/go.mod h1:QPSTGXuIQdnZFEm3myf9NZ5uBMwCdJWUvfj9ZZ+2oBM=
1014+
istio.io/client-go v1.23.3-0.20241007150824-1455e2e0ee0a h1:MZyree5xnOHalv93KgXLX9hb3EINj8EgLp7ztjWObos=
1015+
istio.io/client-go v1.23.3-0.20241007150824-1455e2e0ee0a/go.mod h1:Lfa3anzx7/kCOpcAciR+JiRMj/SYuzDcbXQDjkThnLg=
10161016
k8s.io/api v0.18.2/go.mod h1:SJCWI7OLzhZSvbY7U8zwNl9UA4o1fizoug34OV/2r78=
10171017
k8s.io/api v0.18.4/go.mod h1:lOIQAKYgai1+vz9J7YcDZwC26Z0zQewYOGWdyIPUUQ4=
10181018
k8s.io/api v0.30.1 h1:kCm/6mADMdbAxmIh0LBjS54nQBE+U4KmbCfIkF5CpJY=

istio.deps

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
"name": "PROXY_REPO_SHA",
55
"repoName": "proxy",
66
"file": "",
7-
"lastStableSHA": "6c72b2179f5a58988b920a55b0be8346de3f7b35"
7+
"lastStableSHA": "cbd889517ed13455bf2d88facc5685d958eb54a6"
88
},
99
{
1010
"_comment": "",
1111
"name": "ZTUNNEL_REPO_SHA",
1212
"repoName": "ztunnel",
1313
"file": "",
14-
"lastStableSHA": "3ead5b81415936e1d3d7f4e81b0d87178817b289"
14+
"lastStableSHA": "906d9c34eb40703fe07a9d14e1bd09da2e370f61"
1515
}
1616
]

manifests/charts/istio-cni/templates/daemonset.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,10 @@ spec:
7676
{{- if or .Values.cni.pullPolicy .Values.global.imagePullPolicy }}
7777
imagePullPolicy: {{ .Values.cni.pullPolicy | default .Values.global.imagePullPolicy }}
7878
{{- end }}
79+
ports:
80+
- containerPort: 15014
81+
name: metrics
82+
protocol: TCP
7983
readinessProbe:
8084
httpGet:
8185
path: /readyz

manifests/charts/istio-control/istio-discovery/files/kube-gateway.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,9 @@ spec:
104104
runAsGroup: {{ .ProxyGID | default "1337" }}
105105
runAsNonRoot: true
106106
ports:
107+
- containerPort: 15020
108+
name: metrics
109+
protocol: TCP
107110
- containerPort: 15021
108111
name: status-port
109112
protocol: TCP

pilot/pkg/config/kube/gateway/testdata/deployment/cluster-ip.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,9 @@ spec:
134134
image: test/proxyv2:test
135135
name: istio-proxy
136136
ports:
137+
- containerPort: 15020
138+
name: metrics
139+
protocol: TCP
137140
- containerPort: 15021
138141
name: status-port
139142
protocol: TCP

pilot/pkg/config/kube/gateway/testdata/deployment/custom-class.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,9 @@ spec:
131131
image: test/proxyv2:test
132132
name: istio-proxy
133133
ports:
134+
- containerPort: 15020
135+
name: metrics
136+
protocol: TCP
134137
- containerPort: 15021
135138
name: status-port
136139
protocol: TCP

pilot/pkg/config/kube/gateway/testdata/deployment/infrastructure-labels-annotations.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,9 @@ spec:
137137
image: test/proxyv2:test
138138
name: istio-proxy
139139
ports:
140+
- containerPort: 15020
141+
name: metrics
142+
protocol: TCP
140143
- containerPort: 15021
141144
name: status-port
142145
protocol: TCP

pilot/pkg/config/kube/gateway/testdata/deployment/kube-gateway-ambient-redirect-infra.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,9 @@ spec:
131131
image: test/proxyv2:test
132132
name: istio-proxy
133133
ports:
134+
- containerPort: 15020
135+
name: metrics
136+
protocol: TCP
134137
- containerPort: 15021
135138
name: status-port
136139
protocol: TCP

pilot/pkg/config/kube/gateway/testdata/deployment/kube-gateway-ambient-redirect.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,9 @@ spec:
131131
image: test/proxyv2:test
132132
name: istio-proxy
133133
ports:
134+
- containerPort: 15020
135+
name: metrics
136+
protocol: TCP
134137
- containerPort: 15021
135138
name: status-port
136139
protocol: TCP

pilot/pkg/config/kube/gateway/testdata/deployment/manual-ip.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,9 @@ spec:
131131
image: test/proxyv2:test
132132
name: istio-proxy
133133
ports:
134+
- containerPort: 15020
135+
name: metrics
136+
protocol: TCP
134137
- containerPort: 15021
135138
name: status-port
136139
protocol: TCP

pilot/pkg/config/kube/gateway/testdata/deployment/manual-sa.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,9 @@ spec:
131131
image: test/proxyv2:test
132132
name: istio-proxy
133133
ports:
134+
- containerPort: 15020
135+
name: metrics
136+
protocol: TCP
134137
- containerPort: 15021
135138
name: status-port
136139
protocol: TCP

pilot/pkg/config/kube/gateway/testdata/deployment/multinetwork.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,9 @@ spec:
138138
image: test/proxyv2:test
139139
name: istio-proxy
140140
ports:
141+
- containerPort: 15020
142+
name: metrics
143+
protocol: TCP
141144
- containerPort: 15021
142145
name: status-port
143146
protocol: TCP

pilot/pkg/config/kube/gateway/testdata/deployment/proxy-config-crd.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,9 @@ spec:
131131
image: test/proxyv2:test-distroless
132132
name: istio-proxy
133133
ports:
134+
- containerPort: 15020
135+
name: metrics
136+
protocol: TCP
134137
- containerPort: 15021
135138
name: status-port
136139
protocol: TCP

pilot/pkg/config/kube/gateway/testdata/deployment/simple.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,9 @@ spec:
137137
image: test/proxyv2:test
138138
name: istio-proxy
139139
ports:
140+
- containerPort: 15020
141+
name: metrics
142+
protocol: TCP
140143
- containerPort: 15021
141144
name: status-port
142145
protocol: TCP

pilot/pkg/model/cluster_local.go

+29-23
Original file line numberDiff line numberDiff line change
@@ -19,26 +19,29 @@ import (
1919
"sync"
2020

2121
"istio.io/istio/pkg/config/host"
22-
"istio.io/istio/pkg/util/sets"
2322
)
2423

2524
var (
2625
defaultClusterLocalNamespaces = []string{"kube-system"}
2726
defaultClusterLocalServices = []string{"kubernetes.default.svc"}
2827
)
2928

30-
// ClusterLocalHosts is a map of host names or wildcard patterns which should only
31-
// be made accessible from within the same cluster.
29+
// ClusterLocalHosts is a map of host names or wildcard patterns which indicate
30+
// whether a host be made accessible from within the same cluster or not.
3231
type ClusterLocalHosts struct {
33-
specific sets.Set[host.Name]
34-
wildcard sets.Set[host.Name]
32+
specific map[host.Name]bool
33+
wildcard map[host.Name]bool
3534
}
3635

3736
// IsClusterLocal indicates whether the given host should be treated as a
3837
// cluster-local destination.
3938
func (c ClusterLocalHosts) IsClusterLocal(h host.Name) bool {
40-
_, _, ok := MostSpecificHostMatch(h, c.specific, c.wildcard)
41-
return ok
39+
_, local, ok := MostSpecificHostMatch(h, c.specific, c.wildcard)
40+
// Explicitly set clusterLocal to false if host is not found in clusterLocal settings
41+
if !ok {
42+
local = false
43+
}
44+
return local
4245
}
4346

4447
// ClusterLocalProvider provides the cluster-local hosts.
@@ -98,22 +101,15 @@ func (c *clusterLocalProvider) onMeshUpdated(e *Environment) {
98101

99102
// Collect the cluster-local hosts.
100103
hosts := ClusterLocalHosts{
101-
specific: make(map[host.Name]struct{}, 0),
102-
wildcard: make(map[host.Name]struct{}, 0),
104+
specific: make(map[host.Name]bool),
105+
wildcard: make(map[host.Name]bool),
103106
}
107+
104108
for _, serviceSettings := range e.Mesh().ServiceSettings {
105-
if serviceSettings.GetSettings().GetClusterLocal() {
106-
for _, h := range serviceSettings.GetHosts() {
107-
hostname := host.Name(h)
108-
if hostname.IsWildCarded() {
109-
hosts.wildcard.Insert(hostname)
110-
} else {
111-
hosts.specific.Insert(hostname)
112-
}
113-
}
114-
} else {
115-
// Remove defaults if specified to be non-cluster-local.
116-
for _, h := range serviceSettings.GetHosts() {
109+
isClusterLocal := serviceSettings.GetSettings().GetClusterLocal()
110+
for _, h := range serviceSettings.GetHosts() {
111+
// If clusterLocal false, check to see if we should remove a default clusterLocal host.
112+
if !isClusterLocal {
117113
for i, defaultClusterLocalHost := range defaultClusterLocalHosts {
118114
if len(defaultClusterLocalHost) > 0 {
119115
if h == string(defaultClusterLocalHost) ||
@@ -126,15 +122,25 @@ func (c *clusterLocalProvider) onMeshUpdated(e *Environment) {
126122
}
127123
}
128124
}
125+
126+
// Add hosts with their clusterLocal setting to sets.
127+
for _, h := range serviceSettings.GetHosts() {
128+
hostname := host.Name(h)
129+
if hostname.IsWildCarded() {
130+
hosts.wildcard[hostname] = isClusterLocal
131+
} else {
132+
hosts.specific[hostname] = isClusterLocal
133+
}
134+
}
129135
}
130136

131137
// Add any remaining defaults to the end of the list.
132138
for _, defaultClusterLocalHost := range defaultClusterLocalHosts {
133139
if len(defaultClusterLocalHost) > 0 {
134140
if defaultClusterLocalHost.IsWildCarded() {
135-
hosts.wildcard.Insert(defaultClusterLocalHost)
141+
hosts.wildcard[defaultClusterLocalHost] = true
136142
} else {
137-
hosts.specific.Insert(defaultClusterLocalHost)
143+
hosts.specific[defaultClusterLocalHost] = true
138144
}
139145
}
140146
}

0 commit comments

Comments
 (0)