Merge pull request #1485 from brendarearden/istio-spoof

Update istio to work with new nginx spoof image

charts/rancher-istio/rancher-istio/100.0.1+up1.10.4/Chart.yaml

@@ -5,6 +5,7 @@ annotations:
   catalog.cattle.io/namespace: istio-system
   catalog.cattle.io/os: linux
   catalog.cattle.io/provides-gvr: networking.istio.io.virtualservice/v1beta1
+  catalog.cattle.io/rancher-version: '>= 2.6.0-0'
   catalog.cattle.io/release-name: rancher-istio
   catalog.cattle.io/requests-cpu: 710m
   catalog.cattle.io/requests-memory: 2314Mi

charts/rancher-istio/rancher-istio/100.0.1+up1.10.4/templates/istio-install-job.yaml

@@ -11,6 +11,12 @@ spec:
   backoffLimit: 1
   template:
     spec:
+      {{- if .Values.installer.releaseMirror.enabled }}
+      hostAliases:
+      - ip: "127.0.0.1"
+        hostnames:
+        - "github.com"
+      {{- end }}
       containers:
         - name: istioctl-installer
           image: {{ template "system_default_registry" . }}{{ .Values.installer.repository }}:{{ .Values.installer.tag }}
@@ -21,6 +27,8 @@ spec:
             value: {{ template "istio.namespace" . }}
           - name: FORCE_INSTALL
             value: {{ .Values.forceInstall | default "false" | quote }}
+          - name: RELEASE_MIRROR_ENABLED
+            value: {{ .Values.installer.releaseMirror.enabled | quote }}
           command: ["/bin/sh","-c"]
           args: ["/usr/local/app/scripts/run.sh"]
           volumeMounts:
@@ -42,9 +50,7 @@ spec:
             name: istio-installer-overlay
         {{- end }}
       serviceAccountName: istio-installer
-      {{- if .Values.global.rbac.pspEnabled }}
       securityContext:
         runAsUser: 101
         runAsGroup: 101
-      {{- end }}
       restartPolicy: Never

charts/rancher-istio/rancher-istio/100.0.1+up1.10.4/values.yaml

@@ -5,7 +5,12 @@ forceInstall: false
 
 installer:
   repository: rancher/istio-installer
-  tag: 1.10.4-rancher1
+  tag: 1.10.4-rancher2
+  ##releaseMirror are configurations for istio upgrades. 
+  ##Setting releaseMirror.enabled: true will cause istio to use bundled in images from rancher/istio-installer to perfom an upgrade - this is ideal
+  ##for airgap setups. Setting releaseMirror.enabled to false means istio will call externally to github to fetch the required assets.
+  releaseMirror:
+    enabled: false
 
 ##Native support for dns added in 1.8
 dns:
@@ -56,7 +61,7 @@ global:
   defaultPodDisruptionBudget:
     enabled: true
   rbac:
-    pspEnabled: false
+    pspEnabled: true
 
 # Kiali subchart from rancher-kiali-server
 kiali:

index.yaml

@@ -2016,6 +2016,7 @@ entries:
       catalog.cattle.io/namespace: istio-system
       catalog.cattle.io/os: linux
       catalog.cattle.io/provides-gvr: networking.istio.io.virtualservice/v1beta1
+      catalog.cattle.io/rancher-version: '>= 2.6.0-0'
       catalog.cattle.io/release-name: rancher-istio
       catalog.cattle.io/requests-cpu: 710m
       catalog.cattle.io/requests-memory: 2314Mi
@@ -2023,7 +2024,7 @@ entries:
       catalog.cattle.io/ui-component: istio
     apiVersion: v1
     appVersion: 1.10.4
-    created: "2021-09-17T11:40:02.22432-07:00"
+    created: "2021-09-23T13:53:23.208871-07:00"
     dependencies:
     - condition: kiali.enabled
       name: kiali
@@ -2033,7 +2034,7 @@ entries:
       repository: file://./charts/tracing
     description: A basic Istio setup that installs with the istioctl. Refer to https://istio.io/latest/
       for details.
-    digest: bf0adc34a59a5c97c7b1d06a27d42af29f45ea3892712acf38eff4d30a5eb566
+    digest: 75f077c7a261394cf96e1f94e5fe3f28b7714a4ca5eb285576019bb4c3e297bb
     icon: https://charts.rancher.io/assets/logos/istio.svg
     keywords:
     - networking

packages/rancher-istio/charts/Chart.yaml

@@ -19,3 +19,4 @@ annotations:
   catalog.cattle.io/os: linux
   catalog.cattle.io/requests-cpu: "710m"
   catalog.cattle.io/requests-memory: "2314Mi"
+  catalog.cattle.io/rancher-version: ">= 2.6.0-0"

packages/rancher-istio/charts/templates/istio-install-job.yaml

@@ -11,6 +11,12 @@ spec:
   backoffLimit: 1
   template:
     spec:
+      {{- if .Values.installer.releaseMirror.enabled }}
+      hostAliases:
+      - ip: "127.0.0.1"
+        hostnames:
+        - "github.com"
+      {{- end }}
       containers:
         - name: istioctl-installer
           image: {{ template "system_default_registry" . }}{{ .Values.installer.repository }}:{{ .Values.installer.tag }}
@@ -21,6 +27,8 @@ spec:
             value: {{ template "istio.namespace" . }}
           - name: FORCE_INSTALL
             value: {{ .Values.forceInstall | default "false" | quote }}
+          - name: RELEASE_MIRROR_ENABLED
+            value: {{ .Values.installer.releaseMirror.enabled | quote }}
           command: ["/bin/sh","-c"]
           args: ["/usr/local/app/scripts/run.sh"]
           volumeMounts:
@@ -42,9 +50,7 @@ spec:
             name: istio-installer-overlay
         {{- end }}
       serviceAccountName: istio-installer
-      {{- if .Values.global.rbac.pspEnabled }}
       securityContext:
         runAsUser: 101
         runAsGroup: 101
-      {{- end }}
       restartPolicy: Never

packages/rancher-istio/charts/values.yaml

@@ -5,7 +5,12 @@ forceInstall: false
 
 installer:
   repository: rancher/istio-installer
-  tag: 1.10.4-rancher1
+  tag: 1.10.4-rancher2
+  ##releaseMirror are configurations for istio upgrades. 
+  ##Setting releaseMirror.enabled: true will cause istio to use bundled in images from rancher/istio-installer to perfom an upgrade - this is ideal
+  ##for airgap setups. Setting releaseMirror.enabled to false means istio will call externally to github to fetch the required assets.
+  releaseMirror:
+    enabled: false
 
 ##Native support for dns added in 1.8
 dns:
@@ -56,7 +61,7 @@ global:
   defaultPodDisruptionBudget:
     enabled: true
   rbac:
-    pspEnabled: false
+    pspEnabled: true
 
 # Kiali subchart from rancher-kiali-server
 kiali: