-
Notifications
You must be signed in to change notification settings - Fork 7.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Missing upgrade note for 1.23.0 Ambient mode #52751
Comments
cc @bleggett |
For helm we may need to have users explicitly do it, but for istioctl we can automatically set |
Yeah this is another one that I definitely created a release note for but which didn't make it into the published notes, for reasons that I'm not clear on.
|
Oh it is in the change notes: https://istio.io/latest/news/releases/1.23.x/announcing-1.23/change-notes/#installation |
The reason we did not simply sustain the previous default ( Installing
Ok good. |
I don't use the Helm chart however and nothing in that line tells me that previous default behavior changed. Based on the upgrade notes, I expected to be able to install Istio 1.23.0 using my current IstioOperator manifest and the |
I definitely agree with that sentiment. In my new configuration I only configured it for kube-system.
Are all of the various places it needs to be configured documented somewhere? I haven't come across a complete list of the places updates are needed, I kind of just figured it out when I initially deployed Ambient mode on 1.22.x. |
Agreed, fair. It could have been more explicit that because the default behavior was a problem, the default behavior has changed. Since ambient is still in beta, maintaining strict back compat is not a requirement, but the relnote (that I wrote) could have been worded more explicitly.
Or in operator-resource-speak:
Helm has ways to describe the available values that can be overriden for a particular chart (
This is something generally we are trying to improve. |
Ah to be honest, Ambient mode has worked so well I kind of forgot it is technically a beta feature 😅
Thank you! That is simpler than specifying via the environment variable. |
Please ping me on Slack so we can publish a case study based on that sentiment :) |
Using that config results in It doesn't look to be a valid part of https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/#ComponentSpec either. I tried nesting it under This is the config that is currently working for me but I don't know if it is a recommended way of configuring it. I grepped through the manifests included in the Istio v1.23.0 release and it looks like this env var is the only place
|
So we need two things.
|
It should be in
The env-var is equivalent anyway, so that's fine to carry on with if you continue to use IstioOperator. |
oh @Phenix66 my bad - it should be
Because the IstioOperator indirects the Helm values, but (apparently) in several different ways. (component.pilot = no, values.pilot = yes) (why do we have 6 ways to do one thing? IDK - I do apologize tho) |
That worked perfectly, thank you! |
Closing since we found this is documented in https://istio.io/latest/news/releases/1.23.x/announcing-1.23/change-notes/#installation and issue resolved above. Thanks everyone. |
Is this the right place to submit this?
Bug Description
Upgrading Istio Ambient mode from 1.22.2 to 1.23.0 and it seems there is a missing upgrade note in https://istio.io/latest/news/releases/1.23.x/announcing-1.23/upgrade-notes/
My Istio configuration details (I would paste my IstioOperator manifest but it's on another network):
My issue was nearly identical to #52057 except I encountered the error only after upgrading Istio and changing nothing else in my configuration. Thanks to @yardenshoham commenting on that issue, I figured out the fix. I had to configure the env var
CA_TRUSTED_NODE_ACCOUNTS: "kube-system/ztunnel"
for the pilot component in my config then everything worked smoothly.The default value for this env var on the istiod container was
istio-system/ztunnel
on my Istio 1.23.0 deployment. I checked my most recent v1.22.2 deployment and that env var was set toistio-system/ztunnel,kube-system/ztunnel
automatically. So either the documentation should have mentioned that this value would need to be configured appropriately when upgrading to 1.23.0, if this change was intended, or there is a regression where that env var isn't being configured correctly anymore when deploying ztunnel to a different namespace.Version
Additional Information
No response
The text was updated successfully, but these errors were encountered: