Bump Istio and simplify update script

.github/workflows/kind-e2e.yaml

@@ -23,9 +23,6 @@ jobs:
         - ./test/conformance
         - ./test/e2e
 
-        istio-version:
-        - latest
-
         encryption:
         - disabled
         - system-internal-tls
@@ -56,18 +53,18 @@ jobs:
         set -o pipefail
 
         # Replace cluster.local with random suffix.
-        sed -ie "s/cluster\.local/${CLUSTER_SUFFIX}/g" third_party/istio-${{ matrix.istio-version }}/istio-kind-${{ matrix.istio-profile }}/istio.yaml
+        sed -ie "s/cluster\.local/${CLUSTER_SUFFIX}/g" third_party/istio-latest/istio-kind-${{ matrix.istio-profile }}/istio.yaml
 
         # Deploy Istio
-        ./third_party/istio-${{ matrix.istio-version }}/install-istio.sh istio-kind-${{ matrix.istio-profile }}
+        kubectl apply -f ./third_party/istio-latest/istio-kind-${{ matrix.istio-profile }}
 
         # Remove Knative Certificate as we are running without Serving CRs
         rm -f config/700-istio-knative-certificate.yaml
 
         # Build and Publish our containers to the docker daemon (including test assets)
         ko resolve --platform=linux/amd64 -f test/config/ -f config/ | kubectl apply -f -
 
-        CONFIG_ISTIO="./third_party/istio-${{ matrix.istio-version }}/istio-kind-${{ matrix.istio-profile }}/config-istio.yaml"
+        CONFIG_ISTIO="./third_party/istio-latest/istio-kind-${{ matrix.istio-profile }}/config-istio.yaml"
         if [[ -f "${CONFIG_ISTIO}" ]]; then
            kubectl apply -f "${CONFIG_ISTIO}"
         fi

go.mod

@@ -7,8 +7,8 @@ require (
 	go.uber.org/zap v1.27.0
 	golang.org/x/sync v0.7.0
 	google.golang.org/protobuf v1.34.1
-	istio.io/api v1.22.1-0.20240524024004-b6815be0740d
-	istio.io/client-go v1.22.1
+	istio.io/api v1.22.2-0.20240619002433-8214ad1c7bd7
+	istio.io/client-go v1.22.2
 	k8s.io/api v0.29.2
 	k8s.io/apimachinery v0.29.2
 	k8s.io/client-go v0.29.2

go.sum

@@ -660,10 +660,10 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-istio.io/api v1.22.1-0.20240524024004-b6815be0740d h1:2GncSQ55NOr91NYPmi0jqhVM7z7/xswJsD96dQMkN38=
-istio.io/api v1.22.1-0.20240524024004-b6815be0740d/go.mod h1:S3l8LWqNYS9yT+d4bH+jqzH2lMencPkW7SKM1Cu9EyM=
-istio.io/client-go v1.22.1 h1:78BUMxytD0muwpwHdcA9qTOTJXN0jib0mXmNLdXxj0c=
-istio.io/client-go v1.22.1/go.mod h1:Z2QE9uMt6tDVyrmiLfLVhutbqtfUkPJ7A5Uw/p6gNFo=
+istio.io/api v1.22.2-0.20240619002433-8214ad1c7bd7 h1:iSnlKJkc4UREFpBnaJLnZv2dtpg5DXUbk0BqTXpa3n0=
+istio.io/api v1.22.2-0.20240619002433-8214ad1c7bd7/go.mod h1:S3l8LWqNYS9yT+d4bH+jqzH2lMencPkW7SKM1Cu9EyM=
+istio.io/client-go v1.22.2 h1:BiE7itlXFTHpZwOv0t2aZQGga7oCox8lYOdaYbyWNEo=
+istio.io/client-go v1.22.2/go.mod h1:Fxt0tVZLXQRKyrBv7uwm4zCZE0qayejG0bSwZy9K6Hg=
 k8s.io/api v0.29.2 h1:hBC7B9+MU+ptchxEqTNW2DkUosJpp1P+Wn6YncZ474A=
 k8s.io/api v0.29.2/go.mod h1:sdIaaKuU7P44aoyyLlikSLayT6Vb7bvJNCX105xZXY0=
 k8s.io/apiextensions-apiserver v0.29.2 h1:UK3xB5lOWSnhaCk0RFZ0LUacPZz9RY4wi/yt2Iu+btg=

third_party/library.sh → hack/library.sh

@@ -14,29 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-source "$(git rev-parse --show-toplevel)/vendor/knative.dev/hack/library.sh"
-
-readonly APPLY_ORDER=(
-  Namespace
-  ServiceAccount
-  ClusterRole
-  ClusterRoleBinding
-  Role
-  RoleBinding
-  CustomResourceDefinition
-  ConfigMap
-  Deployment
-  Service
-  HorizontalPodAutoscaler
-  PodDisruptionBudget
-  MutatingWebhookConfiguration
-  ValidatingWebhookConfiguration
-
-  # Istio resources
-  EnvoyFilter
-  PeerAuthentication
-)
-
+source $(dirname "$0")/../vendor/knative.dev/hack/library.sh
 
 function download_istio() {
   # Find the right arch so we can download the correct istioctl version
@@ -63,8 +41,6 @@ function download_istio() {
     DOWNLOAD_URL=https://github.com/istio/istio/releases/download/${ISTIO_VERSION}/${ISTIO_TARBALL}
   fi
 
-  SYSTEM_NAMESPACE="${SYSTEM_NAMESPACE:-"knative-serving"}"
-
   ISTIO_TMP=$(mktemp -d)
   pushd "$ISTIO_TMP"
   curl -LO "$DOWNLOAD_URL"
@@ -86,7 +62,18 @@ function cleanup_istio() {
 function add_crd_label() {
   local lib_path="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
   go_run github.com/vmware-tanzu/carvel-ytt/cmd/ytt@v0.43.0 \
-    -f - -f "${lib_path}/label-crd-overlay.ytt.yaml"
+    -f - \
+    -f <(cat <<EOF
+#@ load("@ytt:overlay", "overlay")
+
+#@overlay/match by=overlay.subset({"kind":"CustomResourceDefinition"}), expects="1+"
+---
+metadata:
+  labels:
+    #@overlay/match missing_ok=True
+    knative.dev/crd-install: "true"
+EOF
+)
 }
 
 function generate_manifests() {
@@ -101,7 +88,6 @@ function generate_manifests() {
     mkdir -p "$target_dir"
 
     echo "Generating manifest from $(basename $(dirname "$file"))/$(basename "$file")"
-    echo "  using istioctl flags $@"
 
     tmpfile=$(mktemp)
     rm "${target_dir}/istio.yaml" || true
@@ -117,17 +103,6 @@ EOF
 
     "${ISTIO_DIR}"/bin/istioctl manifest generate -f "$file" "$@" | add_crd_label >> "${tmpfile}"
 
-    for kind in "${APPLY_ORDER[@]}"; do
-      run_yq eval "select(.kind == \"${kind}\")" "${tmpfile}" >> "${target_dir}/istio.yaml"
-      echo "---" >> "${target_dir}/istio.yaml"
-
-      # Remove the kind we added - after iteration we'll add what's remaining
-      run_yq eval --inplace "select(.kind != \"${kind}\")" "${tmpfile}"
-      if [ ! -s ${tmpfile} ]; then
-        break
-      fi
-    done
-
     # Add any resources that weren't on our prioritized list
     cat "${tmpfile}" >> "${target_dir}/istio.yaml"
 
@@ -148,9 +123,6 @@ EOF
       echo "  appending ${istio_extra}"
       cat "${istio_extra}" >> "${target_dir}/istio.yaml"
     fi
-
-    # Remove documents with no content
-    run_yq eval --inplace 'select(. != null)' "${target_dir}/istio.yaml"
   done
 }
 
@@ -164,16 +136,3 @@ function generate() {
 
   generate_manifests "$path" "$@"
 }
-
-function run_yq() {
-  go_run github.com/mikefarah/yq/v4@v4.28.1 "$@"
-}
-
-function install_yaml() {
-  for kind in "${APPLY_ORDER[@]}"; do
-    run_yq eval "select(.kind == \"${kind}\")" "$1" | kubectl apply -f -
-  done
-
-  # In case we missed anything in our list
-  kubectl apply -f "$1"
-}

hack/update-codegen.sh

@@ -55,6 +55,3 @@ ${GOPATH}/bin/deepcopy-gen \
 group "Update deps post-codegen"
 # Make sure our dependencies are up-to-date
 ${REPO_ROOT_DIR}/hack/update-deps.sh
-
-group "Update istio generated manifests"
-${REPO_ROOT_DIR}/third_party/istio-latest/generate-manifests.sh

hack/update-deps.sh

@@ -19,6 +19,12 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-source $(dirname "$0")/../vendor/knative.dev/hack/library.sh
+ISTIO_VERSION="1.22.2"
 
+source $(dirname "$0")/library.sh
+
+generate "${ISTIO_VERSION}" ./third_party/istio-latest
+
+go get "istio.io/client-go@v${ISTIO_VERSION}"
 go_update_deps "$@"
+

test/e2e-common.sh

@@ -67,7 +67,7 @@ function test_setup() {
     istio_profile=istio-ci-mesh
   fi
 
-  ${istio_dir}/install-istio.sh ${istio_profile} || return 1
+  kubectl apply -f ${istio_dir}/${istio_profile} || return 1
 
   echo ">> Bringing up net-istio Ingress Controller"
   # Do not install Knative Certificate for e2e tests, as we are running without Serving CRs