Merging release-0.8 to master (final round) (istio#5975)

* use Gateway and VirtualService to expose helloworld service (istio#5791) * use Gateway and VirtualService to expose helloworld service * readme fix * Make istio work without rbac. (istio#5877) Fixed istio/old_issues_repo#255 * Update Jaeger version and add limit on the number of traces held in m… (istio#5873) * Update Jaeger version and add limit on the number of traces held in memory * Use tag 1 to pick up latest stable versions * Use tag 1.5 * enable mixer alpha3_v2 tests (istio#5844) * enable mixer alpha3_v2 tests * fix capture logs for new target * make rate limit test more resilient * linter errors * fix fmt * update tests * update api sha to head of release-0.8 (istio#5939) * loose the validation on istioctl to allow users to pass config (istio#5955) * remove the unecessary check
wuweichi · Jun 1, 2018 · c057402 · c057402
1 parent 48542f8
commit c057402
Show file tree

Hide file tree

Showing 21 changed files with 167 additions and 79 deletions.
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -138,6 +138,47 @@ jobs:
       - store_artifacts:
           path: /var/lib/localkube/
 
+  e2e-mixer-noauth-v1alpha3-v2:
+    <<: *integrationDefaults
+    environment:
+            - KUBECONFIG: /go/out/minikube.conf
+            - TEST_ENV: minikube-none
+            - GOPATH: /go
+            - ISTIO_PROXY_IMAGE: proxyv2
+    steps:
+      - <<: *initWorkingDir
+      - checkout
+      - attach_workspace:
+          at:  /go
+      - <<: *markJobStartsOnGCS
+      - run: make sync
+      - run: bin/testEnvRootMinikube.sh start
+      - run:
+          command: |
+            if [ ! -f /go/out/linux_amd64/release/pilot-discovery ]; then
+              # Should only happen when re-running a job, and the workspace is gone
+              time make build test-bins
+            fi
+            make docker.all generate_yaml
+      - run: bin/testEnvRootMinikube.sh wait
+      - run: docker images
+      - run:
+          no_output_timeout: 20m
+          # Run the test even if previous failed
+          when: always
+          name: make e2e_mixer
+          command: |
+            make test/local/noauth/e2e_mixer_envoyv2
+      - <<: *recordZeroExitCodeIfTestPassed
+      - <<: *recordNonzeroExitCodeIfTestFailed
+      - <<: *markJobFinishesOnGCS
+      - store_artifacts:
+          path: /home/circleci/logs
+      - store_artifacts:
+          path: /tmp
+      - store_test_results:
+          path: /go/out/tests
+
   e2e-mixer:
     <<: *integrationDefaults
     environment:
@@ -237,9 +278,6 @@ jobs:
                 make test/local/noauth/e2e_pilotv2
       - <<: *recordZeroExitCodeIfTestPassed
       - <<: *recordNonzeroExitCodeIfTestFailed
-      - run:
-          when: always
-          command: make dumpsys
       - <<: *markJobFinishesOnGCS
       - store_test_results:
           path: /go/out/tests
@@ -280,9 +318,6 @@ jobs:
                 make test/local/auth/e2e_pilotv2
       - <<: *recordZeroExitCodeIfTestPassed
       - <<: *recordNonzeroExitCodeIfTestFailed
-      - run:
-          when: always
-          command: make dumpsys
       - <<: *markJobFinishesOnGCS
       - store_test_results:
           path: /go/out/tests
@@ -530,6 +565,9 @@ workflows:
           requires:
             - test
             - build
+      - e2e-mixer-noauth-v1alpha3-v2:
+          requires:
+            - build
       - e2e-mixer:
           requires:
             - build
@@ -552,6 +590,9 @@ workflows:
       - codecov:
           requires:
             - build
+      - e2e-mixer-noauth-v1alpha3-v2:
+          requires:
+            - build
       - e2e-mixer:
           requires:
             - build

diff --git a/install/kubernetes/helm/istio/charts/galley/templates/deployment.yaml b/install/kubernetes/helm/istio/charts/galley/templates/deployment.yaml
@@ -16,7 +16,9 @@ spec:
       labels:
         istio: galley
     spec:
+{{- if .Values.global.rbacEnabled }}
       serviceAccountName: istio-galley-service-account
+{{- end }}
       containers:
         - name: validator
           image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"

diff --git a/install/kubernetes/helm/istio/charts/galley/templates/serviceaccount.yaml b/install/kubernetes/helm/istio/charts/galley/templates/serviceaccount.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.global.rbacEnabled }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -8,3 +9,4 @@ metadata:
     chart: {{ .Chart.Name }}-{{ .Chart.Version }}
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
+{{- end }}
diff --git a/install/kubernetes/helm/istio/charts/ingress/templates/deployment.yaml b/install/kubernetes/helm/istio/charts/ingress/templates/deployment.yaml
@@ -18,7 +18,9 @@ spec:
       annotations:
         sidecar.istio.io/inject: "false"
     spec:
+{{- if .Values.global.rbacEnabled }}
       serviceAccountName: istio-ingress-service-account
+{{- end }}
       containers:
         - name: {{ template "istio.name" . }}
           image: "{{ .Values.global.hub }}/proxy:{{ .Values.global.tag }}"

diff --git a/install/kubernetes/helm/istio/charts/ingress/templates/serviceaccount.yaml b/install/kubernetes/helm/istio/charts/ingress/templates/serviceaccount.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.global.rbacEnabled }}
 apiVersion: v1
 kind: ServiceAccount
 {{- if .Values.global.imagePullSecrets }}
@@ -12,3 +13,4 @@ metadata:
     chart: {{ .Chart.Name }}-{{ .Chart.Version }}
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
+{{- end }}
diff --git a/install/kubernetes/helm/istio/charts/mixer/templates/deployment.yaml b/install/kubernetes/helm/istio/charts/mixer/templates/deployment.yaml
@@ -1,6 +1,8 @@
 {{- define "policy_container" }}
     spec:
+{{- if .Values.global.rbacEnabled }}
       serviceAccountName: istio-mixer-service-account
+{{- end }}
       volumes:
       - name: istio-certs
         secret:
@@ -75,7 +77,9 @@
 
 {{- define "telemetry_container" }}
     spec:
+{{- if .Values.global.rbacEnabled }}
       serviceAccountName: istio-mixer-service-account
+{{- end }}
       volumes:
       - name: istio-certs
         secret:

diff --git a/install/kubernetes/helm/istio/charts/mixer/templates/serviceaccount.yaml b/install/kubernetes/helm/istio/charts/mixer/templates/serviceaccount.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.global.rbacEnabled }}
 apiVersion: v1
 kind: ServiceAccount
 {{- if .Values.global.imagePullSecrets }}
@@ -12,3 +13,4 @@ metadata:
     chart: {{ .Chart.Name }}-{{ .Chart.Version }}
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
+{{- end }}
diff --git a/install/kubernetes/helm/istio/charts/pilot/templates/deployment.yaml b/install/kubernetes/helm/istio/charts/pilot/templates/deployment.yaml
@@ -21,7 +21,9 @@ spec:
       annotations:
         sidecar.istio.io/inject: "false"
     spec:
+{{- if .Values.global.rbacEnabled }}
       serviceAccountName: istio-pilot-service-account
+{{- end }}
       containers:
         - name: discovery
           image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"

diff --git a/install/kubernetes/helm/istio/charts/pilot/templates/serviceaccount.yaml b/install/kubernetes/helm/istio/charts/pilot/templates/serviceaccount.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.global.rbacEnabled }}
 apiVersion: v1
 kind: ServiceAccount
 {{- if .Values.global.imagePullSecrets }}
@@ -12,3 +13,4 @@ metadata:
     chart: {{ .Chart.Name }}-{{ .Chart.Version }}
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
+{{- end }}
diff --git a/install/kubernetes/helm/istio/charts/prometheus/templates/serviceaccount.yaml b/install/kubernetes/helm/istio/charts/prometheus/templates/serviceaccount.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.global.rbacEnabled }}
 apiVersion: v1
 kind: ServiceAccount
 {{- if .Values.global.imagePullSecrets }}
@@ -7,3 +8,4 @@ imagePullSecrets:
 metadata:
   name: prometheus
   namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/install/kubernetes/helm/istio/charts/security/templates/deployment.yaml b/install/kubernetes/helm/istio/charts/security/templates/deployment.yaml
@@ -19,7 +19,9 @@ spec:
       annotations:
         sidecar.istio.io/inject: "false"
     spec:
+{{- if .Values.global.rbacEnabled }}
       serviceAccountName: istio-citadel-service-account
+{{- end }}
       containers:
         - name: citadel
           image: "{{ .Values.global.hub }}/{{ .Values.image }}:{{ .Values.global.tag }}"

diff --git a/install/kubernetes/helm/istio/charts/security/templates/serviceaccount.yaml b/install/kubernetes/helm/istio/charts/security/templates/serviceaccount.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.global.rbacEnabled }}
 apiVersion: v1
 kind: ServiceAccount
 {{- if .Values.global.imagePullSecrets }}
@@ -29,4 +30,5 @@ metadata:
     chart: {{ .Chart.Name }}-{{ .Chart.Version }}
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
-{{- end }}
+{{- end }}
+{{- end }}
diff --git a/install/kubernetes/helm/istio/charts/tracing/templates/deployment.yaml b/install/kubernetes/helm/istio/charts/tracing/templates/deployment.yaml
@@ -38,6 +38,8 @@ spec:
                 fieldPath: metadata.namespace
           - name: COLLECTOR_ZIPKIN_HTTP_PORT
             value: "{{ .Values.service.internalPort }}"
+          - name: MEMORY_MAX_TRACES
+            value: "{{ .Values.jaeger.memory.max_traces }}"
           livenessProbe:
             httpGet:
               path: /

diff --git a/install/kubernetes/helm/istio/values.yaml b/install/kubernetes/helm/istio/values.yaml
@@ -395,10 +395,12 @@ tracing:
   enabled: false
   jaeger:
     enabled: false
+    memory:
+      max_traces: 50000
   replicaCount: 1
   image:
     repository: jaegertracing/all-in-one
-    tag: 1.4.1
+    tag: 1.5
   service:
     name: http
     type: ClusterIP

diff --git a/istio.deps b/istio.deps
@@ -4,6 +4,6 @@
 		"name": "PROXY_REPO_SHA",
 		"repoName": "proxy",
 		"file": "",
-		"lastStableSHA": "383534746b0c27bfc9b48a6b6141f1c200116261"
+		"lastStableSHA": "456ad786f902fb61b167043d2914544cf4cabdef"
 	}
 ]
diff --git a/istioctl/cmd/istioctl/inject.go b/istioctl/cmd/istioctl/inject.go
@@ -112,9 +112,7 @@ func validateFlags() error {
 	if meshConfigFile == "" && meshConfigMapName == "" {
 		err = multierr.Append(err, errors.New("--meshConfigFile or --meshConfigMapName must be set"))
 	}
-	if injectConfigFile != "" && injectConfigMapName != "" {
-		err = multierr.Append(err, errors.New("--injectConfigFile and --injectConfigMapName are mutually exclusive"))
-	}
+
 	err = multierr.Append(err, inject.ValidateIncludeIPRanges(includeIPRanges))
 	err = multierr.Append(err, inject.ValidateExcludeIPRanges(excludeIPRanges))
 	err = multierr.Append(err, inject.ValidateIncludeInboundPorts(includeInboundPorts))

diff --git a/samples/helloworld/README.md b/samples/helloworld/README.md
@@ -26,11 +26,11 @@ Now create the deployment using the updated yaml file:
 kubectl create -f helloworld-istio.yaml
 ```
 
-Get the ingress URL and confirm it's running using curl.
+Follow the [instructions](https://preliminary.istio.io/docs/tasks/traffic-management/ingress.html#determining-the-ingress-ip-and-ports) to set the INGRESS_HOST and INGRESS_PORT variables then confirm it's running using curl.
 
 ```bash
-export HELLOWORLD_URL=$(kubectl get po -l istio=ingress -n istio-system -o 'jsonpath={.items[0].status.hostIP}'):$(kubectl get svc istio-ingress -n istio-system -o 'jsonpath={.spec.ports[0].nodePort}')
-curl http://$HELLOWORLD_URL/hello
+export GATEWAY_URL=$INGRESS_HOST:$INGRESS_PORT
+curl http://$GATEWAY_URL/hello
 ```
 
 ## Autoscale the services

diff --git a/samples/helloworld/helloworld.yaml b/samples/helloworld/helloworld.yaml
@@ -5,7 +5,6 @@ metadata:
   labels:
     app: helloworld
 spec:
-  type: NodePort
   ports:
   - port: 5000
     name: http
@@ -56,18 +55,36 @@ spec:
         ports:
         - containerPort: 5000
 ---
-apiVersion: extensions/v1beta1
-kind: Ingress
+apiVersion: networking.istio.io/v1alpha3
+kind: Gateway
 metadata:
-  name: helloworld
-  annotations:
-    kubernetes.io/ingress.class: "istio"
+  name: helloworld-gateway
 spec:
-  rules:
-  - http:
-      paths:
-      - path: /hello
-        backend:
-          serviceName: helloworld
-          servicePort: 5000
+  selector:
+    istio: ingressgateway # use istio default controller
+  servers:
+  - port:
+      number: 80
+      name: http
+      protocol: HTTP
+    hosts:
+    - "*"
 ---
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: helloworld
+spec:
+  hosts:
+  - "*"
+  gateways:
+  - helloworld-gateway
+  http:
+  - match:
+    - uri:
+        exact: /hello
+    route:
+    - destination:
+        host: helloworld
+        port:
+          number: 5000