Update Istio to 1.9

Package Owner Merge Request

Package Changes

Istio control plane and Istio operator update to upstream Istio 1.9.7.

MRs associated with this change.

• https://repo1.dso.mil/platform-one/big-bang/apps/core/istio-controlplane/-/merge_requests/60
• https://repo1.dso.mil/platform-one/big-bang/apps/core/istio-operator/-/merge_requests/18
• https://repo1.dso.mil/platform-one/big-bang/apps/core/authservice/-/merge_requests/38

Additional Details

• Closes https://repo1.dso.mil/platform-one/big-bang/apps/core/istio-controlplane/-/issues/34
• Closes https://repo1.dso.mil/platform-one/big-bang/apps/core/istio-operator/-/issues/13
• Closes https://repo1.dso.mil/platform-one/big-bang/apps/core/authservice/-/issues/16
• Closes #628 (closed)

changed milestone to %1.14.0

changed the description

marked this merge request as draft

added 1 commit

• 08c519a6 - chore(istio-oper): update pull secret to new format

Compare with previous version

changed title from Draft: Update values.yaml for Istio 1.9 update. to Draft: Update Big Bang for Istio 1.9 update.

changed title from Draft: Update Big Bang for Istio 1.9 update. to Draft: Update Istio to 1.9

added istio label

added authservice label

I believe the following items are still required:

• Canary upgrade documentation
• A new IB image for https://repo1.dso.mil/dsop/opensource/istio/1.9/proxyv2/-/issues/7

Thank you @michaelmcleroy

dsop/opensource/istio/1.9/proxyv2#7 has been resolved now.

We are working on documentation of manual upgrade following the upstream documentation: https://istio.io/latest/docs/setup/upgrade/canary/. We ran into an issue during the upgrade and if we can resolve it then we can have the documentation ready on Monday.

mentioned in merge request !737 (merged)

@cdevarenne It looks like the upgrade pipeline is failing. This would not be doing a Canary upgrade, but just an in-place upgrade. Can you take a look and see what is going on?

I restarted the pipeline just now to get a 2nd run on it so you'd have 2 data points.

added 61 commits

• 08c519a6...32abc006 - 60 commits from branch master
• f2abdb24 - Merge branch 'master' into 628-update-istio-to-1-9

Compare with previous version

marked this merge request as ready

resolved all threads

added statusreview label

@cdevarenne During an upgrade of authservice to 1.9.7, the pod/authservice-authservice-redis-replicas-* have problems upgrading and restart. After failing 3-5 times they eventually work (takes about 5-7 minutes). Here is the error they are throwing:

redis 1:S 11 Aug 2021 19:30:29.651 * MASTER <-> REPLICA sync started
redis 1:S 11 Aug 2021 19:30:29.651 # Error condition on socket for SYNC: Connection refused
redis 1:S 11 Aug 2021 19:30:30.653 * Connecting to MASTER authservice-authservice-redis-master-0.authservice-authservice-redis-headless.authservice.svc.cluster.local:6379

I believe we have 2 replicas running by default.

Can you investigate if this is expected behavior or a side effect of the EnvoyFilters in authservice since those switch when the new istio is deployed?

added statusdoing label and removed statusreview label

@michaelmcleroy I'm able to reproduce the issue. looking into it.