fix: associate revision to Istio control plane (#681)

.github/workflows/ci.yaml

@@ -150,6 +150,13 @@ jobs:
           sudo snap install concierge --classic
           sudo concierge prepare --trace
 
+      - name: Configure Cilium for Istio
+        run: |
+          # for context, see https://docs.cilium.io/en/stable/network/servicemesh/istio/
+          kubectl -n kube-system patch configmap cilium-config --type merge --patch '{"data":{"bpf-lb-sock-hostns-only":"true"}}'
+          kubectl -n kube-system patch configmap cilium-config --type merge --patch '{"data":{"cni-exclusive":"false"}}'
+          kubectl -n kube-system rollout restart daemonset cilium
+
       - name: Download packed charm(s)
         id: download-charms
         timeout-minutes: 5
@@ -161,7 +168,7 @@ jobs:
       - name: Run integration tests
         run: |
           juju add-model test-istio
-          tox -e ${{ matrix.integration-types }} -- --model test-istio --charms-path=${{ github.workspace }}/charms/
+          tox -e ${{ matrix.integration-types }} -- --model test-istio --charms-path=${{ github.workspace }}/charms/ --cni-bin-dir=/opt/cni/bin --cni-conf-dir=/etc/cni/net.d
         timeout-minutes: 80
 
       - name: Setup Debug Artifact Collection

charms/istio-pilot/src/charm.py

@@ -212,6 +212,12 @@ def _istioctl_extra_flags(self):
             f"values.pilot.image={pilot_image}",
             "--set",
             f"values.global.tag={global_tag}",
+            # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            # NOTE: setting the default revision was necessary to solve
+            # https://github.com/canonical/istio-operators/issues/680
+            "--set",
+            "values.global.revision=default",
+            # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
             "--set",
             f"values.global.hub={global_hub}",
             "--set",
@@ -247,9 +253,7 @@ def _istioctl_extra_flags(self):
     def install(self, _):
         """Install charm."""
 
-        self._log_and_set_status(
-            MaintenanceStatus("Deploying Istio control plane with Istio CNI plugin.")
-        )
+        self._log_and_set_status(MaintenanceStatus("Deploying Istio control plane."))
 
         # Call the istioctl wrapper to install the Istio Control Plane
         istioctl = Istioctl(

charms/istio-pilot/src/istioctl.py

@@ -51,9 +51,9 @@ def install(self):
         """Wrapper for the `istioctl install` command."""
         install_msg = (
             "Installing the Istio Control Plane with the following settings:\n"
-            "Profile: {self._profile}\n"
-            "Namespace: {self._namespace}\n"
-            "Istioctl extra flags: {self._istioctl_extra_flags}"
+            f"Profile: {self._profile}\n"
+            f"Namespace: {self._namespace}\n"
+            f"Istioctl extra flags: {self._istioctl_extra_flags}"
         )
 
         try:
@@ -161,6 +161,7 @@ def version(self) -> dict:
                 [
                     self._istioctl_path,
                     "version",
+                    "-r=default",
                     f"-i={self._namespace}",
                     "-o=yaml",
                 ]

charms/istio-pilot/tests/unit/test_charm.py

@@ -1375,6 +1375,8 @@ def test_upgrade_successful(
                 "--set",
                 f"values.global.tag={pilot_image_tag}",
                 "--set",
+                "values.global.revision=default",
+                "--set",
                 "values.global.hub=docker.io/istio",
                 "--set",
                 "values.global.proxy.image=proxyv2",

charms/istio-pilot/tests/unit/test_istioctl.py

@@ -222,6 +222,7 @@ def test_istioctl_version(mocked_check_output):
         [
             ISTIOCTL_BINARY,
             "version",
+            "-r=default",
             f"-i={NAMESPACE}",
             "-o=yaml",
         ]

tests/conftest.py

@@ -10,3 +10,11 @@ def pytest_addoption(parser: Parser):
         "--charms-path",
         help="Path to directory where charm files are stored.",
     )
+    parser.addoption(
+        "--cni-bin-dir",
+        help="Path to the directory of the CNI binaries.",
+    )
+    parser.addoption(
+        "--cni-conf-dir",
+        help="Path to the directory of the CNI configurations.",
+    )

tests/test_bundle.py

@@ -33,6 +33,10 @@
 ISTIO_PILOT_METADATA = yaml.safe_load(Path("charms/istio-pilot/metadata.yaml").read_text())
 ISTIO_GATEWAY_APP_NAME = "istio-ingressgateway"
 ISTIO_PILOT_APP_NAME = "istio-pilot"
+ISTIO_GATEWAY_CHARM_NAME = ISTIO_GATEWAY_METADATA["name"]
+ISTIO_PILOT_CHARM_NAME = ISTIO_PILOT_METADATA["name"]
+ISTIO_PILOT_CONFIG_OPTION_FOR_CNI_BIN_DIR = "cni-bin-dir"
+ISTIO_PILOT_CONFIG_OPTION_FOR_CNI_CONF_DIR = "cni-conf-dir"
 ISTIO_GATEWAY_KIND = "ingress"
 ISTIO_GATEWAY_INDEPENDENT_WORKLOAD_POD_SECURITY_CONTEXT: ContainerSecurityContext = {
     "runAsGroup": 1337,
@@ -90,14 +94,14 @@ async def test_kubectl_access(ops_test: OpsTest):
 @pytest.mark.abort_on_fail
 async def test_build_and_deploy_istio_charms(ops_test: OpsTest, request):
     # Build, deploy, and relate istio charms
-    istio_gateway_name = ISTIO_GATEWAY_METADATA["name"]
-    istio_pilot_name = ISTIO_PILOT_METADATA["name"]
     if charms_path := request.config.getoption("--charms-path"):
         istio_gateway = (
-            f"{charms_path}/{istio_gateway_name}/{istio_gateway_name}[email protected]"
+            f"{charms_path}/{ISTIO_GATEWAY_CHARM_NAME}"
+            f"/{ISTIO_GATEWAY_CHARM_NAME}[email protected]"
         )
         istio_pilot = (
-            f"{charms_path}/{istio_pilot_name}/{istio_pilot_name}[email protected]"
+            f"{charms_path}/{ISTIO_PILOT_CHARM_NAME}"
+            f"/{ISTIO_PILOT_CHARM_NAME}[email protected]"
         )
     else:
         istio_gateway = await ops_test.build_charm("charms/istio-gateway")
@@ -127,6 +131,45 @@ async def test_build_and_deploy_istio_charms(ops_test: OpsTest, request):
     )
 
 
+@pytest.mark.abort_on_fail
+async def test_istio_cni_enablement(ops_test: OpsTest, request):
+    """Test charms are active after enabling Istio CNI and after (re-)disabling it."""
+    # reading K8s distribution-specific test configurations:
+    cni_bin_dir = request.config.getoption("--cni-bin-dir")
+    cni_conf_dir = request.config.getoption("--cni-conf-dir")
+    for test_parameter in (cni_bin_dir, cni_conf_dir):
+        # NOTE: neither `None` nor `""` allowed (empty strings as charm configs disable Istio CNI)
+        assert test_parameter
+
+    # enabling Istio CNI:
+    await ops_test.model.applications[ISTIO_PILOT_APP_NAME].set_config(
+        {
+            ISTIO_PILOT_CONFIG_OPTION_FOR_CNI_BIN_DIR: cni_bin_dir,
+            ISTIO_PILOT_CONFIG_OPTION_FOR_CNI_CONF_DIR: cni_conf_dir,
+        }
+    )
+
+    await ops_test.model.wait_for_idle(
+        status="active",
+        raise_on_blocked=False,
+        timeout=90 * 10,
+    )
+
+    # disabling Istio CNI:
+    await ops_test.model.applications[ISTIO_PILOT_APP_NAME].set_config(
+        {
+            ISTIO_PILOT_CONFIG_OPTION_FOR_CNI_BIN_DIR: "",
+            ISTIO_PILOT_CONFIG_OPTION_FOR_CNI_CONF_DIR: "",
+        }
+    )
+
+    await ops_test.model.wait_for_idle(
+        status="active",
+        raise_on_blocked=False,
+        timeout=90 * 10,
+    )
+
+
 @pytest.mark.parametrize(
     "app_name,charm_metadata",
     [