Skip to content

v0.12.0

Latest
Latest
Compare
Choose a tag to compare
@github-actions github-actions released this 04 Sep 13:45
· 50 commits to main since this release
v0.12.0
This tag was signed with the committer’s verified signature.
SgtCoDFish Ashley Davis
SSH Key Fingerprint: 2/r7Xip8D/TOyjbQBZcd6gKt41j0xlAUYgAvO5tqmb4 Learn about vigilant mode.
13f57d6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.

istio-csr integrates cert-manager into Istio, allowing you to issue workload certificates using the power of cert-manager.

v0.12.0 introduces support for Istio Ambient Mode, expands upon the runtime configuration functionality introduced in previous releases, and includes various other improvements.

Features

Istio Ambient Mode Support

Istio Ambient Mode allows the use of Istio without requiring sidecar containers to run in your pods. This is powerful, but functions slightly differently and istio-csr previously didn't support this mode of operation.

Thanks to @paulwilljones istio-csr can now handle this mode of operation!

Istio Ambient Mode is enabled by setting the app.server.caTrustedNodeAccounts Helm value to a comma-separated list of namespace/service-accounts values indicating which service accounts are permitted to use node authentication, such as istio-system/ztunnel.

As this is a new feature, we'd be keen to hear your feedback and learn how this can be improved!

Runtime Configuration Improvements

Provisioning Resources

Runtime configuration allows istio-csr to be installed at the same time as cert-manager itself, which can simplify the cluster setup process. It also enables issuers to be changed on the fly, which makes rotation of CA certificates simpler and reduces the risk of downtime.

An issue we noticed was that istio-csr would always report as unhealthy until runtime configuration was available. On the face of it, this seems like expected behavior - without a configured issuer, istio-csr can't issue workload certs or provision the istio serving cert / istiod cert. The issue we found was that this causes the Helm install of istio-csr to hang until the runtime configuration ConfigMap was provided, forcing the need to handle runtime configuration then and there.

To make this process simpler, we've made a few Helm chart changes:

  1. It's now possible to pass extraObjects as a Helm value specifying arbitrary resources to create alongside the istio-csr install. This enables creating an issuer during the Helm install, if desired.
  2. There's a new .app.runtimeConfiguration.create value which, if set, will create a runtime configuration ConfigMap with the values specified in app.runtimeConfiguration.issuer.

Health Checks

In addition, we've changed how health checks work for istio-csr with runtime configuration. If using pure runtime configuration (app.certmanager.issuer is blank), the istio-csr health checks will report healthy until runtime configuration is available for the first time. After runtime configuration is first detected, the health checks will return to normal.

Other Fixes

We now also propagate annotations onto the dynamic istiod cert which is used with runtime configuration, and a few roles have been fixed to ensure that installing into different namespaces works as expected.

What's Changed

Istio Ambient Mode

Runtime Configuration

Test Improvements / Other

New Contributors

Full Changelog: v0.11.0...v0.12.0

Contributors

SgtCoDFish, paulwilljones, and 3 other contributors
Assets 3
Loading