Ingress and Egress gateways issue during upgrade

1

Hi,

I have another issue with istioctl upgrade. My manifest starts with the following lines:

$ head -9 pawel-default.yaml
apiVersion: operator.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: default
  tag: 1.5.1

  components:
    ingressGateways: []
    egressGateways: []

And when I call istioctl upgrade command I get the information, that ingress and egress gateways will be updated:

$ istioctl upgrade --filename pawel-debug-istiooperator.yaml --filename profiles/pawel-default.yaml
Control Plane - pilot pod - istiod-78d5d88d9b-7tvhg - version: 1.5.1
Control Plane - pilot pod - istiod-78d5d88d9b-pm9kz - version: 1.5.1
Control Plane - pilot pod - istiod-78d5d88d9b-qsjzv - version: 1.5.1

Upgrade version check passed: 1.5.1 -> 1.5.1.

Upgrade check: Warning!!! The following IOPS will be changed as part of upgrade. Please double check they are correct:
components:
  egressGateways:
    '[0->?]': map[enabled:false k8s:map[env:[map[name:ISTIO_META_ROUTER_MODE value:sni-dnat]]
      hpaSpec:map[maxReplicas:5 metrics:[map[resource:map[name:cpu targetAverageUtilization:80]
      type:Resource]] minReplicas:1 scaleTargetRef:map[apiVersion:apps/v1 kind:Deployment
      name:istio-egressgateway]] resources:map[limits:map[cpu:2000m memory:1024Mi]
      requests:map[cpu:100m memory:128Mi]] service:map[ports:[map[name:http2 port:80]
      map[name:https port:443] map[name:tls port:15443 targetPort:15443]]] strategy:map[rollingUpdate:map[maxSurge:100%
      maxUnavailable:25%]]] name:istio-egressgateway] ->
  ingressGateways:
    '[0->?]': map[enabled:true k8s:map[env:[map[name:ISTIO_META_ROUTER_MODE value:sni-dnat]]
      hpaSpec:map[maxReplicas:5 metrics:[map[resource:map[name:cpu targetAverageUtilization:80]
      type:Resource]] minReplicas:1 scaleTargetRef:map[apiVersion:apps/v1 kind:Deployment
      name:istio-ingressgateway]] resources:map[limits:map[cpu:2000m memory:1024Mi]
      requests:map[cpu:100m memory:128Mi]] service:map[ports:[map[name:status-port
      port:15020 targetPort:15020] map[name:http2 port:80 targetPort:80] map[name:https
      port:443] map[name:kiali port:15029 targetPort:15029] map[name:prometheus port:15030
      targetPort:15030] map[name:grafana port:15031 targetPort:15031] map[name:tracing
      port:15032 targetPort:15032] map[name:tls port:15443 targetPort:15443] map[name:tcp
      port:31400]]] strategy:map[rollingUpdate:map[maxSurge:100% maxUnavailable:25%]]]
      name:istio-ingressgateway] ->
  pilot:
    k8s:
      hpaSpec: -> map[minReplicas:3]
installPackagePath: /var/folders/3d/w7ht3mfn4_lfqscjdwc6j9lm0000gp/T/istio-install-packages/istio-1.5.1/install/kubernetes/operator/charts
  ->

Confirm to proceed [y/N]?
2

Hi Pawel, this is just alerting you to the fact that default values are changing for your install.
In this case I’m not sure why the whole map is being changed it looks like the entire ingress and egress value set is changing in your case which doesn’t look right.
We probably need to make the output better to be able to make sense of it.
I’ve created https://github.com/istio/istio/issues/23177 to track it.
Martin

3

Hi @ostromart, any update of this? The issue still exists in 1.6.2:

$ istioctl upgrade -f pawel-debug-istiooperator.yaml -f profiles/karhoo-default.yaml --dry-run
2020-06-17T12:05:18.347045Z	info	proto: tag has too few fields: "-"
Control Plane - pilot pod - istiod-5f565b6fcd-2nb7n - version: 1.6.2
Control Plane - pilot pod - istiod-5f565b6fcd-zfgcb - version: 1.6.2
Control Plane - pilot pod - istiod-5f565b6fcd-zkzmb - version: 1.6.2

addonComponents:
  kiali:
    k8s:
      resources: -> map[requests:map[cpu:200m]]
  prometheus:
    enabled: true -> false
components:
  egressGateways:
    '[0->?]': map[enabled:false k8s:map[env:[map[name:ISTIO_META_ROUTER_MODE value:sni-dnat]]
      hpaSpec:map[maxReplicas:5 metrics:[map[resource:map[name:cpu targetAverageUtilization:80]
      type:Resource]] minReplicas:1 scaleTargetRef:map[apiVersion:apps/v1 kind:Deployment
      name:istio-egressgateway]] resources:map[limits:map[cpu:2000m memory:1024Mi]
      requests:map[cpu:100m memory:128Mi]] service:map[ports:[map[name:http2 port:80]
      map[name:https port:443] map[name:tls port:15443 targetPort:15443]]] strategy:map[rollingUpdate:map[maxSurge:100%
      maxUnavailable:25%]]] name:istio-egressgateway] ->
  ingressGateways:
    '[0->?]': map[enabled:true k8s:map[env:[map[name:ISTIO_META_ROUTER_MODE value:sni-dnat]]
      hpaSpec:map[maxReplicas:5 metrics:[map[resource:map[name:cpu targetAverageUtilization:80]
      type:Resource]] minReplicas:1 scaleTargetRef:map[apiVersion:apps/v1 kind:Deployment
      name:istio-ingressgateway]] resources:map[limits:map[cpu:2000m memory:1024Mi]
      requests:map[cpu:100m memory:128Mi]] service:map[ports:[map[name:status-port
      port:15021 targetPort:15021] map[name:http2 port:80 targetPort:8080] map[name:https
      port:443 targetPort:8443] map[name:tls port:15443 targetPort:15443]]] strategy:map[rollingUpdate:map[maxSurge:100%
      maxUnavailable:25%]]] name:istio-ingressgateway] ->
...

Thank you in advance.

Cheers,
Pawel

4

It’s on Tao’s plate - please ping him on the issue using an @ to get some attention.