feat: Istio upgrade to 1.21

charts/kubezero-istio-gateway/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: kubezero-istio-gateway
 description: KubeZero Umbrella Chart for Istio gateways
 type: application
-version: 0.19.5
+version: 0.21.0
 home: https://kubezero.com
 icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
 keywords:

charts/kubezero-istio-gateway/README.md

@@ -1,6 +1,6 @@
 # kubezero-istio-gateway
 
-![Version: 0.19.4](https://img.shields.io/badge/Version-0.19.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.21.0](https://img.shields.io/badge/Version-0.21.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 KubeZero Umbrella Chart for Istio gateways
 
@@ -21,7 +21,7 @@ Kubernetes: `>= 1.26.0`
 | Repository | Name | Version |
 |------------|------|---------|
 | https://cdn.zero-downtime.net/charts/ | kubezero-lib | >= 0.1.6 |
-| https://istio-release.storage.googleapis.com/charts | gateway | 1.19.4 |
+| https://istio-release.storage.googleapis.com/charts | gateway | 1.21.0 |
 
 ## Values
 
@@ -41,6 +41,8 @@ Kubernetes: `>= 1.26.0`
 | gateway.service.externalTrafficPolicy | string | `"Local"` |  |
 | gateway.service.type | string | `"NodePort"` |  |
 | gateway.terminationGracePeriodSeconds | int | `120` |  |
+| hardening.rejectUnderscoresHeaders | bool | `true` |  |
+| hardening.unescapeSlashes | bool | `true` |  |
 | proxyProtocol | bool | `true` |  |
 | telemetry.enabled | bool | `false` |  |
 

charts/kubezero-istio-gateway/charts/gateway/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 1.19.4
+appVersion: 1.21.0
 description: Helm chart for deploying Istio gateways
 icon: https://istio.io/latest/favicons/android-192x192.png
 keywords:
@@ -9,4 +9,4 @@ name: gateway
 sources:
 - https://github.com/istio/istio
 type: application
-version: 1.19.4
+version: 1.21.0

charts/kubezero-istio-gateway/charts/gateway/README.md

@@ -35,6 +35,28 @@ To view support configuration options and documentation, run:
 helm show values istio/gateway
 ```
 
+### Profiles
+
+Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
+These can be set with `--set profile=<profile>`.
+For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
+
+For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
+
+Explicitly set values have highest priority, then profile settings, then chart defaults.
+
+As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
+When configuring the chart, you should not include this.
+That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
+
+### OpenShift
+
+When deploying the gateway in an OpenShift cluster, use the `openshift` profile to override the default values, for example:
+
+```console
+helm install istio-ingressgateway istio/gateway -- set profile=openshift
+```
+
 ### `image: auto` Information
 
 The image used by the chart, `auto`, may be unintuitive.

charts/kubezero-istio-gateway/charts/gateway/files/profile-ambient.yaml

@@ -0,0 +1,25 @@
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+variant: distroless
+pilot:
+  variant: distroless
+  env:
+    # Setup more secure default that is off in 'default' only for backwards compatibility
+    VERIFY_CERTIFICATE_AT_CLIENT: "true"
+    ENABLE_AUTO_SNI: "true"
+
+    PILOT_ENABLE_HBONE: "true"
+    CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
+    PILOT_ENABLE_AMBIENT_CONTROLLERS: "true"
+cni:
+  logLevel: info
+  privileged: true
+  ambient:
+    enabled: true
+
+  # Default excludes istio-system; its actually fine to redirect there since we opt-out istiod, ztunnel, and istio-cni
+  excludeNamespaces:
+    - kube-system

charts/kubezero-istio-gateway/charts/gateway/files/profile-compatibility-version-1.20.yaml

@@ -0,0 +1,6 @@
+pilot:
+  env:
+    ENABLE_EXTERNAL_NAME_ALIAS: "false"
+    PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
+    VERIFY_CERTIFICATE_AT_CLIENT: "false"
+    ENABLE_AUTO_SNI: "false"

charts/kubezero-istio-gateway/charts/gateway/files/profile-demo.yaml

@@ -0,0 +1,69 @@
+# The demo profile enables a variety of things to try out Istio in non-production environments.
+# * Lower resource utilization.
+# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
+# * More ports enabled on the ingress, which is used in some tasks.
+meshConfig:
+  accessLogFile: /dev/stdout
+  extensionProviders:
+    - name: otel
+      envoyOtelAls:
+        service: opentelemetry-collector.istio-system.svc.cluster.local
+        port: 4317
+    - name: skywalking
+      skywalking:
+        service: tracing.istio-system.svc.cluster.local
+        port: 11800
+    - name: otel-tracing
+      opentelemetry:
+        port: 4317
+        service: opentelemetry-collector.otel-collector.svc.cluster.local
+
+global:
+  proxy:
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+
+pilot:
+  autoscaleEnabled: false
+  traceSampling: 100
+  resources:
+    requests:
+      cpu: 10m
+      memory: 100Mi
+
+gateways:
+  istio-egressgateway:
+    autoscaleEnabled: false
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+  istio-ingressgateway:
+    autoscaleEnabled: false
+    ports:
+    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
+    # Note that AWS ELB will by default perform health checks on the first port
+    # on this list. Setting this to the health check port will ensure that health
+    # checks always work. https://github.com/istio/istio/issues/12503
+    - port: 15021
+      targetPort: 15021
+      name: status-port
+    - port: 80
+      targetPort: 8080
+      name: http2
+    - port: 443
+      targetPort: 8443
+      name: https
+    - port: 31400
+      targetPort: 31400
+      name: tcp
+      # This is the port where sni routing happens
+    - port: 15443
+      targetPort: 15443
+      name: tls
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi

charts/kubezero-istio-gateway/charts/gateway/files/profile-openshift.yaml

@@ -0,0 +1,18 @@
+# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
+# CNI must be installed.
+cni:
+  cniBinDir: /var/lib/cni/bin
+  cniConfDir: /etc/cni/multus/net.d
+  chained: false
+  cniConfFileName: "istio-cni.conf"
+  excludeNamespaces:
+    - istio-system
+    - kube-system
+  logLevel: info
+  privileged: true
+  provider: "multus"
+global:
+  platform: openshift
+istio_cni:
+  enabled: true
+  chained: false

charts/kubezero-istio-gateway/charts/gateway/files/profile-preview.yaml

@@ -0,0 +1,9 @@
+# The preview profile contains features that are experimental.
+# This is intended to explore new features coming to Istio.
+# Stability, security, and performance are not guaranteed - use at your own risk.
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # Enable Istio agent to handle DNS requests for known hosts
+      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
+      ISTIO_META_DNS_CAPTURE: "true"

charts/kubezero-istio-gateway/charts/gateway/templates/deployment.yaml

@@ -46,6 +46,10 @@ spec:
         - name: net.ipv4.ip_unprivileged_port_start
           value: "0"
       {{- end }}
+      {{- with .Values.volumes }}
+      volumes:
+        {{ toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: istio-proxy
           # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
@@ -94,9 +98,9 @@ spec:
             name: http-envoy-prom
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
-          {{- if .Values.volumeMounts }}
+          {{- with .Values.volumeMounts }}
           volumeMounts:
-          {{- toYaml .Values.volumeMounts | nindent 12 }}
+            {{ toYaml . | nindent 12 }}
           {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
@@ -118,7 +122,3 @@ spec:
       {{- with .Values.priorityClassName }}
       priorityClassName: {{ . }}
       {{- end }}
-      {{- with .Values.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}

charts/kubezero-istio-gateway/charts/gateway/templates/hpa.yaml

@@ -28,4 +28,15 @@ spec:
           averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
           type: Utilization
     {{- end }}
+    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+          type: Utilization
+    {{- end }}
+  {{- if .Values.autoscaling.autoscaleBehavior }}
+  behavior: {{ toYaml .Values.autoscaling.autoscaleBehavior | nindent 4 }}
+  {{- end }}
 {{- end }}

charts/kubezero-istio-gateway/charts/gateway/templates/service.yaml

@@ -15,12 +15,19 @@ spec:
 {{- with .Values.service.loadBalancerIP }}
   loadBalancerIP: "{{ . }}"
 {{- end }}
-{{- with .Values.service.ipFamilyPolicy }}
+{{- if eq .Values.service.type "LoadBalancer" }}
-  ipFamilyPolicy: "{{ . }}"
+  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
+  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
+  {{- end }}
 {{- end }}
-{{- with .Values.service.ipFamilies }}
+{{- if .Values.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
+{{- end }}
+{{- if .Values.service.ipFamilies }}
   ipFamilies:
-{{ toYaml . | indent 4 }}
+{{- range .Values.service.ipFamilies }}
+  - {{ . }}
+{{- end }}
 {{- end }}
 {{- with .Values.service.loadBalancerSourceRanges }}
   loadBalancerSourceRanges:

charts/kubezero-istio-gateway/charts/gateway/templates/zzz_profile.yaml

@@ -0,0 +1,34 @@
+{{/*
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- $defaults := $.Values.defaults }}
+{{- $_ := unset $.Values "defaults" }}
+{{- $profile := dict }}
+{{- with .Values.profile }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" $.Values.profile) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}

charts/kubezero-istio-gateway/charts/gateway/values.schema.json

@@ -2,240 +2,300 @@
   "$schema": "http://json-schema.org/schema#",
   "type": "object",
   "additionalProperties": false,
-  "properties": {
+  "$defs": {
-    "global": {
+    "values": {
-      "type": "object"
-    },
-    "affinity": {
-      "type": "object"
-    },
-    "securityContext": {
-      "type": ["object", "null"]
-    },
-    "containerSecurityContext": {
-      "type": ["object", "null"]
-    },
-    "kind":{
-      "type": "string",
-      "enum": ["Deployment", "DaemonSet"]
-    },
-    "annotations": {
-      "additionalProperties": {
-        "type": [
-          "string",
-          "integer"
-        ]
-      },
-      "type": "object"
-    },
-    "autoscaling": {
       "type": "object",
       "properties": {
-        "enabled": {
+        "global": {
-          "type": "boolean"
-        },
-        "maxReplicas": {
-          "type": "integer"
-        },
-        "minReplicas": {
-          "type": "integer"
-        },
-        "targetCPUUtilizationPercentage": {
-          "type": "integer"
-        }
-      }
-    },
-    "env": {
-      "type": "object"
-    },
-    "labels": {
-      "type": "object"
-    },
-    "volumes": {
-      "type": "array"
-    },
-    "volumeMounts": {
-      "type": "array"
-    },
-    "name": {
-      "type": "string"
-    },
-    "nodeSelector": {
-      "type": "object"
-    },
-    "podAnnotations": {
-      "type": "object",
-      "properties": {
-        "inject.istio.io/templates": {
-          "type": "string"
-        },
-        "prometheus.io/path": {
-          "type": "string"
-        },
-        "prometheus.io/port": {
-          "type": "string"
-        },
-        "prometheus.io/scrape": {
-          "type": "string"
-        }
-      }
-    },
-    "replicaCount": {
-      "type": [ "integer", "null" ]
-    },
-    "resources": {
-      "type": "object",
-      "properties": {
-        "limits": {
-          "type": "object",
-          "properties": {
-            "cpu": {
-              "type": "string"
-            },
-            "memory": {
-              "type": "string"
-            }
-          }
-        },
-        "requests": {
-          "type": "object",
-          "properties": {
-            "cpu": {
-              "type": "string"
-            },
-            "memory": {
-              "type": "string"
-            }
-          }
-        }
-      }
-    },
-    "revision": {
-      "type": "string"
-    },
-    "runAsRoot": {
-      "type": "boolean"
-    },
-    "unprivilegedPort": {
-      "type": ["string", "boolean"],
-      "enum": [true, false, "auto"]
-    },
-    "service": {
-      "type": "object",
-      "properties": {
-        "annotations": {
           "type": "object"
         },
-        "externalTrafficPolicy": {
+        "affinity": {
+          "type": "object"
+        },
+        "securityContext": {
+          "type": [
+            "object",
+            "null"
+          ]
+        },
+        "containerSecurityContext": {
+          "type": [
+            "object",
+            "null"
+          ]
+        },
+        "kind": {
+          "type": "string",
+          "enum": [
+            "Deployment",
+            "DaemonSet"
+          ]
+        },
+        "annotations": {
+          "additionalProperties": {
+            "type": [
+              "string",
+              "integer"
+            ]
+          },
+          "type": "object"
+        },
+        "autoscaling": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            },
+            "maxReplicas": {
+              "type": "integer"
+            },
+            "minReplicas": {
+              "type": "integer"
+            },
+            "targetCPUUtilizationPercentage": {
+              "type": "integer"
+            }
+          }
+        },
+        "env": {
+          "type": "object"
+        },
+        "labels": {
+          "type": "object"
+        },
+        "name": {
           "type": "string"
         },
-        "loadBalancerIP": {
+        "nodeSelector": {
+          "type": "object"
+        },
+        "podAnnotations": {
+          "type": "object",
+          "properties": {
+            "inject.istio.io/templates": {
+              "type": "string"
+            },
+            "prometheus.io/path": {
+              "type": "string"
+            },
+            "prometheus.io/port": {
+              "type": "string"
+            },
+            "prometheus.io/scrape": {
+              "type": "string"
+            }
+          }
+        },
+        "replicaCount": {
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "resources": {
+          "type": "object",
+          "properties": {
+            "limits": {
+              "type": "object",
+              "properties": {
+                "cpu": {
+                  "type": "string"
+                },
+                "memory": {
+                  "type": "string"
+                }
+              }
+            },
+            "requests": {
+              "type": "object",
+              "properties": {
+                "cpu": {
+                  "type": "string"
+                },
+                "memory": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "revision": {
           "type": "string"
         },
-        "loadBalancerSourceRanges": {
+        "compatibilityVersion": {
+          "type": "string"
+        },
+        "runAsRoot": {
+          "type": "boolean"
+        },
+        "unprivilegedPort": {
+          "type": [
+            "string",
+            "boolean"
+          ],
+          "enum": [
+            true,
+            false,
+            "auto"
+          ]
+        },
+        "service": {
+          "type": "object",
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "externalTrafficPolicy": {
+              "type": "string"
+            },
+            "loadBalancerIP": {
+              "type": "string"
+            },
+            "loadBalancerSourceRanges": {
+              "type": "array"
+            },
+            "ipFamilies": {
+              "items": {
+                "type": "string",
+                "enum": [
+                  "IPv4",
+                  "IPv6"
+                ]
+              }
+            },
+            "ipFamilyPolicy": {
+              "type": "string",
+              "enum": [
+                "",
+                "SingleStack",
+                "PreferDualStack",
+                "RequireDualStack"
+              ]
+            },
+            "ports": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string"
+                  },
+                  "port": {
+                    "type": "integer"
+                  },
+                  "protocol": {
+                    "type": "string"
+                  },
+                  "targetPort": {
+                    "type": "integer"
+                  }
+                }
+              }
+            },
+            "type": {
+              "type": "string"
+            }
+          }
+        },
+        "serviceAccount": {
+          "type": "object",
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "name": {
+              "type": "string"
+            },
+            "create": {
+              "type": "boolean"
+            }
+          }
+        },
+        "rbac": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            }
+          }
+        },
+        "tolerations": {
           "type": "array"
         },
-        "ipFamilies" : {
+        "topologySpreadConstraints": {
-          "items": {
+          "type": "array"
-            "type": "string",
-            "enum": ["IPv4", "IPv6"]
-        }
         },
-        "ipFamilyPolicy" : {
+        "networkGateway": {
+          "type": "string"
+        },
+        "imagePullPolicy": {
           "type": "string",
-          "enum": ["", "SingleStack", "PreferDualStack", "RequireDualStack"]
+          "enum": [
+            "",
+            "Always",
+            "IfNotPresent",
+            "Never"
+          ]
         },
-        "ports": {
+        "imagePullSecrets": {
           "type": "array",
           "items": {
             "type": "object",
             "properties": {
               "name": {
                 "type": "string"
-              },
-              "port": {
-                "type": "integer"
-              },
-              "protocol": {
-                "type": "string"
-              },
-              "targetPort": {
-                "type": "integer"
               }
             }
           }
         },
-        "type": {
+        "podDisruptionBudget": {
-          "type": "string"
+          "type": "object",
-        }
+          "properties": {
-      }
+            "minAvailable": {
-    },
+              "type": [
-    "serviceAccount": {
+                "integer",
-      "type": "object",
+                "string"
-      "properties": {
+              ]
-        "annotations": {
+            },
-          "type": "object"
+            "maxUnavailable": {
-        },
+              "type": [
-        "name": {
+                "integer",
-          "type": "string"
+                "string"
-        },
+              ]
-        "create": {
+            },
-          "type": "boolean"
+            "unhealthyPodEvictionPolicy": {
-        }
+              "type": "string",
-      }
+              "enum": [
-    },
+                "",
-    "rbac": {
+                "IfHealthyBudget",
-      "type": "object",
+                "AlwaysAllow"
-      "properties": {
+              ]
-        "enabled": {
+            }
-          "type": "boolean"
-        }
-      }
-    },
-    "tolerations": {
-      "type": "array"
-    },
-    "topologySpreadConstraints": {
-      "type": "array"
-    },
-    "networkGateway": {
-      "type": "string"
-    },
-    "imagePullPolicy": {
-      "type": "string",
-      "enum": ["", "Always", "IfNotPresent", "Never"]
-    },
-    "imagePullSecrets": {
-      "type": "array",
-      "items": {
-        "type": "object",
-        "properties": {
-          "name": {
-            "type": "string"
           }
+        },
+        "terminationGracePeriodSeconds": {
+          "type": "number"
+        },
+        "volumes": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "volumeMounts": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "priorityClassName": {
+          "type": "string"
         }
       }
-    },
-    "podDisruptionBudget": {
-      "type": "object",
-      "properties": {
-        "minAvailable": {
-          "type": ["integer", "string"]
-        },
-        "maxUnavailable": {
-          "type": ["integer", "string"]
-        },
-        "unhealthyPodEvictionPolicy": {
-          "type": "string",
-          "enum": ["", "IfHealthyBudget", "AlwaysAllow"]
-        }
-      }
-    },
-    "terminationGracePeriodSeconds": {
-      "type": "number"
-    },
-    "priorityClassName": {
-      "type": "string"
     }
-  }
+  },
+  "defaults": {
+    "$ref": "#/$defs/values"
+  },
+  "$ref": "#/$defs/values"
 }

charts/kubezero-istio-gateway/charts/gateway/values.yaml

@@ -1,139 +1,152 @@
-# Name allows overriding the release name. Generally this should not be set
+defaults:
-name: ""
+  # Name allows overriding the release name. Generally this should not be set
-# revision declares which revision this gateway is a part of
-revision: ""
-
-# Controls the spec.replicas setting for the Gateway deployment if set.
-# Otherwise defaults to Kubernetes Deployment default (1).
-replicaCount:
-
-kind: Deployment
-
-rbac:
-  # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
-  # when using http://gateway-api.org/.
-  enabled: true
-
-serviceAccount:
-  # If set, a service account will be created. Otherwise, the default is used
-  create: true
-  # Annotations to add to the service account
-  annotations: {}
-  # The name of the service account to use.
-  # If not set, the release name is used
   name: ""
+  # revision declares which revision this gateway is a part of
+  revision: ""
 
-podAnnotations:
+  # Controls the spec.replicas setting for the Gateway deployment if set.
-  prometheus.io/port: "15020"
+  # Otherwise defaults to Kubernetes Deployment default (1).
-  prometheus.io/scrape: "true"
+  replicaCount:
-  prometheus.io/path: "/stats/prometheus"
-  inject.istio.io/templates: "gateway"
-  sidecar.istio.io/inject: "true"
 
-# Define the security context for the pod.
+  kind: Deployment
-# If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-# On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-securityContext: ~
-containerSecurityContext: ~
 
-service:
+  rbac:
-  # Type of service. Set to "None" to disable the service entirely
+    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
-  type: LoadBalancer
+    # when using http://gateway-api.org/.
-  ports:
+    enabled: true
-  - name: status-port
+
-    port: 15021
+  serviceAccount:
-    protocol: TCP
+    # If set, a service account will be created. Otherwise, the default is used
-    targetPort: 15021
+    create: true
-  - name: http2
+    # Annotations to add to the service account
-    port: 80
+    annotations: {}
-    protocol: TCP
+    # The name of the service account to use.
-    targetPort: 80
+    # If not set, the release name is used
-  - name: https
+    name: ""
-    port: 443
+
-    protocol: TCP
+  podAnnotations:
-    targetPort: 443
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+    prometheus.io/path: "/stats/prometheus"
+    inject.istio.io/templates: "gateway"
+    sidecar.istio.io/inject: "true"
+
+  # Define the security context for the pod.
+  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+  securityContext: ~
+  containerSecurityContext: ~
+
+  service:
+    # Type of service. Set to "None" to disable the service entirely
+    type: LoadBalancer
+    ports:
+    - name: status-port
+      port: 15021
+      protocol: TCP
+      targetPort: 15021
+    - name: http2
+      port: 80
+      protocol: TCP
+      targetPort: 80
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 443
+    annotations: {}
+    loadBalancerIP: ""
+    loadBalancerSourceRanges: []
+    externalTrafficPolicy: ""
+    externalIPs: []
+    ipFamilyPolicy: ""
+    ipFamilies: []
+    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
+    # allocateLoadBalancerNodePorts: false
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 2000m
+      memory: 1024Mi
+
+  autoscaling:
+    enabled: true
+    minReplicas: 1
+    maxReplicas: 5
+    targetCPUUtilizationPercentage: 80
+    targetMemoryUtilizationPercentage: {}
+    autoscaleBehavior: {}
+
+  # Pod environment variables
+  env: {}
+
+  # Labels to apply to all resources
+  labels: {}
+
+  # Annotations to apply to all resources
   annotations: {}
-  loadBalancerIP: ""
-  loadBalancerSourceRanges: []
-  externalTrafficPolicy: ""
-  externalIPs: []
-  ipFamilyPolicy: ""
-  ipFamilies: []
 
-resources:
+  nodeSelector: {}
-  requests:
-    cpu: 100m
-    memory: 128Mi
-  limits:
-    cpu: 2000m
-    memory: 1024Mi
 
-autoscaling:
+  tolerations: []
-  enabled: true
-  minReplicas: 1
-  maxReplicas: 5
-  targetCPUUtilizationPercentage: 80
 
-# Pod environment variables
+  topologySpreadConstraints: []
-env: {}
 
-# Labels to apply to all resources
+  affinity: {}
-labels: {}
 
-# Annotations to apply to all resources
+  # If specified, the gateway will act as a network gateway for the given network.
-annotations: {}
+  networkGateway: ""
 
-nodeSelector: {}
+  # Specify image pull policy if default behavior isn't desired.
+  # Default behavior: latest images will be Always else IfNotPresent
+  imagePullPolicy: ""
 
-tolerations: []
+  imagePullSecrets: []
 
-topologySpreadConstraints: []
+  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
+  #
+  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
+  # which means that no PodDisruptionBudget resource will be created.
+  #
+  # To enable the PodDisruptionBudget, configure it by specifying the
+  # `minAvailable` or `maxUnavailable`. For example, to set the
+  # minimum number of available replicas to 1, you can update this value as follows:
+  #
+  # podDisruptionBudget:
+  #   minAvailable: 1
+  #
+  # Or, to allow a maximum of 1 unavailable replica, you can set:
+  #
+  # podDisruptionBudget:
+  #   maxUnavailable: 1
+  #
+  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
+  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
+  #
+  # podDisruptionBudget:
+  #   minAvailable: 1
+  #   unhealthyPodEvictionPolicy: AlwaysAllow
+  #
+  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
+  #
+  # podDisruptionBudget: {}
+  #
+  podDisruptionBudget: {}
 
-affinity: {}
+  terminationGracePeriodSeconds: 30
 
-# If specified, the gateway will act as a network gateway for the given network.
+  # A list of `Volumes` added into the Gateway Pods. See
-networkGateway: ""
+  # https://kubernetes.io/docs/concepts/storage/volumes/.
+  volumes: []
 
-# Specify image pull policy if default behavior isn't desired.
+  # A list of `VolumeMounts` added into the Gateway Pods. See
-# Default behavior: latest images will be Always else IfNotPresent
+  # https://kubernetes.io/docs/concepts/storage/volumes/.
-imagePullPolicy: ""
+  volumeMounts: []
 
-imagePullSecrets: []
+  # Configure this to a higher priority class in order to make sure your Istio gateway pods
-
+  # will not be killed because of low priority class.
-# This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
+  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-#
+  # for more detail.
-# By default, the `podDisruptionBudget` is disabled (set to `{}`),
+  priorityClassName: ""
-# which means that no PodDisruptionBudget resource will be created.
-#
-# To enable the PodDisruptionBudget, configure it by specifying the
-# `minAvailable` or `maxUnavailable`. For example, to set the
-# minimum number of available replicas to 1, you can update this value as follows:
-#
-# podDisruptionBudget:
-#   minAvailable: 1
-#
-# Or, to allow a maximum of 1 unavailable replica, you can set:
-#
-# podDisruptionBudget:
-#   maxUnavailable: 1
-#
-# You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
-# For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
-#
-# podDisruptionBudget:
-#   minAvailable: 1
-#   unhealthyPodEvictionPolicy: AlwaysAllow
-#
-# To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
-#
-# podDisruptionBudget: {}
-#
-podDisruptionBudget: {}
-
-terminationGracePeriodSeconds: 30
-
-# Configure this to a higher priority class in order to make sure your Istio gateway pods
-# will not be killed because of low priority class.
-# Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-# for more detail.
-priorityClassName: ""

charts/kubezero-istio-gateway/gateway.patch

@@ -11,25 +11,6 @@ diff -tubr charts/gateway.orig/templates/deployment.yaml charts/gateway/template
    selector:
      matchLabels:
        {{- include "gateway.selectorLabels" . | nindent 6 }}
-@@ -86,6 +90,10 @@
-             name: http-envoy-prom
-           resources:
-             {{- toYaml .Values.resources | nindent 12 }}
-+          {{- if .Values.volumeMounts }}
-+          volumeMounts:
-+          {{- toYaml .Values.volumeMounts | nindent 12 }}
-+          {{- end }}
-       {{- with .Values.nodeSelector }}
-       nodeSelector:
-         {{- toYaml . | nindent 8 }}
-@@ -102,3 +110,7 @@
-       topologySpreadConstraints:
-         {{- toYaml . | nindent 8 }}
-       {{- end }}
-+      {{- with .Values.volumes }}
-+      volumes:
-+        {{- toYaml . | nindent 8 }}
-+      {{- end }}
 diff -tubr charts/gateway.orig/templates/service.yaml charts/gateway/templates/service.yaml
 --- charts/gateway.orig/templates/service.yaml	2022-12-09 14:58:33.000000000 +0000
 +++ charts/gateway/templates/service.yaml	2022-12-12 22:52:27.629670669 +0000
@@ -49,19 +30,3 @@ diff -tubr charts/gateway.orig/templates/service.yaml charts/gateway/templates/s
  {{- end }}
  {{- if .Values.service.externalIPs }}
    externalIPs: {{- range .Values.service.externalIPs }}
-diff -tubr charts/gateway.orig/values.schema.json charts/gateway/values.schema.json
---- charts/gateway.orig/values.schema.json	2022-12-09 14:58:33.000000000 +0000
-+++ charts/gateway/values.schema.json	2022-12-12 22:52:27.629670669 +0000
-@@ -51,6 +51,12 @@
-     "labels": {
-       "type": "object"
-     },
-+    "volumes": {
-+      "type": "array"
-+    },
-+    "volumeMounts": {
-+      "type": "array"
-+    },
-     "name": {
-       "type": "string"
-     },

charts/kubezero-istio/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: kubezero-istio
 description: KubeZero Umbrella Chart for Istio
 type: application
-version: 0.19.5
+version: 0.21.0
 home: https://kubezero.com
 icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
 keywords:

charts/kubezero-istio/README.md

@@ -1,6 +1,6 @@
 # kubezero-istio
 
-![Version: 0.19.4](https://img.shields.io/badge/Version-0.19.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.21.0](https://img.shields.io/badge/Version-0.21.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 KubeZero Umbrella Chart for Istio
 
@@ -21,9 +21,9 @@ Kubernetes: `>= 1.26.0`
 | Repository | Name | Version |
 |------------|------|---------|
 | https://cdn.zero-downtime.net/charts/ | kubezero-lib | >= 0.1.6 |
-| https://istio-release.storage.googleapis.com/charts | base | 1.19.4 |
+| https://istio-release.storage.googleapis.com/charts | base | 1.21.0 |
-| https://istio-release.storage.googleapis.com/charts | istiod | 1.19.4 |
+| https://istio-release.storage.googleapis.com/charts | istiod | 1.21.0 |
-| https://kiali.org/helm-charts | kiali-server | 1.76.0 |
+| https://kiali.org/helm-charts | kiali-server | 1.82.0 |
 
 ## Values
 

charts/kubezero-istio/dashboards.yaml

@@ -5,18 +5,18 @@ folder: Istio
 condition: '.Values.istiod.telemetry.enabled'
 dashboards:
 - name: istio-control-plane
-  url: https://grafana.com/api/dashboards/7645/revisions/187/download
+  url: https://grafana.com/api/dashboards/7645/revisions/201/download
   tags:
   - Istio
 - name: istio-mesh
-  url: https://grafana.com/api/dashboards/7639/revisions/187/download
+  url: https://grafana.com/api/dashboards/7639/revisions/201/download
   tags:
   - Istio
 - name: istio-service
-  url: https://grafana.com/api/dashboards/7636/revisions/187/download
+  url: https://grafana.com/api/dashboards/7636/revisions/201/download
   tags:
   - Istio
 - name: istio-workload
-  url: https://grafana.com/api/dashboards/7630/revisions/187/download
+  url: https://grafana.com/api/dashboards/7630/revisions/201/download
   tags:
   - Istio

charts/kubezero/values.yaml

@@ -58,13 +58,13 @@ storage:
 istio:
   enabled: false
   namespace: istio-system
-  targetRevision: 0.19.4
+  targetRevision: 0.21.0
 
 istio-ingress:
   enabled: false
   chart: kubezero-istio-gateway
   namespace: istio-ingress
-  targetRevision: 0.19.4
+  targetRevision: 0.21.0
   gateway:
     service: {}
 
@@ -72,7 +72,7 @@ istio-private-ingress:
   enabled: false
   chart: kubezero-istio-gateway
   namespace: istio-ingress
-  targetRevision: 0.19.4
+  targetRevision: 0.21.0
   gateway:
     service: {}