Uploaded image for project: 'OpenShift Service Mesh'
  1. OpenShift Service Mesh
  2. OSSM-9101

Update OSSM to Istio 1.26

XMLWordPrintable

    • Update OSSM to Istio 1.26
    • False
    • Hide

      None

      Show
      None
    • False
    • Documentation (Ref Guide, User Guide, etc.), Release Notes, Migration
    • In Progress
    • 0% To Do, 14% In Progress, 86% Done
    • Hide
      This release introduces support for Kubernetes traffic distribution feature, part of the Kubernetes Service API, within OpenShift Service Mesh. As of OpenShift Container Platform 4.19, this is a beta feature and requires enabling the ServiceTrafficDistribution feature.

      This release introduces developer preview support for the experimental Kubernetes ClusterTrustBundle feature, which provides a new way of distributing X.509 trust anchors (root certificates) to workloads within the cluster. As of OpenShift Container Platform 4.19, this is an Alpha feature and requires enabling the ClusterTrustBundle feature.

      This release deprecates the use of ISTIO_META_DNS_AUTO_ALLOCATE in proxyMetadata in favor of a newer version of DNS auto-allocation label on the ServiceEntry.
      Show
      This release introduces support for Kubernetes traffic distribution feature, part of the Kubernetes Service API, within OpenShift Service Mesh. As of OpenShift Container Platform 4.19, this is a beta feature and requires enabling the ServiceTrafficDistribution feature. This release introduces developer preview support for the experimental Kubernetes ClusterTrustBundle feature, which provides a new way of distributing X.509 trust anchors (root certificates) to workloads within the cluster. As of OpenShift Container Platform 4.19, this is an Alpha feature and requires enabling the ClusterTrustBundle feature. This release deprecates the use of ISTIO_META_DNS_AUTO_ALLOCATE in proxyMetadata in favor of a newer version of DNS auto-allocation label on the ServiceEntry.

      Goal:

      Update OSSM to latest version of Istio (currently 1.26).

      Acceptance Criteria:

      • All OSSM components (Sail-operator, Istio, Envoy, Kiali, Docs, QE) are updated to support the new version of Istio
      • All unit and integration tests pass on all platforms.
      • Release notes to note any new features that will not be GA in OSSM (Specify text in the release notes field)
      • Feature support table is updated to reflect any changes in support status
      • Issues are created for any new features that require:
        • Additional QE tests (upstream or downstream)
        • Additional documentation (beyond release notes or feature support)
      • Istio Proxy container is based on UBI9 minimal (instead of RHEL ELS minimal)

      Open questions:

      • Should we update the BoringSSL compatibility layer to OpenSSL 3.2?
        • No - the RHEL team has given assurances that all versions of OpenSSL in RHEL 9.x will be backward compatible with binaries built against OpenSSL 3.0.
      • Should we update repos to track main and then branch when 1.26 is released?

              rh-ee-yannliu Yann Liu
              rcernich1 Rob Cernich
              Cameron Garrison, Dario Cillerai, Yann Liu, Zuzana Miklánková
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: