release 0.7.0 (#243)

helm/core/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 0.6.2
+appVersion: 0.7.0
 description: Helm chart for deploying higress gateways
 icon: https://higress.io/img/higress_logo_small.png
 keywords:
@@ -9,4 +9,4 @@ name: higress-core
 sources:
 - http://github.com/alibaba/higress
 type: application
-version: 0.6.2
+version: 0.7.0

helm/core/templates/configmap.yaml

@@ -15,7 +15,7 @@
     # When processing a leaf namespace Istio will search for declarations in that namespace first
     # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
     # is processed as if it were declared in the leaf namespace.
-    {{- if .Values.global.enableMesh }}
+    {{- if .Values.global.enableHigressIstio }}
     rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
     {{- else }}
     rootNamespace: {{ .Release.Namespace }}
@@ -23,6 +23,9 @@
 
     configSources:
       - address: "xds://127.0.0.1:15051"
+    {{- if .Values.global.enableIstioAPI }}
+      - address: "k8s://"
+    {{- end }}
 
     defaultConfig:
       {{- if .Values.global.meshID }}
@@ -74,7 +77,7 @@
       discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
       {{- end }}
       {{- else }}
-      {{- if .Values.global.enableMesh }}
+      {{- if .Values.global.enableHigressIstio }}
       discoveryAddress: {{ printf "istiod.%s.svc" .Values.global.istioNamespace }}:15012
       {{- else }}
       discoveryAddress: higress-controller.{{.Release.Namespace}}.svc:15012

helm/core/templates/controller-clusterrole.yaml

@@ -106,3 +106,10 @@ rules:
   - apiGroups: ["admissionregistration.k8s.io"]
     resources: ["validatingwebhookconfigurations"]
     verbs: ["get", "list", "watch", "update"]
+
+  # istio configuration
+  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
+  # please proceed with caution
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["get", "watch", "list"]
+    resources: ["*"]

helm/core/templates/controller-deployment.yaml

@@ -28,7 +28,7 @@ spec:
       securityContext:
         {{- toYaml .Values.controller.podSecurityContext | nindent 8 }}
       containers:
-{{- if not .Values.global.enableMesh }}
+{{- if not .Values.global.enableHigressIstio }}
         - name: discovery
 {{- if contains "/" .Values.pilot.image }}
           image: "{{ .Values.pilot.image }}"
@@ -120,7 +120,11 @@ spec:
             value: "{{ .Values.global.istiod.enableAnalysis }}"
           - name: CLUSTER_ID
             value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
-          {{- if not .Values.global.enableMesh }}
+          {{- if .Values.global.enableIstioAPI }}
+          - name: HIGRESS_ENABLE_ISTIO_API
+            value: "true"
+          {{- end }}
+          {{- if not .Values.global.enableHigressIstio }}
           - name: CUSTOM_CA_CERT_NAME
             value: "higress-ca-root-cert"
           {{- end }}
@@ -228,7 +232,7 @@ spec:
       volumes:
       - name: log
         emptyDir: {}
-      {{- if not .Values.global.enableMesh }}
+      {{- if not .Values.global.enableHigressIstio }}
       - name: config
         configMap:
           name: higress-config

helm/core/templates/controller-service.yaml

@@ -8,7 +8,7 @@ spec:
   type: {{ .Values.controller.service.type }}
   ports:
     {{- toYaml .Values.controller.ports | nindent 4 }}
-    {{- if not .Values.global.enableMesh }}
+    {{- if not .Values.global.enableHigressIstio }}
     - port: 15010
       name: grpc-xds # plaintext
       protocol: TCP

helm/core/templates/deployment.yaml

@@ -29,8 +29,8 @@ spec:
   template:
     metadata:
       annotations:
-      {{- if .Values.global.enableMesh }}
-        "enableMesh": "true"
+      {{- if .Values.global.enableHigressIstio }}
+        "enableHigressIstio": "true"
       {{- end }}
       {{- if .Values.gateway.podAnnotations }}
         {{- toYaml .Values.gateway.podAnnotations | nindent 8 }}
@@ -224,7 +224,7 @@ spec:
       {{- end }}
       - name: istio-ca-root-cert
         configMap:
-      {{- if .Values.global.enableMesh }}
+      {{- if .Values.global.enableHigressIstio }}
           name: istio-ca-root-cert
       {{- else }}
           name: higress-ca-root-cert

helm/core/values.yaml

@@ -4,7 +4,9 @@ global:
   # for internal usage only, not to be configured by users.
   autoscalingv2API: true
   kind: false
-  enableMesh: false
+  enableIstioAPI: false
+  # Deprecated
+  enableHigressIstio: false
   # Used to locate istiod.
   istioNamespace: istio-system
   # enable pod disruption budget for the control plane, which is used to
@@ -31,7 +33,7 @@ global:
   # Dev builds from prow are on gcr.io
   hub: higress-registry.cn-hangzhou.cr.aliyuncs.com/higress
   # Default tag for Istio images.
-  tag: 0.6.1
+  tag: 0.7.0
 
   # Specify image pull policy if default behavior isn't desired.
   # Default behavior: latest images will be Always else IfNotPresent.
@@ -365,7 +367,7 @@ gateway:
   name: "higress-gateway"
   replicas: 2
   image: gateway
-  tag: "0.6.2"
+  tag: "0.7.0"
   # revision declares which revision this gateway is a part of
   revision: ""
 
@@ -453,7 +455,7 @@ controller:
   name: "higress-controller"
   replicas: 1
   image: higress
-  tag: "0.6.1"
+  tag: "0.7.0"
   env: {}
 
   labels: {}
@@ -543,7 +545,7 @@ pilot:
   rollingMaxUnavailable: 25%
 
   hub: higress-registry.cn-hangzhou.cr.aliyuncs.com/higress
-  tag: 0.6.1
+  tag: 0.7.0
 
   # Can be a full hub/image:tag
   image: pilot
@@ -609,4 +611,4 @@ pilot:
 enableSkywalking: false
 Skywalking:
   address: "skywalking-oap.higress-system.svc"
-  port: 11800
+  port: 11800