release 0.7.0 (#243)

helm/core/templates/configmap.yaml

@@ -15,7 +15,7 @@
     # When processing a leaf namespace Istio will search for declarations in that namespace first
     # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
     # is processed as if it were declared in the leaf namespace.
-    {{- if .Values.global.enableMesh }}
+    {{- if .Values.global.enableHigressIstio }}
     rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
     {{- else }}
     rootNamespace: {{ .Release.Namespace }}
@@ -23,6 +23,9 @@
 
     configSources:
       - address: "xds://127.0.0.1:15051"
+    {{- if .Values.global.enableIstioAPI }}
+      - address: "k8s://"
+    {{- end }}
 
     defaultConfig:
       {{- if .Values.global.meshID }}
@@ -74,7 +77,7 @@
       discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
       {{- end }}
       {{- else }}
-      {{- if .Values.global.enableMesh }}
+      {{- if .Values.global.enableHigressIstio }}
       discoveryAddress: {{ printf "istiod.%s.svc" .Values.global.istioNamespace }}:15012
       {{- else }}
       discoveryAddress: higress-controller.{{.Release.Namespace}}.svc:15012

helm/core/templates/controller-clusterrole.yaml

@@ -106,3 +106,10 @@ rules:
   - apiGroups: ["admissionregistration.k8s.io"]
     resources: ["validatingwebhookconfigurations"]
     verbs: ["get", "list", "watch", "update"]
+
+  # istio configuration
+  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
+  # please proceed with caution
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["get", "watch", "list"]
+    resources: ["*"]

helm/core/templates/controller-deployment.yaml

@@ -28,7 +28,7 @@ spec:
       securityContext:
         {{- toYaml .Values.controller.podSecurityContext | nindent 8 }}
       containers:
-{{- if not .Values.global.enableMesh }}
+{{- if not .Values.global.enableHigressIstio }}
         - name: discovery
 {{- if contains "/" .Values.pilot.image }}
           image: "{{ .Values.pilot.image }}"
@@ -120,7 +120,11 @@ spec:
             value: "{{ .Values.global.istiod.enableAnalysis }}"
           - name: CLUSTER_ID
             value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
-          {{- if not .Values.global.enableMesh }}
+          {{- if .Values.global.enableIstioAPI }}
+          - name: HIGRESS_ENABLE_ISTIO_API
+            value: "true"
+          {{- end }}
+          {{- if not .Values.global.enableHigressIstio }}
           - name: CUSTOM_CA_CERT_NAME
             value: "higress-ca-root-cert"
           {{- end }}
@@ -228,7 +232,7 @@ spec:
       volumes:
       - name: log
         emptyDir: {}
-      {{- if not .Values.global.enableMesh }}
+      {{- if not .Values.global.enableHigressIstio }}
       - name: config
         configMap:
           name: higress-config

helm/core/templates/controller-service.yaml

@@ -8,7 +8,7 @@ spec:
   type: {{ .Values.controller.service.type }}
   ports:
     {{- toYaml .Values.controller.ports | nindent 4 }}
-    {{- if not .Values.global.enableMesh }}
+    {{- if not .Values.global.enableHigressIstio }}
     - port: 15010
       name: grpc-xds # plaintext
       protocol: TCP

helm/core/templates/deployment.yaml

@@ -29,8 +29,8 @@ spec:
   template:
     metadata:
       annotations:
-      {{- if .Values.global.enableMesh }}
-        "enableMesh": "true"
+      {{- if .Values.global.enableHigressIstio }}
+        "enableHigressIstio": "true"
       {{- end }}
       {{- if .Values.gateway.podAnnotations }}
         {{- toYaml .Values.gateway.podAnnotations | nindent 8 }}
@@ -224,7 +224,7 @@ spec:
       {{- end }}
       - name: istio-ca-root-cert
         configMap:
-      {{- if .Values.global.enableMesh }}
+      {{- if .Values.global.enableHigressIstio }}
           name: istio-ca-root-cert
       {{- else }}
           name: higress-ca-root-cert