Feat: upgrade istio from 1.19.5 to 1.27.1 (#3066)

2026-05-27 14:17:27 +08:00 · 2025-11-20 14:43:30 +08:00
parent 7dfc42fd92
commit b2b4f72775
173 changed files with 25684 additions and 4741 deletions
--- a/pkg/ingress/kube/gateway/istio/testdata/invalid.status.yaml.golden
+++ b/pkg/ingress/kube/gateway/istio/testdata/invalid.status.yaml.golden
@@ -3,7 +3,6 @@ kind: GatewayClass
 metadata:
  creationTimestamp: null
  name: higress
-  namespace: default
 spec: null
 status:
  conditions:
@@ -22,8 +21,8 @@ metadata:
 spec: null
 status:
  addresses:
-  - type: IPAddress
-    value: 1.2.3.4
+  - type: Hostname
+    value: higress-gateway.higress-system.svc.domain.suffix
  conditions:
  - lastTransitionTime: fake
    message: Resource accepted
@@ -62,6 +61,165 @@ status:
    supportedKinds:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
+    - group: gateway.networking.k8s.io
+      kind: GRPCRoute
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: Gateway
+metadata:
+  creationTimestamp: null
+  name: invalid-cert-kind
+  namespace: higress-system
+spec: null
+status:
+  addresses:
+  - type: Hostname
+    value: higress-gateway.higress-system.svc.domain.suffix
+  conditions:
+  - lastTransitionTime: fake
+    message: Resource accepted
+    reason: Accepted
+    status: "True"
+    type: Accepted
+  - lastTransitionTime: fake
+    message: Resource programmed, assigned to service(s) higress-gateway.higress-system.svc.domain.suffix:34000
+    reason: Programmed
+    status: "True"
+    type: Programmed
+  listeners:
+  - attachedRoutes: 0
+    conditions:
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: Accepted
+      status: "True"
+      type: Accepted
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: NoConflicts
+      status: "False"
+      type: Conflicted
+    - lastTransitionTime: fake
+      message: Bad TLS configuration
+      reason: Invalid
+      status: "False"
+      type: Programmed
+    - lastTransitionTime: fake
+      message: invalid certificate reference core/unknown/my-cert-http., only secret
+        is allowed
+      reason: InvalidCertificateRef
+      status: "False"
+      type: ResolvedRefs
+    name: default
+    supportedKinds:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+    - group: gateway.networking.k8s.io
+      kind: GRPCRoute
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: Gateway
+metadata:
+  creationTimestamp: null
+  name: invalid-cert-malformed
+  namespace: higress-system
+spec: null
+status:
+  conditions:
+  - lastTransitionTime: fake
+    message: Resource accepted
+    reason: Accepted
+    status: "True"
+    type: Accepted
+  - lastTransitionTime: fake
+    message: 'Failed to assign to any requested addresses: no instances found for
+      hostname "higress-gateway.higress-system.svc.domain.suffix"'
+    reason: Invalid
+    status: "False"
+    type: Programmed
+  listeners:
+  - attachedRoutes: 0
+    conditions:
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: Accepted
+      status: "True"
+      type: Accepted
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: NoConflicts
+      status: "False"
+      type: Conflicted
+    - lastTransitionTime: fake
+      message: Bad TLS configuration
+      reason: Invalid
+      status: "False"
+      type: Programmed
+    - lastTransitionTime: fake
+      message: 'invalid certificate reference /Secret/malformed., the certificate
+        is malformed: tls: failed to find any PEM data in certificate input'
+      reason: InvalidCertificateRef
+      status: "False"
+      type: ResolvedRefs
+    name: default
+    supportedKinds:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+    - group: gateway.networking.k8s.io
+      kind: GRPCRoute
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: Gateway
+metadata:
+  creationTimestamp: null
+  name: invalid-cert-notfound
+  namespace: higress-system
+spec: null
+status:
+  addresses:
+  - type: Hostname
+    value: higress-gateway.higress-system.svc.domain.suffix
+  conditions:
+  - lastTransitionTime: fake
+    message: Resource accepted
+    reason: Accepted
+    status: "True"
+    type: Accepted
+  - lastTransitionTime: fake
+    message: Resource programmed, assigned to service(s) higress-gateway.higress-system.svc.domain.suffix:34001
+    reason: Programmed
+    status: "True"
+    type: Programmed
+  listeners:
+  - attachedRoutes: 0
+    conditions:
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: Accepted
+      status: "True"
+      type: Accepted
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: NoConflicts
+      status: "False"
+      type: Conflicted
+    - lastTransitionTime: fake
+      message: Bad TLS configuration
+      reason: Invalid
+      status: "False"
+      type: Programmed
+    - lastTransitionTime: fake
+      message: invalid certificate reference /Secret/nonexistent., secret higress-system/nonexistent
+        not found
+      reason: InvalidCertificateRef
+      status: "False"
+      type: ResolvedRefs
+    name: default
+    supportedKinds:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+    - group: gateway.networking.k8s.io
+      kind: GRPCRoute
 ---
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: Gateway
@@ -110,6 +268,54 @@ status:
    supportedKinds:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
+    - group: gateway.networking.k8s.io
+      kind: GRPCRoute
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: Gateway
+metadata:
+  creationTimestamp: null
+  name: protocol-lower-case
+  namespace: higress-system
+spec: null
+status:
+  conditions:
+  - lastTransitionTime: fake
+    message: Resource accepted
+    reason: Accepted
+    status: "True"
+    type: Accepted
+  - lastTransitionTime: fake
+    message: 'Failed to assign to any requested addresses: no instances found for
+      hostname "higress-gateway.higress-system.svc.cluster.local"'
+    reason: Invalid
+    status: "False"
+    type: Programmed
+  listeners:
+  - attachedRoutes: 0
+    conditions:
+    - lastTransitionTime: fake
+      message: 'protocol "http" is unsupported. hint: "HTTP" (uppercase) may be supported'
+      reason: UnsupportedProtocol
+      status: "False"
+      type: Accepted
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: NoConflicts
+      status: "False"
+      type: Conflicted
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: Programmed
+      status: "True"
+      type: Programmed
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: ResolvedRefs
+      status: "True"
+      type: ResolvedRefs
+    name: http
+    supportedKinds: []
 ---
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: Gateway
@@ -126,9 +332,8 @@ status:
    status: "True"
    type: Accepted
  - lastTransitionTime: fake
-    message: 'Failed to assign to any requested addresses: port 8080 not found for
-      hostname "higress-gateway.higress-system.svc.domain.suffix" (hint: the service
-      port should be specified, not the workload port'
+    message: 'Failed to assign to any requested addresses: no instances found for
+      hostname "higress-gateway.higress-system.svc.domain.suffix"'
    reason: Invalid
    status: "False"
    type: Programmed
@@ -159,12 +364,14 @@ status:
    supportedKinds:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
+    - group: gateway.networking.k8s.io
+      kind: GRPCRoute
 ---
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: Gateway
 metadata:
  creationTimestamp: null
-  name: invalid-cert-kind
+  name: udp-protocol
  namespace: higress-system
 spec: null
 status:
@@ -175,9 +382,102 @@ status:
    status: "True"
    type: Accepted
  - lastTransitionTime: fake
-    message: Resource programmed
-    reason: Programmed
+    message: 'Failed to assign to any requested addresses: no instances found for
+      hostname "higress-gateway.higress-system.svc.cluster.local"'
+    reason: Invalid
+    status: "False"
+    type: Programmed
+  listeners:
+  - attachedRoutes: 0
+    conditions:
+    - lastTransitionTime: fake
+      message: protocol "UDP" is unsupported
+      reason: UnsupportedProtocol
+      status: "False"
+      type: Accepted
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: NoConflicts
+      status: "False"
+      type: Conflicted
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: Programmed
+      status: "True"
+      type: Programmed
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: ResolvedRefs
+      status: "True"
+      type: ResolvedRefs
+    name: udp
+    supportedKinds: []
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: Gateway
+metadata:
+  creationTimestamp: null
+  name: unknown-protocol
+  namespace: higress-system
+spec: null
+status:
+  conditions:
+  - lastTransitionTime: fake
+    message: Resource accepted
+    reason: Accepted
    status: "True"
+    type: Accepted
+  - lastTransitionTime: fake
+    message: 'Failed to assign to any requested addresses: no instances found for
+      hostname "higress-gateway.higress-system.svc.cluster.local"'
+    reason: Invalid
+    status: "False"
+    type: Programmed
+  listeners:
+  - attachedRoutes: 0
+    conditions:
+    - lastTransitionTime: fake
+      message: protocol "unknown" is unsupported
+      reason: UnsupportedProtocol
+      status: "False"
+      type: Accepted
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: NoConflicts
+      status: "False"
+      type: Conflicted
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: Programmed
+      status: "True"
+      type: Programmed
+    - lastTransitionTime: fake
+      message: No errors found
+      reason: ResolvedRefs
+      status: "True"
+      type: ResolvedRefs
+    name: unknown
+    supportedKinds: []
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: Gateway
+metadata:
+  creationTimestamp: null
+  name: invalid-gateway-address
+  namespace: invalid-gateway-address
+spec: null
+status:
+  conditions:
+  - lastTransitionTime: fake
+    message: Resource accepted
+    reason: Accepted
+    status: "True"
+    type: Accepted
+  - lastTransitionTime: fake
+    message: 'Failed to assign to any requested addresses: hostname "higress-gateway.higress-system.svc.cluster.local"
+      not found'
+    reason: Invalid
+    status: "False"
    type: Programmed
  listeners:
  - attachedRoutes: 0
@@ -198,111 +498,42 @@ status:
      status: "True"
      type: Programmed
    - lastTransitionTime: fake
-      message: invalid certificate reference core/unknown/my-cert-http., only secret
-        is allowed
-      reason: InvalidCertificateRef
-      status: "False"
+      message: No errors found
+      reason: ResolvedRefs
+      status: "True"
      type: ResolvedRefs
    name: default
    supportedKinds:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
+    - group: gateway.networking.k8s.io
+      kind: GRPCRoute
 ---
 apiVersion: gateway.networking.k8s.io/v1beta1
-kind: Gateway
+kind: HTTPRoute
 metadata:
  creationTimestamp: null
-  name: invalid-cert-notfound
-  namespace: higress-system
+  name: invalid-backendRef-hostname
+  namespace: default
 spec: null
 status:
-  conditions:
-  - lastTransitionTime: fake
-    message: Resource accepted
-    reason: Accepted
-    status: "True"
-    type: Accepted
-  - lastTransitionTime: fake
-    message: Resource programmed
-    reason: Programmed
-    status: "True"
-    type: Programmed
-  listeners:
-  - attachedRoutes: 0
-    conditions:
+  parents:
+  - conditions:
    - lastTransitionTime: fake
-      message: No errors found
+      message: Route was valid
      reason: Accepted
      status: "True"
      type: Accepted
    - lastTransitionTime: fake
-      message: No errors found
-      reason: NoConflicts
-      status: "False"
-      type: Conflicted
-    - lastTransitionTime: fake
-      message: No errors found
-      reason: Programmed
-      status: "True"
-      type: Programmed
-    - lastTransitionTime: fake
-      message: invalid certificate reference /Secret/nonexistent., secret higress-system/nonexistent
-        not found
-      reason: InvalidCertificateRef
+      message: backend(unknown.example.com) not found
+      reason: BackendNotFound
      status: "False"
      type: ResolvedRefs
-    name: default
-    supportedKinds:
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
---
-apiVersion: gateway.networking.k8s.io/v1beta1
-kind: Gateway
-metadata:
-  creationTimestamp: null
-  name: invalid-cert-malformed
-  namespace: higress-system
-spec: null
-status:
-  conditions:
-  - lastTransitionTime: fake
-    message: Resource accepted
-    reason: Accepted
-    status: "True"
-    type: Accepted
-  - lastTransitionTime: fake
-    message: Resource programmed
-    reason: Programmed
-    status: "True"
-    type: Programmed
-  listeners:
-  - attachedRoutes: 0
-    conditions:
-    - lastTransitionTime: fake
-      message: No errors found
-      reason: Accepted
-      status: "True"
-      type: Accepted
-    - lastTransitionTime: fake
-      message: No errors found
-      reason: NoConflicts
-      status: "False"
-      type: Conflicted
-    - lastTransitionTime: fake
-      message: No errors found
-      reason: Programmed
-      status: "True"
-      type: Programmed
-    - lastTransitionTime: fake
-      message: 'invalid certificate reference /Secret/malformed., the certificate
-        is malformed: tls: failed to find any PEM data in certificate input'
-      reason: InvalidCertificateRef
-      status: "False"
-      type: ResolvedRefs
-    name: default
-    supportedKinds:
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
+    controllerName: istio.io/gateway-controller
+    parentRef:
+      group: ""
+      kind: Service
+      name: httpbin
 ---
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: HTTPRoute
@@ -324,13 +555,39 @@ status:
      reason: InvalidKind
      status: "False"
      type: ResolvedRefs
-    controllerName: higress.io/gateway-controller
+    controllerName: istio.io/gateway-controller
    parentRef:
      name: gateway
      namespace: higress-system
 ---
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: HTTPRoute
+metadata:
+  creationTimestamp: null
+  name: invalid-backendRef-mirror
+  namespace: default
+spec: null
+status:
+  parents:
+  - conditions:
+    - lastTransitionTime: fake
+      message: Route was valid
+      reason: Accepted
+      status: "True"
+      type: Accepted
+    - lastTransitionTime: fake
+      message: backend(does-not-exist.default.svc.domain.suffix) not found
+      reason: BackendNotFound
+      status: "False"
+      type: ResolvedRefs
+    controllerName: istio.io/gateway-controller
+    parentRef:
+      group: ""
+      kind: Service
+      name: httpbin
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
 metadata:
  creationTimestamp: null
  name: invalid-backendRef-mixed
@@ -349,7 +606,7 @@ status:
      reason: InvalidKind
      status: "False"
      type: ResolvedRefs
-    controllerName: higress.io/gateway-controller
+    controllerName: istio.io/gateway-controller
    parentRef:
      name: gateway
      namespace: higress-system
@@ -374,13 +631,39 @@ status:
      reason: BackendNotFound
      status: "False"
      type: ResolvedRefs
-    controllerName: higress.io/gateway-controller
+    controllerName: istio.io/gateway-controller
    parentRef:
      name: gateway
      namespace: higress-system
 ---
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: HTTPRoute
+metadata:
+  creationTimestamp: null
+  name: invalid-backendRef-serviceimport
+  namespace: default
+spec: null
+status:
+  parents:
+  - conditions:
+    - lastTransitionTime: fake
+      message: Route was valid
+      reason: Accepted
+      status: "True"
+      type: Accepted
+    - lastTransitionTime: fake
+      message: backend(unknown-service-import.default.svc.domain.suffix) not found
+      reason: BackendNotFound
+      status: "False"
+      type: ResolvedRefs
+    controllerName: istio.io/gateway-controller
+    parentRef:
+      group: ""
+      kind: Service
+      name: httpbin
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
 metadata:
  creationTimestamp: null
  name: invalid-mirror
@@ -399,7 +682,7 @@ status:
      reason: InvalidKind
      status: "False"
      type: ResolvedRefs
-    controllerName: higress.io/gateway-controller
+    controllerName: istio.io/gateway-controller
    parentRef:
      name: gateway
      namespace: higress-system
@@ -424,7 +707,7 @@ status:
      reason: ResolvedRefs
      status: "True"
      type: ResolvedRefs
-    controllerName: higress.io/gateway-controller
+    controllerName: istio.io/gateway-controller
    parentRef:
      name: gateway
      namespace: higress-system
@@ -432,6 +715,58 @@ status:
 ---
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: HTTPRoute
+metadata:
+  creationTimestamp: null
+  name: invalid-parentRef-service
+  namespace: default
+spec: null
+status:
+  parents:
+  - conditions:
+    - lastTransitionTime: fake
+      message: Route was valid
+      reason: Accepted
+      status: "True"
+      type: Accepted
+    - lastTransitionTime: fake
+      message: All references resolved
+      reason: ResolvedRefs
+      status: "True"
+      type: ResolvedRefs
+    controllerName: istio.io/gateway-controller
+    parentRef:
+      group: ""
+      kind: Service
+      name: not-found
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
+metadata:
+  creationTimestamp: null
+  name: invalid-parentRef-service-entry
+  namespace: default
+spec: null
+status:
+  parents:
+  - conditions:
+    - lastTransitionTime: fake
+      message: 'parent service entry: "not-found" not found'
+      reason: NoMatchingParent
+      status: "False"
+      type: Accepted
+    - lastTransitionTime: fake
+      message: All references resolved
+      reason: ResolvedRefs
+      status: "True"
+      type: ResolvedRefs
+    controllerName: istio.io/gateway-controller
+    parentRef:
+      group: networking.istio.io
+      kind: ServiceEntry
+      name: not-found
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
 metadata:
  creationTimestamp: null
  name: invalid-sectionname-port
@@ -450,7 +785,7 @@ status:
      reason: ResolvedRefs
      status: "True"
      type: ResolvedRefs
-    controllerName: higress.io/gateway-controller
+    controllerName: istio.io/gateway-controller
    parentRef:
      name: gateway
      namespace: higress-system
@@ -476,7 +811,7 @@ status:
      reason: ResolvedRefs
      status: "True"
      type: ResolvedRefs
-    controllerName: higress.io/gateway-controller
+    controllerName: istio.io/gateway-controller
    parentRef:
      group: ""
      kind: Service