Zero downtime upgrade test

[werdes72]

Zero downtime Istio upgrade test

Set environment variable for your cluster domain

You must run this test against a production like Gardener cluster:

export DOMAIN_TO_EXPOSE_WORKLOADS=$(kubectl get cm -n kube-system shoot-info -o "jsonpath={.data['domain']}")

Install Istio and api-gateway

kubectl apply -f https://github.com/kyma-project/istio/releases/latest/download/istio-manager.yaml
kubectl apply -f https://github.com/kyma-project/istio/releases/latest/download/istio-default-cr.yaml

kubectl apply -f https://github.com/kyma-project/api-gateway/releases/latest/download/api-gateway-manager.yaml
kubectl apply -f https://github.com/kyma-project/api-gateway/releases/latest/download/apigateway-default-cr.yaml

Deploy the workload

kubectl create ns test
kubectl label namespace test istio-injection=enabled --overwrite
kubectl -n test create -f https://raw.githubusercontent.com/istio/istio/master/samples/httpbin/httpbin.yaml

cat <<EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
  namespace: test
spec:
  hosts:
  - "httpbin.$DOMAIN_TO_EXPOSE_WORKLOADS"
  gateways:
  - kyma-system/kyma-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        port:
          number: 8000
        host: httpbin.test.svc.cluster.local
EOF

Check the response. Run it in a separate terminal, no output means that there are no errors

Keep it running until you finish the update

#!/bin/bash

while true
do
curl -fsS https://httpbin.$DOMAIN_TO_EXPOSE_WORKLOADS/headers > /dev/null
done

Check the Istio version in your cluster and apply a new one

kubectl get -n istio-system deployments.apps/istiod -ojson | jq -r '.spec.template.spec.containers[0].image'

• Deploy the Istio manager version with the updated Istio version.
• Verify that Istiod is running the new Istio version

kubectl get -n istio-system deployments.apps/istiod -ojson | jq -r '.spec.template.spec.containers[0].image'

• Verify that service proxy of the httpbin workload is running the new Istio version

kubectl get -n test pods -l app=httpbin -ojson | jq -r '.items[0].spec.containers[0].image'

• Verify that all requests to the httpbin workload worked without errors during the upgrade.

[kyma-bot]

This issue or PR has been automatically marked as stale due to the lack of recent activity.
Thank you for your contributions.

This bot triages issues and PRs according to the following rules:

• After 60d of inactivity, lifecycle/stale is applied
• After 7d of inactivity since lifecycle/stale was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Close this issue or PR with /close

If you think that I work incorrectly, kindly raise an issue with the problem.

/lifecycle stale