Istio 1.22.1 update

[strekm]

Description

Update the Kyma Istio module to use new Istio version. Update Istio version and used dependencies, adjust tests and documentation if needed. The upgrade needs to have zero downtime for production settings.

Consider following changes:

• Delta xDS on by default that can be turned off by setting ISTIO_DELTA_XDS to false
• Default tracing to zipkin.istio-system.svc removed not affecting the module since, we do not use default setting
• Default value of the feature flag ENHANCED_RESOURCE_SCOPING to true that can be turned off with compatibility mode
• ServiceEntry with resolution: NONE now respects targetPort that can be turned off with compatibility mode
• New ambient mode waypoint attachment method should not affect Istio module

ACs:

• Review Istio RNs.
• Verify that the new Istio version doesn't introduce features that transition to a new phase in Istio, potentially affecting Kyma's Istio behavior. If such changes are identified, discuss them with the team to determine the best course of action.
  - [ ] Istio bumped on the main and latest release branch.
• Prepare Kyma runtime Istio RNs based on open-source Istio RNs.
• Istio installs and upgrades to new version.
• Istio module upgrades with zero downtime - Zero downtime upgrade test #429
• Tests and documentation updated if needed.
• Verify that sidecars are in sync with Control Plane.
• Istio and Envoy Version updated in the README.md and /docs/user/README.md files. You can use the scripts scripts/get_module_istio_version.sh and scripts/get_module_envoy_version.sh to extract the versions.
• Check compatibilityVersion of the previous minor version. You can find it in the helm-profiles directory. Evaluate content, and adjust compatibility mode implementation in api/v1alpha2/comaptibility_mode.go. Check the release notes for any compatibility flags that might be not covered by the compatibilityVersion. Update docs/user/04-00-istio-custom-resource.md if needed.

TODO:

• Verify changed merging behaviour for IstioOperator field meshConfig.defaultConfig.proxyMetadata. Docs from Istio notes: Improved the meshConfig.defaultConfig.proxyMetadata field to do a deep merge when overridden, rather than replacing all values. --> No changed behaviour, the configuration injected to the proxies is the same
• Implement Proxy restart when compatibility mode is changed to rollout ProxyMetadata
• Verify if ingress gateway is restart automatically because of ProxyMetadata change
• Update API versions to v1
• Figure out why we have multiple versions in controlled_resources_list.yaml -> it's a bug, duplicated VirtualService version was removed. Also versions of Istio resources will be updated to v1 where possible.
• Create follow ups for technical debt
  • https://github.com/orgs/kyma-project/projects/27/views/37?pane=issue&itemId=67983504
  • https://github.com/orgs/kyma-project/projects/27/views/37?pane=issue&itemId=67985133

DoD:

• Provide documentation.
• Test on a production-like environment.
• Verify if the solution works for both open-source Kyma and SAP BTP, Kyma runtime.
• Check the outcome of all related pipelines.
• As a PR reviewer, verify code coverage and evaluate if it is acceptable.
• Add release notes.
• Verify Istio API changes (v1 version)

Attachments
Istio Release Announcements
Istio Upgrade Notes
Istio Change Notes

[triffer]

Technical debt that should be handled as part of follow ups.

• The file compatibility_mode.go is in the v1alpha2 package, but should be moved to internal/comaptibility package
• The NewRestartProxyPredicate in the pods package is added internally in the GetPodsToRestart function. It would be better to handle this in the SidecarsRestarter to have the predicate creation in one place. This would simplify the function args.