Merge tag '1.22.7' into tetratefips-release-1.22

Istio release 1.22.7

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
   "name": "istio build-tools",
-  "image": "gcr.io/istio-testing/build-tools:release-1.22-02098ccc0766fde1c577cf9f9258fb43a08ec8c8",
+  "image": "gcr.io/istio-testing/build-tools:release-1.22-70caecf3832f7f72fccfc9aaa536acb3a69bdc6a",
   "privileged": true,
   "remoteEnv": {
     "USE_GKE_GCLOUD_AUTH_PLUGIN": "True",

Makefile.core.mk

@@ -49,7 +49,7 @@ endif
 export VERSION
 
 # Base version of Istio image to use
-BASE_VERSION ?= 1.22-2024-09-17T19-00-54
+BASE_VERSION ?= 1.22-2024-11-26T19-01-41
 ISTIO_BASE_REGISTRY ?= gcr.io/istio-release
 
 export GO111MODULE ?= on

common/.commonfiles.sha

@@ -1 +1 @@
-2f988bb7f975a3426624f4d9e92ea26d542b1b6f
+2c0d7e2143bb1e1f698b4ec4c2d586340a8d21b9

common/scripts/setup_env.sh

@@ -75,7 +75,7 @@ fi
 TOOLS_REGISTRY_PROVIDER=${TOOLS_REGISTRY_PROVIDER:-gcr.io}
 PROJECT_ID=${PROJECT_ID:-istio-testing}
 if [[ "${IMAGE_VERSION:-}" == "" ]]; then
-  IMAGE_VERSION=release-1.22-02098ccc0766fde1c577cf9f9258fb43a08ec8c8
+  IMAGE_VERSION=release-1.22-70caecf3832f7f72fccfc9aaa536acb3a69bdc6a
 fi
 if [[ "${IMAGE_NAME:-}" == "" ]]; then
   IMAGE_NAME=build-tools

go.mod

@@ -106,8 +106,8 @@ require (
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 	helm.sh/helm/v3 v3.14.3
-	istio.io/api v1.22.4-0.20240808015337-e0ff1ca45c33
-	istio.io/client-go v1.22.4-0.20240808020015-3d90011dbcfe
+	istio.io/api v1.22.7-0.20241205190107-5d7b98128323
+	istio.io/client-go v1.22.7-0.20241205190906-f1b3ac5102a8
 	k8s.io/api v0.30.0
 	k8s.io/apiextensions-apiserver v0.30.0
 	k8s.io/apimachinery v0.30.0

go.sum

@@ -1102,10 +1102,10 @@ helm.sh/helm/v3 v3.14.3/go.mod h1:v6myVbyseSBJTzhmeE39UcPLNv6cQK6qss3dvgAySaE=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-istio.io/api v1.22.4-0.20240808015337-e0ff1ca45c33 h1:/IeYCiL05FL8ZxndwibKznhLsrZRDH0xaHwsk/roU7I=
-istio.io/api v1.22.4-0.20240808015337-e0ff1ca45c33/go.mod h1:S3l8LWqNYS9yT+d4bH+jqzH2lMencPkW7SKM1Cu9EyM=
-istio.io/client-go v1.22.4-0.20240808020015-3d90011dbcfe h1:8E+07PR3a1LypFLxNksDYcTwyMPB06797cavwK5zWds=
-istio.io/client-go v1.22.4-0.20240808020015-3d90011dbcfe/go.mod h1:pCCBfkXZVAxptGlL5gdGIonPxFsNQZ+iBxvYIUF9z7c=
+istio.io/api v1.22.7-0.20241205190107-5d7b98128323 h1:Rxuq0NqDMqBsfagJzNV5Ts+tQ2QE6isnoUYKARA3YI4=
+istio.io/api v1.22.7-0.20241205190107-5d7b98128323/go.mod h1:S3l8LWqNYS9yT+d4bH+jqzH2lMencPkW7SKM1Cu9EyM=
+istio.io/client-go v1.22.7-0.20241205190906-f1b3ac5102a8 h1:z2yB/AZIE1ND+gjlfoMuhFslRE2DI3nvVLPoLTlSBNc=
+istio.io/client-go v1.22.7-0.20241205190906-f1b3ac5102a8/go.mod h1:noO8SoyMxLwni3w+yGK67aydi2klExjmiqnXyeRS/00=
 k8s.io/api v0.18.2/go.mod h1:SJCWI7OLzhZSvbY7U8zwNl9UA4o1fizoug34OV/2r78=
 k8s.io/api v0.18.4/go.mod h1:lOIQAKYgai1+vz9J7YcDZwC26Z0zQewYOGWdyIPUUQ4=
 k8s.io/api v0.30.0 h1:siWhRq7cNjy2iHssOB9SCGNCl2spiF1dO3dABqZ8niA=

istio.deps

@@ -4,13 +4,13 @@
     "name": "PROXY_REPO_SHA",
     "repoName": "proxy",
     "file": "",
-    "lastStableSHA": "59080172cb101a90727fb6fbf829bf514d63cb53"
+    "lastStableSHA": "d17e607ff67ff7b6eccbf396d370d7a2c53a5238"
   },
   {
     "_comment": "",
     "name": "ZTUNNEL_REPO_SHA",
     "repoName": "ztunnel",
     "file": "",
-    "lastStableSHA": "2eaa669fecf8505c9abb9676b64ff6a50f124a37"
+    "lastStableSHA": "2a6c8147207af15724336c0b6191149f6d1a8ca9"
   }
 ]

pilot/pkg/networking/core/cluster_builder_test.go

@@ -2090,6 +2090,18 @@ func TestShouldH2Upgrade(t *testing.T) {
 			},
 			upgrade: false,
 		},
+		{
+			name:        "mesh upgrade - dr useClientProtocol",
+			clusterName: "bar",
+			port:        &model.Port{Protocol: protocol.HTTP},
+			mesh:        &meshconfig.MeshConfig{H2UpgradePolicy: meshconfig.MeshConfig_UPGRADE},
+			connectionPool: &networking.ConnectionPoolSettings{
+				Http: &networking.ConnectionPoolSettings_HTTPSettings{
+					UseClientProtocol: true,
+				},
+			},
+			upgrade: false,
+		},
 		{
 			name:        "non-http",
 			clusterName: "bar",

pilot/pkg/networking/core/cluster_traffic_policy.go

@@ -195,6 +195,12 @@ func shouldH2Upgrade(clusterName string, port *model.Port, mesh *meshconfig.Mesh
 	// Upgrade if tls.GetMode() == networking.TLSSettings_ISTIO_MUTUAL
 	if connectionPool != nil && connectionPool.Http != nil {
 		override := connectionPool.Http.H2UpgradePolicy
+		// If useClientProtocol is set, do not upgrade
+		if connectionPool.Http.UseClientProtocol {
+			log.Debugf("Not upgrading cluster because useClientProtocol is set: %v (%v %v)",
+				clusterName, mesh.H2UpgradePolicy, override)
+			return false
+		}
 		// If user wants an upgrade at destination rule/port level that means he is sure that
 		// it is a Http port - upgrade in such case. This is useful incase protocol sniffing is
 		// enabled and user wants to upgrade/preserve http protocol from client.

pilot/pkg/networking/core/route/route.go

@@ -781,7 +781,12 @@ func ApplyRedirect(out *route.Route, redirect *networking.HTTPRedirect, port int
 		action.Redirect.ResponseCode = route.RedirectAction_PERMANENT_REDIRECT
 	default:
 		log.Warnf("Redirect Code %d is not yet supported", redirect.RedirectCode)
-		action = nil
+		// Can't just set action to nil here because the proto marshaller will still see
+		// the Route_Redirect type of the variable and assume that the value is set
+		// (and panic because it's not). What we need to do is set out.Action directly to
+		// (a typeless) nil so that type assertions to Route_Redirect will fail.
+		out.Action = nil
+		return
 	}
 
 	out.Action = action

pilot/pkg/networking/core/route/route_test.go

@@ -943,6 +943,19 @@ func TestBuildHTTPRoutes(t *testing.T) {
 		g.Expect(redirectAction.Redirect.ResponseCode).To(Equal(envoyroute.RedirectAction_PERMANENT_REDIRECT))
 	})
 
+	t.Run("for invalid redirect code", func(t *testing.T) {
+		g := NewWithT(t)
+		cg := core.NewConfigGenTest(t, core.TestOptions{})
+
+		routes, err := route.BuildHTTPRoutesForVirtualService(node(cg), virtualServiceWithInvalidRedirect, serviceRegistry,
+			nil, 8080, gatewayNames, route.RouteOptions{})
+		g.Expect(err).NotTo(HaveOccurred())
+		g.Expect(len(routes)).To(Equal(1))
+
+		_, ok := routes[0].Action.(*envoyroute.Route_Redirect)
+		g.Expect(ok).To(BeFalse())
+	})
+
 	t.Run("for path prefix redirect", func(t *testing.T) {
 		g := NewWithT(t)
 		cg := core.NewConfigGenTest(t, core.TestOptions{})
@@ -1872,6 +1885,26 @@ var virtualServiceWithRedirect = config.Config{
 	},
 }
 
+var virtualServiceWithInvalidRedirect = config.Config{
+	Meta: config.Meta{
+		GroupVersionKind: gvk.VirtualService,
+		Name:             "acme",
+	},
+	Spec: &networking.VirtualService{
+		Hosts:    []string{},
+		Gateways: []string{"some-gateway"},
+		Http: []*networking.HTTPRoute{
+			{
+				Redirect: &networking.HTTPRedirect{
+					Uri:          "example.org",
+					Authority:    "some-authority.default.svc.cluster.local",
+					RedirectCode: 317,
+				},
+			},
+		},
+	},
+}
+
 var virtualServiceWithRedirectPathPrefix = config.Config{
 	Meta: config.Meta{
 		GroupVersionKind: gvk.VirtualService,