Merge tag '1.21.3' into tetratefips-release-1.21

Istio release 1.21.3
tetratelabs · Jun 5, 2024 · 579e43b · 579e43b
2 parents cdbfca8 + 7f26a10
commit 579e43b
Show file tree

Hide file tree

Showing 116 changed files with 3,602 additions and 263 deletions.
diff --git a/Makefile.core.mk b/Makefile.core.mk
@@ -49,7 +49,7 @@ endif
 export VERSION
 
 # Base version of Istio image to use
-BASE_VERSION ?= 1.21-2024-04-16T19-01-22
+BASE_VERSION ?= 1.21-2024-04-26T19-03-19
 ISTIO_BASE_REGISTRY ?= gcr.io/istio-release
 
 export GO111MODULE ?= on

diff --git a/cni/deployments/kubernetes/Dockerfile.install-cni b/cni/deployments/kubernetes/Dockerfile.install-cni
@@ -13,7 +13,7 @@ FROM ${ISTIO_BASE_REGISTRY}/base:${BASE_VERSION} as debug
 # It is built on the base distroless image, with iptables binary and libraries added
 # The source can be found at https://github.com/istio/distroless/tree/iptables
 # This version is from commit 86c4972a9f5f245cfb382c8e1e95f176d968c882.
-FROM ${ISTIO_BASE_REGISTRY}/iptables@sha256:87e7a5b30a2844e16363cdd3b6ff06565079627a592c95f5c0fc9aaa56366452 as distroless
+FROM ${ISTIO_BASE_REGISTRY}/iptables@sha256:863a23b9b2d6f3f282e651fb62a47d28a7bd19356839367654254f5677cea6fa as distroless
 
 # This will build the final image based on either debug or distroless from above
 # hadolint ignore=DL3006

diff --git a/docker/Dockerfile.distroless b/docker/Dockerfile.distroless
@@ -1,5 +1,5 @@
 # prepare a distroless source context to copy files from
-FROM gcr.io/distroless/static-debian11@sha256:072d78bc452a2998929a9579464e55067db4bf6d2c5f9cde582e33c10a415bd1 as distroless_source
+FROM gcr.io/distroless/static-debian11@sha256:6d31326376a7834b106f281b04f67b5d015c31732f594930f2ea81365f99d60c as distroless_source
 
 # prepare a base dev to modify file contents
 FROM ubuntu:focal as ubuntu_source

diff --git a/go.mod b/go.mod
@@ -104,8 +104,8 @@ require (
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 	helm.sh/helm/v3 v3.14.2
-	istio.io/api v1.21.1-0.20240404235206-c5bbf8925ab4
-	istio.io/client-go v1.21.1-0.20240405000214-24e0fc37eb1e
+	istio.io/api v1.21.3-0.20240422111456-ce2c1feea604
+	istio.io/client-go v1.21.3-0.20240422111956-6caf45ef5297
 	k8s.io/api v0.29.0
 	k8s.io/apiextensions-apiserver v0.29.0
 	k8s.io/apimachinery v0.29.0
@@ -144,7 +144,7 @@ require (
 	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/docker v24.0.7+incompatible // indirect
+	github.com/docker/docker v25.0.5+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.8.1 // indirect
 	github.com/emicklei/go-restful/v3 v3.11.2 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.0.4 // indirect

diff --git a/go.sum b/go.sum
@@ -159,8 +159,8 @@ github.com/docker/cli v24.0.7+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvM
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v0.7.3-0.20190327010347-be7ac8be2ae0/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v24.0.7+incompatible h1:Wo6l37AuwP3JaMnZa226lzVXGA3F9Ig1seQen0cKYlM=
-github.com/docker/docker v24.0.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v25.0.5+incompatible h1:UmQydMduGkrD5nQde1mecF/YnSbTOaPeFIeP5C4W+DE=
+github.com/docker/docker v25.0.5+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.1 h1:j/eKUktUltBtMzKqmfLB0PAgqYyMHOp5vfsD1807oKo=
 github.com/docker/docker-credential-helpers v0.8.1/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/go-units v0.3.3/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
@@ -1089,10 +1089,10 @@ helm.sh/helm/v3 v3.14.2/go.mod h1:2itvvDv2WSZXTllknfQo6j7u3VVgMAvm8POCDgYH424=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-istio.io/api v1.21.1-0.20240404235206-c5bbf8925ab4 h1:0UHHbkxkYvDR/O0bTzT5xNLLoj+9YZv8qcAFmcPVisg=
-istio.io/api v1.21.1-0.20240404235206-c5bbf8925ab4/go.mod h1:TFCMUCAHRjxBv1CsIsFCsYHPHi4axVI4vdIzVr8eFjY=
-istio.io/client-go v1.21.1-0.20240405000214-24e0fc37eb1e h1:BGYkehSl6ebfIw9k800qZFQ2sh3S6MfbhjL094q05WQ=
-istio.io/client-go v1.21.1-0.20240405000214-24e0fc37eb1e/go.mod h1:mqwsapfu4b1FG47puY9H8y4+ga1+d+hxfdosNQ1HclY=
+istio.io/api v1.21.3-0.20240422111456-ce2c1feea604 h1:rBkCndZuKojMaNBV6iC7zD/q8zwDKDaWs+1t8mrf13Q=
+istio.io/api v1.21.3-0.20240422111456-ce2c1feea604/go.mod h1:TFCMUCAHRjxBv1CsIsFCsYHPHi4axVI4vdIzVr8eFjY=
+istio.io/client-go v1.21.3-0.20240422111956-6caf45ef5297 h1:79TwlDwAC9BOIsmNJuoBj1DFeifnntHKovTU3C8a6PM=
+istio.io/client-go v1.21.3-0.20240422111956-6caf45ef5297/go.mod h1:9LEzw82gl2VZrc9fNnWrkGMmhWSrYsgcgi650KY3LII=
 k8s.io/api v0.18.2/go.mod h1:SJCWI7OLzhZSvbY7U8zwNl9UA4o1fizoug34OV/2r78=
 k8s.io/api v0.18.4/go.mod h1:lOIQAKYgai1+vz9J7YcDZwC26Z0zQewYOGWdyIPUUQ4=
 k8s.io/api v0.29.0 h1:NiCdQMY1QOp1H8lfRyeEf8eOwV6+0xA6XEE44ohDX2A=

diff --git a/istio.deps b/istio.deps
@@ -4,7 +4,7 @@
     "name": "PROXY_REPO_SHA",
     "repoName": "proxy",
     "file": "",
-    "lastStableSHA": "bcf6c19288e9d4a133f815657c951539018bc9bb"
+    "lastStableSHA": "6e17fceba9bf16510d80f98b3523672b58f2ce5e"
   },
   {
     "_comment": "",

diff --git a/manifests/charts/base/files/profile-openshift.yaml b/manifests/charts/base/files/profile-openshift.yaml
@@ -15,4 +15,5 @@ global:
   platform: openshift
 istio_cni:
   enabled: true
-  chained: false
+  chained: false
+platform: openshift
diff --git a/manifests/charts/base/templates/default.yaml b/manifests/charts/base/templates/default.yaml
@@ -7,7 +7,7 @@ metadata:
     app: istiod
     release: {{ .Release.Name }}
     istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision }}
+    istio.io/rev: {{ .Values.defaultRevision | quote }}
 webhooks:
   - name: validation.istio.io
     clientConfig:

diff --git a/manifests/charts/default/files/profile-openshift.yaml b/manifests/charts/default/files/profile-openshift.yaml
@@ -15,4 +15,5 @@ global:
   platform: openshift
 istio_cni:
   enabled: true
-  chained: false
+  chained: false
+platform: openshift
diff --git a/manifests/charts/default/templates/mutatingwebhook.yaml b/manifests/charts/default/templates/mutatingwebhook.yaml
@@ -33,7 +33,7 @@ metadata:
   name: istio-revision-tag-default
   labels:
     istio.io/tag: "default"
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "Pilot"
     app: sidecar-injector

diff --git a/manifests/charts/default/templates/validatingwebhook.yaml b/manifests/charts/default/templates/validatingwebhook.yaml
@@ -5,7 +5,7 @@ metadata:
   labels:
     app: istiod
     istio: istiod
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     istio.io/tag: "default"
     # Required to make sure this resource is removed
     # when purging Istio resources

diff --git a/manifests/charts/gateway/README.md b/manifests/charts/gateway/README.md
@@ -54,7 +54,7 @@ That is, `--set some.field=true` should be passed, not `--set defaults.some.fiel
 When deploying the gateway in an OpenShift cluster, use the `openshift` profile to override the default values, for example:
 
 ```console
-helm install istio-ingressgateway istio/gateway -- set profile=openshift
+helm install istio-ingressgateway istio/gateway --set profile=openshift
 ```
 
 ### `image: auto` Information

diff --git a/manifests/charts/gateway/files/profile-openshift.yaml b/manifests/charts/gateway/files/profile-openshift.yaml
@@ -15,4 +15,5 @@ global:
   platform: openshift
 istio_cni:
   enabled: true
-  chained: false
+  chained: false
+platform: openshift
diff --git a/manifests/charts/gateway/templates/deployment.yaml b/manifests/charts/gateway/templates/deployment.yaml
@@ -25,7 +25,7 @@ spec:
       labels:
         sidecar.istio.io/inject: "true"
         {{- with .Values.revision }}
-        istio.io/rev: {{ . }}
+        istio.io/rev: {{ . | quote }}
         {{- end }}
         {{- include "gateway.podLabels" . | nindent 8 }}
     spec:
@@ -65,8 +65,10 @@ spec:
             allowPrivilegeEscalation: false
             privileged: false
             readOnlyRootFilesystem: true
+            {{- if not (eq .Values.platform "openshift") }}
             runAsUser: 1337
             runAsGroup: 1337
+            {{- end }}
             runAsNonRoot: true
           {{- else }}
             capabilities:

diff --git a/manifests/charts/gateways/istio-egress/files/profile-openshift.yaml b/manifests/charts/gateways/istio-egress/files/profile-openshift.yaml
@@ -15,4 +15,5 @@ global:
   platform: openshift
 istio_cni:
   enabled: true
-  chained: false
+  chained: false
+platform: openshift
diff --git a/manifests/charts/gateways/istio-egress/templates/autoscale.yaml b/manifests/charts/gateways/istio-egress/templates/autoscale.yaml
@@ -38,7 +38,7 @@ metadata:
   labels:
 {{ $gateway.labels | toYaml | indent 4 }}
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "EgressGateways"
 spec:

diff --git a/manifests/charts/gateways/istio-egress/templates/deployment.yaml b/manifests/charts/gateways/istio-egress/templates/deployment.yaml
@@ -8,7 +8,7 @@ metadata:
   labels:
 {{ $gateway.labels | toYaml | indent 4 }}
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "EgressGateways"
 spec:
@@ -34,13 +34,13 @@ spec:
         chart: gateways
 {{- end }}
         service.istio.io/canonical-name: {{ $gateway.name }}
-        service.istio.io/canonical-revision: {{ index $gateway.labels "app.kubernetes.io/version" | default (index $gateway.labels "version") | default .Values.revision | default "latest" }}
-        istio.io/rev: {{ .Values.revision | default "default" }}
+        service.istio.io/canonical-revision: {{ index $gateway.labels "app.kubernetes.io/version" | default (index $gateway.labels "version") | default .Values.revision | default "latest" | quote }}
+        istio.io/rev: {{ .Values.revision | default "default" | quote }}
         install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
         operator.istio.io/component: "EgressGateways"
         sidecar.istio.io/inject: "false"
       annotations:
-        istio.io/rev: {{ .Values.revision | default "default" }}
+        istio.io/rev: {{ .Values.revision | default "default" | quote }}
         {{- if .Values.meshConfig.enablePrometheusMerge }}
         prometheus.io/port: "15020"
         prometheus.io/scrape: "true"

diff --git a/manifests/charts/gateways/istio-egress/templates/injected-deployment.yaml b/manifests/charts/gateways/istio-egress/templates/injected-deployment.yaml
@@ -12,7 +12,7 @@ metadata:
   labels:
 {{ $gateway.labels | toYaml | indent 4 }}
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "EgressGateways"
 spec:

diff --git a/manifests/charts/gateways/istio-egress/templates/poddisruptionbudget.yaml b/manifests/charts/gateways/istio-egress/templates/poddisruptionbudget.yaml
@@ -8,7 +8,7 @@ metadata:
   labels:
 {{ $gateway.labels | toYaml | trim | indent 4 }}
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "EgressGateways"
 spec:

diff --git a/manifests/charts/gateways/istio-egress/templates/role.yaml b/manifests/charts/gateways/istio-egress/templates/role.yaml
@@ -6,7 +6,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "EgressGateways"
 rules:

diff --git a/manifests/charts/gateways/istio-egress/templates/rolebindings.yaml b/manifests/charts/gateways/istio-egress/templates/rolebindings.yaml
@@ -6,7 +6,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "EgressGateways"
 roleRef:

diff --git a/manifests/charts/gateways/istio-egress/templates/service.yaml b/manifests/charts/gateways/istio-egress/templates/service.yaml
@@ -12,7 +12,7 @@ metadata:
   labels:
 {{ $gateway.labels | toYaml | indent 4 }}
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "EgressGateways"
 spec:

diff --git a/manifests/charts/gateways/istio-egress/templates/serviceaccount.yaml b/manifests/charts/gateways/istio-egress/templates/serviceaccount.yaml
@@ -13,7 +13,7 @@ metadata:
   labels:
 {{ $gateway.labels | toYaml | trim | indent 4 }}
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "EgressGateways"
   {{- with $gateway.serviceAccount.annotations }}

diff --git a/manifests/charts/gateways/istio-ingress/files/profile-openshift.yaml b/manifests/charts/gateways/istio-ingress/files/profile-openshift.yaml
@@ -15,4 +15,5 @@ global:
   platform: openshift
 istio_cni:
   enabled: true
-  chained: false
+  chained: false
+platform: openshift
diff --git a/manifests/charts/gateways/istio-ingress/templates/autoscale.yaml b/manifests/charts/gateways/istio-ingress/templates/autoscale.yaml
@@ -38,7 +38,7 @@ metadata:
   labels:
 {{ $gateway.labels | toYaml | indent 4 }}
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "IngressGateways"
 spec:

diff --git a/manifests/charts/gateways/istio-ingress/templates/deployment.yaml b/manifests/charts/gateways/istio-ingress/templates/deployment.yaml
@@ -8,7 +8,7 @@ metadata:
   labels:
 {{ $gateway.labels | toYaml | indent 4 }}
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "IngressGateways"
 spec:
@@ -34,13 +34,13 @@ spec:
         chart: gateways
 {{- end }}
         service.istio.io/canonical-name: {{ $gateway.name }}
-        service.istio.io/canonical-revision: {{ index $gateway.labels "app.kubernetes.io/version" | default (index $gateway.labels "version") | default .Values.revision | default "latest" }}
-        istio.io/rev: {{ .Values.revision | default "default" }}
+        service.istio.io/canonical-revision: {{ index $gateway.labels "app.kubernetes.io/version" | default (index $gateway.labels "version") | default .Values.revision | default "latest" | quote }}
+        istio.io/rev: {{ .Values.revision | default "default" | quote }}
         install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
         operator.istio.io/component: "IngressGateways"
         sidecar.istio.io/inject: "false"
       annotations:
-        istio.io/rev: {{ .Values.revision | default "default" }}
+        istio.io/rev: {{ .Values.revision | default "default" | quote }}
         {{- if .Values.meshConfig.enablePrometheusMerge }}
         prometheus.io/port: "15020"
         prometheus.io/scrape: "true"

diff --git a/manifests/charts/gateways/istio-ingress/templates/injected-deployment.yaml b/manifests/charts/gateways/istio-ingress/templates/injected-deployment.yaml
@@ -12,7 +12,7 @@ metadata:
   labels:
 {{ $gateway.labels | toYaml | indent 4 }}
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "IngressGateways"
 spec:

diff --git a/manifests/charts/gateways/istio-ingress/templates/poddisruptionbudget.yaml b/manifests/charts/gateways/istio-ingress/templates/poddisruptionbudget.yaml
@@ -8,7 +8,7 @@ metadata:
   labels:
 {{ $gateway.labels | toYaml | trim | indent 4 }}
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "IngressGateways"
 spec:

diff --git a/manifests/charts/gateways/istio-ingress/templates/role.yaml b/manifests/charts/gateways/istio-ingress/templates/role.yaml
@@ -6,7 +6,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "IngressGateways"
 rules:

diff --git a/manifests/charts/gateways/istio-ingress/templates/rolebindings.yaml b/manifests/charts/gateways/istio-ingress/templates/rolebindings.yaml
@@ -6,7 +6,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "IngressGateways"
 roleRef:

diff --git a/manifests/charts/gateways/istio-ingress/templates/service.yaml b/manifests/charts/gateways/istio-ingress/templates/service.yaml
@@ -12,7 +12,7 @@ metadata:
   labels:
 {{ $gateway.labels | toYaml | indent 4 }}
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "IngressGateways"
 spec:

diff --git a/manifests/charts/gateways/istio-ingress/templates/serviceaccount.yaml b/manifests/charts/gateways/istio-ingress/templates/serviceaccount.yaml
@@ -13,7 +13,7 @@ metadata:
   labels:
 {{ $gateway.labels | toYaml | trim | indent 4 }}
     release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
     install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
     operator.istio.io/component: "IngressGateways"
   {{- with $gateway.serviceAccount.annotations }}

diff --git a/manifests/charts/istio-cni/files/profile-openshift.yaml b/manifests/charts/istio-cni/files/profile-openshift.yaml
@@ -15,4 +15,5 @@ global:
   platform: openshift
 istio_cni:
   enabled: true
-  chained: false
+  chained: false
+platform: openshift
diff --git a/manifests/charts/istio-cni/templates/clusterrole.yaml b/manifests/charts/istio-cni/templates/clusterrole.yaml
@@ -12,6 +12,12 @@ rules:
 - apiGroups: [""]
   resources: ["pods","nodes","namespaces"]
   verbs: ["get", "list", "watch"]
+{{- if (eq .Values.platform "openshift") }}
+- apiGroups: ["security.openshift.io"]
+  resources: ["securitycontextconstraints"]
+  resourceNames: ["privileged"]
+  verbs: ["use"]
+{{- end }}
 ---
 {{- if .Values.cni.repair.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/manifests/charts/istio-control/istio-discovery/files/grpc-agent.yaml b/manifests/charts/istio-control/istio-discovery/files/grpc-agent.yaml
@@ -32,7 +32,7 @@ metadata:
     service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
     service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
   annotations: {
-    istio.io/rev: {{ .Revision | default "default" }},
+    istio.io/rev: {{ .Revision | default "default" | quote }},
     {{- if ge (len $containers) 1 }}
     {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
     kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",

diff --git a/manifests/charts/istio-control/istio-discovery/files/profile-openshift.yaml b/manifests/charts/istio-control/istio-discovery/files/profile-openshift.yaml
@@ -15,4 +15,5 @@ global:
   platform: openshift
 istio_cni:
   enabled: true
-  chained: false
+  chained: false
+platform: openshift