Istio K8sObjectOverlay.PathValue list elements not working

user_5889131 0
Viewed 271

I had an existing instance of IstioOperator installed from Istio v1.5:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: istio
spec:
  profile: default
  components:
    ingressGateways:
      - namespace: istio-system
        name: istio-ingressgateway
        enabled: true
        k8s:
          serviceAnnotations:
            "cloud.google.com/load-balancer-type": "Internal"
            "service.beta.kubernetes.io/aws-load-balancer-internal": "0.0.0.0/0"
            "service.beta.kubernetes.io/azure-load-balancer-internal": "true"
            "external-dns.alpha.kubernetes.io/hostname": "*.SedTarget"
  addonComponents:
    kiali:
      enabled: true
    prometheus:
      enabled: false

This worked fine.

I added the following section in the k8s section (under spec.components.ingressGateways[0].k8s):

          overlays:
          - apiVersion: v1
            kind: Service
            name: istio-ingressgateway
            patches:
            - path: spec.ports.[name:kafka]
              value:
                name: kafka
                protocol: TCP
                port: 9092
                targetPort: 9092

So that I could add kafka to list of ports.

This did not work, even though the docs show I should be able to specify something like [name:kafka] to add an element to a list:

K8sObjectOverlay.PathValue

Field - Path of the form a.[key1:value1].b.[:value2] Where [key1:value1] is a selector for a key-value pair to identify a list element and [:value] is a value selector to identify a list element in a leaf list. All path intermediate nodes must exist.

I believe this is not due to a typo, because I am able to replace an existing element in the list with the kafka patch by specifying a path like spec.ports[1]. I am not able to specify an existing port to overwrite it with any [key:value] pair, and spec.ports[-] does not work for appending to the end of the list.

This does not match my expectations. Does anyone have any ideas where I'm going wrong?

Thanks in advance!

istio kubernetes
1 Answers

I spent some time learning this and got the tls service to work.

First, sounds like you are missing the | in the YAML override.

          overlays:
          - apiVersion: v1
            kind: Service
            name: istio-ingressgateway
            patches:
            - path: spec.ports.[name:kafka]
              value: |  <== here
                name: kafka
                protocol: TCP
                port: 9092
                targetPort: 9092

You can get more info by looking at the operator logs. For example:

$ kubectl -n istio-operator logs istio-operator-5998f6c744-kg2v6

and you should see something like this:

2020-06-20T06:20:28.200545Z info    installer   Applying Kubernetes overlay:
- kind: Service
  name: istio-ingressgateway
  patches:
  - path: spec.ports.[name:kafka]
    value: |
      name: kafka
      port: 9092
      protocol: TCP
      targetPort: 9092

However, this doesn't seem to override the port and I get (even if I manually add the kafka port to the istio-ingressgateway K8s service):

2020-06-20T06:37:01.388907Z error   reconciling err: path spec.ports.[name:kafka]: element [name:kafka] not found

It does work with something existing like spec.ports.[name:tls].

Now, I'm not exactly sure what you are trying to do by modifying the ingress gateway service. As I understand these overrides are meant for specific Istio components and not how you 'use' Istio per se.

Typically, to add a gateway/service with Istio you would use something like this with Gateway and VirtualService resources.

user_29892610
Related