1.23: fix workload group regression (#3299)

Master PR https://github.com/istio/api/pull/3295
Fixes https://github.com/istio/istio/issues/52749

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
   "name": "istio build-tools",
-  "image": "gcr.io/istio-testing/build-tools:master-3a1982fd09c72f345f85d394d5cce906b5484b76",
+  "image": "gcr.io/istio-testing/build-tools:release-1.23-d82829888b6f4a2b2b2644fe481d72ced2e402aa",
   "privileged": true,
   "remoteEnv": {
     "USE_GKE_GCLOUD_AUTH_PLUGIN": "True",

CODEOWNERS

@@ -1,6 +1 @@
-*                @istio/technical-oversight-committee 
-/Makefile*       @istio/wg-test-and-release-maintainers
-/*.md            @istio/wg-test-and-release-maintainers
-/common/         @istio/wg-test-and-release-maintainers
-/common-protos/  @istio/wg-test-and-release-maintainers
-/scripts/        @istio/wg-test-and-release-maintainers
+* @istio/release-managers-1-23

common/.commonfiles.sha

@@ -1 +1 @@
-cbe0f69e442f6d1d19c702d931b39048abd833c2
+e6bbccc51a140216fb669986e89602881002553d

common/Makefile.common.mk

@@ -92,7 +92,7 @@ mirror-licenses: mod-download-go
 	@license-lint --mirror
 
 TMP := $(shell mktemp -d -u)
-UPDATE_BRANCH ?= "master"
+UPDATE_BRANCH ?= "release-1.23"
 
 BUILD_TOOLS_ORG ?= "istio"
 

common/scripts/setup_env.sh

@@ -75,7 +75,7 @@ fi
 TOOLS_REGISTRY_PROVIDER=${TOOLS_REGISTRY_PROVIDER:-gcr.io}
 PROJECT_ID=${PROJECT_ID:-istio-testing}
 if [[ "${IMAGE_VERSION:-}" == "" ]]; then
-  IMAGE_VERSION=master-3a1982fd09c72f345f85d394d5cce906b5484b76
+  IMAGE_VERSION=release-1.23-d82829888b6f4a2b2b2644fe481d72ced2e402aa
 fi
 if [[ "${IMAGE_NAME:-}" == "" ]]; then
   IMAGE_NAME=build-tools

kubernetes/customresourcedefinitions.gen.yaml

@@ -11895,8 +11895,6 @@ spec:
                     type: integer
                 type: object
                 x-kubernetes-validations:
-                - message: Address is required
-                  rule: has(self.address) || has(self.network)
                 - message: UDS may not include ports
                   rule: '(has(self.address) && self.address.startsWith(''unix://''))
                     ? !has(self.ports) : true'
@@ -12093,8 +12091,6 @@ spec:
                     type: integer
                 type: object
                 x-kubernetes-validations:
-                - message: Address is required
-                  rule: has(self.address) || has(self.network)
                 - message: UDS may not include ports
                   rule: '(has(self.address) && self.address.startsWith(''unix://''))
                     ? !has(self.ports) : true'
@@ -12291,8 +12287,6 @@ spec:
                     type: integer
                 type: object
                 x-kubernetes-validations:
-                - message: Address is required
-                  rule: has(self.address) || has(self.network)
                 - message: UDS may not include ports
                   rule: '(has(self.address) && self.address.startsWith(''unix://''))
                     ? !has(self.ports) : true'

networking/v1alpha3/service_entry.pb.go

@@ -956,6 +956,8 @@ type ServiceEntryAddress struct {
 
 	// Value is the address (192.168.0.2)
 	Value string `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
+	// Host is the name associated with this address
+	Host string `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"`
 }
 
 func (x *ServiceEntryAddress) Reset() {
@@ -997,6 +999,13 @@ func (x *ServiceEntryAddress) GetValue() string {
 	return ""
 }
 
+func (x *ServiceEntryAddress) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
 var File_networking_v1alpha3_service_entry_proto protoreflect.FileDescriptor
 
 var file_networking_v1alpha3_service_entry_proto_rawDesc = []byte{
@@ -1083,13 +1092,14 @@ var file_networking_v1alpha3_service_entry_proto_rawDesc = []byte{
 	0x69, 0x73, 0x74, 0x69, 0x6f, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67,
 	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x33, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
 	0x65, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x52, 0x09, 0x61,
-	0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x65, 0x73, 0x22, 0x2b, 0x0a, 0x13, 0x53, 0x65, 0x72, 0x76,
+	0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x65, 0x73, 0x22, 0x3f, 0x0a, 0x13, 0x53, 0x65, 0x72, 0x76,
 	0x69, 0x63, 0x65, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12,
 	0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x22, 0x5a, 0x20, 0x69, 0x73, 0x74, 0x69, 0x6f, 0x2e, 0x69,
-	0x6f, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67,
-	0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x33, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x42, 0x22, 0x5a, 0x20, 0x69, 0x73, 0x74,
+	0x69, 0x6f, 0x2e, 0x69, 0x6f, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x6b, 0x69, 0x6e, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x33, 0x62, 0x06, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

networking/v1alpha3/service_entry.pb.html

@@ -668,6 +668,17 @@ No
 <td>
 <p>Value is the address (192.168.0.2)</p>
 
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="ServiceEntryAddress-host">
+<td><code>host</code></td>
+<td><code>string</code></td>
+<td>
+<p>Host is the name associated with this address</p>
+
 </td>
 <td>
 No

networking/v1alpha3/service_entry.proto

@@ -647,5 +647,8 @@ message ServiceEntryStatus {
 message ServiceEntryAddress{
   // Value is the address (192.168.0.2)
   string value = 1;
+
+  // Host is the name associated with this address
+  string host = 2;
 }
 

networking/v1alpha3/workload_group.pb.go

@@ -127,6 +127,7 @@ type WorkloadGroup struct {
 	// should default to `default`. The workload identities (mTLS certificates) will be bootstrapped using the
 	// specified service account's token. Workload entries in this group will be in the same namespace as the
 	// workload group, and inherit the labels and annotations from the above `metadata` field.
+	// +protoc-gen-crd:validation:IgnoreSubValidation:["Address is required"]
 	Template *WorkloadEntry `protobuf:"bytes,2,opt,name=template,proto3" json:"template,omitempty"`
 	// `ReadinessProbe` describes the configuration the user must provide for healthchecking on their workload.
 	// This configuration mirrors K8S in both syntax and logic for the most part.

networking/v1alpha3/workload_group.proto

@@ -109,6 +109,7 @@ message WorkloadGroup {
   // should default to `default`. The workload identities (mTLS certificates) will be bootstrapped using the
   // specified service account's token. Workload entries in this group will be in the same namespace as the
   // workload group, and inherit the labels and annotations from the above `metadata` field.
+  // +protoc-gen-crd:validation:IgnoreSubValidation:["Address is required"]
   WorkloadEntry template = 2 [(google.api.field_behavior) = REQUIRED];
 
   // `ObjectMeta` describes metadata that will be attached to a `WorkloadEntry`.

releasenotes/notes/3279.yaml

@@ -0,0 +1,6 @@
+apiVersion: release-notes/v2
+kind: bug-fix
+area: traffic-management
+releaseNotes:
+  - |
+    **Fixed** ServiceEntryStatus Addresses field could not easily support assigning IPs to each host which lead to an undesired divergence in behavior between the new and old implementations for automatic allocation of IP addresses for SericeEntry. Added a "Host" field to the Address in order to support mapping allocated IP to a host.