prepare for v1.23

[dhawton]

Description

Prepare for 1.23 release

Reviewers

• Ambient
• Docs
• Installation
• Networking
• Performance and Scalability
• Extensions and Telemetry
• Security
• Test and Release
• User Experience
• Developer Infrastructure
• Localization/Translation

[dhawton]

/retest

[dhawton]

/test doc.test.profile-default

[dhawton]

/test doc.test.profile-ambient

[dhawton]

/test doc.test.profile-ambient

extend wasm flake

[dhawton]

/test doc.test.profile-demo

[craigbox]

/retest

Failing tests:

• default
  • test output includes errors relating to istioctl x wait being removed
    • Error: unknown flag: --for - possibly related to the istioctl x wait command changing in 1.23?
    • On 1.22, when running istioctl experimental wait --for=distribution I get Error: unable to query pilot for distribution (are you using pilot version >= 1.4 with config distribution tracking on): unexpected status code: 409; when running with -vklog 9, it actually gets a 101 Switching Protocols error, which appears to be when upgrading to websockets and may be related to IPv6?
  • the actual failure appears to be the output has extra semi-colons in it. investigating if this is a change in Envoy output or if for some reason the hostname has a semicolon suffixed.
• none:
  • config-resource-ready
    • relates to a feature that has been removed; the whole page just needs to be removed
  • dns-proxy
    • possibly due to IPv6 being in 1.23?
  • canary upgrade
    • flaky scripting: the awk fetches the 10th token, though this will differ based on SYNCED (1 token) or NOT SENT (2 tokens) being output.

$ istioctl proxy-status | grep "$(kubectl -n istio-system get pod -l app=istio-ingressgateway -o jsonpath='{.items..metadata.name}')" | awk '{print $10}'
istiod-77d7cbcfdb-npn7p
$ istioctl proxy-status | grep "$(kubectl -n istio-system get pod -l app=istio-ingressgateway -o jsonpath='{.items..metadata.name}')" 
istio-ingressgateway-857d9d77f7-xq5hr.istio-system     Kubernetes     SYNCED     SYNCED     SYNCED     NOT SENT     NOT SENT     istiod-77d7cbcfdb-npn7p     1.22.2
$ istioctl proxy-status 
NAME                                                   CLUSTER        CDS        LDS        EDS        RDS          ECDS         ISTIOD                      VERSION
istio-ingressgateway-857d9d77f7-xq5hr.istio-system     Kubernetes     SYNCED     SYNCED     SYNCED     NOT SENT     NOT SENT     istiod-77d7cbcfdb-npn7p     1.22.2
sleep-7656cf8794-q2g6d.default                         Kubernetes     SYNCED     SYNCED     SYNCED     SYNCED       NOT SENT     istiod-77d7cbcfdb-npn7p     1.22.2
$ istioctl proxy-status | awk '{print $10}'

istiod-77d7cbcfdb-npn7p
1.22.2

There's no JSON output for istioctl - someone proposed it but it was never merged. So instead I propose the rather hacky-looking:

istioctl proxy-status | grep "$(kubectl -n istio-system get pod -l app=istio-ingressgateway -o jsonpath='{.items..metadata.name}')" | awk -F '[[:space:]][[:space:]]+' '{print $8}'

[dhawton]

dns-proxy page failure is in the section about Auto Allocation.. which received a few changes in 1.23. I don't believe this is related to dual stack, as the SE above the auto allocation does pass the test.

[craigbox]

/retest

Latest links:

• DNS proxy
• authz-tcp - flake? The page literally has a warning under this snip which says "If you don’t see the expected output, retry after a few seconds. Caching and propagation can cause a delay."
• circuit breaking - the page/snips were updated, this test output doesn't reflect that. Fixed, needed to update the test as it doesn't use the _out

[dhawton]

/test doc.test.profile-ambient

Flake

[dhawton]

/test doc.test.profile-ambient

[craigbox]

/test doc.test.profile-none

Might be a flake even though it's also in the DNS Proxy page. It looks like it just didn't get programmed in time.

[dhawton]

/test doc.test.profile-none

Might be a flake even though it's also in the DNS Proxy page. It looks like it just didn't get programmed in time.

No.. it's another change in istioctl. I have disabled that validation for now.. I'll take a look at both first thing in the AM, but as long as we fix before 1.23.0 it should be ok to disable for now.

[craigbox]

No.. it's another change in istioctl.

Cool. (I tried testing with 1.23.0-alpha.0 which still had the same output.)