istio-ecosystem/sail-operator 1.31.0

Sail Operator 1.31.0

on GitHub

Added

• Add support for Istio 1.31.0

Changed

• Add correct ciphersuite and ECDH curves on OpenShift
  Removes cipher suite list from meshConfig when minProtocolVersion is TLS 1.3
  and correctly sets ECDH curves from the OpenShift TLS profile.

• Remove TLS12_ENABLED from ZTunnel for Istio 1.31+
  Istio 1.31's OpenSSL backend supports FIPS 140-3 natively and no longer needs
  the explicit TLS 1.2 enablement flag.

• Resolve cipher suites directly from tlsProfile
  Fixes cipher suites being filtered out by the controller-runtime library when
  TLS min version is 1.3. The operator now reads them directly from the profile.

• Pass TLS 1.3 cipher suites to Envoy via proxy metadata
  Allows passing TLS 1.3 cipher suites to envoy on OpenShift by passing
  the env var OPENSSL_TLS1_3_CIPHERSUITES through proxy metadata. Syncs
  this with the APIServer TLS settings.

• Detect remote istiod webhook failures from cluster events instead of probing
  The webhook controller no longer actively probes the remote istiod's readiness
  endpoint. It now passively detects webhook call failures from cluster events and
  marks the webhook and its owning IstioRevision as not-ready for a short degraded
  window after a failure. The length of this window is configurable via the
  WEBHOOK_DEGRADED_WINDOW environment variable (default 2 minutes).

Fixed

• Fix race condition in ToDiscoveryClient (#2260)
  Concurrent calls shared the same config object; the fix copies it before
  creating the discovery client.

• Reconcile OwnerRef on IstioRevision object during update (#2083)
  When revision.CreateOrUpdate reconciles during update, the OwnerReference
  is not being updated, which could lead to a state, where the orphaned
  revision is never pruned or reflected in "status.revisions".
  Add OwnerReference during reconcile update.