istioctl verify-install -f operator-config.yaml now dependant on an istio-operator pod?

[cybrhwk]

We are currently on 1.17.2 of istio and are looking to do a fresh install with 1.22.0.

Our current terraform script for 1.17.2 has the verify-install step which runs and completes successfully.

Upgrading to 1.22.0 with the same terraform script the verify-install step now fails unless I run istioctl operator init as mentioned in the docs, but the top of this doc click here the operator shouldn't be used for installations/upgrades etc, but running istioctl operator init command results in an istio-operator pod being created so I'm slightly confused as to why this additional step is now required for the verify-install command to run successfully? I've included the error I am seeing below

[jwendell]

I just tried 1.22.1 real quick (with no custom file) and it works just fine. Can you share your installation file? My guess is that it's something in it.

[cybrhwk]

Yeah, the verify-install command works without the file for me as well, but for it to validate my install script I need to specify the file, if the istio-operator pod is present it run successfully. This is my config below

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: istio-operator
  namespace: istio-operator
spec:
  profile: minimal
  tag: 1.22.0-distroless
  components:
    base:
      enabled: true
    cni:
      enabled: false
    egressGateways:
    - enabled: false
      name: istio-egressgateway
    ingressGateways:
    - enabled: false
      name: istio-ingressgateway
    istiodRemote:
      enabled: false
    pilot:
      k8s:
        env:
          - name: PILOT_ENABLE_PERSISTENT_SESSION_FILTER
            value: "1"
        podAnnotations:
          co.elastic.logs/enabled : "true"
          co.elastic.logs/processors.dissect.field: "message"
          co.elastic.logs/processors.dissect.tokenizer: "%%{@timestamp}	%%{level}	%%{message}"
          co.elastic.logs/processors.dissect.overwrite_keys: "true"
          co.elastic.logs/processors.dissect.target_prefix: ""
        hpaSpec:
          minReplicas: 2
        affinity:
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - istiod
              topologyKey: "kubernetes.io/hostname"
  meshConfig:
   meshMTLS:
     minProtocolVersion: TLSV1_3
   enablePrometheusMerge: true  
  values:
    telemetry:
      enabled: true
      v2:
        enabled: true
        prometheus:
          enabled: true
        stackdriver:
          enabled: false

[jwendell]

Are you passing the result of istioctl manifest generate to istioctl verify-install?

https://istio.io/latest/docs/setup/install/istioctl/#verify-a-successful-installation

[cybrhwk]

No, as I hadn't done that previously when running 1.17.2 it was this same file I was using to verify, which worked fine with that version

[jwendell]

That file above is not the one we're supposed to pass to verify-install. This file is the one you use to install Istio.

So, that's the workflow:

$ ./bin/istioctl manifest generate -f istioctl-config.yaml > manifest.yaml
$ ./bin/istioctl install -f istioctl-config.yaml
$ ./bin/istioctl verify-install -f  manifest.yaml

[cybrhwk]

Thanks I will give that a go now. Is this a recent change?