Istio charms need to provide a way to configure images for airgapped environment

[i-chvets]

Description

For Istio components to run in an airgapped environment all image workloads that can end up running need to be configurable.

Design/solution

Changes required for both Istio charms: istio-pilot and isito-gateway.

For istio-pilot a configuration option image-configuration is added to charm's configuration (config.yaml). This option allows to provide charm, at deployment time, with image information that is used when handling installation of the workload. Since istio-pilot uses istioctl binary to configure the workload, a call to this binary contains all necessary image infromation to be used in deployment. This is achieved by using --set option of istioctl and supplying image information found in the charm configuration.
image-configuration option is multi-line YAML or JSON that can be passed at deployment time of istio-pilot

For istio-gateway a configuration option proxy-image is added to configuration. This option is used when rendering manifest to ensure a correct image is referenced.

Implementation is done separately for each charm to allow for proper separation of changes.

PR for Istio Pilot charm: #321 (this work is largerly based on this PR #316)
PR for Istio Gateway charm: #323

Testing

Testing is done in airgapped environment that was setup using this guide (still draft PR at this point, but will be in official README).

1. Create test VM (Multipass, Cloud, etc.)
2. Deploy airgapped container as described in this guide
3. Build Istio charms locallt using this branch: istio-pilot and istion-ingressgateway
4. Transfer these two charms to the VM (in case of Multipass VM: multipass transfer <charms> <vm-name>:/home/ubuntu)
5. Login into test VM and start airgapped test container as described in the guide
6. Copy the charms into airgapped contaier as described in the guide, eg. lxc file push <charms> airgapped-microk8s/root/
7. In airgapped test container ensure that MIcrok8s controller is running and kubeflow model exists.
8. Obtain image information to be used in deployment of both Istio charms and note image repository and tag, they wil be used in deployment (see below):

# docker images
REPOSITORY                      TAG       IMAGE ID       CREATED        SIZE
registry                        2.8.1     f5352b75f67e   3 months ago   25.9MB
172.17.0.2:5000/istio/proxyv2   1.16.2    0ed03fb4d64c   7 months ago   249MB
172.17.0.2:5000/istio/pilot     1.16.2    2c8b5d81a23c   7 months ago   190MB

10. Deploy and relate charms with image-configuration option set to string that contains JSON with information obtained from previous step, eg. registry (172.17.0.2:5000), image names and tag 1.16.2`, etc.:

juju deploy ./istio-pilot_ubuntu-20.04-amd64.charm --trust --config image-configuration="{"pilot-image": pilot, "global-tag": 1.16.2, "global-hub": 172.17.0.2:5000/istio, "global-proxy-image": proxyv2, "global-proxy-init-image": proxyv2, "grpc-bootstrap-init": busybox:1.28}"
juju deploy ./istio-gateway_ubuntu-20.04-amd64.charm istio-ingressgateway --config kind=ingress --config proxy-image=172.17.0.2:5000/istio/proxyv2:1.16.2
juju relate istio-pilot istio-ingressgateway

11. Wait for successful deployment of Istio charms.
12. Verify deployment:

# juju status --relations
Model     Controller          Cloud/Region        Version  SLA          Timestamp
kubeflow  microk8s-localhost  microk8s/localhost  2.9.44   unsupported  19:52:56Z

App                   Version  Status  Scale  Charm          Channel  Rev  Address         Exposed  Message
istio-ingressgateway           active      1  istio-gateway             0  10.152.183.147  no       
istio-pilot                    active      1  istio-pilot               0  10.152.183.36   no       

Unit                     Workload  Agent  Address       Ports  Message
istio-ingressgateway/0*  active    idle   10.1.205.173         
istio-pilot/0*           active    idle   10.1.205.171         

Relation provider        Requirer                          Interface    Type     Message
istio-pilot:istio-pilot  istio-ingressgateway:istio-pilot  k8s-service  regular 

# microk8s.kubectl -n kubeflow get pods
NAME                                            READY   STATUS    RESTARTS   AGE
modeloperator-7b89654c4d-t8fvv                  1/1     Running   0          4m26s
istiod-df6b8f759-59sgw                          1/1     Running   0          2m25s
istio-pilot-0                                   1/1     Running   0          3m18s
istio-ingressgateway-0                          1/1     Running   0          108s
istio-ingressgateway-workload-b8b7dbc5c-tx9cb   1/1     Running   0          25s

# microk8s.kubectl -n kubeflow get gateways
NAME            AGE
istio-gateway   2m54s

# microk8s.kubectl -n kubeflow describe pod istiod-df6b8f759-59sgw | grep Image:
    Image:         172.17.0.2:5000/istio/pilot:1.16.2

# microk8s.kubectl -n kubeflow describe pod istio-ingressgateway-workload-b8b7dbc5c-tx9cb | grep Image:
    Image:         172.17.0.2:5000/istio/proxyv2:1.16.2

[DnPlas]

This enhancement was completed in #321 and #323. Closing the issue now as there is nothing else that needs to be tracked.