Istio Configmap automatically change to default config after a certain time period

[ReinertM]

Hello,

while configuring an extension provider as part of a mesh config in Kyma, I encountered a problem with the configmap "istio" in the istio-system namespace (and the corresponding istio-operator "installed-state-default-operator") changing back their config to the default after a certain time.

What am I trying to configure?

meshConfig:
  extensionProviders:
  - name: oauth2-proxy
    envoyExtAuthzHttp:
      service: oauth2-proxy.oauth2-proxy.svc.cluster.local
      port: 4180
      includeRequestHeadersInCheck:
      - cookie
      headersToUpstreamOnAllow:
      - authorization
      headersToDownstreamOnDeny:
      - set-cookie

Expected behaviour:
Changes stay valid

Actual behaviour:
Configmap and operator change to original config, resulting in an "rbac: access denied" error when trying to authenticate via oauth2-proxy.

I would appreciate if someone could point me to the resource that has to be changed in order for my changes to stay valid.

Thank you.

PS: I have checked to cluster for any scheduling tasks or cron-jobs but didn't find anything.

[strekm]

hello Matthias,
Istio is Kyma managed module and any changes to Istio configuration will be reconciled back to original state provided by Istio module.
At this moment it is not possible to configure extension providers but this topic is on our roadmap.
Please let me know how we can support you, i'm open to meet and discuss matters.

Cheers,
Magda

[ReinertM]

Hi Magda,

thanks you for the swift response.
Maybe I am a bit ahead of time but implementation of the extension provider did actually work and I was able to authenticate via OIDC provider, however the reconsiliation of istio makes it unsuitable for productive deployments.
Nevertheless, I am interested to find out about the reconciliation process.
Feel free to send me an invite via my mail address mreinert@gambit.de or connect via LinkedIn.

Thanks a lot,
Matthias

[gabbi]

Hi Matthias,

I have sent you an invitation.

BR

Gaurav