Start testing Istio 1.3.6 solved critical CVE (CVE-2019-18801) (#6196)

This patch updates Istio version to 1.3.6 which solved CVE-2019-18801.

third_party/istio-1.3-latest

@@ -1 +1 @@
-istio-1.3.5
+istio-1.3.6

third_party/istio-1.3.5/download-istio.sh → third_party/istio-1.3.6/download-istio.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 # Download and unpack Istio
-ISTIO_VERSION=1.3.5
+ISTIO_VERSION=1.3.6
 DOWNLOAD_URL=https://github.com/istio/istio/releases/download/${ISTIO_VERSION}/istio-${ISTIO_VERSION}-linux.tar.gz
 
 wget --no-check-certificate $DOWNLOAD_URL

third_party/istio-1.3.5/istio-crds.yaml → third_party/istio-1.3.6/istio-crds.yaml

@@ -776,7 +776,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   namespace: istio-system
-  name: istio-init-crd-10-1.3.5
+  name: istio-init-crd-10-1.3.6
 spec:
   template:
     metadata:
@@ -786,7 +786,7 @@ spec:
       serviceAccountName: istio-init-service-account
       containers:
       - name: istio-init-crd-10
-        image: "docker.io/istio/kubectl:1.3.5"
+        image: "docker.io/istio/kubectl:1.3.6"
         imagePullPolicy: IfNotPresent
         volumeMounts:
         - name: crd-10
@@ -805,7 +805,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   namespace: istio-system
-  name: istio-init-crd-11-1.3.5
+  name: istio-init-crd-11-1.3.6
 spec:
   template:
     metadata:
@@ -815,7 +815,7 @@ spec:
       serviceAccountName: istio-init-service-account
       containers:
       - name: istio-init-crd-11
-        image: "docker.io/istio/kubectl:1.3.5"
+        image: "docker.io/istio/kubectl:1.3.6"
         imagePullPolicy: IfNotPresent
         volumeMounts:
         - name: crd-11
@@ -834,7 +834,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   namespace: istio-system
-  name: istio-init-crd-12-1.3.5
+  name: istio-init-crd-12-1.3.6
 spec:
   template:
     metadata:
@@ -844,7 +844,7 @@ spec:
       serviceAccountName: istio-init-service-account
       containers:
         - name: istio-init-crd-12
-          image: "docker.io/istio/kubectl:1.3.5"
+          image: "docker.io/istio/kubectl:1.3.6"
           imagePullPolicy: IfNotPresent
           volumeMounts:
             - name: crd-12

third_party/istio-1.3.5/istio-knative-extras.yaml → third_party/istio-1.3.6/istio-knative-extras.yaml

@@ -43,7 +43,7 @@ kind: ClusterRoleBinding
 metadata:
   name: istio-multi
   labels:
-    chart: istio-1.3.5
+    chart: istio-1.3.6
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -124,7 +124,7 @@ spec:
       serviceAccountName: cluster-local-gateway-service-account
       containers:
         - name: istio-proxy
-          image: "docker.io/istio/proxyv2:1.3.5"
+          image: "docker.io/istio/proxyv2:1.3.6"
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 15020

third_party/istio-1.3.5/istio-lean.yaml → third_party/istio-1.3.6/istio-lean.yaml

@@ -271,7 +271,7 @@ kind: ClusterRoleBinding
 metadata:
   name: istio-multi
   labels:
-    chart: istio-1.3.5
+    chart: istio-1.3.6
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -438,7 +438,7 @@ spec:
       serviceAccountName: cluster-local-gateway-service-account
       containers:
         - name: istio-proxy
-          image: "docker.io/istio/proxyv2:1.3.5"
+          image: "docker.io/istio/proxyv2:1.3.6"
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 15020
@@ -622,7 +622,7 @@ spec:
       serviceAccountName: istio-ingressgateway-service-account
       containers:
         - name: ingress-sds
-          image: "docker.io/istio/node-agent-k8s:1.3.5"
+          image: "docker.io/istio/node-agent-k8s:1.3.6"
           imagePullPolicy: IfNotPresent
           resources:
             limits:
@@ -646,7 +646,7 @@ spec:
           - name: ingressgatewaysdsudspath
             mountPath: /var/run/ingress_gateway
         - name: istio-proxy
-          image: "docker.io/istio/proxyv2:1.3.5"
+          image: "docker.io/istio/proxyv2:1.3.6"
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 15020
@@ -846,7 +846,7 @@ spec:
       serviceAccountName: istio-pilot-service-account
       containers:
         - name: discovery
-          image: "docker.io/istio/pilot:1.3.5"
+          image: "docker.io/istio/pilot:1.3.6"
           imagePullPolicy: IfNotPresent
           args:
           - "discovery"