istio shared cm per version and update svc cluster rollout order

the istio shared config map must exist for the targeted version prior to
upgrading the service

dev-infrastructure/svc-pipeline.yaml

@@ -102,6 +102,16 @@ resourceGroups:
   subscription: {{ .svc.subscription }}
   aksCluster: {{ .svc.aks.name }}
   steps:
+  # configure istio
+  - name: istio-config
+    action: Shell
+    command: make -C ../istio deploy
+    dryRun:
+      variables:
+        - name: DRY_RUN
+          value: "true"
+    dependsOn:
+    - istio-upgrade
   # - updates workload to use istio on version svc.istio.targetVersion
   # - configures istio IP tag usage
   - name: istio-upgrade
@@ -120,16 +130,6 @@ resourceGroups:
       configRef: svc.rg
     dependsOn:
     - svc
-  # configure istio
-  - name: istio-config
-    action: Shell
-    command: make -C ../istio deploy
-    dryRun:
-      variables:
-        - name: DRY_RUN
-          value: "true"
-    dependsOn:
-    - istio-upgrade
   # Install ACRpull
   - name: acrpull
     action: Shell

istio/Makefile

@@ -5,6 +5,7 @@ HELM_CMD ?= helm upgrade --install
 deploy:
 	${HELM_CMD} istio \
 		deploy/helm/istio/ \
+		--set "istioVersions={${ISTIO_VERSIONS}}" \
 		--namespace aks-istio-system
 .PHONY: deploy
 

istio/deploy/helm/istio/templates/istio-shared-configmap.yml

@@ -1,9 +1,11 @@
+{{ range $version := .Values.istioVersions }}
+---
 kind: ConfigMap
 apiVersion: v1
 metadata:
   labels:
-    istio.io/rev: asm-1-23
-  name: istio-shared-configmap-asm-1-23
+    istio.io/rev: {{ $version }}
+  name: istio-shared-configmap-{{ $version }}
   namespace: aks-istio-system
 data:
   mesh: |-
@@ -14,3 +16,4 @@ data:
         port: "8080"
         includeRequestHeadersInCheck: ["x-ext-authz"]
         pathPrefix: "/v1/EnvoyValidateRequest"
+{{ end }}

istio/deploy/helm/istio/values.yaml

@@ -1 +1 @@
-# This file is intentionally left blank.
+istioVersions: []

istio/pipeline.yaml

@@ -13,3 +13,6 @@ resourceGroups:
       variables:
         - name: DRY_RUN
           value: "true"
+    variables:
+      - name: ISTIO_VERSIONS
+        configRef: svc.istio.versions