Fix usages of istioctl create-remote-secret

By default, istioctl creates the ServiceAccount if it doesn't yet exist. If you run the `create-remote-secret` command before you create the Istio resource, the ServiceAccount won't yet exist and will therefore be created, along with a ClusterRole and ClusterRoleBinding. This will later cause the reconciliation of the Istio resource to fail because Helm will refuse to overwrite these resources.

Signed-off-by: Marko Lukša <[email protected]>

docs/README.md

@@ -940,7 +940,8 @@ These installation instructions are adapted from: https://istio.io/latest/docs/s
     ```sh
     istioctl create-remote-secret \
       --context="${CTX_CLUSTER1}" \
-      --name=cluster1 | \
+      --name=cluster1 \
+      --create-service-account=false | \
       kubectl apply -f - --context="${CTX_CLUSTER2}"
     ```
 
@@ -951,7 +952,8 @@ These installation instructions are adapted from: https://istio.io/latest/docs/s
     istioctl create-remote-secret \
       --context="${CTX_CLUSTER1}" \
       --name=cluster1 \
-      --server="https://${CLUSTER1_CONTAINER_IP}:6443" | \
+      --server="https://${CLUSTER1_CONTAINER_IP}:6443" \
+      --create-service-account=false | \
       kubectl apply -f - --context "${CTX_CLUSTER2}"
     ```
 
@@ -960,7 +962,8 @@ These installation instructions are adapted from: https://istio.io/latest/docs/s
     ```sh
     istioctl create-remote-secret \
       --context="${CTX_CLUSTER2}" \
-      --name=cluster2 | \
+      --name=cluster2 \
+      --create-service-account=false | \
       kubectl apply -f - --context="${CTX_CLUSTER1}"
     ```
 
@@ -971,7 +974,8 @@ These installation instructions are adapted from: https://istio.io/latest/docs/s
     istioctl create-remote-secret \
       --context="${CTX_CLUSTER2}" \
       --name=cluster2 \
-      --server="https://${CLUSTER2_CONTAINER_IP}:6443" | \
+      --server="https://${CLUSTER2_CONTAINER_IP}:6443" \
+      --create-service-account=false | \
       kubectl apply -f - --context "${CTX_CLUSTER1}"
     ```
 
@@ -1133,7 +1137,8 @@ In this setup there is a Primary cluster (`cluster1`) and a Remote cluster (`clu
     ```sh
     istioctl create-remote-secret \
       --context="${CTX_CLUSTER2}" \
-      --name=remote | \
+      --name=remote \
+      --create-service-account=false | \
       kubectl apply -f - --context="${CTX_CLUSTER1}"
     ```
 
@@ -1144,7 +1149,8 @@ In this setup there is a Primary cluster (`cluster1`) and a Remote cluster (`clu
     istioctl create-remote-secret \
       --context="${CTX_CLUSTER2}" \
       --name=remote \
-      --server="https://${REMOTE_CONTAINER_IP}:6443" | \
+      --server="https://${REMOTE_CONTAINER_IP}:6443" \
+      --create-service-account=false | \
       kubectl apply -f - --context "${CTX_CLUSTER1}"
     ```
 

docs/multicluster/setup-multi-primary.sh

@@ -166,7 +166,8 @@ WEST_CONTAINER_IP=$(kubectl get nodes east-control-plane --context "${CTX_CLUSTE
 istioctl create-remote-secret \
   --context="${CTX_CLUSTER1}" \
   --name=east \
-  --server="https://${WEST_CONTAINER_IP}:6443" | \
+  --server="https://${WEST_CONTAINER_IP}:6443" \
+  --create-service-account=false | \
   kubectl apply -f - --context "${CTX_CLUSTER2}"
 
 # 11. Install a remote secret in east that provides access to west’s API server.
@@ -175,7 +176,8 @@ EAST_CONTAINER_IP=$(kubectl get nodes west-control-plane --context "${CTX_CLUSTE
 istioctl create-remote-secret \
   --context="${CTX_CLUSTER2}" \
   --name=west \
-  --server="https://${EAST_CONTAINER_IP}:6443" | \
+  --server="https://${EAST_CONTAINER_IP}:6443" \
+  --create-service-account=false | \
   kubectl apply -f - --context "${CTX_CLUSTER1}"
 
 # 12. Deploy sample applications and verify that you get a response from both v1 and v2 of the helloworld service.

tests/e2e/util/istioctl/istioctl.go

@@ -48,7 +48,7 @@ func istioctl(format string, args ...interface{}) string {
 // - secretName: name of the secret
 // - internalIP: internal IP of the remote cluster
 func CreateRemoteSecret(remoteKubeconfig string, secretName string, internalIP string) (string, error) {
-	cmd := istioctl("create-remote-secret --kubeconfig %s --name %s --server=https://%s:6443", remoteKubeconfig, secretName, internalIP)
+	cmd := istioctl("create-remote-secret --kubeconfig %s --name %s --server=https://%s:6443 --create-service-account=false", remoteKubeconfig, secretName, internalIP)
 	yaml, err := shell.ExecuteCommand(cmd)
 
 	return yaml, err