Skip to content

Release 1.28#1536

Closed
rafaelvzago wants to merge 82 commits intoistio-ecosystem:release-1.28from
rafaelvzago:release-1.28
Closed

Release 1.28#1536
rafaelvzago wants to merge 82 commits intoistio-ecosystem:release-1.28from
rafaelvzago:release-1.28

Conversation

@rafaelvzago
Copy link
Copy Markdown
Contributor

What type of PR is this?

  • Enhancement / New Feature
  • Bug Fix
  • Refactor
  • Optimization
  • Test
  • Documentation Update

What this PR does / why we need it:

This PR prepares the release-1.28 branch for Istio 1.28.3:

  • Bumps operator VERSION to 1.28.3
  • Updates PREVIOUS_VERSION to 1.28.2
  • Removes alpha/development versions from versions.yaml (master, v1.30-alpha)
  • Regenerates manifests, charts, and bundle files

Which issue(s) this PR fixes:

Fixes #1532

Related Issue/PR #1533

Additional information:

This follows the standard release preparation process for adding a new Istio patch version to the operator.

sridhargaddam and others added 30 commits November 13, 2025 06:16
…em#1342)

This PR updates the commit-check GitHub action to validate only
the first commit in a PR instead of every commit. This avoids
validation for additional commits and provides some flexibility
when subsequent commits can be described by the PR title.

Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
…tem#1326)

* Add Claude Code command for updating EOL Istio versions

Adds a custom Claude Code slash command (/update-eol-versions) that
automates the process of marking End-of-Life Istio versions in
versions.yaml. The command fetches the current supported versions from
istio.io and updates the EOL status accordingly.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Filip Brychta <fbrychta@redhat.com>

* Be more specific about fields to be kept

Signed-off-by: Filip Brychta <fbrychta@redhat.com>

* Update .claude/commands/update-eol-versions.md

Co-authored-by: Francisco Herrera <fjglira@gmail.com>

* Update .claude/commands/update-eol-versions.md

Co-authored-by: Francisco Herrera <fjglira@gmail.com>

---------

Signed-off-by: Filip Brychta <fbrychta@redhat.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Francisco Herrera <fjglira@gmail.com>
When vendor mode is enabled in this project, the command "go list"
can return an empty string, causing errors while running "make gen"
command. This PR modifies the command to use "-mod=readonly" which
ensures the Go command properly resolves the module directory even
when vendoring is in use.

Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
Signed-off-by: Filip Brychta <fbrychta@redhat.com>
There doesn't seem to be a reason to test it on all versions, test it
only on latest patch version, as we do in all other multi cluster
tests.

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
…o-ecosystem#1347)

The problem causing operator-framework/operator-lifecycle-manager#3675
is reverted in 0.38.0 so we can use that version.

Signed-off-by: Filip Brychta <fbrychta@redhat.com>
…em#1357)

Update the codecov.yml ignore pattern from 'tests' to 'tests/**' to properly
exclude all files under the tests directory from coverage calculation.

This resolves the codecov/project failures for PRs that add e2e test
infrastructure code, which is not meant to be unit tested.

Related to: istio-ecosystem#1356

Signed-off-by: Rafael Zago <rafaelvzago@gmail.com>
istio-ecosystem#1346)

- Detect VERSION column dynamically

- Avoid relying on last-column extraction

Signed-off-by: Mikhail Abramov <mabramov@redhat.com>
…o-ecosystem#1368)

Adding some small changes into the templates to add more information into the api reference doc to show the API version and avoid confusion when you have more than one version of a CRD

Signed-off-by: Francisco Herrera <fjglira@gmail.com>
In case it was requested, don't delete the deployed operator.

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
We don't yet support helm v4 (see istio-ecosystem#1371).

Signed-off-by: Daniel Grimm <dgrimm@redhat.com>
…stio-ecosystem#1376)

Signed-off-by: openshift-service-mesh-bot <openshiftservicemeshbot@gmail.com>
…stio-ecosystem#1377)

Signed-off-by: openshift-service-mesh-bot <openshiftservicemeshbot@gmail.com>
…stio-ecosystem#1378)

Signed-off-by: openshift-service-mesh-bot <openshiftservicemeshbot@gmail.com>
Adding a update script into the update dependencies script to update automatically the istio versions in the docs each time that the istio versions are updated in the versions.yaml file



Remove backup creation



Adding compability with macOS for the script

Signed-off-by: Francisco Herrera <fjglira@gmail.com>
This adds the v1 CRD version of ZTunnel which we missed earlier.

Signed-off-by: Daniel Grimm <dgrimm@redhat.com>
The `Profile` field was removed from the v1 ZTunnel API
as part of the API graduation from v1alpha1 to v1. This
PR removes the associated printcolumn.

Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
Adding more information when the test run fails for all the sample applications namespaces and pods

Signed-off-by: Francisco Herrera <fjglira@gmail.com>
This PR includes the following changes.

1. Moved AGENTS.md to the repo root as its recommend to have it in the
   root repo - https://agents.md/#examples
   Several other projects seem to be following this convention.
2. Moved the domain knowledge files into the .agents folder
3. Added IstioRevisionTag to the project overview CRD list
4. Updated the docs to show how the resources relate to each other
5. Graduated the ztunnel CRD to v1
6. Fixed typos, broken links, and older references like IstioCNI v1alpha1
7. Updated the controller references and the test framework

Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
Claude does not currently support reading from
AGENTS.md, and there’s an open issue tracking it:
anthropics/claude-code#6235
This PR adds a workaround by embedding AGENTS.md into
CLAUDE.md so AGENTS.md can remain a living document.

Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
…1404)

The script was failing in CI with exit code 141 due to SIGPIPE when using 'head -n 2' with 'set -o pipefail'. This temporarily disables pipefail around the problematic command to handle the SIGPIPE gracefully while maintaining script safety.

Signed-off-by: Francisco Herrera <fjglira@gmail.com>
…#1405)

Adding a make target to use it lcoally and in a specific test to always check if the dependencies script is working



Avoid updating dependencies

Signed-off-by: Francisco Herrera <fjglira@gmail.com>
This PR includes the following changes

1. Corrects the kubectl command to use the kustomization directory
2. Updates the make target that publishes sample images to quay.io/sail-dev
3. Fixes broken links

Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
* E2E: Extract common function to await conditions

This code is very repetitive and verbose, extracting it to a common
function allows the tests to be much more concise and readable, without
affecting functionality.
The main benefit of this is making the tests easier to read and
maintain, and avoid repeating code (and making mistakes).

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>

* E2E: Add specific AwaitDeployment function

Most of the tests that await for the DeploymentAvailable condition do it
on the control plane namespace for a Deployment.
Extracting this specific case makes the tests even easier to read and
understand.

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>

* E2E: Add CheckSamplePodsReady function

Reuse CheckPodsReady and add a specific function CheckSamplePodsReady
since most of the calls are on the sample namespace.
Both checks are now in the `checks.go` file for logical consistency.

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>

* E2E: Extract waiting for CNI DaemonSet to be ready

This is repetitive and verbose, extracting this makes the tests easier to
read and maintain.

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>

---------

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
The update istio version in doc script was missing the main readme file because of the path passed

Signed-off-by: Francisco Herrera <fjglira@gmail.com>
This commit fixes substantial content changes that were incorrectly
introduced during the markdown to AsciiDoc migration in commit
e823206. The fixes restore missing
content and correct broken links while preserving all changes made
after the migration commit.

Changes in docs/README.adoc:
- Fix broken internal link: changed guidelines.md to guidelines.adoc

Changes in docs/deployment-models/multicluster.adoc:

Primary-Remote - Single-Network section:
- Restore missing 'externalIstiod: true' in Istio resource on cluster1
- Restore missing step 2: Create east-west gateway on cluster1
- Restore missing step 3: Expose istiod on cluster1
- Fix remotePilotAddress: use istio-eastwestgateway ClusterIP instead
  of istiod LoadBalancer IP
- Restore missing istiodRemote.injectionPath configuration
- Restore missing step 5: Set control plane cluster annotation
- Fix remote secret name: change from 'cluster2' to 'remote'
- Restore missing kind-specific instructions for REMOTE_CONTAINER_IP
- Fix external links: restore primary-remote/ URLs (removed
  _single-network)
- Fix verification steps: restore single curl commands (removed loops)
- Fix cleanup order to match original
- Fix wait command format to match original (inline with apply)

Primary-Remote - Multi-Network section:
- Remove incorrectly added network label command
- Fix step title to match original

All fixes preserve later changes (e.g., version updates from commit
d2cbd96) and only revert unwanted changes from the migration commit.

Refs: e823206
Fixes: istio-ecosystem#1373

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
…1122)

* update docs: add terminology

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* Add docs for istio nftables

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* Add installation steps on OpenShift

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* Update Istio nftables doc

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* update doc

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* update docs

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* add converted ascii istio-nftables.adoc

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* remove markdown doc file

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* update docs: fix typo and commit check

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* update docs

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* review updates

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* update istio-nftables doc

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* doc: update nftables doc upgrade part (istio-ecosystem#1122)

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* review updates

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* remove unused sample files

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

* update version tag

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

---------

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>
Add "/setup-dev-env" command for setting up a local dev environment with
KIND, a local operator build, Istio, sample apps, and connectivity tests.

Key changes:
- The "/setup-dev-env" supports both sidecar and ambient profiles.
- The sail operator, built from local source code is deployed to the
  kind cluster.
- Sample apps (sleep and httpbin) use local kustomization files.
- Connectivity checks include mTLS validation.
- The command ends with a short summary and suggested next steps.

Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
…tio-ecosystem#1353)

* Expose common namespaces in E2E tests

To be able to use directly without redefining or passing them all over.

The namespaces are reused in the test suite files (instead of redefined)
in order to minimize the amount of changes, but we can further refactor
this in the future.

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>

* Extract multicluster resource creation

This males tests easier to maintain while avoiding code duplication

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>

* Add Ambient tests to E2E Multi Primary

Istio 1.27+ supports running Multi-Primary deployments in Abmient mode,
so tests were adapted to run both on Sidecar and Ambient mode.

Both modes run the same tests, sequentialy & independently of each
other.

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>

---------

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
…stio-ecosystem#1413)

Signed-off-by: openshift-service-mesh-bot <openshiftservicemeshbot@gmail.com>
rikatz and others added 23 commits January 6, 2026 10:17
Signed-off-by: Ricardo Pchevuzinske Katz <katz@redhat.com>
…stio-ecosystem#1475)

Signed-off-by: openshift-service-mesh-bot <openshiftservicemeshbot@gmail.com>
…em#1472)

* E2E: Add a validation for E/W GW to get LB IP

This might take a while, expecially on a public cloud.
Make sure the tests wait for the IP to be assigned before proceeding,
otherwise they'll get stuck later waiting for the communication to
proceed (and sometimes fail).

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>

* E2E: Add check that multicluster gateway rechable

To rule out infrastructure problems, a sanity check is added to try and
reach the gateway on the other side.
If this check fails, this could indicate an infrastructure problem.

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>

* E2E: Improve connectivity checking in multicluster

Having curl fetch the URL several times saves time waiting on responses
since it's much cheaper than each `exec` call.
This makes successful tests finish much faster instead of waiting for
the response to randomly land on the expected version.

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>

---------

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
)

This should copy over required metadata.

Signed-off-by: Nick Fox <nfox@redhat.com>
This should prevent ERROR: failed to build: failed to read GITHUB_EVENT_PATH "/home/runner/work/_temp/_github_workflow/event.json"

Signed-off-by: Filip Brychta <fbrychta@redhat.com>
The old logic was complex and prone to timing out on actual cloud
environments where it takes more time to delete resources.

It was rewritten to be simpler and easier to understand by using
Eventually which uses the default parameters the tests use for such
long-running polling operations.

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
)

The types we're removed in istio/istio and need to be added back to the transformer for the CRD schema.

Signed-off-by: Nick Fox <nfox@redhat.com>
…stio-ecosystem#1506)

Signed-off-by: openshift-service-mesh-bot <openshiftservicemeshbot@gmail.com>
…stio-ecosystem#1507)

Signed-off-by: openshift-service-mesh-bot <openshiftservicemeshbot@gmail.com>
…cosystem#1511)

Fix failed versions-triggered-build action workflow by adding setup
buildx step.

Signed-off-by: Maxim Babushkin <mbabushk@redhat.com>
…stio-ecosystem#1512)

Signed-off-by: openshift-service-mesh-bot <openshiftservicemeshbot@gmail.com>
…stio-ecosystem#1515)

Signed-off-by: openshift-service-mesh-bot <openshiftservicemeshbot@gmail.com>
…stio-ecosystem#1516)

Signed-off-by: openshift-service-mesh-bot <openshiftservicemeshbot@gmail.com>
…o-ecosystem#1505)

This commit adds documentation for deploying Istio in multi-primary multi-network ambient mode using the Sail Operator.

Signed-off-by: Mikhail Abramov <mabramov@redhat.com>
…stio-ecosystem#1520)

Signed-off-by: openshift-service-mesh-bot <openshiftservicemeshbot@gmail.com>
…1519)

The validate_spec_components function in configuration-converter.sh was
failing with "Error: bad expression, please check expression syntax"
on extracting "components" keys.

The original command attempted to delete non-"enabled" keys using:
del(.spec.components.[] | keys[] | select(. != "enabled"))

This failed because:
- `.spec.components.[]` incorrectly tries to iterate over object values
- `keys[]` syntax doesn't work in this pipeline context in yq v4
- `select(. != "enabled")` references values instead of key names
- No proper context management for applying deletions back to document

Replaced with proper yq v4 syntax using the `with()` function.

Signed-off-by: Maxim Babushkin <mbabushk@redhat.com>
…stio-ecosystem#1527)

Signed-off-by: openshift-service-mesh-bot <openshiftservicemeshbot@gmail.com>
…stem#1514)

* Enable external registry support for OCP e2e tests in CI

Signed-off-by: Francisco Herrera <fjglira@gmail.com>

Revert "Enable external registry support for OCP e2e tests in CI"

This reverts commit 5f33138.

Enable external registry support for OCP e2e tests in CI

Signed-off-by: Francisco Herrera <fjglira@gmail.com>

* Fix lint

Signed-off-by: Francisco Herrera <fjglira@gmail.com>

* Update tests/e2e/common-operator-integ-suite.sh

Co-authored-by: Filip Brychta <fbrychta@redhat.com>
Signed-off-by: Francisco Herrera <fjglira@gmail.com>

* Add some improvements around the use of internal registry

Signed-off-by: Francisco Herrera <fjglira@gmail.com>

---------

Signed-off-by: Francisco Herrera <fjglira@gmail.com>
Co-authored-by: Filip Brychta <fbrychta@redhat.com>
This change updates the End-of-Life versions for Istio to the latest
supported releases in the sail-operator.

Signed-off-by: pbajjuri20 <pbajjuri@redhat.com>
…stio-ecosystem#1530)

Signed-off-by: openshift-service-mesh-bot <openshiftservicemeshbot@gmail.com>
…stio-ecosystem#1534)

Signed-off-by: openshift-service-mesh-bot <openshiftservicemeshbot@gmail.com>
@rafaelvzago rafaelvzago requested a review from a team as a code owner January 23, 2026 15:57
@istio-testing
Copy link
Copy Markdown
Collaborator

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@istio-testing
Copy link
Copy Markdown
Collaborator

Hi @rafaelvzago. Thanks for your PR.

I'm waiting for a istio-ecosystem or istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.