Fix infinite reconcile loop when Istio version is EOL

controllers/istio/istio_controller.go

@@ -123,6 +123,9 @@ func validate(istio *v1.Istio) error {
 func (r *Reconciler) reconcileActiveRevision(ctx context.Context, istio *v1.Istio) error {
 	version, err := istioversion.Resolve(istio.Spec.Version)
 	if err != nil {
+		if istioversion.IsEOLVersion(istio.Spec.Version) {
+			return reconciler.NewValidationError(fmt.Sprintf("version %q is end-of-life and cannot be installed; use a supported version", istio.Spec.Version))
+		}
 		return fmt.Errorf("failed to resolve Istio version for %q: %w", istio.Name, err)
 	}
 	values, err := revision.ComputeValues(

pkg/istioversion/version.go

@@ -84,6 +84,16 @@ func Resolve(version string) (string, error) {
 	return info.Name, nil
 }
 
+// IsEOLVersion returns true if the version is known but has been marked end-of-life.
+func IsEOLVersion(version string) bool {
+	for _, eolVersion := range EOL {
+		if eolVersion == version {
+			return true
+		}
+	}
+	return false
+}
+
 func init() {
 	// we can't use ldflags when running tests, use an env variable instead
 	// tmp workaround for https://github.com/golang/go/issues/64246

pkg/istioversion/version_test.go

@@ -82,13 +82,18 @@ versions:
 	assert.Equal(t, "v0.1", eolVersions[0])
 
 	Map = versionMap
+	EOL = eolVersions
 	resolved, err := Resolve("latest")
 	assert.NoError(t, err)
 	assert.Equal(t, "v2.0.0", resolved)
 
 	resolved, err = Resolve("nonexistent-version")
 	assert.Error(t, err)
 	assert.Equal(t, "", resolved)
+
+	assert.True(t, IsEOLVersion("v0.1"))
+	assert.False(t, IsEOLVersion("nonexistent-version"))
+	assert.False(t, IsEOLVersion("v1.0.0"))
 }
 
 func TestParseVersionsYaml_SingleVersion(t *testing.T) {

pkg/reconcile/cni.go

@@ -70,6 +70,9 @@ func (r *CNIReconciler) Validate(ctx context.Context, version, namespace string)
 func (r *CNIReconciler) ComputeValues(version string, userValues *v1.CNIValues, profile string) (helm.Values, error) {
 	resolvedVersion, err := istioversion.Resolve(version)
 	if err != nil {
+		if istioversion.IsEOLVersion(version) {
+			return nil, reconciler.NewValidationError(fmt.Sprintf("version %q is end-of-life and cannot be installed; use a supported version", version))
+		}
 		return nil, fmt.Errorf("failed to resolve CNI version: %w", err)
 	}
 

pkg/reconcile/ztunnel.go

@@ -71,6 +71,9 @@ func (r *ZTunnelReconciler) Validate(ctx context.Context, version, namespace str
 func (r *ZTunnelReconciler) ComputeValues(version string, userValues *v1.ZTunnelValues) (helm.Values, error) {
 	resolvedVersion, err := istioversion.Resolve(version)
 	if err != nil {
+		if istioversion.IsEOLVersion(version) {
+			return nil, reconciler.NewValidationError(fmt.Sprintf("version %q is end-of-life and cannot be installed; use a supported version", version))
+		}
 		return nil, fmt.Errorf("failed to resolve ZTunnel version: %w", err)
 	}
 

tests/integration/api/istio_test.go

@@ -534,7 +534,7 @@ var _ = Describe("Istio resource", Ordered, func() {
 				}
 				Expect(k8sClient.Create(ctx, istio, &client.CreateOptions{})).To(Succeed())
 				Eventually(getObject).WithArguments(ctx, k8sClient, istioKey, istio).
-					Should(HaveConditionMessage(v1.IstioConditionReconciled, "failed to resolve Istio version"))
+					Should(HaveConditionMessage(v1.IstioConditionReconciled, "is end-of-life and cannot be installed"))
 			})
 		})
 	})