Make Serving service mesh tests more stable

Makefile

@@ -25,6 +25,7 @@ install-serving:
 	INSTALL_EVENTING="false" ./hack/install.sh
 
 install-serving-with-mesh:
+	FULL_MESH="true" UNINSTALL_MESH="false" ./hack/mesh.sh
 	FULL_MESH=true SCALE_UP=4 INSTALL_SERVING=true INSTALL_EVENTING="false" ./hack/install.sh
 
 install-eventing:

hack/lib/mesh.bash

@@ -128,6 +128,10 @@ function deploy_gateways {
 }
 
 function undeploy_gateways {
+  oc delete -n serverless-tests -f "${resources_dir}"/network-policy-monitoring.yaml --ignore-not-found || return $?
+  for ns in serverless-tests eventing-e2e0 eventing-e2e1 eventing-e2e2 eventing-e2e3 eventing-e2e4; do
+    oc delete -n "$ns" -f "${resources_dir}"/kafka-service-entry.yaml --ignore-not-found || return $?
+  done
   oc delete -f "${resources_dir}"/peerauthentication.yaml --ignore-not-found || return $?
   oc delete -f "${resources_dir}"/gateway.yaml --ignore-not-found || return $?
   oc delete -f "${resources_dir}"/smmr.yaml --ignore-not-found || return $?

hack/lib/mesh_resources/gateway.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: knative-serving
 spec:
   selector:
-    istio: ingressgateway
+    knative: ingressgateway
   servers:
     - port:
         number: 443
@@ -24,7 +24,7 @@ metadata:
   namespace: knative-serving
 spec:
   selector:
-    istio: ingressgateway
+    knative: ingressgateway
   servers:
     - port:
         number: 8081

hack/lib/mesh_resources/namespace.yaml

@@ -7,3 +7,51 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: knative-eventing
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: serving-tests
+  labels:
+    maistra.io/member-of: istio-system # Workaround for OSSM-1397
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: serving-tests-alt
+  labels:
+    maistra.io/member-of: istio-system # Workaround for OSSM-1397
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: serverless-tests
+  labels:
+    maistra.io/member-of: istio-system # Workaround for OSSM-1397
+---
+# Additional namespaces for upgrade tests
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: eventing-e2e0
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: eventing-e2e1
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: eventing-e2e2
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: eventing-e2e3
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: eventing-e2e4
+---

hack/lib/mesh_resources/smcp.yaml

@@ -6,6 +6,16 @@ metadata:
 spec:
   profiles:
   - default
+  techPreview:
+    meshConfig:
+      defaultConfig:
+        terminationDrainDuration: 35s
+  gateways:
+    ingress:
+      service:
+        metadata:
+          labels:
+            knative: ingressgateway
   proxy:
     networking:
       trafficControl:

hack/lib/mesh_resources/smmr.yaml

@@ -1,49 +1,3 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: serving-tests
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: serving-tests-alt
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: serverless-tests
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: serverless-tests2
----
-# Additional namespaces for upgrade tests
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: eventing-e2e0
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: eventing-e2e1
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: eventing-e2e2
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: eventing-e2e3
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: eventing-e2e4
----
 apiVersion: maistra.io/v1
 kind: ServiceMeshMemberRoll
 metadata:

serving/metadata-webhook/config/100-namespace.yaml

@@ -4,3 +4,4 @@ metadata:
   name: serving-tests
   labels:
     samples.knative.dev/release: devel
+    maistra.io/member-of: istio-system # Workaround for OSSM-1397

serving/metadata-webhook/pkg/defaults/ksvc_defaults.go

@@ -14,9 +14,6 @@ const (
 	sidecarrewriteAppHTTPProbers    = "sidecar.istio.io/rewriteAppHTTPProbers"
 	proxyIstioConfig                = "proxy.istio.io/config"
 	holdApplicationUntilProxyStarts = `{ "holdApplicationUntilProxyStarts": true }`
-
-	maistraProxyEnv          = "sidecar.maistra.io/proxyEnv"
-	terminationDrainDuration = `{ "TERMINATION_DRAIN_DURATION_SECONDS": "20" }`
 )
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
@@ -46,7 +43,6 @@ func (r *TargetKService) SetDefaults(_ context.Context) {
 
 	r.Spec.Template.Annotations[sidecarInject] = "true"
 	r.Spec.Template.Annotations[sidecarrewriteAppHTTPProbers] = "true"
-	r.Spec.Template.Annotations[maistraProxyEnv] = terminationDrainDuration
 	r.Spec.Template.Annotations[proxyIstioConfig] = holdApplicationUntilProxyStarts
 }
 

serving/metadata-webhook/pkg/defaults/ksvc_defaults_test.go

@@ -33,7 +33,6 @@ func TestTargetKServiceDefaulting(t *testing.T) {
 									proxyIstioConfig:             holdApplicationUntilProxyStarts,
 									sidecarInject:                "true",
 									sidecarrewriteAppHTTPProbers: "true",
-									maistraProxyEnv:              terminationDrainDuration,
 								},
 							},
 						},
@@ -57,7 +56,6 @@ func TestTargetKServiceDefaulting(t *testing.T) {
 								Annotations: map[string]string{
 									sidecarInject:                "false",
 									sidecarrewriteAppHTTPProbers: "false",
-									maistraProxyEnv:              `{ "TERMINATION_DRAIN_DURATION_SECONDS": "5" }`,
 								},
 							},
 						},
@@ -80,7 +78,6 @@ func TestTargetKServiceDefaulting(t *testing.T) {
 									proxyIstioConfig:             holdApplicationUntilProxyStarts,
 									sidecarInject:                "true",
 									sidecarrewriteAppHTTPProbers: "true",
-									maistraProxyEnv:              terminationDrainDuration,
 								},
 							},
 						},

test/serving.bash

@@ -21,6 +21,10 @@ function prepare_knative_serving_tests {
 
   # Create test resources (namespaces, configMaps, secrets)
   oc apply -f test/config/cluster-resources.yaml
+  # Workaround for https://issues.redhat.com/browse/OSSM-1397
+  if [[ $FULL_MESH == "true" ]]; then
+    oc label namespace serving-tests maistra.io/member-of=istio-system --overwrite
+  fi
   oc apply -f test/config/test-resources.yaml
   # Adding scc for anyuid to test TestShouldRunAsUserContainerDefault.
   oc adm policy add-scc-to-user anyuid -z default -n serving-tests
@@ -77,6 +81,12 @@ function upstream_knative_serving_e2e_and_conformance_tests {
     parallel=2
   fi
 
+  if [[ $FULL_MESH == "true" ]]; then
+    # reconfiguring istio-proxies is flaky on too much parallelism,
+    # random pods will fail to start with `PostStartHook failed`
+    parallel=8
+  fi
+
   mv ./test/e2e/autoscale_test.go ./test/e2e/autoscale_test.backup
 
   SYSTEM_NAMESPACE="$SERVING_NAMESPACE" go_test_e2e -tags="e2e" -timeout=30m -parallel=$parallel \