openshift-service-mesh · openshift-merge-bot · Feb 12, 2026 · Jan 17, 2026 · Jan 18, 2026 · Jan 19, 2026
diff --git a/.claude/commands/refactor.md b/.claude/commands/refactor.md
@@ -0,0 +1,144 @@
+# Refactor Code
+
+This command helps refactor code while maintaining quality, testability, and adherence to project conventions.
+
+## Tasks
+
+1. **Understand the current code**:
+   - Read the file(s) or code sections to be refactored
+   - Understand the current functionality and behavior
+   - Identify any existing tests that cover this code
+   - Note any dependencies and usage patterns
+
+2. **Identify refactoring opportunities**:
+   - Look for code smells (duplication, complex functions, unclear naming, etc.)
+   - Check for violations of SOLID principles or Go best practices
+   - Identify areas that could benefit from better separation of concerns
+   - Consider testability improvements
+   - Look for opportunities to reduce complexity
+   - Check side effects in the current code that might be lost if logic is moved
+
+3. **Plan the refactoring**:
+   - Define what will be changed and why
+   - Ensure the refactoring maintains existing functionality (no behavior changes)
+   - Consider backwards compatibility and API stability
+   - Plan how to verify the refactoring doesn't break anything
+   - For significant refactorings, consider breaking into smaller steps
+
+4. **Execute the refactoring**:
+   - Make the code changes following Go best practices
+   - Follow the Sail Operator code conventions:
+     - Use descriptive variable and function names
+     - Keep functions focused and small
+     - Separate business logic from Kubernetes controller logic when possible
+     - Use interfaces for testability
+     - Add error handling where appropriate
+   - Preserve existing comments that are still relevant
+   - Update or add comments only where the logic isn't self-evident
+   - If a line of code is fine as-is, don't change it just for the sake of change. Focus on the core improvement areas.
+
+5. **Update or add tests**:
+   - Ensure existing tests still pass
+   - Add new tests if the refactoring exposed previously untestable code
+   - Update tests if function signatures or behavior changed
+   - Run `make test` to verify all unit tests pass
+
+6. **Verify the changes**:
+   - Run `make lint` to ensure code style compliance
+   - Run `make test` for unit tests
+   - For controller changes, consider running `make test.integration`
+   - Review the diff to ensure no unintended changes were made
+
+7. **Summarize the refactoring**:
+   - List the files changed
+   - Describe the improvements made
+   - Note any potential impacts or follow-up work needed
+   - Suggest commit message following the format below
+
+## Commit Message Format
+
+When suggesting a commit message for refactored code, use this format:
+
+```
+<brief description of the refactoring>
+
+<detailed explanation of what was refactored and why>
+
+Co-authored-by: Claude Code <noreply@anthropic.com>
+```
+
+**Example:**
+```
+Refactor reconciliation error handling
+
+Extract common error handling logic into a shared helper function
+to reduce code duplication across controllers. This improves
+maintainability and ensures consistent error handling behavior.
+
+Co-authored-by: Claude Code <noreply@anthropic.com>
+```
+
+## Important Notes
+
+- **No behavior changes**: Refactoring should preserve existing functionality
+- **Keep it focused**: Don't mix refactoring with new features or bug fixes
+- **Test coverage**: Ensure tests still pass and cover the refactored code
+- **Incremental approach**: For large refactorings, break into smaller, reviewable chunks
+- **Avoid over-engineering**: Don't add abstractions or patterns that aren't currently needed
+- **API compatibility**: Be extra careful with changes to public APIs or CRD types. Prioritize refactoring internal logic over changing exported function signatures unless specifically requested.
+- **Sign commits**: Remember to use `-s` flag when committing
+- **Attribution**: Always include `Co-authored-by: Claude Code <noreply@anthropic.com>` in commit messages
+
+## Common Refactoring Patterns
+
+### Extract Function
+When a function is too long or does multiple things:
+```go
+// Before
+func ProcessRequest(req Request) error {
+    // 50 lines of code doing multiple things
+}
+
+// After
+func ProcessRequest(req Request) error {
+    if err := validateRequest(req); err != nil {
+        return err
+    }
+    return executeRequest(req)
+}
+```
+
+### Remove Duplication
+When similar code appears in multiple places:
+```go
+// Before: Duplicated error handling in multiple functions
+
+// After: Extracted to a shared helper
+func handleReconcileError(err error, resource string) {
+    // Common error handling logic
+}
+```
+
+### Simplify Conditionals
+When conditions are complex or nested:
+```go
+// Before
+if !isEnabled || (config != nil && config.Mode == "disabled") {
+    return
+}
+
+// After
+if shouldSkip(isEnabled, config) {
+    return
+}
+```
+
+### Improve Names
+When variable or function names are unclear:
+```go
+// Before
+func proc(d []byte) error { ... }
+
+// After
+func processManifest(manifestData []byte) error { ... }
+```
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
@@ -1,6 +1,6 @@
 {
   "name": "istio build-tools",
-  "image": "gcr.io/istio-testing/build-tools:master-32187b891c5e9353c42b45ab386fb5afeb2f1c6b",
+  "image": "gcr.io/istio-testing/build-tools:master-011fa76a5d2c95261e3b6d31b44e3dc1e74d43bf",
   "privileged": true,
   "remoteEnv": {
     "USE_GKE_GCLOUD_AUTH_PLUGIN": "True",

diff --git a/.github/workflows/update-deps.yaml b/.github/workflows/update-deps.yaml
@@ -16,7 +16,7 @@ jobs:
   update-deps:
     runs-on: ubuntu-latest
     container:
-      image: gcr.io/istio-testing/build-tools:master-32187b891c5e9353c42b45ab386fb5afeb2f1c6b
+      image: gcr.io/istio-testing/build-tools:master-011fa76a5d2c95261e3b6d31b44e3dc1e74d43bf
       options: --entrypoint ''
 
     steps:

diff --git a/.github/workflows/update-eol-versions.yaml b/.github/workflows/update-eol-versions.yaml
@@ -0,0 +1,43 @@
+name: Update EOL Versions
+
+on:
+  schedule:
+    - cron: "0 2 * * *" # Nightly
+  workflow_dispatch: # Allow manual trigger
+
+run-name: update-eol-versions
+
+env:
+  GIT_USER: ${{ secrets.GIT_USER }}
+  GH_TOKEN: ${{ secrets.GIT_TOKEN }}
+  AUTOMATOR_ORG: istio-ecosystem
+  AUTOMATOR_REPO: sail-operator
+
+jobs:
+  update-eol-versions:
+    runs-on: ubuntu-latest
+    container:
+      image: gcr.io/istio-testing/build-tools:master-eebcdda8856e2d4f528991d27d4808880cce4c52
+      options: --entrypoint ''
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        repository: istio/test-infra
+        ref: master
+
+    # this is a workaround for a permissions issue when using the istio build container
+    - run: git config --system --add safe.directory /__w/sail-operator/sail-operator
+
+    - name: Run Automator to update EOL versions
+      run: |
+        ./tools/automator/automator.sh \
+          --org=$AUTOMATOR_ORG \
+          --repo=sail-operator \
+          --branch=main \
+          '--title=Automator: Update EOL Istio versions in $AUTOMATOR_ORG/$AUTOMATOR_REPO@main' \
+          --email=openshiftservicemeshbot@gmail.com \
+          --modifier=update_eol_versions \
+          --token-env \
+          --cmd='BUILD_WITH_CONTAINER=0 ./tools/update_eol_versions.sh' \
+          --signoff
diff --git a/Dockerfile b/Dockerfile
@@ -14,7 +14,6 @@ ARG TARGETOS TARGETARCH
 COPY --from=packager /output /
 
 ADD out/${TARGETOS:-linux}_${TARGETARCH:-amd64}/sail-operator /sail-operator
-ADD resources /var/lib/sail-operator/resources
 
 USER 65532:65532
 WORKDIR /

diff --git a/Makefile.core.mk b/Makefile.core.mk
@@ -218,8 +218,8 @@ test.integration: envtest ## Run integration tests located in the tests/integrat
 	go run github.com/onsi/ginkgo/v2/ginkgo --tags=integration --junit-report=junit-integration.xml --output-dir="$(ARTIFACTS)" $(GINKGO_FLAGS) ./tests/integration/...
 
 .PHONY: test.scorecard
-test.scorecard: operator-sdk ## Run the operator scorecard test.
-	OPERATOR_SDK=$(OPERATOR_SDK) ${SOURCE_DIR}/tests/scorecard-test.sh
+test.scorecard: operator-sdk ## Run the operator scorecard test. Use OCP=true to run against an existing OCP cluster instead of Kind.
+	OCP=$${OCP:-false} OPERATOR_SDK=$(OPERATOR_SDK) SCORECARD_NAMESPACE="$${SCORECARD_NAMESPACE:-scorecard-test}" ${SOURCE_DIR}/tests/scorecard-test.sh
 
 .PHONY: test.e2e.ocp
 test.e2e.ocp: istioctl ## Run the end-to-end tests against an existing OCP cluster. While running on OCP in downstream you need to set ISTIOCTL_DOWNLOAD_URL to the URL where the istioctl productized binary.
@@ -251,7 +251,7 @@ build: build-$(TARGET_ARCH) ## Build the sail-operator binary.
 
 .PHONY: run
 run: gen ## Run a controller from your host.
-	POD_NAMESPACE=${NAMESPACE} go run ./cmd/main.go --config-file=./hack/config.properties --resource-directory=./resources
+	POD_NAMESPACE=${NAMESPACE} go run ./cmd/main.go --config-file=./hack/config.properties
 
 # docker build -t ${IMAGE} --build-arg GIT_TAG=${GIT_TAG} --build-arg GIT_REVISION=${GIT_REVISION} --build-arg GIT_STATUS=${GIT_STATUS} .
 .PHONY: docker-build
@@ -568,14 +568,14 @@ MISSPELL ?= $(LOCALBIN)/misspell
 
 ## Tool Versions
 OPERATOR_SDK_VERSION ?= v1.42.0
-HELM_VERSION ?= v3.19.5
+HELM_VERSION ?= v3.20.0
 CONTROLLER_TOOLS_VERSION ?= v0.20.0
-CONTROLLER_RUNTIME_BRANCH ?= release-0.22
-OPM_VERSION ?= v1.61.0
-OLM_VERSION ?= v0.38.0
+CONTROLLER_RUNTIME_BRANCH ?= release-0.23
+OPM_VERSION ?= v1.63.0
+OLM_VERSION ?= v0.40.0
 GITLEAKS_VERSION ?= v8.30.0
 ISTIOCTL_VERSION ?= 1.26.2
-RUNME_VERSION ?= 3.16.4
+RUNME_VERSION ?= 3.16.5
 MISSPELL_VERSION ?= v0.3.4
 
 .PHONY: helm $(HELM)

diff --git a/README.md b/README.md
@@ -2,6 +2,7 @@
 [![integration test badge](https://github.com/istio-ecosystem/sail-operator/actions/workflows/integration-tests.yaml/badge.svg)](https://github.com/istio-ecosystem/sail-operator/actions/workflows/integration-tests.yaml)
 [![update-deps badge](https://github.com/istio-ecosystem/sail-operator/actions/workflows/update-deps.yaml/badge.svg)](https://github.com/istio-ecosystem/sail-operator/actions/workflows/update-deps.yaml)
 [![nightly-images badge](https://github.com/istio-ecosystem/sail-operator/actions/workflows/nightly-images.yaml/badge.svg)](https://github.com/istio-ecosystem/sail-operator/actions/workflows/nightly-images.yaml)
+[![update-eol-versions badge](https://github.com/istio-ecosystem/sail-operator/actions/workflows/update-eol-versions.yaml/badge.svg)](https://github.com/istio-ecosystem/sail-operator/actions/workflows/update-eol-versions.yaml)
 
 # Sail Operator
 
@@ -89,7 +90,7 @@ spec:
 
 ## Getting Started
 
-You’ll need a Kubernetes cluster to run against. You can use [KIND](https://sigs.k8s.io/kind) to get a local cluster for testing, or run against a remote cluster.  
+You’ll need a Kubernetes cluster to run against. You can use [KIND](https://sigs.k8s.io/kind) to get a local cluster for testing, or run against a remote cluster.
 **Note:** Your controller will automatically use the current context in your kubeconfig file (i.e. whatever cluster `kubectl cluster-info` shows).
 
 ### Quick start using a local KIND cluster
@@ -205,7 +206,7 @@ kubectl get istiocni default
 kubectl get ztunnel default
 ```
 
-**Note** - The version can be specified by modifying the `version` field within `Istio` and `IstioCNI` manifests.  
+**Note** - The version can be specified by modifying the `version` field within `Istio` and `IstioCNI` manifests.
 For other deployment options, refer to the [docs](docs) directory.
 
 ### Undeploying the operator
@@ -326,6 +327,10 @@ Not all Istio patch versions will be included in Sail Operator releases. Some ma
 
 When an Istio release is out of support, the corresponding Sail Operator release will be out of support as well.
 
+### Component Version Compatibility
+
+When running multiple Istio components (control plane, IstioCNI, ZTunnel), each component at version `1.x` is generally compatible with other components at versions `1.x-1`, `1.x`, and `1.x+1`. This allows for rolling upgrades where components can temporarily run at different minor versions. For best results, keep all components at the same version and follow the recommended update order: control plane first, then IstioCNI, then ZTunnel.
+
 > [!NOTE]
 > The first stable 1.0 release did not follow this versioning strategy but subsequent releases will.
 

diff --git a/api/v1/istio_types.go b/api/v1/istio_types.go
@@ -37,10 +37,10 @@ const (
 type IstioSpec struct {
 	// +sail:version
 	// Defines the version of Istio to install.
-	// Must be one of: v1.28-latest, v1.28.2, v1.28.1, v1.28.0, v1.27-latest, v1.27.5, v1.27.4, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.8, v1.26.7, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, master, v1.30-alpha.3c9f2b4b.
-	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Istio Version",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:fieldGroup:General", "urn:alm:descriptor:com.tectonic.ui:select:v1.28-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.28.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.28.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.28.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.27-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.26-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.8", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.7", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.6", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.0", "urn:alm:descriptor:com.tectonic.ui:select:master", "urn:alm:descriptor:com.tectonic.ui:select:v1.30-alpha.3c9f2b4b"}
-	// +kubebuilder:validation:Enum=v1.28-latest;v1.28.2;v1.28.1;v1.28.0;v1.27-latest;v1.27.5;v1.27.4;v1.27.3;v1.27.2;v1.27.1;v1.27.0;v1.26-latest;v1.26.8;v1.26.7;v1.26.6;v1.26.5;v1.26.4;v1.26.3;v1.26.2;v1.26.1;v1.26.0;v1.25-latest;v1.25.5;v1.25.4;v1.25.3;v1.25.2;v1.25.1;v1.24-latest;v1.24.6;v1.24.5;v1.24.4;v1.24.3;v1.24.2;v1.24.1;v1.24.0;v1.23-latest;v1.23.6;v1.23.5;v1.23.4;v1.23.3;v1.23.2;v1.22-latest;v1.22.8;v1.22.7;v1.22.6;v1.22.5;v1.21.6;master;v1.30-alpha.3c9f2b4b
-	// +kubebuilder:default=v1.28.2
+	// Must be one of: v1.28-latest, v1.28.3, v1.28.2, v1.28.1, v1.28.0, v1.27-latest, v1.27.6, v1.27.5, v1.27.4, v1.27.3, v1.27.2, v1.27.1, v1.27.0, master, v1.30-alpha.9e476e6b.
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Istio Version",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:fieldGroup:General", "urn:alm:descriptor:com.tectonic.ui:select:v1.28-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.28.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.28.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.28.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.28.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.27-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.6", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.0", "urn:alm:descriptor:com.tectonic.ui:select:master", "urn:alm:descriptor:com.tectonic.ui:select:v1.30-alpha.9e476e6b"}
+	// +kubebuilder:validation:Enum=v1.28-latest;v1.28.3;v1.28.2;v1.28.1;v1.28.0;v1.27-latest;v1.27.6;v1.27.5;v1.27.4;v1.27.3;v1.27.2;v1.27.1;v1.27.0;v1.26-latest;v1.26.8;v1.26.7;v1.26.6;v1.26.5;v1.26.4;v1.26.3;v1.26.2;v1.26.1;v1.26.0;v1.25-latest;v1.25.5;v1.25.4;v1.25.3;v1.25.2;v1.25.1;v1.24-latest;v1.24.6;v1.24.5;v1.24.4;v1.24.3;v1.24.2;v1.24.1;v1.24.0;v1.23-latest;v1.23.6;v1.23.5;v1.23.4;v1.23.3;v1.23.2;v1.22-latest;v1.22.8;v1.22.7;v1.22.6;v1.22.5;v1.21.6;master;v1.30-alpha.9e476e6b
+	// +kubebuilder:default=v1.28.3
 	Version string `json:"version"`
 
 	// Defines the update strategy to use when the version in the Istio CR is updated.
@@ -261,7 +261,7 @@ const (
 // +kubebuilder:resource:scope=Cluster,categories=istio-io
 // +kubebuilder:subresource:status
 // +kubebuilder:printcolumn:name="Namespace",type="string",JSONPath=".spec.namespace",description="The namespace for the control plane components."
-// +kubebuilder:printcolumn:name="Profile",type="string",JSONPath=".spec.values.profile",description="The selected profile (collection of value presets)."
+// +kubebuilder:printcolumn:name="Profile",type="string",JSONPath=".spec.profile",description="The selected profile (collection of value presets)."
 // +kubebuilder:printcolumn:name="Revisions",type="string",JSONPath=".status.revisions.total",description="Total number of IstioRevision objects currently associated with this object."
 // +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.revisions.ready",description="Number of revisions that are ready."
 // +kubebuilder:printcolumn:name="In use",type="string",JSONPath=".status.revisions.inUse",description="Number of revisions that are currently being used by workloads."
@@ -282,7 +282,7 @@ type Istio struct {
 	// +optional
 	metav1.ObjectMeta `json:"metadata"`
 
-	// +kubebuilder:default={version: "v1.28.2", namespace: "istio-system", updateStrategy: {type:"InPlace"}}
+	// +kubebuilder:default={version: "v1.28.3", namespace: "istio-system", updateStrategy: {type:"InPlace"}}
 	// +optional
 	Spec IstioSpec `json:"spec"`