OCPBUGS-77305: Bump to OSSM 3.2.2 and Istio 1.27.5

[aslakknutsen]

Upgrade to OSSM 3.2.2 and Istio 1.27.5

• Latest security fixes
• Gateway API Inference Extension 1.1 - Multi Port Inference Pool support

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[rikatz]

/cc @rhamini3

[rikatz]

/assign

[coderabbitai]

📝 Walkthrough

Walkthrough

This pull request updates default version constants for the ingress operator's dependencies. The defaultGatewayAPIOperatorVersion constant is updated from version 3.2.0 to 3.2.2, and the defaultIstioVersion constant is updated from v1.27.3 to v1.27.5. These changes are reflected in the operator's source code and also propagated to the corresponding environment variables in both the standard and IBM Cloud managed deployment manifests. The modifications ensure consistent version specifications across the codebase and deployment configurations.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	The pull request description clearly describes the changes: upgrading OSSM to 3.2.2 and Istio to 1.27.5, mentioning specific improvements like security fixes and Gateway API Inference Extension features.
Title check	✅ Passed	The title clearly summarizes the main change: updating OSSM (OpenShift Service Mesh) to version 3.2.2 and Istio to version 1.27.5, which matches the file changes across code constants and deployment manifests.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[rhamini3]

/test e2e-aws-gatewayapi-conformance
/test e2e-aws-pre-release-ossm

[rhamini3]

PR changes LGTM

small suggestion: update the PR title and lets wait for CI results

[openshift-ci-robot]

@aslakknutsen: This pull request references NE-2396 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Upgrade to OSSM 3.2.2 and Istio 1.27.5

• Latest security fixes
• Gateway API Inference Extension 1.1 - Multi Port Inference Pool support

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@aslakknutsen: This pull request references NE-2495 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Upgrade to OSSM 3.2.2 and Istio 1.27.5

• Latest security fixes
• Gateway API Inference Extension 1.1 - Multi Port Inference Pool support

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[rikatz]

/jira refresh

[openshift-ci-robot]

@rikatz: This pull request references NE-2495 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[rikatz]

/jira refresh

[openshift-ci-robot]

@rikatz: This pull request references NE-2495 which is a valid jira issue.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[rikatz]

/approve
/lgtm
Thanks
/cc @rhamini3

For QE validation

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rikatz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [rikatz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rikatz]

/hold

For PR scrub discussion

[rikatz]

/retest-required

[rikatz]

/test e2e-aws-pre-release-ossm

[rhamini3]

/test e2e-aws-pre-release-ossm

[rikatz]

/hold

@aslakknutsen @rhamini3 the error on the pre-release test seems related with the istio.io/rev bug that Aslak found. I am not sure if the pre-release already contains the bugfix for it, but it would be worth to check on a live cluster, with the same pre-release process if creating a Gateway, then creating a HTTPRoute works or is stuck without parent due to the missing istio.io/rev label.

If so, we need a new pre-release to test if this bug is gone.

[rhamini3]

Marking as verified since the bump is successful and gatewayAPI objects are created successfully

% oc -n openshift-operators get sub,csv,pod
NAME                                                     PACKAGE                SOURCE             CHANNEL
subscription.operators.coreos.com/servicemeshoperator3   servicemeshoperator3   redhat-operators   stable

NAME                                                                     DISPLAY                            VERSION   RELEASE   REPLACES                      PHASE
clusterserviceversion.operators.coreos.com/servicemeshoperator3.v3.2.2   Red Hat OpenShift Service Mesh 3   3.2.2               servicemeshoperator3.v3.2.1   Succeeded

NAME                                         READY   STATUS    RESTARTS   AGE
pod/servicemesh-operator3-68d7475dd6-vlwmt   1/1     Running   0          25s
iamin@iamin-mac secrets-crt % oc get gc
NAME                CONTROLLER                           ACCEPTED   AGE
openshift-default   openshift.io/gateway-controller/v1   True       2m28s
iamin@iamin-mac secrets-crt % oc get istio
NAME                NAMESPACE           PROFILE   REVISIONS   READY   IN USE   ACTIVE REVISION     STATUS    VERSION   AGE
openshift-gateway   openshift-ingress             1           1       0        openshift-gateway   Healthy   v1.27.5   106s

% oc -n openshift-ingress get gateway
NAME      CLASS               ADDRESS                                                                   PROGRAMMED   AGE
gateway   openshift-default   a7988e177e9104fd58345cb2f8df5ebd-1366535360.us-west-1.elb.amazonaws.com   True         16s

  status:
    parents:
    - conditions:
      - lastTransitionTime: "2026-02-25T16:12:06Z"
        message: Route was valid
        observedGeneration: 1
        reason: Accepted
        status: "True"
        type: Accepted
      - lastTransitionTime: "2026-02-25T16:12:06Z"
        message: All references resolved
        observedGeneration: 1
        reason: ResolvedRefs
        status: "True"
        type: ResolvedRefs
      controllerName: openshift.io/gateway-controller/v1
      parentRef:
        group: gateway.networking.k8s.io
        kind: Gateway
        name: gateway
        namespace: openshift-ingress
kind: List
metadata:
  resourceVersion: ""

/verified by @rhamini3

[openshift-ci-robot]

@rhamini3: This PR has been marked as verified by @rhamini3.

Details

In response to this:

Marking as verified since the bump is successful and gatewayAPI objects are created successfully

% oc -n openshift-operators get sub,csv,pod
NAME                                                     PACKAGE                SOURCE             CHANNEL
subscription.operators.coreos.com/servicemeshoperator3   servicemeshoperator3   redhat-operators   stable

NAME                                                                     DISPLAY                            VERSION   RELEASE   REPLACES                      PHASE
clusterserviceversion.operators.coreos.com/servicemeshoperator3.v3.2.2   Red Hat OpenShift Service Mesh 3   3.2.2               servicemeshoperator3.v3.2.1   Succeeded

NAME                                         READY   STATUS    RESTARTS   AGE
pod/servicemesh-operator3-68d7475dd6-vlwmt   1/1     Running   0          25s
iamin@iamin-mac secrets-crt % oc get gc
NAME                CONTROLLER                           ACCEPTED   AGE
openshift-default   openshift.io/gateway-controller/v1   True       2m28s
iamin@iamin-mac secrets-crt % oc get istio
NAME                NAMESPACE           PROFILE   REVISIONS   READY   IN USE   ACTIVE REVISION     STATUS    VERSION   AGE
openshift-gateway   openshift-ingress             1           1       0        openshift-gateway   Healthy   v1.27.5   106s

% oc -n openshift-ingress get gateway
NAME      CLASS               ADDRESS                                                                   PROGRAMMED   AGE
gateway   openshift-default   a7988e177e9104fd58345cb2f8df5ebd-1366535360.us-west-1.elb.amazonaws.com   True         16s

 status:
   parents:
   - conditions:
     - lastTransitionTime: "2026-02-25T16:12:06Z"
       message: Route was valid
       observedGeneration: 1
       reason: Accepted
       status: "True"
       type: Accepted
     - lastTransitionTime: "2026-02-25T16:12:06Z"
       message: All references resolved
       observedGeneration: 1
       reason: ResolvedRefs
       status: "True"
       type: ResolvedRefs
     controllerName: openshift.io/gateway-controller/v1
     parentRef:
       group: gateway.networking.k8s.io
       kind: Gateway
       name: gateway
       namespace: openshift-ingress
kind: List
metadata:
 resourceVersion: ""

/verified by @rhamini3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[rikatz]

/retitle OCPBUGS-77305: Bump to OSSM 3.2.2 and Istio 1.27.5

[openshift-ci-robot]

@aslakknutsen: This pull request references Jira Issue OCPBUGS-77305, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Upgrade to OSSM 3.2.2 and Istio 1.27.5

• Latest security fixes
• Gateway API Inference Extension 1.1 - Multi Port Inference Pool support

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[rikatz]

/retest-required
/hold cancel

[openshift-ci]

@aslakknutsen: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-pre-release-ossm	006060f	link	false	/test e2e-aws-pre-release-ossm

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@aslakknutsen: Jira Issue Verification Checks: Jira Issue OCPBUGS-77305
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-77305 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

Upgrade to OSSM 3.2.2 and Istio 1.27.5

• Latest security fixes
• Gateway API Inference Extension 1.1 - Multi Port Inference Pool support

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-robot]

Fix included in accepted release 4.22.0-0.nightly-2026-02-26-092444