NE-2471: Replace OLM-based Istio install with Sail Library

[gcs278]

Replace OLM-based Istio installation with Sail Library

This PR implements the changes described in the Gateway API without OLM Enhancement to remove the OLM dependency for Gateway API support.

Summary

Adds support for direct Helm chart installation using the sail-operator library (behind the GatewayAPIWithoutOLM feature gate). This change:

• Eliminates OLM/Marketplace dependency, enabling Gateway API on clusters without these capabilities
• Avoids conflicts with existing OSSM subscriptions created by cluster administrators
• Simplifies Gateway API version management by removing Subscription/InstallPlan coordination
• Reduces resource overhead by embedding Istio installation logic in cluster-ingress-operator instead of requiring a separate operator deployment
• Enables Gateway API on OKE clusters which do not include OSSM licensing

Implementation Details

Sail Library Integration:

• Uses the Sail library (behind GatewayAPIWithoutOLM feature gate) to deploy istiod directly via Helm with automatic drift detection and repair
• Vendors istiod Helm charts via the sail-operator library (go.mod), which embeds charts as resources
• Sets the GatewayClass as ownerReference for the Helm chart to enable automatic garbage collection
• Adds GatewayClass finalizer (openshift.io/ingress-operator-sail-finalizer) to ensure clean Helm uninstall on deletion

CRD Management:

• Installs Gateway API CRDs when OLM is not managing them, with ownership detection to avoid conflicts with existing OSSM installations
• Labels managed CRDs with ingress.operator.openshift.io/owned for ownership tracking
• Adds Helm keep annotation to CRDs, ensuring they persist after uninstall to preserve user custom resources

Installation Status:

• Exposes installation status via GatewayClass conditions (ControllerInstalled, CRDsReady)

RBAC:

• Adds minimal RBAC permissions for creating Helm-managed resources via a new cluster role & cluster role binding (00-cluster-role-sail-library.yaml and 01-cluster-role-binding-sail-library.yaml)

Migration:

• Handles automatic migration from 4.21 OLM-based installation by deleting the existing Istio CR, waiting for sail-operator cleanup, and reinstalling via Helm while preserving istiod and ingress functionality during transition

🚧 TechPreview Notes 🚧:

• Uses upstream Istio images from gcr.io/istio-release (GA will use downstream OSSM images from Red Hat registry)
• Deploys Gateway API v1.4.1 CRDs while using v1.5.0-rc.3 Go library (transitively required by Istio). GatewayClass API is stable between versions with no breaking changes.
• Uses development branch of sail-operator (github.com/aslakknutsen/sail-operator) until downstream library is available.

User-Facing Improvements

Installation Compatibility:

• Gateway API now installs successfully on clusters with existing OSSM v2.x subscriptions (previously failed due to conflicting Subscription resources)
• Installation no longer affected by OLM installPlanApproval: Manual issue in openshift-operators namespace (NE-2224)
• Works on clusters without OLM/Marketplace capabilities (e.g., OKE deployments)

Functional Behavior:

• Gateway and HTTPRoute APIs and functionality remain unchanged
• Users install Gateway API the same way: create a GatewayClass with controller name openshift.io/gateway-controller/v1
• Existing gateways continue working through the migration without reconfiguration

Based on proof of concept work in:

• WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by @aslakknutsen
• [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347 by @gcs278
• [WIP] NE-2471: Replace OLM-based Istio install with Sail Library #1358 by @rikatz

TODO

• Separate K8S bump to 1.35 into another commit
• Implement a tech-preview feature flag
• Implement upgrade migration logic to handle transition from OLM-based to Sail Library-based installation
• Add helm drift reconciliation
• Get EP Update (NE-2470: Gateway API without OLM enhancements#1933) agreed upon, and merged
• Get feature gate API NE-2480: Add featuregate for Gateway API without OLM api#2691 merged
• Add Unit Testing
• Add/Update existing pre-submit E2E Testing (gateway_api_test.go)
• Examine and isolate cluster role RBAC updates

Follow Up (After Merge, but Before GA)

• Move to downstream sail-operator library when available (NE-2519)
• Pre-release Testing: Configure Istio version and container pullspecs: set defaults from sail library but allow overrides for pre-release testing and custom registries (similar to the "unsupported.do-not-use.openshift.io/ossm-catalog" annotation sets) (NE-2507)
• Update origin tests (gatewayapicontroller.go) to test GatewayAPIWithoutOLM feature gate to get TP CI signal (including upgrade test) (NE-2291)
• Replace escalate permission with explicit list of required istiod permissions in ClusterRole (debatable if required for GA) (NE-2518)

[openshift-ci-robot]

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

🚧 Work in Progress 🚧

---

Replace OLM-based Istio installation with Sail Library

This PR implements the changes described in openshift/enhancements#1933 to remove the OLM dependency for Gateway API support.

Summary:

Replaces the OLM Subscription-based OSSM installation with direct Helm chart installation using sail-operator libraries. This change:

• Eliminates OLM/Marketplace dependency, enabling Gateway API on clusters without these capabilities
• Avoids conflicts with existing OSSM subscriptions created by cluster administrators
• Simplifies Gateway API lifecycle management by removing Subscription/InstallPlan coordination
• Reduces resource overhead by eliminating the sail-operator deployment when service mesh is not needed
• Enables Gateway API on OKE clusters which do not include OSSM licensing

Implementation Details:

The cluster-ingress-operator now:

• Vendors Helm charts via the sail-operator library (go.mod), which embeds charts as resources
• Uses install.NewInstaller() with PresetGatewayAPI to deploy istiod directly via Helm
• Sets the GatewayClass as ownerReference for Helm releases to enable automatic garbage collection
• Add RBAC permissions for Helm-managed resources, webhooks, and Istio API groups
• Bump k8s dependencies to v0.35.0 and controller-runtime to v0.22.4 (required by sail-operator library
• Remove all OLM-related logic, tests, documentation, flags, status, etc.
• Handles automatic migration from 4.21 OLM-based installation by deleting the existing Istio CR, waiting for sail-operator cleanup, and reinstalling via Helm with no data plane downtime

Based on proof of concept work in:

• WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by @aslakknutsen
• [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347 by @gcs278

Status: Work in progress - testing and migration logic in development.

TODO:

• Separate K8S bump to 1.35 into another commit
• Implement upgrade migration logic to handle transition from OLM-based to Helm-based installation (from [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347)
• Add reconciliation watches for Helm-managed resources (requires sail library updates)
• Remove all legacy OLM/OSSM subscription code, tests, and documentation
• Implement Istio CRD installation logic for layered product support (requires sail library updates)
• Move to downstream sail-operator library when available (right now is https://github.com/aslakknutsen/sail-operator/tree/sail_library)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

🚧 Work in Progress 🚧

---

Replace OLM-based Istio installation with Sail Library

This PR implements the changes described in openshift/enhancements#1933 to remove the OLM dependency for Gateway API support.

Summary:

Replaces the OLM Subscription-based OSSM installation with direct Helm chart installation using sail-operator libraries. This change:

• Eliminates OLM/Marketplace dependency, enabling Gateway API on clusters without these capabilities
• Avoids conflicts with existing OSSM subscriptions created by cluster administrators
• Simplifies Gateway API lifecycle management by removing Subscription/InstallPlan coordination
• Reduces resource overhead by eliminating the sail-operator deployment when service mesh is not needed
• Enables Gateway API on OKE clusters which do not include OSSM licensing

Implementation Details:

The cluster-ingress-operator now:

• Vendors Helm charts via the sail-operator library (go.mod), which embeds charts as resources
• Uses install.NewInstaller() with PresetGatewayAPI to deploy istiod directly via Helm
• Sets the GatewayClass as ownerReference for Helm releases to enable automatic garbage collection
• Add RBAC permissions for Helm-managed resources, webhooks, and Istio API groups
• Bump k8s dependencies to v0.35.0 and controller-runtime to v0.22.4 (required by sail-operator library)
• Remove all OLM-related logic, tests, documentation, flags, status, etc.
• Handles automatic migration from 4.21 OLM-based installation by deleting the existing Istio CR, waiting for sail-operator cleanup, and reinstalling via Helm with no data plane downtime

Based on proof of concept work in:

• WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by @aslakknutsen
• [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347 by @gcs278

Status: Work in progress - testing and migration logic in development.

TODO:

• Separate K8S bump to 1.35 into another commit
• Implement upgrade migration logic to handle transition from OLM-based to Helm-based installation (from [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347)
• Add reconciliation watches for Helm-managed resources (requires sail library updates)
• Remove all legacy OLM/OSSM subscription code, tests, and documentation
• Implement Istio CRD installation logic for layered product support (requires sail library updates)
• Move to downstream sail-operator library when available (right now is https://github.com/aslakknutsen/sail-operator/tree/sail_library)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

🚧 Work in Progress 🚧

---

Replace OLM-based Istio installation with Sail Library

This PR implements the changes described in openshift/enhancements#1933 to remove the OLM dependency for Gateway API support.

Summary:

Replaces the OLM Subscription-based OSSM installation with direct Helm chart installation using sail-operator libraries. This change:

• Eliminates OLM/Marketplace dependency, enabling Gateway API on clusters without these capabilities
• Avoids conflicts with existing OSSM subscriptions created by cluster administrators
• Simplifies Gateway API lifecycle management by removing Subscription/InstallPlan coordination
• Reduces resource overhead by eliminating the sail-operator deployment when service mesh is not needed
• Enables Gateway API on OKE clusters which do not include OSSM licensing

Implementation Details:

The cluster-ingress-operator now:

• Vendors Helm charts via the sail-operator library (go.mod), which embeds charts as resources
• Uses install.NewInstaller() with PresetGatewayAPI to deploy istiod directly via Helm
• Sets the GatewayClass as ownerReference for Helm releases to enable automatic garbage collection
• Add RBAC permissions for Helm-managed resources, webhooks, and Istio API groups
• Bump k8s dependencies to v0.35.0 and controller-runtime to v0.22.4 (required by sail-operator library)
• Remove all OLM-related logic, tests, documentation, flags, status, etc.
• Handles automatic migration from 4.21 OLM-based installation by deleting the existing Istio CR, waiting for sail-operator cleanup, and reinstalling via Helm with no data plane downtime

Based on proof of concept work in:

• WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by @aslakknutsen
• [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347 by @gcs278

Status: Work in progress

TODO:

• Separate K8S bump to 1.35 into another commit
• Implement upgrade migration logic to handle transition from OLM-based to Helm-based installation (from [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347)
• Add reconciliation watches for Helm-managed resources (requires sail library updates)
• Remove all legacy OLM/OSSM subscription code, tests, and documentation
• Implement Istio CRD installation logic for layered product support (requires sail library updates)
• Move to downstream sail-operator library when available (right now is https://github.com/aslakknutsen/sail-operator/tree/sail_library)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

🚧 Work in Progress 🚧

---

Replace OLM-based Istio installation with Sail Library

This PR implements the changes described in openshift/enhancements#1933 to remove the OLM dependency for Gateway API support.

Summary:

Replaces the OLM Subscription-based OSSM installation with direct Helm chart installation using sail-operator libraries. This change:

• Eliminates OLM/Marketplace dependency, enabling Gateway API on clusters without these capabilities
• Avoids conflicts with existing OSSM subscriptions created by cluster administrators
• Simplifies Gateway API lifecycle management by removing Subscription/InstallPlan coordination
• Reduces resource overhead by eliminating the sail-operator deployment when service mesh is not needed
• Enables Gateway API on OKE clusters which do not include OSSM licensing

Implementation Details:

The cluster-ingress-operator now:

• Vendors Helm charts via the sail-operator library (go.mod), which embeds charts as resources
• Uses install.NewInstaller() with PresetGatewayAPI to deploy istiod directly via Helm
• Sets the GatewayClass as ownerReference for Helm releases to enable automatic garbage collection
• Add RBAC permissions for Helm-managed resources, webhooks, and Istio API groups
• Bump k8s dependencies to v0.35.0 and controller-runtime to v0.22.4 (required by sail-operator library)
• Remove all OLM-related logic, tests, documentation, flags, status, etc.
• Handles automatic migration from 4.21 OLM-based installation by deleting the existing Istio CR, waiting for sail-operator cleanup, and reinstalling via Helm with no data plane downtime

Based on proof of concept work in:

• WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by @aslakknutsen
• [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347 by @gcs278

Status: Work in progress:

• I've adapted WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by breaking K8S bump into separate commit, and squashing the commits from @aslakknutsen
• We are still using @aslakknutsen's local development branch for the sail-libraries
• Enhancement NE-2470: Gateway API without OLM enhancements#1933 is still under going review

TODO:

NID = NID Team Action
OSSM = OSSM Team Action

• [NID] Separate K8S bump to 1.35 into another commit
• [NID] Get NE-2470: Gateway API without OLM enhancements#1933 agreed upon, and merged
• [NID] Implement upgrade migration logic to handle transition from OLM-based to Helm-based installation (from [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347)
• [NID & OSSM] Add reconciliation watches for Helm-managed resources (requires sail library updates)
• [NID] Remove all legacy OLM/OSSM subscription code, tests, and documentation
• [NID & OSSM] Implement Istio CRD installation logic for layered product support (requires sail library updates)
• [NID & OSSM] Move to downstream sail-operator library when available (right now is https://github.com/aslakknutsen/sail-operator/tree/sail_library)
• [NID & OSSM] Configure Istio version and container pullspecs: set defaults from sail library but allow overrides for pre-release testing and custom registries (requires sail library updates)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

🚧 Work in Progress 🚧

---

Replace OLM-based Istio installation with Sail Library

This PR implements the changes described in openshift/enhancements#1933 to remove the OLM dependency for Gateway API support.

Summary:

Replaces the OLM Subscription-based OSSM installation with direct Helm chart installation using sail-operator libraries. This change:

• Eliminates OLM/Marketplace dependency, enabling Gateway API on clusters without these capabilities
• Avoids conflicts with existing OSSM subscriptions created by cluster administrators
• Simplifies Gateway API lifecycle management by removing Subscription/InstallPlan coordination
• Reduces resource overhead by eliminating the sail-operator deployment when service mesh is not needed
• Enables Gateway API on OKE clusters which do not include OSSM licensing

Implementation Details:

The cluster-ingress-operator now:

• Vendors Helm charts via the sail-operator library (go.mod), which embeds charts as resources
• Uses install.NewInstaller() with PresetGatewayAPI to deploy istiod directly via Helm
• Sets the GatewayClass as ownerReference for Helm releases to enable automatic garbage collection
• Add RBAC permissions for Helm-managed resources, webhooks, and Istio API groups
• Bump k8s dependencies to v0.35.0 and controller-runtime to v0.22.4 (required by sail-operator library)
• Remove all OLM-related logic, tests, documentation, flags, status, etc.
• Handles automatic migration from 4.21 OLM-based installation by deleting the existing Istio CR, waiting for sail-operator cleanup, and reinstalling via Helm with no data plane downtime

Based on proof of concept work in:

• WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by @aslakknutsen
• [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347 by @gcs278

Status: Work in progress:

• I've adapted WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by breaking K8S bump into separate commit, and squashing the commits from @aslakknutsen
• We are still using @aslakknutsen's local development branch for the sail-libraries
• Enhancement NE-2470: Gateway API without OLM enhancements#1933 is still under going review

TODO:

NID = NID Team Action
OSSM = OSSM Team Action

• [NID] Separate K8S bump to 1.35 into another commit
• [NID] Remove all legacy OLM/OSSM subscription code, tests, and documentation
• [NID] Get NE-2470: Gateway API without OLM enhancements#1933 agreed upon, and merged
• [NID] Implement upgrade migration logic to handle transition from OLM-based to Helm-based installation (from [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347)
• [NID & OSSM] Add reconciliation watches for Helm-managed resources (requires sail library updates)
• [NID & OSSM] Implement Istio CRD installation logic for layered product support (requires sail library updates)
• [NID & OSSM] Move to downstream sail-operator library when available (right now is https://github.com/aslakknutsen/sail-operator/tree/sail_library)
• [NID & OSSM] Configure Istio version and container pullspecs: set defaults from sail library but allow overrides for pre-release testing and custom registries (requires sail library updates)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

🚧 Work in Progress 🚧

---

Replace OLM-based Istio installation with Sail Library

This PR implements the changes described in openshift/enhancements#1933 to remove the OLM dependency for Gateway API support.

Summary:

Replaces the OLM Subscription-based OSSM installation with direct Helm chart installation using sail-operator libraries. This change:

• Eliminates OLM/Marketplace dependency, enabling Gateway API on clusters without these capabilities
• Avoids conflicts with existing OSSM subscriptions created by cluster administrators
• Simplifies Gateway API lifecycle management by removing Subscription/InstallPlan coordination
• Reduces resource overhead by eliminating the sail-operator deployment when service mesh is not needed
• Enables Gateway API on OKE clusters which do not include OSSM licensing

Implementation Details:

The cluster-ingress-operator now:

• Vendors Helm charts via the sail-operator library (go.mod), which embeds charts as resources
• Uses install.NewInstaller() with PresetGatewayAPI to deploy istiod directly via Helm
• Sets the GatewayClass as ownerReference for Helm releases to enable automatic garbage collection
• Add RBAC permissions for Helm-managed resources, webhooks, and Istio API groups
• Bump k8s dependencies to v0.35.0 and controller-runtime to v0.22.4 (required by sail-operator library)
• Remove all OLM-related logic, tests, documentation, flags, status, etc.
• Handles automatic migration from 4.21 OLM-based installation by deleting the existing Istio CR, waiting for sail-operator cleanup, and reinstalling via Helm with no data plane downtime

Based on proof of concept work in:

• WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by @aslakknutsen
• [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347 by @gcs278

Status: Work in progress:

• I've adapted WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by breaking K8S bump into separate commit, and squashing the commits from @aslakknutsen
• We are still using @aslakknutsen's local development branch for the sail-libraries
• Enhancement NE-2470: Gateway API without OLM enhancements#1933 is still under going review

TODO:

NID = NID Team Action
OSSM = OSSM Team Action

• [NID] Separate K8S bump to 1.35 into another commit
• [NID] Remove all legacy OLM/OSSM subscription code, tests, and documentation
• [NID] Implement a tech-preview feature flag (aka don't remove the OLM logic yet...whoops)
• [NID] Get NE-2470: Gateway API without OLM enhancements#1933 agreed upon, and merged
• [NID] Implement upgrade migration logic to handle transition from OLM-based to Helm-based installation (from [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347)
• [NID & OSSM] Add reconciliation watches for Helm-managed resources (requires sail library updates)
• [NID & OSSM] Implement Istio CRD installation logic for layered product support (requires sail library updates)
• [NID & OSSM] Move to downstream sail-operator library when available (right now is https://github.com/aslakknutsen/sail-operator/tree/sail_library)
• [NID & OSSM] Configure Istio version and container pullspecs: set defaults from sail library but allow overrides for pre-release testing and custom registries (requires sail library updates)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

🚧 Work in Progress 🚧

---

Replace OLM-based Istio installation with Sail Library

This PR implements the changes described in openshift/enhancements#1933 to remove the OLM dependency for Gateway API support.

Summary:

Replaces the OLM Subscription-based OSSM installation with direct Helm chart installation using sail-operator libraries. This change:

• Eliminates OLM/Marketplace dependency, enabling Gateway API on clusters without these capabilities
• Avoids conflicts with existing OSSM subscriptions created by cluster administrators
• Simplifies Gateway API lifecycle management by removing Subscription/InstallPlan coordination
• Reduces resource overhead by eliminating the sail-operator deployment when service mesh is not needed
• Enables Gateway API on OKE clusters which do not include OSSM licensing

Implementation Details:

The cluster-ingress-operator now:

• Vendors Helm charts via the sail-operator library (go.mod), which embeds charts as resources
• Uses install.NewInstaller() with PresetGatewayAPI to deploy istiod directly via Helm
• Sets the GatewayClass as ownerReference for Helm releases to enable automatic garbage collection
• Add RBAC permissions for Helm-managed resources, webhooks, and Istio API groups
• Bump k8s dependencies to v0.35.0 and controller-runtime to v0.22.4 (required by sail-operator library)
• Remove all OLM-related logic, tests, documentation, flags, status, etc.
• Handles automatic migration from 4.21 OLM-based installation by deleting the existing Istio CR, waiting for sail-operator cleanup, and reinstalling via Helm with no data plane downtime

Based on proof of concept work in:

• WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by @aslakknutsen
• [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347 by @gcs278

Status: Work in progress:

• I've adapted WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by breaking K8S bump into separate commit, and squashing the commits from @aslakknutsen
• We are still using @aslakknutsen's local development branch for the sail-libraries
• Enhancement NE-2470: Gateway API without OLM enhancements#1933 is still under going review

TODO:

NID = NID Team Action
OSSM = OSSM Team Action

• [NID] Separate K8S bump to 1.35 into another commit
• [NID] Remove all legacy OLM/OSSM subscription code, tests, and documentation
• [NID] Implement a tech-preview feature flag (aka don't remove the OLM logic yet...whoops)
• [NID] Get NE-2470: Gateway API without OLM enhancements#1933 agreed upon, and merged
• [NID] Implement upgrade migration logic to handle transition from OLM-based to Helm-based installation (from [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347)
• [NID & OSSM] Add reconciliation watches for Helm-managed resources (requires sail library updates)
• [NID & OSSM] Implement Istio CRD installation logic for layered product support (requires sail library updates)
• [NID & OSSM] Move to downstream sail-operator library when available (right now is https://github.com/aslakknutsen/sail-operator/tree/sail_library)
• [NID & OSSM] Configure Istio version and container pullspecs: set defaults from sail library but allow overrides for pre-release testing and custom registries (requires sail library updates)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

🚧 Work in Progress 🚧

---

Replace OLM-based Istio installation with Sail Library

This PR implements the changes described in openshift/enhancements#1933 to remove the OLM dependency for Gateway API support.

Summary:

Replaces the OLM Subscription-based OSSM installation with direct Helm chart installation using sail-operator libraries. This change:

• Eliminates OLM/Marketplace dependency, enabling Gateway API on clusters without these capabilities
• Avoids conflicts with existing OSSM subscriptions created by cluster administrators
• Simplifies Gateway API lifecycle management by removing Subscription/InstallPlan coordination
• Reduces resource overhead by eliminating the sail-operator deployment when service mesh is not needed
• Enables Gateway API on OKE clusters which do not include OSSM licensing

Implementation Details:

The cluster-ingress-operator now:

• Vendors Helm charts via the sail-operator library (go.mod), which embeds charts as resources
• Uses install.NewInstaller() with PresetGatewayAPI to deploy istiod directly via Helm
• Sets the GatewayClass as ownerReference for Helm releases to enable automatic garbage collection
• Add RBAC permissions for Helm-managed resources, webhooks, and Istio API groups
• Bump k8s dependencies to v0.35.0 and controller-runtime to v0.22.4 (required by sail-operator library)
• Remove all OLM-related logic, tests, documentation, flags, status, etc.
• Handles automatic migration from 4.21 OLM-based installation by deleting the existing Istio CR, waiting for sail-operator cleanup, and reinstalling via Helm with no data plane downtime

Based on proof of concept work in:

• WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by @aslakknutsen
• [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347 by @gcs278

Status: Work in progress:

• I've adapted WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by breaking K8S bump into separate commit, and squashing the commits from @aslakknutsen
• We are still using @aslakknutsen's local development branch for the sail-libraries
• Enhancement NE-2470: Gateway API without OLM enhancements#1933 is still under going review

TODO:

NID = NID Team Action
OSSM = OSSM Team Action

• [NID] Separate K8S bump to 1.35 into another commit
• [NID] Remove all legacy OLM/OSSM subscription code, tests, and documentation
• [NID] Implement a tech-preview feature flag (aka don't remove the OLM logic yet...whoops)
• [NID] Get NE-2470: Gateway API without OLM enhancements#1933 agreed upon, and merged
• [NID] Implement upgrade migration logic to handle transition from OLM-based to Helm-based installation (from [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347)
• [NID & OSSM] Add reconciliation watches for Helm-managed resources (requires sail library updates)
• [NID & OSSM] Implement Istio CRD installation logic for layered product support (requires sail library updates)
• [NID & OSSM] Move to downstream sail-operator library when available (right now is https://github.com/aslakknutsen/sail-operator/tree/sail_library)
• [NID & OSSM] Configure Istio version and container pullspecs: set defaults from sail library but allow overrides for pre-release testing and custom registries (requires sail library updates)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

🚧 Work in Progress 🚧

---

Replace OLM-based Istio installation with Sail Library

This PR implements the changes described in openshift/enhancements#1933 to remove the OLM dependency for Gateway API support.

Summary:

Replaces the OLM Subscription-based OSSM installation with direct Helm chart installation using sail-operator libraries. This change:

• Eliminates OLM/Marketplace dependency, enabling Gateway API on clusters without these capabilities
• Avoids conflicts with existing OSSM subscriptions created by cluster administrators
• Simplifies Gateway API lifecycle management by removing Subscription/InstallPlan coordination
• Reduces resource overhead by eliminating the sail-operator deployment when service mesh is not needed
• Enables Gateway API on OKE clusters which do not include OSSM licensing

Implementation Details:

The cluster-ingress-operator now:

• Vendors Helm charts via the sail-operator library (go.mod), which embeds charts as resources
• Uses install.NewInstaller() with PresetGatewayAPI to deploy istiod directly via Helm
• Sets the GatewayClass as ownerReference for Helm releases to enable automatic garbage collection
• Add RBAC permissions for Helm-managed resources, webhooks, and Istio API groups
• Bump k8s dependencies to v0.35.0 and controller-runtime to v0.22.4 (required by sail-operator library)
• Remove all OLM-related logic, tests, documentation, flags, status, etc.
• Handles automatic migration from 4.21 OLM-based installation by deleting the existing Istio CR, waiting for sail-operator cleanup, and reinstalling via Helm with no data plane downtime

Based on proof of concept work in:

• WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by @aslakknutsen
• [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347 by @gcs278

Status: Work in progress:

• I've adapted WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by breaking K8S bump into separate commit, and squashing the commits from @aslakknutsen
• We are still using @aslakknutsen's local development branch for the sail-libraries
• Enhancement NE-2470: Gateway API without OLM enhancements#1933 is still under going review

TODO:

NID = NID Team Action
OSSM = OSSM Team Action

• [NID] Separate K8S bump to 1.35 into another commit
• [NID] Remove all legacy OLM/OSSM subscription code, tests, and documentation
• [NID] Implement a tech-preview feature flag (aka don't remove the OLM logic yet...whoops)
• [NID] Get NE-2470: Gateway API without OLM enhancements#1933 agreed upon, and merged
• [NID] Implement upgrade migration logic to handle transition from OLM-based to Helm-based installation (from [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347)
• [NID & OSSM] Add reconciliation watches for Helm-managed resources (requires sail library updates)
• [NID & OSSM] Move to downstream sail-operator library when available (right now is https://github.com/aslakknutsen/sail-operator/tree/sail_library)
• [NID & OSSM] Configure Istio version and container pullspecs: set defaults from sail library but allow overrides for pre-release testing and custom registries (requires sail library updates)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

🚧 Work in Progress 🚧

---

Replace OLM-based Istio installation with Sail Library

This PR implements the changes described in openshift/enhancements#1933 to remove the OLM dependency for Gateway API support.

Summary:

Replaces the OLM Subscription-based OSSM installation with direct Helm chart installation using sail-operator libraries. This change:

• Eliminates OLM/Marketplace dependency, enabling Gateway API on clusters without these capabilities
• Avoids conflicts with existing OSSM subscriptions created by cluster administrators
• Simplifies Gateway API lifecycle management by removing Subscription/InstallPlan coordination
• Reduces resource overhead by eliminating the sail-operator deployment when service mesh is not needed
• Enables Gateway API on OKE clusters which do not include OSSM licensing

Implementation Details:

The cluster-ingress-operator now:

• Vendors Helm charts via the sail-operator library (go.mod), which embeds charts as resources
• Uses install.NewInstaller() with PresetGatewayAPI to deploy istiod directly via Helm
• Sets the GatewayClass as ownerReference for Helm releases to enable automatic garbage collection
• Add RBAC permissions for Helm-managed resources, webhooks, and Istio API groups
• Bump k8s dependencies to v0.35.0 and controller-runtime to v0.22.4 (required by sail-operator library)
• Remove all OLM-related logic, tests, documentation, flags, status, etc.
• Handles automatic migration from 4.21 OLM-based installation by deleting the existing Istio CR, waiting for sail-operator cleanup, and reinstalling via Helm with no data plane downtime

Based on proof of concept work in:

• WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by @aslakknutsen
• [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347 by @gcs278

Status: Work in progress:

• I've adapted WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by breaking K8S bump into separate commit, and squashing the commits from @aslakknutsen
• We are still using @aslakknutsen's local development branch for the sail-libraries
• Enhancement NE-2470: Gateway API without OLM enhancements#1933 is still under going review

TODO:

NID = NID Team Action
OSSM = OSSM Team Action

• [NID] Separate K8S bump to 1.35 into another commit
• [NID] Remove all legacy OLM/OSSM subscription code, tests, and documentation
• [NID] Implement a tech-preview feature flag (aka don't remove the OLM logic yet...whoops)
• [NID] Get NE-2470: Gateway API without OLM enhancements#1933 agreed upon, and merged
• [NID] Get feaure gate API NE-2480: Add featuregate for Gateway API without OLM api#2691 merged
• [NID] Implement upgrade migration logic to handle transition from OLM-based to Helm-based installation (from [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347)
• [NID & OSSM] Add reconciliation watches for Helm-managed resources (requires sail library updates)
• [NID & OSSM] Move to downstream sail-operator library when available (right now is https://github.com/aslakknutsen/sail-operator/tree/sail_library)
• [NID & OSSM] Configure Istio version and container pullspecs: set defaults from sail library but allow overrides for pre-release testing and custom registries (requires sail library updates)
• [NID] Add Unit Testing

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

🚧 Work in Progress 🚧

---

Replace OLM-based Istio installation with Sail Library

This PR implements the changes described in openshift/enhancements#1933 to remove the OLM dependency for Gateway API support.

Summary:

Replaces the OLM Subscription-based OSSM installation with direct Helm chart installation using sail-operator libraries. This change:

• Eliminates OLM/Marketplace dependency, enabling Gateway API on clusters without these capabilities
• Avoids conflicts with existing OSSM subscriptions created by cluster administrators
• Simplifies Gateway API lifecycle management by removing Subscription/InstallPlan coordination
• Reduces resource overhead by eliminating the sail-operator deployment when service mesh is not needed
• Enables Gateway API on OKE clusters which do not include OSSM licensing

Implementation Details:

The cluster-ingress-operator now:

• Vendors Helm charts via the sail-operator library (go.mod), which embeds charts as resources
• Uses install.NewInstaller() with PresetGatewayAPI to deploy istiod directly via Helm
• Sets the GatewayClass as ownerReference for Helm releases to enable automatic garbage collection
• Add RBAC permissions for Helm-managed resources, webhooks, and Istio API groups
• Bump k8s dependencies to v0.35.0 and controller-runtime to v0.22.4 (required by sail-operator library)
• Remove all OLM-related logic, tests, documentation, flags, status, etc.
• Handles automatic migration from 4.21 OLM-based installation by deleting the existing Istio CR, waiting for sail-operator cleanup, and reinstalling via Helm with no data plane downtime

Based on proof of concept work in:

• WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by @aslakknutsen
• [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347 by @gcs278

Status: Work in progress:

• I've adapted WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by breaking K8S bump into separate commit, and squashing the commits from @aslakknutsen
• We are still using @aslakknutsen's local development branch for the sail-libraries
• Enhancement NE-2470: Gateway API without OLM enhancements#1933 is still under going review

TODO:

NID = NID Team Action
OSSM = OSSM Team Action

• [NID] Separate K8S bump to 1.35 into another commit
• [NID] Remove all legacy OLM/OSSM subscription code, tests, and documentation
• [NID] Implement a tech-preview feature flag (aka don't remove the OLM logic yet...whoops)
• [NID] Implement upgrade migration logic to handle transition from OLM-based to Helm-based installation (from [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347)
• [NID] Get NE-2470: Gateway API without OLM enhancements#1933 agreed upon, and merged
• [NID] Get feaure gate API NE-2480: Add featuregate for Gateway API without OLM api#2691 merged
• [NID & OSSM] Add reconciliation watches for Helm-managed resources (requires sail library updates)
• [NID & OSSM] Move to downstream sail-operator library when available (right now is https://github.com/aslakknutsen/sail-operator/tree/sail_library)
• [NID & OSSM] Configure Istio version and container pullspecs: set defaults from sail library but allow overrides for pre-release testing and custom registries (requires sail library updates)
• [NID] Add Unit Testing

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

🚧 Work in Progress 🚧

---

Replace OLM-based Istio installation with Sail Library

This PR implements the changes described in openshift/enhancements#1933 to remove the OLM dependency for Gateway API support.

Summary:

Replaces the OLM Subscription-based OSSM installation with direct Helm chart installation using sail-operator libraries. This change:

• Eliminates OLM/Marketplace dependency, enabling Gateway API on clusters without these capabilities
• Avoids conflicts with existing OSSM subscriptions created by cluster administrators
• Simplifies Gateway API lifecycle management by removing Subscription/InstallPlan coordination
• Reduces resource overhead by eliminating the sail-operator deployment when service mesh is not needed
• Enables Gateway API on OKE clusters which do not include OSSM licensing

Implementation Details:

The cluster-ingress-operator now:

• Vendors Helm charts via the sail-operator library (go.mod), which embeds charts as resources
• Uses install.NewInstaller() with PresetGatewayAPI to deploy istiod directly via Helm
• Sets the GatewayClass as ownerReference for Helm releases to enable automatic garbage collection
• Add RBAC permissions for Helm-managed resources, webhooks, and Istio API groups
• Bump k8s dependencies to v0.35.0 and controller-runtime to v0.22.4 (required by sail-operator library)
• Remove all OLM-related logic, tests, documentation, flags, status, etc.
• Handles automatic migration from 4.21 OLM-based installation by deleting the existing Istio CR, waiting for sail-operator cleanup, and reinstalling via Helm with no data plane downtime

Based on proof of concept work in:

• WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by @aslakknutsen
• [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347 by @gcs278

Status: Work in progress:

• I've adapted WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by breaking K8S bump into separate commit, and squashing the commits from @aslakknutsen
• We are still using @aslakknutsen's local development branch for the sail-libraries
• Enhancement NE-2470: Gateway API without OLM enhancements#1933 is still under going review

TODO:

NID = NID Team Action
OSSM = OSSM Team Action

• [NID] Separate K8S bump to 1.35 into another commit
• [NID] Remove all legacy OLM/OSSM subscription code, tests, and documentation
• [NID] Implement a tech-preview feature flag (aka don't remove the OLM logic yet...whoops)
• [NID] Implement upgrade migration logic to handle transition from OLM-based to Helm-based installation (from [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347)
• [NID] Add reconciliation watches for Helm-managed resources
• [NID] Get NE-2470: Gateway API without OLM enhancements#1933 agreed upon, and merged
• [NID] Get feature gate API NE-2480: Add featuregate for Gateway API without OLM api#2691 merged
• [OSSM] Move to downstream sail-operator library when available (right now is https://github.com/aslakknutsen/sail-operator/tree/sail_library2)
• [NID] Configure Istio version and container pullspecs: set defaults from sail library but allow overrides for pre-release testing and custom registries (similar to the "unsupported.do-not-use.openshift.io/ossm-catalog" annotation sets)
• [NID] Add Unit Testing
• [NID] Organize dual OLM/Sail Library logic (separate controller? better file naming?)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[rikatz]

Is this an Istio requirement @aslakknutsen @gcs278

Can Istio be started without it?

[aslakknutsen]

I'm working on a new version; aslakknutsen/sail-operator@375b004, but basically to allow the library to install some of these for istio to use, the consumer(CIO Operator) has to have the same rbac else we run into escalation issues.

[aslakknutsen]

@rikatz Or are you referring specifically to the x-k8s.io ones?

[gcs278]

I've removed these btw. Sorry I can't remember what this was, but I think it was some experimental APIs. I don't think we need permissions for them.

I reduced the clusterrole to a minimal set for the CIO usage of the sail library. I only added permissions for the new resources created in the Istiod Helm Chart, along with using escalate for clusterroles, so CIO can create an istiod clusterrole with elevated privileges (that's what Sail Operator does today).

[openshift-ci-robot]

@gcs278: This pull request references NE-2471 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

🚧 Work in Progress 🚧

---

Replace OLM-based Istio installation with Sail Library

This PR implements the changes described in openshift/enhancements#1933 to remove the OLM dependency for Gateway API support.

Summary:

Replaces the OLM Subscription-based OSSM installation with direct Helm chart installation using the sail-operator library. This change:

• Eliminates OLM/Marketplace dependency, enabling Gateway API on clusters without these capabilities
• Avoids conflicts with existing OSSM subscriptions created by cluster administrators
• Simplifies Gateway API lifecycle management by removing Subscription/InstallPlan coordination
• Reduces resource overhead by eliminating the sail-operator deployment when service mesh is not needed
• Enables Gateway API on OKE clusters which do not include OSSM licensing

Implementation Details:

The cluster-ingress-operator now:

• Uses Sail library (behind GatewayAPIWithoutOLM feature gate) to deploy istiod directly via Helm with Gateway API configuratio
• Vendors Helm charts via the sail-operator library (go.mod), which embeds charts as resources
• Sets the GatewayClass as ownerReference for Helm releases to enable automatic garbage collection
• Add RBAC permissions for Helm-managed resources, webhooks, and Istio API groups
• Bump k8s dependencies to v0.35.0 and controller-runtime to v0.22.4 (required by sail-operator library)
• Handles automatic migration from 4.21 OLM-based installation by deleting the existing Istio CR, waiting for sail-operator cleanup, and reinstalling via Helm with no data plane downtime

Based on proof of concept work in:

• WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by @aslakknutsen
• [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347 by @gcs278

Status: Work in progress:

• I've adapted WIP - TEST ONLY - refactor(gatewayapi): replace OLM-based Istio install with Sail Library #1351 by breaking K8S bump into separate commit, and squashing the commits from @aslakknutsen
• We are still using @aslakknutsen's local development branch for the sail-libraries
• Enhancement NE-2470: Gateway API without OLM enhancements#1933 is still under going review

TODO:

NID = NID Team Action
OSSM = OSSM Team Action

• [NID] Separate K8S bump to 1.35 into another commit
• [NID] Remove all legacy OLM/OSSM subscription code, tests, and documentation
• [NID] Implement a tech-preview feature flag (aka don't remove the OLM logic yet...whoops)
• [NID] Implement upgrade migration logic to handle transition from OLM-based to Helm-based installation (from [WIP] NE-2437: [POC] Install Istio via Helm charts instead of OLM subscription #1347)
• [NID] Add reconciliation watches for Helm-managed resources
• [NID] Get NE-2470: Gateway API without OLM enhancements#1933 agreed upon, and merged
• [NID] Get feature gate API NE-2480: Add featuregate for Gateway API without OLM api#2691 merged
• [OSSM] Move to downstream sail-operator library when available (right now is refactor: extract shared reconciliation logic into pkg/reconcile istio-ecosystem/sail-operator#1572)
• [NID] Configure Istio version and container pullspecs: set defaults from sail library but allow overrides for pre-release testing and custom registries (similar to the "unsupported.do-not-use.openshift.io/ossm-catalog" annotation sets)
• [NID] Add Unit Testing
• [NID] Add/Update existing E2E Testing (Separate PR?)
• [NID] Organize dual OLM/Sail Library logic (separate controller? better file naming?)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[gcs278]

Sorry - I think I messed up the last push bump to Aslak's latest changes. But the last push should fix it, and fix a comment in the go.mod.

[gcs278]

/test e2e-aws-operator-techpreview

[bentito]

looked again, looks like just that remaining dep question, which isn't reflective on this PR, so, good to go.

[bentito]

/lgtm

[gcs278]

hypershift failure, and unrelated test failure in e2e-azure-operator
/retest

[openshift-ci]

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/c6220410-2306-11f1-9c3a-90af7c7cc380-0

[openshift-ci]

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/23e6af60-2307-11f1-992d-12ede9d2e079-0

[openshift-ci]

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/26a088fc-2307-11f1-9da4-6bca82f01e76-0

[openshift-ci]

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/e01ef8c0-2309-11f1-813c-239011e41911-0

[rikatz]

👍 thanks!

[rikatz]

change lgtm, I am a bit biased because I have some commits there as well, but given Brett came back already and we did a bunch of reviews as well:

/lgtm

🚢

[gcs278]

unrelated hypershift failure:
/test e2e-hypershift

[rhamini3]

Installed a new cluster with all the updates and reran the checks highlighted here

/verified by @rhamini3

[openshift-ci-robot]

@rhamini3: This PR has been marked as verified by @rhamini3 again :).

Details

In response to this:

Installed a new cluster with all the updates and reran the checks highlighted here

/verified by @rhamini3 again :)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/0198a9d0-233f-11f1-9a7d-ebebc862b301-0

[gcs278]

Now that openshift/origin#30896 is merged, I'm going to unhold this PR. I'll followed up with QE (@ShudiLi & @lihongan) to recommend an OLM to Sail Library verification; however, since this is TP, I think we have the flexibility to merge this as is and follow up with any issues they may find.

The goal is to get this spinning in CI asap. Even with the OLM-logic skips introduced openshift/origin#30896, we are still testing Gateway API ingress mostly end-to-end for Sail Library (minus upgrade tests). When @rhamini3 gets openshift/origin#30905 merged, we will have even better/more precise coverage (and our 5 tests needed for feature gate promotion).

We are still using @aslakknutsen's development branch for our sail library, but as a team we decided that's fine for TP. When openshift-service-mesh/sail-operator#721 is merged into main, or subsequent release-3.3 branches, I will create another vendor bump.

/unhold

[rikatz]

/retest-required

[rikatz]

/override ci/prow/e2e-aws-ovn-hypershift-conformance

the hypershit failing tests are all related to cli. The conformance test is permafailing on all other jobs, and we really need this one to be merged.

## Root Cause
**All 4 failing tests timed out after exactly 15 minutes**, indicating a test framework timeout rather than functional failures.
## Failed Tests
All failures are in the `[sig-cli]` test suite, related to OpenShift CLI admin commands:
### 1. `[sig-cli] oc adm storage-admin`
- **Location**: `github.com/openshift/origin/test/extended/cli/admin.go:251`
- **Timeout at**: Line 306 (step "Test that scoped storage-admin now an admin in project foo")
- **First attempt failed at**: 11:16:27 (15m0s)
- **Retry failed at**: 11:34:54 (15m0s)
### 2. `[sig-cli] oc adm ui-project-commands`
- **Location**: `github.com/openshift/origin/test/extended/cli/admin.go:403`
- **First attempt failed at**: 11:16:33 (15m0s)
- **Retry failed at**: 11:34:54 (15m0s)
### 3. `[sig-cli] templates different namespaces`
- **Location**: `github.com/openshift/origin/test/extended/cli/template.go:345`
- **First attempt failed at**: 11:16:40 (15m0s)
- **Retry failed at**: 11:34:54 (15m0s)
### 4. `[sig-cli] oc adm new-project`
- **Location**: `github.com/openshift/origin/test/extended/cli/admin.go:425`
- **First attempt failed at**: 11:17:11 (15m0s)
- **Retry failed at**: 11:34:54 (15m0s)

The hypershift team was warned about this error

[rikatz]

bot?

/override ci/prow/e2e-aws-ovn-hypershift-conformance

[openshift-ci]

@rikatz: Overrode contexts on behalf of rikatz: ci/prow/e2e-aws-ovn-hypershift-conformance

Details

In response to this:

/override ci/prow/e2e-aws-ovn-hypershift-conformance

the hypershit failing tests are all related to cli. The conformance test is permafailing on all other jobs, and we really need this one to be merged.

## Root Cause
**All 4 failing tests timed out after exactly 15 minutes**, indicating a test framework timeout rather than functional failures.
## Failed Tests
All failures are in the `[sig-cli]` test suite, related to OpenShift CLI admin commands:
### 1. `[sig-cli] oc adm storage-admin`
- **Location**: `github.com/openshift/origin/test/extended/cli/admin.go:251`
- **Timeout at**: Line 306 (step "Test that scoped storage-admin now an admin in project foo")
- **First attempt failed at**: 11:16:27 (15m0s)
- **Retry failed at**: 11:34:54 (15m0s)
### 2. `[sig-cli] oc adm ui-project-commands`
- **Location**: `github.com/openshift/origin/test/extended/cli/admin.go:403`
- **First attempt failed at**: 11:16:33 (15m0s)
- **Retry failed at**: 11:34:54 (15m0s)
### 3. `[sig-cli] templates different namespaces`
- **Location**: `github.com/openshift/origin/test/extended/cli/template.go:345`
- **First attempt failed at**: 11:16:40 (15m0s)
- **Retry failed at**: 11:34:54 (15m0s)
### 4. `[sig-cli] oc adm new-project`
- **Location**: `github.com/openshift/origin/test/extended/cli/admin.go:425`
- **First attempt failed at**: 11:17:11 (15m0s)
- **Retry failed at**: 11:34:54 (15m0s)

The hypershift team was warned about this error

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@rikatz: Overrode contexts on behalf of rikatz: ci/prow/e2e-aws-ovn-hypershift-conformance

Details

In response to this:

bot?

/override ci/prow/e2e-aws-ovn-hypershift-conformance

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@gcs278: This PR was included in a payload test run from openshift/origin#30897
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/07dadcd0-2391-11f1-8c59-fe2512e5aad1-0

[lihongan]

Change included in accepted release 4.22.0-0.nightly-2026-03-23-022245