Skip to content

NE-2519: Move Sail Library to official release branch #1404

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 2 commits into from
Mar 30, 2026
Merged

NE-2519: Move Sail Library to official release branch #1404

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
43c978a
NE-2519: Move Sail Library to official release branch
gcs278 Mar 25, 2026
b1bbbb7
Remove SetImageDefaults that overrode CSV image SHAs
gcs278 Mar 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
16 changes: 5 additions & 11 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ require (
k8s.io/client-go v0.35.1
k8s.io/utils v0.0.0-20260108192941-914a6e750570
sigs.k8s.io/controller-runtime v0.23.3
sigs.k8s.io/gateway-api v1.5.0 // Pinned to v1.4.1 in replace directive
sigs.k8s.io/gateway-api v1.4.1
)

require (
Expand Down Expand Up @@ -201,7 +201,7 @@ require (
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
helm.sh/helm/v3 v3.18.6 // indirect
istio.io/istio v0.0.0-20260309041103-f67b89f49d1a // indirect
istio.io/istio v0.0.0-20260306174229-7da666217518 // indirect
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 30, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# 1) Extract the istio.io/istio version from go.mod
ISTIO_VER=$(rg -n '^\s*istio\.io/istio\s+v' go.mod | sed -E 's/.*istio\.io\/istio\s+(v[^ ]+).*/\1/')
echo "Detected istio.io/istio version: ${ISTIO_VER}"

# 2) Query OSV for known vulnerabilities on that exact version
curl -sS https://api.osv.dev/v1/query \
  -H 'Content-Type: application/json' \
  -d "{\"package\":{\"name\":\"istio.io/istio\",\"ecosystem\":\"Go\"},\"version\":\"${ISTIO_VER}\"}" \
  | jq '.vulns[] | {id, summary, aliases, severity: (.database_specific.severity // "unknown"), modified}'

# 3) Check whether the repo already documents any explicit exception/backport note
rg -n -C 2 'GHSA-|CVE-|backport|vulnerability|security exception|istio\.io/istio' README.md go.mod || true

Repository: openshift/cluster-ingress-operator

Length of output: 1496

🏁 Script executed:

# Check for SECURITY.md or changelog documenting patches
find . -type f \( -iname "SECURITY.md" -o -iname "CHANGELOG*" -o -iname "RELEASE*" \) | head -20

# Look for any comments in go.mod or go.sum about security or istio
rg -n 'istio' go.sum || true

Repository: openshift/cluster-ingress-operator

Length of output: 1955

🏁 Script executed:

# Check the actual commit hash of this pseudo-version
# Pseudo-version format: v0.0.0-<timestamp>-<commithash>
# Extract commit hash and verify what it includes
echo "Pseudo-version breakdown:"
echo "Version: v0.0.0-20260306174229-7da666217518"
echo "Date: 2026-03-06"
echo "Commit hash (short): 7da666217518"

# Search for any documentation in the repo mentioning the specific vulnerabilities
rg -n 'CVE-2021-39155|CVE-2022-23635|CVE-2021-39156|CVE-2019-14993|CVE-2022-31045|GHSA-7774|GHSA-856q|GHSA-hqxw|GHSA-qcvw|GHSA-xwx5' . || echo "No specific CVE references found"

# Check if there's any upstream istio tracking or pinning rationale
rg -n -C 3 'istio' README.md || true

Repository: openshift/cluster-ingress-operator

Length of output: 231

Address HIGH severity Istio vulnerabilities before release.

The pinned istio.io/istio version v0.0.0-20260306174229-7da666217518 is flagged by OSV as affected by four HIGH severity advisories:

Confirm this commit includes downstream backports for these GHSAs, or bump to a patched revision before release.

🧰 Tools
🪛 OSV Scanner (2.3.5)

[HIGH] 204-204: istio.io/istio 0.0.0-20260306174229-7da666217518: Authorization Policy Bypass Due to Case Insensitive Host Comparison

(GHSA-7774-7vr3-cc8j)

[HIGH] 204-204: istio.io/istio 0.0.0-20260306174229-7da666217518: Unauthenticated control plane denial of service attack in Istio

(GHSA-856q-xv3c-7f2f)

[HIGH] 204-204: istio.io/istio 0.0.0-20260306174229-7da666217518: Istio Fragments in Path May Lead to Authorization Policy Bypass

(GHSA-hqxw-mm44-gc4r)

[HIGH] 204-204: istio.io/istio 0.0.0-20260306174229-7da666217518: Istio ReDoS Vulnerability

(GHSA-qcvw-82hh-gq38)

[HIGH] 204-204: istio.io/istio 0.0.0-20260306174229-7da666217518: Ill-formed headers may lead to unexpected behavior in Istio

(GHSA-xwx5-5c9g-x68x)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@go.mod` at line 204, The pinned dependency istio.io/istio at version
v0.0.0-20260306174229-7da666217518 is known to be affected by multiple HIGH
severity advisories; update the go.mod entry by either (a) replacing that
version with a newer patched Istio revision that explicitly contains fixes for
GHSA-7774-7vr3-cc8j, GHSA-856q-xv3c-7f2f, GHSA-hqxw-mm44-gc4r, and
GHSA-qcvw-82hh-gq38, or (b) if you must keep this revision, add and document the
downstream backport commits that remediate those GHSA/CVE issues in the
repository and ensure the go.sum/go mod tidy are updated; verify with go list -m
-json istio.io/istio (or equivalent) that the chosen revision contains the
patches before merging.

Copy link
Copy Markdown
Member

@rikatz rikatz Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coderabbitai can you assess if any of the code used by this repository is actually impacted by this CVE? Given the Istio instance is deployed as a separated process from sail library and using pre-built binaries?

Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

Let me check how istio.io/istio is actually used in this codebase.

🏁 Script executed:

#!/bin/bash
# Find all Go files that import anything from istio.io/istio
rg -n 'istio\.io/istio' --type go -B1 -A1

# Also check what packages from istio.io/istio are imported
rg -n '"istio\.io/istio' --type go

Length of output: 0

@rikatz, confirmed — none of the flagged CVEs impact this repository's operator binary.

Here's the assessment:

  1. istio.io/istio is not imported anywhere in this repo's Go code. Running a full search across all .go files returns zero matches. It is a purely transitive dependency pulled in by github.com/istio-ecosystem/sail-operator, not used directly.

  2. The CVEs are Istio runtime vulnerabilities, not library vulnerabilities that affect operator code:

    • GHSA-7774 / CVE-2021-39155: Authorization policy bypass via case-insensitive host comparison — affects the Istio proxy/control plane handling live traffic.
    • GHSA-856q / CVE-2022-23635: Unauthenticated control plane DoS — affects the Istiod server process.
    • GHSA-hqxw / CVE-2021-39156: Path fragment bypass — affects envoy/proxy traffic routing.
    • GHSA-qcvw / CVE-2019-14993: ReDoS — affects regex evaluation in the Istio control plane.
    • GHSA-xwx5: Ill-formed headers — affects Istio proxy parsing of live HTTP traffic.

  3. Istio runs as pre-built container images (separate processes, separate security boundary). This operator only manages Istio CRDs/lifecycle via the Sail Library — it does not serve Istio traffic, implement authorization policies, or execute any of the vulnerable code paths.

The OSV scanner flagged this purely because the module appears in go.mod/go.sum transitively, which is a known false-positive pattern for operator-style projects that vendor upstream module types without executing their runtime logic. The finding can be safely dismissed for this PR.

k8s.io/cli-runtime v0.35.0 // indirect
k8s.io/component-base v0.35.1 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
Expand All @@ -222,12 +222,6 @@ require (
// github.com/istio-ecosystem/sail-operator.
replace github.com/imdario/mergo => github.com/imdario/mergo v0.3.5

// Use the sail_library_ossm branch from aslakknutsen's fork for Sail Library integration
replace github.com/istio-ecosystem/sail-operator => github.com/aslakknutsen/sail-operator v0.0.0-20260318134045-4159c7d6ebbd

// Pin gateway-api to v1.4.1 to avoid upgrading via transitive dependency.
// The sail-operator main branch uses the latest Istio, which depends on gateway-api v1.5.0.
// However, sail-operator itself doesn't use gateway-api, so pinning is safe and avoids
// unintended API changes in CIO's Gateway API implementation.
// Remove this when sail-operator switches to an OSSM release branch.
replace sigs.k8s.io/gateway-api => sigs.k8s.io/gateway-api v1.4.1
// Use OSSM 3.3.1 for Sail Library integration.
// Replace needed because the fork keeps upstream module name for compatibility.
replace github.com/istio-ecosystem/sail-operator => github.com/openshift-service-mesh/sail-operator v0.0.0-20260327145107-d4059b965c68
44 changes: 22 additions & 22 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,8 +82,6 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkY
github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
github.com/aslakknutsen/sail-operator v0.0.0-20260318134045-4159c7d6ebbd h1:vfI4hsUFuhLclPLC3oCi+wj7/jyDsNTSws2xCyhj/Sg=
github.com/aslakknutsen/sail-operator v0.0.0-20260318134045-4159c7d6ebbd/go.mod h1:M9xr1Yd0Vk4NATmQ0VFlAFhA4Xxv0UIe2vl1mZhk9JQ=
github.com/aws/aws-sdk-go v1.34.28/go.mod h1:H7NKnBqNVzoTJpGfLrQkkD+ytBA93eiDYi/+8rV9s48=
github.com/aws/aws-sdk-go v1.38.49 h1:E31vxjCe6a5I+mJLmUGaZobiWmg9KdWaud9IfceYeYQ=
github.com/aws/aws-sdk-go v1.38.49/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
Expand Down Expand Up @@ -325,8 +323,8 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
github.com/google/pprof v0.0.0-20250607225305-033d6d78b36a h1://KbezygeMJZCSHH+HgUZiTeSoiuFspbMg1ge+eFj18=
github.com/google/pprof v0.0.0-20250607225305-033d6d78b36a/go.mod h1:5hDyRhoBCxViHszMt12TnOpEI4VVi+U8Gm9iphldiMA=
github.com/google/s2a-go v0.1.4 h1:1kZ/sQM3srePvKs3tXAvQzo66XfcReoqFpIpIccE7Oc=
github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
Expand All @@ -351,8 +349,8 @@ github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJr
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
Expand Down Expand Up @@ -445,8 +443,8 @@ github.com/mdlayher/netlink v1.6.0 h1:rOHX5yl7qnlpiVkFWoqccueppMtXzeziFjWAjLg6sz
github.com/mdlayher/netlink v1.6.0/go.mod h1:0o3PlBmGst1xve7wQ7j/hwpNaFaH4qCRyWCdcZk8/vA=
github.com/mdlayher/socket v0.1.1 h1:q3uOGirUPfAV2MUoaC7BavjQ154J7+JOkTWyiV+intI=
github.com/mdlayher/socket v0.1.1/go.mod h1:mYV5YIZAfHh4dzDVzI8x8tWLWCliuX8Mon5Awbj+qDs=
github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
github.com/miekg/dns v1.1.68 h1:jsSRkNozw7G/mnmXULynzMNIsgY2dHC8LO6U6Ij2JEA=
github.com/miekg/dns v1.1.68/go.mod h1:fujopn7TB3Pu3JM69XaawiU0wqjpL9/8xGop5UrTPps=
github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
Expand Down Expand Up @@ -486,17 +484,19 @@ github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108
github.com/onsi/ginkgo v1.14.2/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
github.com/onsi/ginkgo/v2 v2.28.0 h1:Rrf+lVLmtlBIKv6KrIGJCjyY8N36vDVcutbGJkyqjJc=
github.com/onsi/ginkgo/v2 v2.28.0/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
github.com/onsi/ginkgo/v2 v2.27.2 h1:LzwLj0b89qtIy6SSASkzlNvX6WktqurSHwkk2ipF/Ns=
github.com/onsi/ginkgo/v2 v2.27.2/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
github.com/onsi/gomega v1.10.5/go.mod h1:gza4q3jKQJijlu05nKWRCW/GavJumGt8aNRxWg7mt48=
github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
github.com/openshift-service-mesh/sail-operator v0.0.0-20260327145107-d4059b965c68 h1:qbJWOmvwtzZJT6u7b2HHMF3g0wWvbcYmv9keKcJlb+k=
github.com/openshift-service-mesh/sail-operator v0.0.0-20260327145107-d4059b965c68/go.mod h1:l5/9fIFLMnrArPGvg49DBrWZzi8LojS5OcGe9nJeeI4=
github.com/openshift/api v0.0.0-20260327065519-582dc3d316b7 h1:7AmoMSqTryaZu65nij6EACe8+DmlMlmR1giaUx5S5sQ=
github.com/openshift/api v0.0.0-20260327065519-582dc3d316b7/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
github.com/openshift/client-go v0.0.0-20260317180604-743f664b82d1 h1:Hr/R38eg5ZJXfbiaHumjJIN1buDZwhsm4ys4npVCXH0=
Expand Down Expand Up @@ -659,8 +659,8 @@ go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5w
go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
Expand Down Expand Up @@ -816,8 +816,8 @@ google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98
google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
google.golang.org/genproto v0.0.0-20231211222908-989df2bf70f3 h1:1hfbdAfFbkmpg41000wDVqr7jUpK/Yo+LPnIxxGzmkg=
google.golang.org/genproto/googleapis/api v0.0.0-20251213004720-97cd9d5aeac2 h1:7LRqPCEdE4TP4/9psdaB7F2nhZFfBiGJomA5sojLWdU=
google.golang.org/genproto/googleapis/api v0.0.0-20251213004720-97cd9d5aeac2/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto=
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls=
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto=
google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 h1:2I6GHUeJ/4shcDpoUlLs/2WPnhg7yJwvXtqcMJt9liA=
google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
Expand Down Expand Up @@ -876,12 +876,12 @@ helm.sh/helm/v3 v3.18.6 h1:S/2CqcYnNfLckkHLI0VgQbxgcDaU3N4A/46E3n9wSNY=
helm.sh/helm/v3 v3.18.6/go.mod h1:L/dXDR2r539oPlFP1PJqKAC1CUgqHJDLkxKpDGrWnyg=
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
istio.io/api v1.29.0-alpha.0.0.20260302212057-b10ab91e9ded h1:fonoS3Wm6ir/iJsTJqyhR5027v/ptXA+RRtlNwHtOzg=
istio.io/api v1.29.0-alpha.0.0.20260302212057-b10ab91e9ded/go.mod h1:+brQWcBHoROuyA6fv8rbgg8Kfn0RCGuqoY0duCMuSLA=
istio.io/client-go v1.29.0-alpha.0.0.20260302212757-4d22331907bb h1:jK7RkLHCZta7D2Txj0ppMdJU3qyRcFYboQzvAgDPtJM=
istio.io/client-go v1.29.0-alpha.0.0.20260302212757-4d22331907bb/go.mod h1:c/UZ1LHBSIKeZnEQOMRybo7PPAznbOrgLnxxm8jMeHY=
istio.io/istio v0.0.0-20260309041103-f67b89f49d1a h1:kgHsCmLQj1sX4seZ6Euv0/3ICFqcAgFhkZdWzXPubgg=
istio.io/istio v0.0.0-20260309041103-f67b89f49d1a/go.mod h1:KE/3TTnFR2LNpcjiNKkAz7t1T0xi6S/T7ZLYqo4DxBQ=
istio.io/api v1.28.5-0.20260306154401-b08bd5908741 h1:DK00OZIwDVG/METF5BCf5x+6Rcy1fLCm4FVoK/eSSh4=
istio.io/api v1.28.5-0.20260306154401-b08bd5908741/go.mod h1:BD3qv/ekm16kvSgvSpuiDawgKhEwG97wx849CednJSg=
istio.io/client-go v1.28.5 h1:fkT84vKKwr2LYnvXDZo67SogByJfsSrRwVPlCxsOGEg=
istio.io/client-go v1.28.5/go.mod h1:DBtlSnmVgdxwjlAL572sM+q5YjyWJRwfN9Oa95ohzPI=
istio.io/istio v0.0.0-20260306174229-7da666217518 h1:wTSzA6ySwn5SU5vs6hAIYruAc+39MwGNwJzKYy7YlSw=
istio.io/istio v0.0.0-20260306174229-7da666217518/go.mod h1:AvwW8kBsPEMitVvHD7YF5MZ8Kqf8OgJoUtwB8O1gtog=
k8s.io/api v0.35.1 h1:0PO/1FhlK/EQNVK5+txc4FuhQibV25VLSdLMmGpDE/Q=
k8s.io/api v0.35.1/go.mod h1:28uR9xlXWml9eT0uaGo6y71xK86JBELShLy4wR1XtxM=
k8s.io/apiextensions-apiserver v0.35.1 h1:p5vvALkknlOcAqARwjS20kJffgzHqwyQRM8vHLwgU7w=
Expand Down
22 changes: 0 additions & 22 deletions pkg/operator/controller/gatewayclass/controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,15 +85,6 @@ const (
// 1. Sail Library mode: Uninstall Istio if this is the last GatewayClass, then remove finalizer
// 2. Downgrade to OLM: Clean up Sail Library status and finalizer (then OLM takes over Istio)
sailLibraryFinalizer = "openshift.io/ingress-operator-sail-finalizer"

// Image configuration for Sail Library installations.
// These are only used for defaulting when CSV image annotations are missing,
// which should not happen in production clusters with proper OSSM release branches.
ossmImageRegistry = "registry.redhat.io/openshift-service-mesh"
istioImageIstiod = "istio-pilot-rhel9"
istioImageProxy = "istio-proxyv2-rhel9"
istioImageCNI = "istio-cni-rhel9"
istioImageZTunnel = "istio-ztunnel-rhel9"
)

type extraIstioConfig struct {
Expand Down Expand Up @@ -184,19 +175,6 @@ func NewUnmanaged(mgr manager.Manager, config Config) (controller.Controller, er
return nil, err
}
} else {
// TODO: Remove this when we switch to an OSSM release branch with proper CSV image annotations.
// The main branch of sail-operator does not maintain image annotations in the CSV,
// causing Istio to fall back to upstream container images. This explicit configuration
// ensures Red Hat images are used until the release branch has the annotations properly maintained.
err := install.SetImageDefaults(resources.FS, ossmImageRegistry, install.ImageNames{
Istiod: istioImageIstiod,
Proxy: istioImageProxy,
CNI: istioImageCNI,
ZTunnel: istioImageZTunnel,
})
if err != nil {
return nil, fmt.Errorf("failed to set image defaults: %w", err)
}
// Start the Sail Library's background reconciliation loop (runs in a goroutine).
// Returns a notification channel that signals when library reconciliation completes,
// allowing us to update GatewayClass status conditions accordingly.
Expand Down
10 changes: 5 additions & 5 deletions vendor/github.com/istio-ecosystem/sail-operator/api/v1/istio_types.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading