Add automation documentation tests for migration from sidecar to ambient by bmangoen · Pull Request #1379 · istio-ecosystem/sail-operator

bmangoen · 2025-11-24T20:41:24Z

What type of PR is this?

What this PR does / why we need it:

Reorganized the migration from sidecar to ambient mode doc part and added automation tests for migration from sidecar to ambient mode

Which issue(s) this PR fixes:

Fixes #1290

codecov · 2025-11-24T20:45:51Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.71%. Comparing base (fa159e5) to head (d28f407).
⚠️ Report is 11 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1379   +/-   ##
=======================================
  Coverage   80.71%   80.71%           
=======================================
  Files          51       51           
  Lines        2598     2598           
=======================================
  Hits         2097     2097           
  Misses        380      380           
  Partials      121      121

Flag	Coverage Δ
integration-tests	`71.42% <ø> (-0.22%)`	⬇️
unit-tests	`52.30% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

fjglira

Looks preatty good in general

fjglira · 2026-01-07T12:13:42Z

Hey @bmangoen checking the execution after the latest changes I see this:

serviceaccount/bookinfo-productpage created
deployment.apps/productpage-v1 created
Warning: unrecognized format "int32"
Warning: unrecognized format "int64"

PLease check the applied yamls because seems that can be issues with the format

No resources found
label "istio.io/rev" not found.
namespace/bookinfo not labeled

Check also a step where is trying to label the namespace and get looking for a label

I think from that last error message is coming the issue that is causing to not go ambient mode correctly in the bookinfo namespace, because in the last step I see that the restarted bookinfo pods are still on sidecar mode:

deployment.apps/waypoint restarted
NAME                                      READY   STATUS              RESTARTS   AGE
bookinfo-gateway-istio-69b9bd5f75-b8rjg   1/1     Terminating         0          9s
bookinfo-gateway-istio-77d5b9c674-8mtfh   1/1     Running             0          3s
bookinfo-gateway-istio-7bcdc79466-5xrr8   0/1     ContainerCreating   0          0s
details-v1-5877f98768-625rj               2/2     Running             0          9s
details-v1-646bfdb84d-frdcm               0/2     Init:0/2            0          0s
productpage-v1-5b5b9f6c4d-c7zm8           2/2     Running             0          9s
productpage-v1-5c5797bc84-9mrq7           0/2     Init:0/2            0          0s
ratings-v1-6b9bdc976d-rhht5               0/2     Init:0/2            0          0s
ratings-v1-99cc4fbb4-vlq42                2/2     Running             0          9s
reviews-v1-75dd6854b4-ls7dw               0/2     Init:0/2            0          0s
reviews-v1-cc7784cd8-khflk                2/2     Running             0          9s
reviews-v2-78d775d888-lzq6q               2/2     Running             0          9s
reviews-v2-7f69f59fd8-vk6lp               0/2     Init:0/2            0          0s
reviews-v3-79c547f6c6-sl66g               0/2     Pending             0          0s
reviews-v3-7d45d95cb-rmb8w                2/2     Running             0          9s
waypoint-67c585948-mggcj                  1/1     Running             0          2s
Found pod(s) in namespace bookinfo: bookinfo-gateway-istio-69b9bd5f75-b8rjg

fjglira

I think we still need to add some wait and validations. At the end the migration looks almost good but there are some steps that seems to not be doing a proper validation

bmangoen · 2026-04-28T08:06:57Z

@bmangoen: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
docs-test_sail-operator_main 29a171d link false /test docs-test
Details

Needs the fix #1890 to pass

fjglira

Just some small comment the rest of the test looks ok, the connectivity is working and the migration seems successfully

fjglira · 2026-05-05T09:55:51Z

+  # Increase inotify limits to prevent "too many open files" errors with ztunnel and ambient mode
+  # This is needed because ztunnel watches ConfigMaps and the default limits are often too low
+  echo "Increasing inotify limits on KIND node..."
+  docker exec "${NAME}"-control-plane sysctl -w fs.inotify.max_user_instances=8192 || true
+  docker exec "${NAME}"-control-plane sysctl -w fs.inotify.max_user_watches=524288 || true
+


These changes are going to be overriden because we get these files from istio/common-files repo

Ah you're right ! Do you think guys from the community would accept this change upstream?

I think we should give a try to do the change upstream. I don't see any downside on this

Removed and waiting for istio/common-files#1278 to be accepted and merged

So, this errors:

##### Test istio-migrate-from-sidecar-to-ambient: Step 28 Error from server: error when creating "STDIN": admission webhook "validation.istio.io" denied the request: configuration is invalid: 2 errors occurred: * invalid policy productpage-ztunnel-protection.bookinfo: invalid `value` for `key` source.workload_name: unknown attribute: source.workload_name * invalid policy productpage-ztunnel-protection.bookinfo: invalid `notValue` for `key` source.workload_name: unknown attribute: source.workload_name Error from server: error when creating "STDIN": admission webhook "validation.istio.io" denied the request: configuration is invalid: 2 errors occurred: * invalid policy reviews-ztunnel-protection.bookinfo: invalid `value` for `key` source.workload_name: unknown attribute: source.workload_name * invalid policy reviews-ztunnel-protection.bookinfo: invalid `notValue` for `key` source.workload_name: unknown attribute: source.workload_name ##### Test istio-migrate-from-sidecar-to-ambient completed: FAIL

Are they related to that change?

Seems that Jonh is concerned about being masking an actual leak instead of a resource consumption issue

So, this errors:

##### Test istio-migrate-from-sidecar-to-ambient: Step 28 Error from server: error when creating "STDIN": admission webhook "validation.istio.io" denied the request: configuration is invalid: 2 errors occurred: * invalid policy productpage-ztunnel-protection.bookinfo: invalid `value` for `key` source.workload_name: unknown attribute: source.workload_name * invalid policy productpage-ztunnel-protection.bookinfo: invalid `notValue` for `key` source.workload_name: unknown attribute: source.workload_name Error from server: error when creating "STDIN": admission webhook "validation.istio.io" denied the request: configuration is invalid: 2 errors occurred: * invalid policy reviews-ztunnel-protection.bookinfo: invalid `value` for `key` source.workload_name: unknown attribute: source.workload_name * invalid policy reviews-ztunnel-protection.bookinfo: invalid `notValue` for `key` source.workload_name: unknown attribute: source.workload_name ##### Test istio-migrate-from-sidecar-to-ambient completed: FAIL

Are they related to that change?

I don't think so. I'm looking at it

Seems that Jonh is concerned about being masking an actual leak instead of a resource consumption issue

Yeah he's right ! So we need to find the leak if there is (or maybe it's just in my local environment, I need to confirm this)

bmangoen · 2026-05-11T15:39:30Z

/retest

fjglira · 2026-05-12T12:32:49Z

Ok, checking these errors:

##### Test istio-migrate-from-sidecar-to-ambient: Step 28

Error from server: error when creating "STDIN": admission webhook "validation.istio.io" denied the request: configuration is invalid: 2 errors occurred:
	* invalid policy productpage-ztunnel-protection.bookinfo: invalid `value` for `key` source.workload_name: unknown attribute: source.workload_name
	* invalid policy productpage-ztunnel-protection.bookinfo: invalid `notValue` for `key` source.workload_name: unknown attribute: source.workload_name


Error from server: error when creating "STDIN": admission webhook "validation.istio.io" denied the request: configuration is invalid: 2 errors occurred:
	* invalid policy reviews-ztunnel-protection.bookinfo: invalid `value` for `key` source.workload_name: unknown attribute: source.workload_name
	* invalid policy reviews-ztunnel-protection.bookinfo: invalid `notValue` for `key` source.workload_name: unknown attribute: source.workload_name

These error happens on this step:

[source,bash,subs="attributes+",name="istio-migrate-from-sidecar-to-ambient"]
----
cat <<EOF | kubectl apply -f-
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: productpage-ztunnel-protection
  namespace: bookinfo
spec:
  targetRefs:
  - kind: Service
    group: ""
    name: productpage
  action: DENY
  rules:
  - when:
    - key: source.workload_name
      notValues: ["waypoint"]

But I don't think are related to the step it self, seems to be related to a kind cluster issue, checking previous steps I see some pods on error state. Maybe worth include some debugging steps to check what is going on. But don't see to be related to the test it self

Reorganized doc and added automation test for migration from sidecar to ambient mode Signed-off-by: bmangoen <bmangoen@redhat.com>

Adding prebuilt functions for creating default Istio resource, installing Bookinfo and creating Bookinfo Gateway Signed-off-by: bmangoen <bmangoen@redhat.com>

Signed-off-by: bmangoen <bmangoen@redhat.com>

* Variabilize istio latest version * Remove execution of checking status Signed-off-by: bmangoen <bmangoen@redhat.com>

* Remove unnecessary console characters / debug statements * Fix all execution errors in the migration.adoc file Signed-off-by: bmangoen <bmangoen@redhat.com>

Signed-off-by: bmangoen <bmangoen@redhat.com>

bmangoen · 2026-05-13T15:59:35Z

    group: ""
    name: productpage
-  action: DENY
+  action: ALLOW


@fjglira I modified a bit the AuthorizationPolicy. They were too restrictive and it blocks all legitimate service-to-service traffic (like ratings → reviews)

bmangoen · 2026-05-13T17:30:22Z

/retest

istio-testing · 2026-05-21T13:00:01Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

bmangoen requested a review from a team as a code owner November 24, 2025 20:41

bmangoen requested a review from fjglira November 24, 2025 20:41

istio-testing added the size/L label Nov 24, 2025

bmangoen changed the title ~~Add automation tests for migration from sidecar to ambient~~ Add automation documentation tests for migration from sidecar to ambient Nov 24, 2025

istio-testing added the needs-rebase label Nov 25, 2025

fjglira reviewed Nov 26, 2025

View reviewed changes

Comment thread docs/migrate-from-sidecar-to-ambient/migration.adoc Outdated

Comment thread docs/migrate-from-sidecar-to-ambient/migration.adoc

Comment thread docs/migrate-from-sidecar-to-ambient/migration.adoc Outdated

Comment thread docs/migrate-from-sidecar-to-ambient/migration.adoc Outdated

bmangoen force-pushed the doc/automation-test-migration-sidecar-to-ambient branch from 5d5f234 to b83b8bc Compare November 27, 2025 13:51

istio-testing removed the needs-rebase label Nov 27, 2025

istio-testing added the needs-rebase label Jan 31, 2026

bmangoen force-pushed the doc/automation-test-migration-sidecar-to-ambient branch from 1ebd7af to 262769a Compare April 17, 2026 11:30

istio-testing removed the needs-rebase label Apr 17, 2026

fjglira reviewed Apr 24, 2026

View reviewed changes

bmangoen force-pushed the doc/automation-test-migration-sidecar-to-ambient branch from 29a171d to 832b65c Compare April 28, 2026 09:52

bmangoen requested a review from fjglira April 29, 2026 07:08

fjglira reviewed May 5, 2026

View reviewed changes

bmangoen added 10 commits May 13, 2026 09:22

Add automation test for migration from sidecar to ambient

7d58df4

Reorganized doc and added automation test for migration from sidecar to ambient mode Signed-off-by: bmangoen <bmangoen@redhat.com>

Add prebuilt functions to migration documentation

88a1983

Adding prebuilt functions for creating default Istio resource, installing Bookinfo and creating Bookinfo Gateway Signed-off-by: bmangoen <bmangoen@redhat.com>

Remove steps which test external URL connectivity

a7842cc

Signed-off-by: bmangoen <bmangoen@redhat.com>

Remove steps which test external URL connectivity

01a1b81

Signed-off-by: bmangoen <bmangoen@redhat.com>

Variabilize istio latest version

4d4c93c

* Variabilize istio latest version * Remove execution of checking status Signed-off-by: bmangoen <bmangoen@redhat.com>

Fix all execution errors

33eb710

* Remove unnecessary console characters / debug statements * Fix all execution errors in the migration.adoc file Signed-off-by: bmangoen <bmangoen@redhat.com>

Wait until istio-ca-root-cert propagation + fix KinD issue

19e3a80

Signed-off-by: bmangoen <bmangoen@redhat.com>

Fix authorization policy for tests connectivity

0ae82c7

Signed-off-by: bmangoen <bmangoen@redhat.com>

Add wait step at Istio creation

428092e

Signed-off-by: bmangoen <bmangoen@redhat.com>

Fix correct label

2270e60

Signed-off-by: bmangoen <bmangoen@redhat.com>

bmangoen force-pushed the doc/automation-test-migration-sidecar-to-ambient branch from a94ca05 to 2270e60 Compare May 13, 2026 07:22

Fix ztunnel authorization policies

d28f407

Signed-off-by: bmangoen <bmangoen@redhat.com>

bmangoen commented May 13, 2026

View reviewed changes

istio-testing added the needs-rebase label May 21, 2026

Conversation

bmangoen commented Nov 24, 2025

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Uh oh!

codecov Bot commented Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

fjglira left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fjglira commented Jan 7, 2026

Uh oh!

fjglira left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bmangoen commented Apr 28, 2026

Uh oh!

fjglira left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmangoen commented May 11, 2026

Uh oh!

fjglira commented May 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmangoen commented May 13, 2026

Uh oh!

istio-testing commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov Bot commented Nov 24, 2025 •

edited

Loading