chore: update istio CRDs to use v1 API (#2606)

briantwatson · web-flow · commit 079c36137835 · 2026-04-23T11:26:18.000-04:00
## Description #### Original scope (3 operator-typed kinds) - **Typed classes** — AuthorizationPolicy, VirtualService, ServiceEntry regenerated at `v1` via `src/istio/tasks.yaml` `KEEP` list update - **advancedHTTP subset** — regenerated at `v1` via `CRD_VERSION` bump in `gen-istio-crd-sources.ts` - **Imports** — aggregator (`crd/index.ts`), `sources/package/v1alpha1.ts`, and 7 direct-path consumers (3 source + 4 spec) repointed to `-v1` - **Hardcoded `apiVersion` literals** — 9 string swaps in operator source + specs - **AuthorizationPolicy chart YAMLs** — 2 Keycloak templates bumped - **Docs** — VirtualService + AuthorizationPolicy examples at `v1` #### Expanded scope (other shipped Istio kinds with upstream `v1`) - **PeerAuthentication** — 5 chart YAMLs (keycloak, istio-common ×2, metrics-server, prometheus-stack) bumped `v1beta1` → `v1` - **Gateway** — 1 chart YAML (`uds-istio-config`) bumped `v1beta1` → `v1` - **DestinationRule** — 1 chart YAML (Keycloak session stickiness) bumped `v1alpha3` → `v1 ## Related Issue Fixes CORE-44 ## Type of change - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [x] Other (security config, docs update, etc) ## Steps to Validate - ` kubectl get vs,authorizationpolicy,serviceentry,peerauthentication,destinationrule,gateway -A -o yaml | grep -E '^- apiVersion:' | sort -u` post-deploy. - Applied `v1beta1` VirtualService and PeerAuthentication → still accepted (no regression) ## Checklist before merging - [x] Test, docs, adr added or updated as needed - [x] [Contributor Guide](https://github.com/defenseunicorns/uds-core/blob/main/CONTRIBUTING.md) followed
diff --git a/docs/dev/authorization-policy-generation.md b/docs/dev/authorization-policy-generation.md
@@ -66,7 +66,7 @@ spec:
 ```
 
 ```yaml
-apiVersion: security.istio.io/v1beta1
+apiVersion: security.istio.io/v1
 kind: AuthorizationPolicy
 metadata:
   name: protect-my-app-ingress-external-app
@@ -99,7 +99,7 @@ spec:
 ```
 
 ```yaml
-apiVersion: security.istio.io/v1beta1
+apiVersion: security.istio.io/v1
 kind: AuthorizationPolicy
 metadata:
   name: protect-my-app-ingress-frontend
@@ -132,7 +132,7 @@ spec:
 ```
 
 ```yaml
-apiVersion: security.istio.io/v1beta1
+apiVersion: security.istio.io/v1
 kind: AuthorizationPolicy
 metadata:
   name: protect-loki-ingress-all
@@ -160,7 +160,7 @@ spec:
 ```
 
 ```yaml
-apiVersion: security.istio.io/v1beta1
+apiVersion: security.istio.io/v1
 kind: AuthorizationPolicy
 metadata:
   name: protect-myapp-ingress-all
@@ -191,7 +191,7 @@ spec:
 ```
 
 ```yaml
-apiVersion: security.istio.io/v1beta1
+apiVersion: security.istio.io/v1
 kind: AuthorizationPolicy
 metadata:
   name: protect-my-app-ingress-9090-backend-istio-admin-gateway
@@ -228,7 +228,7 @@ spec:
 ```
 
 ```yaml
-apiVersion: security.istio.io/v1beta1
+apiVersion: security.istio.io/v1
 kind: AuthorizationPolicy
 metadata:
   name: protect-grafana-ingress-grafana-istio-tenant-gateway
diff --git a/docs/how-to-guides/networking/configure-non-http-ingress.mdx b/docs/how-to-guides/networking/configure-non-http-ingress.mdx
@@ -79,7 +79,7 @@ This example configures SSH ingress, but the same process applies to any TCP pro
    In your application's Zarf package, create a Gateway CR that tells Istio to listen on the new port for your host:
 
    ```yaml title="gateway.yaml"
-   apiVersion: networking.istio.io/v1beta1
+   apiVersion: networking.istio.io/v1
    kind: Gateway
    metadata:
      name: example-ssh-gateway
@@ -101,7 +101,7 @@ This example configures SSH ingress, but the same process applies to any TCP pro
    Route incoming TCP traffic from the gateway to your application service:
 
    ```yaml title="virtualservice.yaml"
-   apiVersion: networking.istio.io/v1beta1
+   apiVersion: networking.istio.io/v1
    kind: VirtualService
    metadata:
      name: example-ssh
diff --git a/src/istio/charts/uds-istio-config/templates/gateway.yaml b/src/istio/charts/uds-istio-config/templates/gateway.yaml
@@ -1,4 +1,4 @@
-# Copyright 2024 Defense Unicorns
+# Copyright 2024-2026 Defense Unicorns
 # SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
 
 {{- $domain := tpl .Values.domain . }}
@@ -7,7 +7,7 @@
 {{- $rootMode := $rootTLS.mode | default ($.Values.tls.mode | default "SIMPLE") -}}
 {{- $rootSupportTLS := $rootTLS.supportTLSV1_2 | default ($.Values.tls.supportTLSV1_2 | default false) -}}
 {{- if .Values.tls }}
-apiVersion: networking.istio.io/v1beta1
+apiVersion: networking.istio.io/v1
 kind: Gateway
 metadata:
   name: {{ .Values.name }}-gateway
diff --git a/src/istio/common/chart/templates/peer-authentication.yaml b/src/istio/common/chart/templates/peer-authentication.yaml
@@ -1,10 +1,10 @@
-# Copyright 2024 Defense Unicorns
+# Copyright 2024-2026 Defense Unicorns
 # SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
 
 ---
 # @lulaStart 4bc74dfa-60b7-4716-af4b-b492a12eec42
 # Source: istio/templates/bigbang/peerAuthentication.yaml
-apiVersion: security.istio.io/v1beta1
+apiVersion: security.istio.io/v1
 kind: PeerAuthentication
 metadata:
   name: default-istio-system
diff --git a/src/istio/common/chart/templates/pepr-istio-config.yaml b/src/istio/common/chart/templates/pepr-istio-config.yaml
@@ -1,4 +1,4 @@
-# Copyright 2024 Defense Unicorns
+# Copyright 2024-2026 Defense Unicorns
 # SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
 
 # Have to pre-create the namespace and also patch it with the istio-injection label later because
@@ -10,7 +10,7 @@ metadata:
   labels:
     istio.io/dataplane-mode: ambient
 ---
-apiVersion: "security.istio.io/v1beta1"
+apiVersion: "security.istio.io/v1"
 kind: PeerAuthentication
 metadata:
   name: permissive-pepr-webhook
@@ -25,7 +25,7 @@ spec:
     "3000":
       mode: PERMISSIVE
 ---
-apiVersion: "security.istio.io/v1beta1"
+apiVersion: "security.istio.io/v1"
 kind: PeerAuthentication
 metadata:
   name: permissive-pepr-webhook-watcher
diff --git a/src/istio/tasks.yaml b/src/istio/tasks.yaml
@@ -48,7 +48,7 @@ tasks:
           npx kubernetes-fluent-client@3.11.6 crd https://raw.githubusercontent.com/istio/istio/1.29.1/manifests/charts/base/files/crd-all.gen.yaml "$OUT_DIR"
 
           # Istio includes all CRDs in a single YAML file so we need to prune down to just the subset we want to keep
-          KEEP="authorizationpolicy-v1beta1 gateway-v1 requestauthentication-v1 serviceentry-v1beta1 sidecar-v1 virtualservice-v1beta1"
+          KEEP="authorizationpolicy-v1 gateway-v1 requestauthentication-v1 serviceentry-v1 sidecar-v1 virtualservice-v1"
           for f in "$OUT_DIR"/*.ts; do
             base="$(basename "$f" .ts)"
             if [[ " $KEEP " != *" $base "* ]]; then
diff --git a/src/keycloak/chart/templates/destination-rule.yaml b/src/keycloak/chart/templates/destination-rule.yaml
@@ -1,8 +1,8 @@
-# Copyright 2024 Defense Unicorns
+# Copyright 2024-2026 Defense Unicorns
 # SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
 
 {{- if and .Values.autoscaling.enabled .Values.autoscaling.sessionStickiness.enabled }}
-apiVersion: networking.istio.io/v1alpha3
+apiVersion: networking.istio.io/v1
 kind: DestinationRule
 metadata:
   name: {{ include "keycloak.fullname" . }}-sticky-session
diff --git a/src/keycloak/chart/templates/istio-authpol-admin.yaml b/src/keycloak/chart/templates/istio-authpol-admin.yaml
@@ -1,8 +1,8 @@
-# Copyright 2024 Defense Unicorns
+# Copyright 2024-2026 Defense Unicorns
 # SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
 
-{{- if .Capabilities.APIVersions.Has "security.istio.io/v1beta1" }}
-apiVersion: security.istio.io/v1beta1
+{{- if .Capabilities.APIVersions.Has "security.istio.io/v1" }}
+apiVersion: security.istio.io/v1
 kind: AuthorizationPolicy
 metadata:
   name: keycloak-block-admin-access-from-public-gateway
diff --git a/src/keycloak/chart/templates/istio-authpol-waypoint.yaml b/src/keycloak/chart/templates/istio-authpol-waypoint.yaml
@@ -1,8 +1,8 @@
-# Copyright 2025 Defense Unicorns
+# Copyright 2025-2026 Defense Unicorns
 # SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
 
-{{- if .Capabilities.APIVersions.Has "security.istio.io/v1beta1" }}
-apiVersion: security.istio.io/v1beta1
+{{- if .Capabilities.APIVersions.Has "security.istio.io/v1" }}
+apiVersion: security.istio.io/v1
 kind: AuthorizationPolicy
 metadata:
   name: keycloak-enforce-waypoint
diff --git a/src/keycloak/chart/templates/istio-peer-auth.yaml b/src/keycloak/chart/templates/istio-peer-auth.yaml
@@ -1,8 +1,8 @@
-# Copyright 2024 Defense Unicorns
+# Copyright 2024-2026 Defense Unicorns
 # SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
 
-{{- if .Capabilities.APIVersions.Has "security.istio.io/v1beta1" }}
-apiVersion: security.istio.io/v1beta1
+{{- if .Capabilities.APIVersions.Has "security.istio.io/v1" }}
+apiVersion: security.istio.io/v1
 kind: PeerAuthentication
 metadata:
   name: keycloak
diff --git a/src/metrics-server/chart/templates/peerauthentication/metrics-api.yaml b/src/metrics-server/chart/templates/peerauthentication/metrics-api.yaml
@@ -1,8 +1,8 @@
-# Copyright 2024 Defense Unicorns
+# Copyright 2024-2026 Defense Unicorns
 # SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
 
-{{- if .Capabilities.APIVersions.Has "security.istio.io/v1beta1" }}
-apiVersion: security.istio.io/v1beta1
+{{- if .Capabilities.APIVersions.Has "security.istio.io/v1" }}
+apiVersion: security.istio.io/v1
 kind: PeerAuthentication
 metadata:
   name: metrics-server-api-exception
diff --git a/src/pepr/operator/controllers/istio/istio-resources.spec.ts b/src/pepr/operator/controllers/istio/istio-resources.spec.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright 2024 Defense Unicorns
+ * Copyright 2024-2026 Defense Unicorns
  * SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
  */
 
@@ -82,7 +82,7 @@ describe("istio-resources (ingress)", () => {
       (_expose, ns, pkgName, gen): IstioVirtualService => {
         const name = `vs-${++vsIdx}`;
         return {
-          apiVersion: "networking.istio.io/v1beta1",
+          apiVersion: "networking.istio.io/v1",
           kind: "VirtualService",
           metadata: {
             name,
@@ -99,7 +99,7 @@ describe("istio-resources (ingress)", () => {
       (_expose, ns, pkgName, gen): IstioServiceEntry => {
         const name = `se-${++seIdx}`;
         return {
-          apiVersion: "networking.istio.io/v1beta1",
+          apiVersion: "networking.istio.io/v1",
           kind: "ServiceEntry",
           metadata: {
             name,
diff --git a/src/pepr/operator/controllers/keycloak/authservice/authorization-policy.spec.ts b/src/pepr/operator/controllers/keycloak/authservice/authorization-policy.spec.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright 2025 Defense Unicorns
+ * Copyright 2025-2026 Defense Unicorns
  * SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns
  */
 
@@ -9,7 +9,7 @@ import type {
   Operation as IstioOperation,
   Rule as IstioRule,
   To as IstioTo,
-} from "../../../crd/generated/istio/authorizationpolicy-v1beta1";
+} from "../../../crd/generated/istio/authorizationpolicy-v1";
 import { PROMETHEUS_PRINCIPAL } from "../../utils";
 import {
   authNRequestAuthentication,
diff --git a/src/pepr/operator/controllers/network/authorizationPolicies.spec.ts b/src/pepr/operator/controllers/network/authorizationPolicies.spec.ts
@@ -1,12 +1,12 @@
 /**
- * Copyright 2025 Defense Unicorns
+ * Copyright 2025-2026 Defense Unicorns
  * SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
  */
 
 import { K8s } from "pepr";
 import { describe, expect, Mock, test, vi } from "vitest";
 import { Direction, Gateway, RemoteGenerated, UDSPackage } from "../../crd";
-import { Action, AuthorizationPolicy } from "../../crd/generated/istio/authorizationpolicy-v1beta1";
+import { Action, AuthorizationPolicy } from "../../crd/generated/istio/authorizationpolicy-v1";
 import { Mode } from "../../crd/generated/package-v1alpha1";
 import { IstioState } from "../istio/namespace";
 import {
@@ -1094,7 +1094,7 @@ describe("createDenyAllExceptWaypointPolicy", () => {
     const policy = createDenyAllExceptWaypointPolicy(pkg, waypointName, appSelector);
 
     // Verify basic policy structure
-    expect(policy.apiVersion).toBe("security.istio.io/v1beta1");
+    expect(policy.apiVersion).toBe("security.istio.io/v1");
     expect(policy.kind).toBe("AuthorizationPolicy");
     expect(policy.metadata?.name).toContain("deny-all-except-waypoint-test-waypoint");
     expect(policy.metadata?.namespace).toBe("test-ns");
diff --git a/src/pepr/operator/controllers/network/authorizationPolicies.ts b/src/pepr/operator/controllers/network/authorizationPolicies.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright 2025 Defense Unicorns
+ * Copyright 2025-2026 Defense Unicorns
  * SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
  */
 
@@ -11,7 +11,7 @@ import {
   AuthorizationPolicy,
   Rule,
   Source,
-} from "../../crd/generated/istio/authorizationpolicy-v1beta1";
+} from "../../crd/generated/istio/authorizationpolicy-v1";
 import { Mode } from "../../crd/generated/package-v1alpha1";
 import { IstioState } from "../istio/namespace";
 import { getWaypointName, shouldUseAmbientWaypoint } from "../istio/waypoint-utils";
@@ -179,7 +179,7 @@ function buildAuthPolicy(
   const generation = pkg.metadata?.generation?.toString() ?? "0";
 
   return {
-    apiVersion: "security.istio.io/v1beta1",
+    apiVersion: "security.istio.io/v1",
     kind: "AuthorizationPolicy",
     metadata: {
       name: policyName,
@@ -505,7 +505,7 @@ export function createDenyAllExceptWaypointPolicy(
 
   // Create the base policy with required fields
   const policy: AuthorizationPolicy = {
-    apiVersion: "security.istio.io/v1beta1",
+    apiVersion: "security.istio.io/v1",
     kind: "AuthorizationPolicy",
     metadata: {
       name: policyName,
diff --git a/src/pepr/operator/controllers/network/generators/kubeAPI.spec.ts b/src/pepr/operator/controllers/network/generators/kubeAPI.spec.ts
@@ -1,11 +1,11 @@
 /**
- * Copyright 2024 Defense Unicorns
+ * Copyright 2024-2026 Defense Unicorns
  * SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
  */
 
 import { K8s, kind } from "pepr";
 import { beforeEach, describe, expect, it, Mock, vi } from "vitest";
-import { AuthorizationPolicy } from "../../../crd/generated/istio/authorizationpolicy-v1beta1";
+import { AuthorizationPolicy } from "../../../crd/generated/istio/authorizationpolicy-v1";
 import {
   updateAPIServerCIDR,
   updateKubeAPIAuthorizationPolicies,
diff --git a/src/pepr/operator/controllers/network/generators/kubeAPI.ts b/src/pepr/operator/controllers/network/generators/kubeAPI.ts
@@ -8,7 +8,7 @@ import { K8s, kind, R } from "pepr";
 
 import { Component, setupLogger } from "../../../../logger";
 import { RemoteGenerated } from "../../../crd";
-import { AuthorizationPolicy } from "../../../crd/generated/istio/authorizationpolicy-v1beta1";
+import { AuthorizationPolicy } from "../../../crd/generated/istio/authorizationpolicy-v1";
 import { UDSConfig } from "../../config/config";
 import { retryWithDelay } from "../../utils";
 import { anywhere } from "./anywhere";
diff --git a/src/pepr/operator/controllers/network/generators/kubeNodes.spec.ts b/src/pepr/operator/controllers/network/generators/kubeNodes.spec.ts
@@ -1,13 +1,13 @@
 /**
- * Copyright 2024 Defense Unicorns
+ * Copyright 2024-2026 Defense Unicorns
  * SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial
  */
 
 import { beforeAll, beforeEach, describe, expect, it, Mock, vi } from "vitest";
 
 import { V1NetworkPolicyList } from "@kubernetes/client-node";
 import { K8s, kind } from "pepr";
-import { AuthorizationPolicy } from "../../../crd/generated/istio/authorizationpolicy-v1beta1";
+import { AuthorizationPolicy } from "../../../crd/generated/istio/authorizationpolicy-v1";
 import { anywhere } from "./anywhere";
 import {
   initAllNodesTarget,
@@ -65,7 +65,7 @@ describe("updateKubeNodesAuthorizationPolicies", () => {
 
   it("should update AuthorizationPolicy if ipBlocks differ", async () => {
     const authPol = {
-      apiVersion: "security.istio.io/v1beta1",
+      apiVersion: "security.istio.io/v1",
       kind: "AuthorizationPolicy",
       metadata: {
         name: "example-authpol",
@@ -95,7 +95,7 @@ describe("updateKubeNodesAuthorizationPolicies", () => {
 
   it("should not update AuthorizationPolicy if ipBlocks match", async () => {
     const authPol = {
-      apiVersion: "security.istio.io/v1beta1",
+      apiVersion: "security.istio.io/v1",
       kind: "AuthorizationPolicy",
       metadata: {
         name: "authpol-match",
@@ -123,7 +123,7 @@ describe("updateKubeNodesAuthorizationPolicies", () => {
 
   it("should create 'from' field if missing", async () => {
     const authPol = {
-      apiVersion: "security.istio.io/v1beta1",
+      apiVersion: "security.istio.io/v1",
       kind: "AuthorizationPolicy",
       metadata: {
         name: "authpol-nofrom",
@@ -148,7 +148,7 @@ describe("updateKubeNodesAuthorizationPolicies", () => {
 
   it("should skip policies missing rules", async () => {
     const authPol = {
-      apiVersion: "security.istio.io/v1beta1",
+      apiVersion: "security.istio.io/v1",
       kind: "AuthorizationPolicy",
       metadata: {
         name: "authpol-norules",
diff --git a/src/pepr/operator/controllers/network/generators/kubeNodes.ts b/src/pepr/operator/controllers/network/generators/kubeNodes.ts
@@ -8,7 +8,7 @@ import { K8s, kind, R } from "pepr";
 
 import { Component, setupLogger } from "../../../../logger";
 import { RemoteGenerated } from "../../../crd";
-import { AuthorizationPolicy } from "../../../crd/generated/istio/authorizationpolicy-v1beta1";
+import { AuthorizationPolicy } from "../../../crd/generated/istio/authorizationpolicy-v1";
 import { UDSConfig } from "../../config/config";
 import { retryWithDelay } from "../../utils";
 import { anywhere } from "./anywhere";
diff --git a/src/pepr/operator/crd/generated/istio/authorizationpolicy-v1.ts b/src/pepr/operator/crd/generated/istio/authorizationpolicy-v1.ts
@@ -334,7 +334,7 @@ export interface Type {
 
 RegisterKind(AuthorizationPolicy, {
   group: "security.istio.io",
-  version: "v1beta1",
+  version: "v1",
   kind: "AuthorizationPolicy",
   plural: "authorizationpolicies",
 });
diff --git a/src/pepr/operator/crd/generated/istio/serviceentry-v1.ts b/src/pepr/operator/crd/generated/istio/serviceentry-v1.ts
@@ -231,7 +231,7 @@ export interface Type {
 
 RegisterKind(ServiceEntry, {
   group: "networking.istio.io",
-  version: "v1beta1",
+  version: "v1",
   kind: "ServiceEntry",
   plural: "serviceentries",
 });
diff --git a/src/pepr/operator/crd/generated/istio/virtualservice-v1.ts b/src/pepr/operator/crd/generated/istio/virtualservice-v1.ts
diff --git a/src/pepr/operator/crd/index.ts b/src/pepr/operator/crd/index.ts
diff --git a/src/pepr/operator/crd/sources/istio/virtualservice-v1.ts b/src/pepr/operator/crd/sources/istio/virtualservice-v1.ts
diff --git a/src/pepr/operator/crd/sources/package/v1alpha1.ts b/src/pepr/operator/crd/sources/package/v1alpha1.ts
diff --git a/src/pepr/scripts/gen-istio-crd-sources.ts b/src/pepr/scripts/gen-istio-crd-sources.ts
diff --git a/src/prometheus-stack/chart/templates/peerauthentication/prometheus-operator-pa.yaml b/src/prometheus-stack/chart/templates/peerauthentication/prometheus-operator-pa.yaml
