Add "ZtunnelNamespace" flag to specify Ztunnel deployment location by MaxBab · Pull Request #58677 · istio/istio

MaxBab · 2026-01-06T07:00:29Z

Please provide a description of this PR:
Add "ZtunnelNamespace" flag to specify Ztunnel deployment location

During deployment of Ambient mode, Ztunnel resource could be deployed to a namespace other that "istio-system".
When executing TestZtunnelConfig and TestZtunnelRestart integration tests,
while Ztunnel resource deployment in a separate NS, the test will fail as will not be able to locate the required resource.

Add "ZtunnelNamespace" flag to specify Ztunnel deployment location.
Defaults to - "istio-system".

tests/integration/ambient/baseline_test.go

sridhargaddam · 2026-01-06T14:11:52Z

tests/integration/ambient/baseline_test.go

 		}`, time.Now().Format(time.RFC3339)) // e.g., “2006-01-02T15:04:05Z07:00”
-	ds := c.Kube().AppsV1().DaemonSets(i.Settings().SystemNamespace)
-	_, err := ds.Patch(context.Background(), "ztunnel", types.StrategicMergePatchType, []byte(patchData), patchOpts)
+	ztunnelNS, err := locateDaemonsetNS(t, "ztunnel")


The other option would be to add a config flag (--istio.test.kube.ztunnelNamespace) with default set to SystemNamespace.

That's a really good idea.
Thanks @sridhargaddam

Implemented the check of the "--istio.test.kube.helm.values=pilot.trustedZtunnelNamespace" flag.
If provided, its value would be used, otherwise it would use "istio-system" as default values.

Actually, my suggestion was to use a dedicated flag for ztunnelNamespace similar to how we have existing flags as shown below.

--istio.test.kube.systemNamespace --istio.test.kube.telemetryNamespace --istio.test.kube.ingressGatewayServiceNamespace

For this, you will have to update the following file by adding the new flag. Something like...

flag.StringVar(&settingsFromCommandline.TrustedZtunnelNamespace, "istio.test.kube.ztunnelNamespace", settingsFromCommandline.TrustedZtunnelNamespace, "Specifies the namespace where ztunnel is deployed. Defaults to the system namespace (istio-system).")

and defining the variable here.

Using the dedicated flag will be simpler and cleaner implementation over parsing the helm values.

Hi @sridhargaddam

But why not to use an existing flag that in any case would be accurate regarding the purpose of the use?
If ZTunnel is being deployed in a custom namespace, the trustedZtunnelNamespace flag should be specified in any case.
So, what is the benefit of adding one more flag that we need to remember to use?

Isn't a flag that could be reused in couple of places for the same purpose (specifying the location of ztunnel), would be cleaner?

Hello Maxim, there are couple of reasons behind suggesting the dedicated flag like --istio.test.kube.ztunnelNamespace.

It would be self-documenting, and users would be able to discover the flag using --help.

It is consistent with the existing flags listed above.

OTOH, if we go with the helm values...

It becomes a hidden setting.

A typo in the user-supplied value would be silently ignored and could manifest as an error that is hard to debug.

It requires careful parsing in the code to read the supplied configuration.

Users would need to read the documentation or inspect the code to discover that the ztunnel namespace can be set via Helm values.

CC: @istio/wg-test-and-release-maintainers

Hi @sridhargaddam

I understand your points and agree with them.
So, with the mentioned above, isn't it preferred to get back to the auto detection of the ztunnel daemon namespace instead of creating additional flag?

While auto-detection is possible, a dedicated flag (--istio.test.kube.ztunnelNamespace) would be cleaner and better aligned with the existing flags. Looping @Stevenjin8 @kfaseela for their feedback.

Hi @sridhargaddam

I've modified the PR and added the ztunnelNamespace flag to specify custom ztunnel namespace.

Stevenjin8 · 2026-01-06T16:22:21Z

@MaxBab could you give some context behind this change? Are you running tests with very custom configs?

MaxBab · 2026-01-07T15:34:48Z

@MaxBab could you give some context behind this change? Are you running tests with very custom configs?

Hello @Stevenjin8

I'm deploying Istio with an external control plance (Sail Operator) and Ztunnel resource is placed within the ztunnel namespace and not within istio-system as it's done by default when using Helm based deployment.

That's why I need to be able to identify ZTunnel resource within a namespace other than istio-system.

MaxBab · 2026-01-07T15:54:07Z

/test integ-cni

sridhargaddam · 2026-01-29T09:51:33Z

tests/integration/ambient/baseline_test.go

 		t.Fatalf("failed to wait for ztunnel rollout status for: %v", err)
 	}
-	if _, err := kubetest.CheckPodsAreReady(kubetest.NewPodFetch(t.AllClusters()[0], i.Settings().SystemNamespace, "app=ztunnel")); err != nil {
+	if _, err := kubetest.CheckPodsAreReady(kubetest.NewPodFetch(t.AllClusters()[0], ztunnelNS, "app=ztunnel")); err != nil {


You'll need to update the following code as well -

istio/tests/integration/ambient/cacert_rotation_test.go

Line 56 in ec64c67

ztunnelPods, err := kubetest.NewPodFetch(t.AllClusters()[0], istioCfg.SystemNamespace, "app=ztunnel")()

Updated.
Thanks for noticing.

sridhargaddam · 2026-01-29T09:55:53Z

Locate the namespace used by ztunnel daemonset and use it in tests. Added "locateDaemonsetNS" function to locate.

Please update the commit message to reflect the current implementation.

During deployment of Ambient mode, Ztunnel resource could be deployed to a namespace other that "istio-system". When executing TestZtunnelConfig and TestZtunnelRestart integration tests, while Ztunnel resource deployment in a separate NS, the test will fail as will not be able to locate the required resource. Add "ZtunnelNamespace" flag to specify Ztunnel deployment location. Defaults to - "istio-system". Signed-off-by: Maxim Babushkin <mbabushk@redhat.com>

sridhargaddam

LGTM, thanks @MaxBab

sridhargaddam · 2026-02-03T06:28:07Z

pkg/test/framework/components/istio/flags.go

 	flag.StringVar(&settingsFromCommandline.TelemetryNamespace, "istio.test.kube.telemetryNamespace", settingsFromCommandline.TelemetryNamespace,
 		"Specifies the namespace in which kiali, tracing providers, graphana, prometheus are deployed.")
+	flag.StringVar(&settingsFromCommandline.ZtunnelNamespace, "istio.test.kube.ztunnelNamespace", settingsFromCommandline.ZtunnelNamespace,
+		"Specifies the namespace where the ztunnel daemonset resides. Defaults to istio-system")


small nit for clarity.

Suggested change

"Specifies the namespace where the ztunnel daemonset resides. Defaults to istio-system")

"Specifies the namespace where the ztunnel daemonset resides in an ambient deployment. Defaults to istio-system")

MaxBab · 2026-02-15T09:39:56Z

Hello @Stevenjin8

Could you take a look at the PR, please?

sridhargaddam · 2026-02-15T16:12:13Z

/test unit-tests

keithmattix · 2026-02-15T19:03:53Z

/retest

istio-testing · 2026-02-16T09:23:00Z

In response to a cherrypick label: new issue created for failed cherrypick: #59091

istio-testing · 2026-02-16T09:23:01Z

In response to a cherrypick label: #58677 failed to apply on top of branch "release-1.27":

Applying: Add "ZtunnelNamespace" flag to specify Ztunnel deployment location
Using index info to reconstruct a base tree...
M	pkg/test/framework/components/istio/flags.go
M	tests/integration/ambient/baseline_test.go
M	tests/integration/ambient/cacert_rotation_test.go
M	tests/integration/ambient/istioctl_test.go
Falling back to patching base and 3-way merge...
Auto-merging tests/integration/ambient/istioctl_test.go
Auto-merging tests/integration/ambient/cacert_rotation_test.go
Auto-merging tests/integration/ambient/baseline_test.go
CONFLICT (content): Merge conflict in tests/integration/ambient/baseline_test.go
Auto-merging pkg/test/framework/components/istio/flags.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Add "ZtunnelNamespace" flag to specify Ztunnel deployment location

istio-testing · 2026-02-16T09:23:03Z

In response to a cherrypick label: new issue created for failed cherrypick: #59092

istio-testing · 2026-02-16T09:23:39Z

In response to a cherrypick label: new pull request could not be created: failed to create pull request against istio/istio#release-1.29 from head istio-testing:cherry-pick-58677-to-release-1.29: status code 422 not one of [201], body: {"message":"Validation Failed","errors":[{"resource":"PullRequest","code":"custom","message":"A pull request already exists for istio-testing:cherry-pick-58677-to-release-1.29."}],"documentation_url":"https://docs.github.com/rest/pulls/pulls#create-a-pull-request","status":"422"}

istio-testing · 2026-02-16T09:23:40Z

In response to a cherrypick label: #58677 failed to apply on top of branch "release-1.28":

Applying: Add "ZtunnelNamespace" flag to specify Ztunnel deployment location
Using index info to reconstruct a base tree...
M	tests/integration/ambient/baseline_test.go
M	tests/integration/ambient/cacert_rotation_test.go
M	tests/integration/ambient/istioctl_test.go
Falling back to patching base and 3-way merge...
Auto-merging tests/integration/ambient/istioctl_test.go
Auto-merging tests/integration/ambient/cacert_rotation_test.go
Auto-merging tests/integration/ambient/baseline_test.go
CONFLICT (content): Merge conflict in tests/integration/ambient/baseline_test.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Add "ZtunnelNamespace" flag to specify Ztunnel deployment location

istio-testing · 2026-02-16T09:23:42Z

In response to a cherrypick label: new issue created for failed cherrypick: #59093

istio-testing · 2026-02-16T09:24:20Z

In response to a cherrypick label: new pull request could not be created: failed to create pull request against istio/istio#release-1.29 from head istio-testing:cherry-pick-58677-to-release-1.29: status code 422 not one of [201], body: {"message":"Validation Failed","errors":[{"resource":"PullRequest","code":"custom","message":"A pull request already exists for istio-testing:cherry-pick-58677-to-release-1.29."}],"documentation_url":"https://docs.github.com/rest/pulls/pulls#create-a-pull-request","status":"422"}

…stio#58677) During deployment of Ambient mode, Ztunnel resource could be deployed to a namespace other that "istio-system". When executing TestZtunnelConfig and TestZtunnelRestart integration tests, while Ztunnel resource deployment in a separate NS, the test will fail as will not be able to locate the required resource. Add "ZtunnelNamespace" flag to specify Ztunnel deployment location. Defaults to - "istio-system". Signed-off-by: Maxim Babushkin <mbabushk@redhat.com>

…58677) (#59140) During deployment of Ambient mode, Ztunnel resource could be deployed to a namespace other that "istio-system". When executing TestZtunnelConfig and TestZtunnelRestart integration tests, while Ztunnel resource deployment in a separate NS, the test will fail as will not be able to locate the required resource. Add "ZtunnelNamespace" flag to specify Ztunnel deployment location. Defaults to - "istio-system". Signed-off-by: Maxim Babushkin <mbabushk@redhat.com>

…58677) (#59118) During deployment of Ambient mode, Ztunnel resource could be deployed to a namespace other that "istio-system". When executing TestZtunnelConfig and TestZtunnelRestart integration tests, while Ztunnel resource deployment in a separate NS, the test will fail as will not be able to locate the required resource. Add "ZtunnelNamespace" flag to specify Ztunnel deployment location. Defaults to - "istio-system". Signed-off-by: Maxim Babushkin <mbabushk@redhat.com>

As follow of this upstream Istio PR work, add the "ztunnelNamespace" flag to the converter flow. istio/istio#58677 Signed-off-by: Maxim Babushkin <mbabushk@redhat.com>

As follow of this upstream Istio PR work, add the "ztunnelNamespace" flag to the converter flow. istio/istio#58677 Signed-off-by: Maxim Babushkin <mbabushk@redhat.com> Co-authored-by: Maxim Babushkin <mbabushk@redhat.com>

…stio#58677) (istio#619) During deployment of Ambient mode, Ztunnel resource could be deployed to a namespace other that "istio-system". When executing TestZtunnelConfig and TestZtunnelRestart integration tests, while Ztunnel resource deployment in a separate NS, the test will fail as will not be able to locate the required resource. Add "ZtunnelNamespace" flag to specify Ztunnel deployment location. Defaults to - "istio-system". Signed-off-by: Maxim Babushkin <mbabushk@redhat.com>

…stio#58677) (istio#620) During deployment of Ambient mode, Ztunnel resource could be deployed to a namespace other that "istio-system". When executing TestZtunnelConfig and TestZtunnelRestart integration tests, while Ztunnel resource deployment in a separate NS, the test will fail as will not be able to locate the required resource. Add "ZtunnelNamespace" flag to specify Ztunnel deployment location. Defaults to - "istio-system". Signed-off-by: Maxim Babushkin <mbabushk@redhat.com>

MaxBab requested a review from a team as a code owner January 6, 2026 07:00

istio-policy-bot added area/ambient Issues related to ambient mesh area/test and release release-notes-none Indicates a PR that does not require release notes. labels Jan 6, 2026

istio-testing added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jan 6, 2026

MaxBab force-pushed the update_TestZtunnelConfig/Restart_tests branch from 9ed08cd to 68b7907 Compare January 6, 2026 07:01

sridhargaddam reviewed Jan 6, 2026

View reviewed changes

MaxBab force-pushed the update_TestZtunnelConfig/Restart_tests branch from 68b7907 to 87b7b59 Compare January 7, 2026 15:30

MaxBab force-pushed the update_TestZtunnelConfig/Restart_tests branch from 87b7b59 to 5fd72a4 Compare January 27, 2026 09:10

istio-testing added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 27, 2026

MaxBab force-pushed the update_TestZtunnelConfig/Restart_tests branch from 5fd72a4 to 94e1afb Compare January 27, 2026 09:16

MaxBab requested a review from sridhargaddam January 29, 2026 09:29

sridhargaddam reviewed Jan 29, 2026

View reviewed changes

MaxBab force-pushed the update_TestZtunnelConfig/Restart_tests branch from 94e1afb to e50c36f Compare February 1, 2026 12:46

istio-testing added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Feb 1, 2026

MaxBab force-pushed the update_TestZtunnelConfig/Restart_tests branch from e50c36f to 80454f5 Compare February 1, 2026 12:47

MaxBab changed the title ~~Locate Ztunnel NS in TestZtunnelConfig and TestZtunnelRestart integ tests~~ Add "ZtunnelNamespace" flag to specify Ztunnel deployment location Feb 1, 2026

MaxBab requested a review from sridhargaddam February 1, 2026 13:32

sridhargaddam approved these changes Feb 3, 2026

View reviewed changes

keithmattix approved these changes Feb 15, 2026

View reviewed changes

istio-testing mentioned this pull request Feb 16, 2026

[release-1.28] Add "ZtunnelNamespace" flag to specify Ztunnel deployment location #59091

Closed

istio-testing mentioned this pull request Feb 16, 2026

[release-1.27] Add "ZtunnelNamespace" flag to specify Ztunnel deployment location #59092

Closed

istio-testing mentioned this pull request Feb 16, 2026

[release-1.28] Add "ZtunnelNamespace" flag to specify Ztunnel deployment location #59093

Closed

MaxBab mentioned this pull request Feb 17, 2026

[release-1.28] Add "ZtunnelNamespace" flag to specify Ztunnel deployment location (#58677) #59118

Merged

MaxBab mentioned this pull request Feb 18, 2026

[release-1.27] Add "ZtunnelNamespace" flag to specify Ztunnel deployment location (#58677) #59140

Merged

MaxBab mentioned this pull request Feb 19, 2026

Add "ztunnelNamespace" flag to converter flow openshift-service-mesh/istio#593

Merged

17 tasks

	"Specifies the namespace where the ztunnel daemonset resides. Defaults to istio-system")
	"Specifies the namespace where the ztunnel daemonset resides in an ambient deployment. Defaults to istio-system")

Conversation

MaxBab commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Stevenjin8 commented Jan 6, 2026

Uh oh!

MaxBab commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MaxBab commented Jan 7, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sridhargaddam commented Jan 29, 2026

Uh oh!

sridhargaddam left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MaxBab commented Feb 15, 2026

Uh oh!

sridhargaddam commented Feb 15, 2026

Uh oh!

keithmattix commented Feb 15, 2026

Uh oh!

istio-testing commented Feb 16, 2026

Uh oh!

istio-testing commented Feb 16, 2026

Uh oh!

istio-testing commented Feb 16, 2026

Uh oh!

istio-testing commented Feb 16, 2026

Uh oh!

istio-testing commented Feb 16, 2026

Uh oh!

istio-testing commented Feb 16, 2026

Uh oh!

istio-testing commented Feb 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

MaxBab commented Jan 6, 2026 •

edited

Loading

MaxBab commented Jan 7, 2026 •

edited

Loading