Automated merge

* upstream/main: (29 commits)
  Avoid specifying platform in the e2e tests (openshift-service-mesh#555)
  Fix InUse detection in IstioRevisionTag controller (openshift-service-mesh#553)
  Update versions in sample yamls (openshift-service-mesh#552)
  Makefile support to deploy sample Istio with ambient profile (openshift-service-mesh#546)
  Document that env vars are strings (openshift-service-mesh#550)
  Ensure profile files are included in the revisiontags chart (openshift-service-mesh#537)
  Split unit/integration tests (openshift-service-mesh#547)
  Remove duplicate empty line at EOF of values_types (openshift-service-mesh#548)
  Skip namespace while deleting cluster scoped resources (openshift-service-mesh#544)
  Remove unneeded securityContext fields from multicluster manifests (openshift-service-mesh#539)
  Automator: Update dependencies in istio-ecosystem/sail-operator@main (openshift-service-mesh#538)
  Automator: Update dependencies in istio-ecosystem/sail-operator@main (openshift-service-mesh#535)
  Fix issue-management page (openshift-service-mesh#522)
  Fix undeploy when using Ambient mode (openshift-service-mesh#533)
  Automator: Update dependencies in istio-ecosystem/sail-operator@main (openshift-service-mesh#532)
  Automator: Update dependencies in istio-ecosystem/sail-operator@main (openshift-service-mesh#531)
  Automator: Update dependencies in istio-ecosystem/sail-operator@main (openshift-service-mesh#530)
  Automator: Update dependencies in istio-ecosystem/sail-operator@main (openshift-service-mesh#529)
  Add note for cni versions compatibility (openshift-service-mesh#525)
  Automator: Update dependencies in istio-ecosystem/sail-operator@main (openshift-service-mesh#526)
  ...

# Conflicts:
#	bundle/manifests/sailoperator.clusterserviceversion.yaml
#	resources/latest/charts/base/files/crd-all.gen.yaml
#	resources/latest/charts/istiod/files/injection-template.yaml
#	resources/latest/charts/istiod/files/waypoint.yaml

Author: openshift-service-mesh-bot

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
   "name": "istio build-tools",
-  "image": "gcr.io/istio-testing/build-tools:master-3d91e3d29bd1057b14995647d90cbf85e043eba6",
+  "image": "gcr.io/istio-testing/build-tools:master-0b8e6b9676d328fbeb28a23b8d1134dcc56d98ec",
   "privileged": true,
   "remoteEnv": {
     "USE_GKE_GCLOUD_AUTH_PLUGIN": "True",

.github/workflows/integration-tests.yaml

@@ -0,0 +1,21 @@
+name: integration-tests
+
+on: [push, pull_request]
+
+jobs:
+  coverage:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Run coverage
+      run: |
+        make test.integration \
+          -e COVERAGE=true
+
+    - name: Upload to Codecov
+      uses: codecov/codecov-action@v4
+      with:
+        files: out/coverage-unit.out,out/coverage-integration.out
+        token: ${{ secrets.CODECOV_TOKEN }}
+        fail_ci_if_error: true

.github/workflows/coverage.yaml .github/workflows/unit-tests.yaml.github/workflows/coverage.yaml renamed to .github/workflows/unit-tests.yaml

@@ -1,4 +1,4 @@
-name: Code coverage workflow
+name: unit-tests
 
 on: [push, pull_request]
 
@@ -10,7 +10,7 @@ jobs:
 
     - name: Run coverage
       run: |
-        make test \
+        make test.unit \
           -e COVERAGE=true
 
     - name: Upload to Codecov

.github/workflows/update-deps.yaml

@@ -23,7 +23,7 @@ jobs:
   update-deps:
     runs-on: ubuntu-latest
     container:
-      image: gcr.io/istio-testing/build-tools:master-3d91e3d29bd1057b14995647d90cbf85e043eba6
+      image: gcr.io/istio-testing/build-tools:master-0b8e6b9676d328fbeb28a23b8d1134dcc56d98ec
       options: --entrypoint ''
 
     steps:

ISSUE-MANAGEMENT.md

@@ -6,10 +6,11 @@ You can report bugs and feature requests to the Sail Operator team opening a new
 Please refer to the [Security Policy](https://github.com/istio-ecosystem/sail-operator/security/policy) for more information on how to report security issues. Please do not report security issues in the public GitHub repository.
 
 ## Community Support
-If you have questions or need help, you can reach out to the Sail Operator community in the [Istio Slack](https://istio.slack.com/). You can join the Istio Slack workspace by visiting the [Istio Slack invitation page](https://slack.istio.io/). Once you join the Istio Slack workspace, you can find the `#sail-operator` channel. Also, you can start a discussion in the [Sail Operator Discussion] (https://github.com/istio-ecosystem/sail-operator/discussions)
+If you have questions or need help, you can reach out to the Sail Operator community in the [Istio Slack](https://istio.slack.com/). You can join the Istio Slack workspace by visiting the [Istio Slack invitation page](https://slack.istio.io/). Once you join the Istio Slack workspace, you can find the `#sail-operator` channel. Also, you can start a discussion in the [Sail Operator Discussion](https://github.com/istio-ecosystem/sail-operator/discussions)
 
 ## Contributing
-If you want to contribute to the Sail Operator project, please refer to the [CONTRIBUTING-SAIL-PROJECT.md](https://github.com/istio-ecosystem/sail-operator/blob/main/CONTRIBUTING-SAIL-PROJECT.md) file for more information on how to contribute to the project. The file [CONTRIBUTING.md](https://github.com/istio-ecosystem/sail-operator/blob/main/CONTRIBUTING.md) contains all the information you need to get started with contributing Istio.
+If you want to contribute to the Sail Operator project, please refer to the [CONTRIBUTING.md](CONTRIBUTING.md) file for more information on how to contribute to the project.
+For contributing to Istio, check out the [CONTRIBUTING.md](https://github.com/istio/community/blob/master/CONTRIBUTING.md) file, which contains all the information you need to get started.
 
 ## Did you find an Istio bug?
 If you found a bug in Istio, please refer to the [Istio GitHub repository](https://github.com/istio-ecosystem/sail-operator/blob/main/CONTRIBUTING-SAIL-PROJECT.md) to check the guidelines on how to report a bug to the Sail team.

Makefile.core.mk

@@ -19,7 +19,7 @@ OLD_VARS := $(.VARIABLES)
 # Use `make print-variables` to inspect the values of the variables
 -include Makefile.vendor.mk
 
-VERSION ?= 0.2.0
+VERSION ?= 0.3.0
 MINOR_VERSION := $(shell echo "${VERSION}" | cut -f1,2 -d'.')
 
 OPERATOR_NAME ?= sailoperator
@@ -330,29 +330,39 @@ deploy-olm: verify-kubeconfig bundle bundle-build bundle-push ## Build and push
 .PHONY: undeploy
 undeploy: verify-kubeconfig ## Undeploy controller from an existing cluster.
 	kubectl delete istios.sailoperator.io --all --all-namespaces --wait=true
+	kubectl delete istiocni.sailoperator.io --all --all-namespaces --wait=true
+	kubectl delete ztunnel.sailoperator.io --all --all-namespaces --wait=true
 	$(MAKE) -e HELM_TEMPL_DEF_FLAGS="$(HELM_TEMPL_DEF_FLAGS)" deploy-yaml | kubectl delete --ignore-not-found -f -
 	kubectl delete ns ${NAMESPACE} --ignore-not-found
 	$(HELM) template chart chart $(HELM_TEMPL_DEF_FLAGS) --set image='$(IMAGE)' --namespace $(NAMESPACE) | kubectl delete --ignore-not-found -f -
 
 .PHONY: undeploy-olm
 undeploy-olm: verify-kubeconfig operator-sdk ## Undeploy the operator from an existing cluster (used only if operator was installed via OLM).
 	kubectl delete istios.sailoperator.io --all --all-namespaces --wait=true
+	kubectl delete istiocni.sailoperator.io --all --all-namespaces --wait=true
+	kubectl delete ztunnel.sailoperator.io --all --all-namespaces --wait=true
 	$(OPERATOR_SDK) cleanup $(OPERATOR_NAME) --delete-all -n ${NAMESPACE}
 
-.PHONY: deploy-example
-deploy-example: deploy-example-openshift ## Deploy an example Istio resource to an existing OCP cluster. Same as `deploy-example-openshift`.
+.PHONY: deploy-istio
+deploy-istio: verify-kubeconfig ## Deploy a sample Istio resource (without CNI) to an existing cluster.
+	kubectl create ns istio-system || echo "namespace istio-system already exists"
+	kubectl apply -f chart/samples/istio-sample.yaml
 
-.PHONY: deploy-example-openshift
-deploy-example-openshift: verify-kubeconfig ## Deploy an example Istio and IstioCNI resource to an existing OCP cluster.
+.PHONY: deploy-istio-with-cni
+deploy-istio-with-cni: verify-kubeconfig ## Deploy a sample Istio and IstioCNI resource to an existing cluster.
 	kubectl create ns istio-cni || echo "namespace istio-cni already exists"
 	kubectl apply -f chart/samples/istiocni-sample.yaml
 	kubectl create ns istio-system || echo "namespace istio-system already exists"
-	kubectl apply -f chart/samples/istio-sample-openshift.yaml
+	kubectl apply -f chart/samples/istio-sample.yaml
 
-.PHONY: deploy-example-kubernetes
-deploy-example-kubernetes: verify-kubeconfig ## Deploy an example Istio resource on an existing cluster.
+.PHONY: deploy-istio-with-ambient
+deploy-istio-with-ambient: verify-kubeconfig ## Deploy necessary Istio resources using the ambient profile.
 	kubectl create ns istio-system || echo "namespace istio-system already exists"
-	kubectl apply -f chart/samples/istio-sample-kubernetes.yaml
+	kubectl apply -f chart/samples/ambient/istio-sample.yaml
+	kubectl create ns istio-cni || echo "namespace istio-cni already exists"
+	kubectl apply -f chart/samples/ambient/istiocni-sample.yaml
+	kubectl create ns ztunnel || echo "namespace zunnel already exists"
+	kubectl apply -f chart/samples/ambient/istioztunnel-sample.yaml
 
 ##@ Generated Code & Resources
 
@@ -469,9 +479,9 @@ ISTIOCTL ?= $(LOCALBIN)/istioctl
 
 ## Tool Versions
 OPERATOR_SDK_VERSION ?= v1.38.0
-HELM_VERSION ?= v3.16.3
+HELM_VERSION ?= v3.16.4
 CONTROLLER_TOOLS_VERSION ?= v0.16.5
-OPM_VERSION ?= v1.48.0
+OPM_VERSION ?= v1.49.0
 OLM_VERSION ?= v0.30.0
 GITLEAKS_VERSION ?= v8.21.2
 ISTIOCTL_VERSION ?= 1.23.0

README.md

@@ -99,20 +99,10 @@ Make sure that the `HUB` and `TAG` environment variables point to your container
 
 Create an instance of the `Istio` resource to install the Istio Control Plane.
 
-Use the `istio-sample-kubernetes.yaml` file on vanilla Kubernetes:
-
-```sh
-# Create the istio-system namespace if it does not exist
-kubectl create ns istio-system
-kubectl apply -f chart/samples/istio-sample-kubernetes.yaml
-```
-
-Use the `istio-sample-openshift.yaml` file on OpenShift:
-
 ```sh
 # Create the istio-system namespace if it does not exist
 kubectl create ns istio-system
-kubectl apply -f chart/samples/istio-sample-openshift.yaml
+kubectl apply -f chart/samples/istio-sample.yaml
 ```
 
 On OpenShift, you must also deploy the Istio CNI plugin by creating an instance of the `IstioCNI` resource:

api/v1alpha1/values_types.gen.go

@@ -28,10 +28,10 @@ const (
 type ZTunnelSpec struct {
 	// +sail:version
 	// Defines the version of Istio to install.
-	// Must be one of: v1.24.0 or latest.
-	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Istio Version",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:fieldGroup:General", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.0", "urn:alm:descriptor:com.tectonic.ui:select:latest"}
-	// +kubebuilder:validation:Enum=v1.24.0;latest
-	// +kubebuilder:default=v1.24.0
+	// Must be one of: v1.24.2.
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Istio Version",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:fieldGroup:General", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.2"}
+	// +kubebuilder:validation:Enum=v1.24.2
+	// +kubebuilder:default=v1.24.2
 	Version string `json:"version"`
 
 	// +sail:profile
@@ -178,7 +178,7 @@ type ZTunnel struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
 
-	// +kubebuilder:default={version: "v1.24.0", namespace: "ztunnel", profile: "ambient"}
+	// +kubebuilder:default={version: "v1.24.2", namespace: "ztunnel", profile: "ambient"}
 	Spec ZTunnelSpec `json:"spec,omitempty"`
 
 	Status ZTunnelStatus `json:"status,omitempty"`