Update synchronize istio to include ztunnel support (#3274)

* Update synchronize istio to include ztunnel support

Signed-off-by: kunal-511 <[email protected]>

* increase katib test timeout

Signed-off-by: kunal-511 <[email protected]>

* revert katib test timeout

Signed-off-by: kunal-511 <[email protected]>

* Update error handling in free-disk-space.sh

Enable debugging options in free-disk-space.sh

Signed-off-by: Julius von Kohout <[email protected]>

* Update full_kubeflow_integration_test.yaml

Signed-off-by: Julius von Kohout <[email protected]>

* Update pipeline_test.yaml

Signed-off-by: Julius von Kohout <[email protected]>

* Upgrade checkout action from v4 to v5

Signed-off-by: Julius von Kohout <[email protected]>

* Update checkout action version in pipeline test

Signed-off-by: Julius von Kohout <[email protected]>

* Make tests/free-disk-space.sh executable

Signed-off-by: juliusvonkohout <[email protected]>

* Remove apt-get autoremove from cleanup script

Removed 'apt-get autoremove' command from the script.

Signed-off-by: Julius von Kohout <[email protected]>

* Update GitHub Actions workflow for disk space management

Signed-off-by: Julius von Kohout <[email protected]>

* Update katib_test.sh

Signed-off-by: Julius von Kohout <[email protected]>

* Upgrade checkout action and add disk space cleanup

Updated checkout action version and added disk space cleanup step.

Signed-off-by: Julius von Kohout <[email protected]>

* already in https://github.com/kubeflow/manifests/blob/master/common/istio/istio-install/base/patches/seccomp-istiod.yaml

Signed-off-by: juliusvonkohout <[email protected]>

---------

Signed-off-by: kunal-511 <[email protected]>
Signed-off-by: Julius von Kohout <[email protected]>
Signed-off-by: juliusvonkohout <[email protected]>
Co-authored-by: Julius von Kohout <[email protected]>

Author: kunal-511

.github/workflows/full_kubeflow_integration_test.yaml

@@ -25,7 +25,10 @@ jobs:
     timeout-minutes: 45
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
+
+    - name: Free up disk space
+      run: ./tests/free-disk-space.sh
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh

.github/workflows/pipeline_run_from_notebook.yaml

@@ -21,7 +21,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
+
+    - name: Free up disk space
+      run: ./tests/free-disk-space.sh
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh

.github/workflows/pipeline_swfs_test.yaml

@@ -25,15 +25,10 @@ jobs:
       labels: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
-    - name: Remove unused software
-      run: |
-        df -h # Check disk space before removal
-        sudo rm -rf /usr/share/dotnet # Example: Remove .NET SDK
-        sudo rm -rf /usr/local/lib/android # Example: Remove Android SDK
-        sudo rm -rf /opt/ghc # Example: Remove Haskell
-        df -h # Check disk space after removal
+    - name: Free up disk space
+      run: ./tests/free-disk-space.sh
 
     - name: Proactively prune OCI system on GHA runner
       run: docker system prune -a --volumes --force

.github/workflows/pipeline_test.yaml

@@ -26,7 +26,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
+
+    - name: Free up disk space
+      run: ./tests/free-disk-space.sh
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh

common/istio/profile.yaml

@@ -29,6 +29,3 @@ spec:
     global:
       configValidation: true
       istioNamespace: istio-system
-      proxy:
-        seccompProfile:
-          type: RuntimeDefault

common/istio/split-istio-packages

@@ -50,13 +50,16 @@ def main():
     args = parse_args()
     with open(args.manifest_file, "r") as f:
         objects = [obj for obj in list(yaml.load_all(f)) if obj]
-    crds, install, cluster_local = [], [], []
+    crds, install, cluster_local, ztunnel = [], [], [], []
     for obj in objects:
         if obj.get("kind") == "CustomResourceDefinition":
             crds.append(obj)
         elif (obj.get("metadata", {}).get("name", "").
               startswith("cluster-local-gateway")):
             cluster_local.append(obj)
+        elif (obj.get("metadata", {}).get("name", "") == "ztunnel" or
+              (obj.get("metadata", {}).get("labels", {}).get("app.kubernetes.io/name") == "ztunnel")):
+            ztunnel.append(obj)
         else:
             install.append(obj)
 
@@ -66,6 +69,8 @@ def main():
         yaml.dump_all(install, f)
     with open("cluster-local-gateway.yaml", "w") as f:
         yaml.dump_all(cluster_local, f)
+    with open("ztunnel.yaml", "w") as f:
+        yaml.dump_all(ztunnel, f)
 
 
 if __name__ == "__main__":

scripts/synchronize-istio-manifests.sh

@@ -42,6 +42,14 @@ echo "Generating non-CNI manifests (insecure overlay)..."
 $ISTIOCTL manifest generate -f profile.yaml -f profile-overlay.yaml \
   --set components.cni.enabled=false > istio-install/overlays/insecure/install-insecure.yaml
 
+echo "Generating ztunnel manifests (ambient mode)..."
+$ISTIOCTL manifest generate -f profile.yaml -f profile-overlay.yaml \
+  --set components.cni.enabled=true \
+  --set components.ztunnel.enabled=true > dump-ztunnel.yaml
+./split-istio-packages -f dump-ztunnel.yaml
+mv $ISTIO_DIRECTORY/ztunnel.yaml $ISTIO_DIRECTORY/istio-install/components/ambient-mode/
+rm dump-ztunnel.yaml crd.yaml install.yaml cluster-local-gateway.yaml
+
 check_uncommitted_changes
 
 SOURCE_TEXT="\[.*\](https://github.com/istio/istio/releases/tag/.*)"

tests/free-disk-space.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+set -euxo pipefail
+
+# This script frees up disk space on GitHub Actions runners.
+# Several GHA workflows were failing with "no space left on device" errors.
+# This script is only meant to run in GitHub Actions CI environment.
+
+# Safety check: Only run on GitHub Actions
+if [[ "${GITHUB_ACTIONS:-false}" != "true" ]]; then
+    echo "ERROR: This script is for GitHub Actions runners only!"
+    exit 1
+fi
+
+echo "=== Initial disk usage ==="
+df -h
+
+echo "=== Freeing up disk space ==="
+
+# Remove large directories not needed for KFP tests
+sudo rm -rf /usr/share/dotnet
+sudo rm -rf /opt/ghc
+sudo rm -rf /usr/local/share/boost
+sudo rm -rf /usr/local/lib/android
+sudo rm -rf /usr/local/.ghcup
+sudo rm -rf /usr/share/swift
+
+# Selectively remove large tools from hostedtoolcache while preserving Go, Node, Python
+# Remove these specific large tools that aren't needed for KFP tests
+sudo rm -rf /opt/hostedtoolcache/CodeQL || true
+sudo rm -rf /opt/hostedtoolcache/Java_* || true
+sudo rm -rf /opt/hostedtoolcache/Ruby || true
+sudo rm -rf /opt/hostedtoolcache/PyPy || true
+sudo rm -rf /opt/hostedtoolcache/boost || true
+
+# Clean package manager
+sudo apt-get autoclean
+
+# Clean Docker
+docker system prune -af --volumes
+docker image prune -af
+
+# Clean containerd
+sudo systemctl stop containerd || true
+sudo rm -rf /var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/* || true
+sudo systemctl start containerd || true
+
+echo "=== Final disk usage ==="
+df -h

tests/katib_test.sh

@@ -8,5 +8,5 @@ kubectl wait --for=condition=Running experiments.kubeflow.org -n $KF_PROFILE --a
 echo "Waiting for all Trials to be Completed..."
 kubectl wait --for=condition=Created trials.kubeflow.org -n $KF_PROFILE --all --timeout=60s
 kubectl get trials.kubeflow.org -n $KF_PROFILE
-kubectl wait --for=condition=Succeeded trials.kubeflow.org -n $KF_PROFILE --all --timeout 600s
-kubectl get trials.kubeflow.org -n $KF_PROFILE
+kubectl wait --for=condition=Succeeded trials.kubeflow.org -n $KF_PROFILE --all --timeout 720s
+kubectl get trials.kubeflow.org -n $KF_PROFILE