e2e: add Istio service mesh integration testing profile

Implements E2E testing profile for Istio integration as per issue #656.

Features:
- Helm-based Istio installation (base, istiod, ingress gateway v1.28.0)
- Automatic sidecar injection for Semantic Router pods
- Istio Gateway and VirtualService configuration for traffic routing
- DestinationRule with ISTIO_MUTUAL mTLS mode
- 4 comprehensive Istio-specific test cases:
  * istio-sidecar-health-check: Validates sidecar injection
  * istio-traffic-routing: Tests routing through Istio gateway
  * istio-mtls-verification: Verifies mTLS configuration
  * istio-tracing-observability: Checks metrics and telemetry

Integration:
- Added 'istio' to CI workflow matrix for automated testing
- Updated e2e/README.md with Istio profile documentation
- Updated tools/make/e2e.mk help text

Test Results (Local):
- All 4 Istio tests passing (100% success rate)
- Setup/teardown working correctly
- Clean resource cleanup verified

Resolves: #656
Signed-off-by: Semantic Router Bot <[email protected]>
Signed-off-by: Asaad Balum <[email protected]>

Author: asaadbalum

e2e/README.md

@@ -522,14 +522,21 @@ See `profiles/ai-gateway/` for a complete example.
 
 ### Istio Profile
 
-The Istio profile tests Semantic Router deployment and functionality in an Istio service mesh environment.
+The Istio profile tests Semantic Router deployment and functionality in an Istio service mesh environment. It validates both Istio-specific features (sidecars, mTLS, tracing) and general Semantic Router functionality through Istio Gateway + VirtualService routing.
 
 **What it Tests:**
 
-- Istio sidecar injection and health
-- Traffic routing through Istio ingress gateway
-- Mutual TLS (mTLS) between services
-- Distributed tracing and observability
+- **Istio-Specific Features:**
+  - Istio sidecar injection and health
+  - Traffic routing through Istio ingress gateway
+  - Mutual TLS (mTLS) between services
+  - Distributed tracing and observability
+
+- **Semantic Router Features (through Istio):**
+  - Chat completions API and stress testing
+  - Domain classification and routing
+  - Semantic cache, PII detection, jailbreak detection
+  - Signal-Decision engine (priority, plugins, keywords, fallback)
 
 **Prerequisites:**
 
@@ -553,13 +560,35 @@ The Istio profile tests Semantic Router deployment and functionality in an Istio
 
 **Test Cases:**
 
+**Istio-Specific Tests (4):**
+
 | Test Case | Description | What it Validates |
 |-----------|-------------|-------------------|
 | `istio-sidecar-health-check` | Verify Envoy sidecar injection | - Istio-proxy container exists<br>- Sidecar is healthy and ready<br>- Namespace has `istio-injection=enabled` label |
 | `istio-traffic-routing` | Test routing through Istio gateway | - Gateway and VirtualService exist<br>- Requests route correctly to Semantic Router<br>- Istio/Envoy headers present in responses |
 | `istio-mtls-verification` | Verify mutual TLS configuration | - DestinationRule has `ISTIO_MUTUAL` mode<br>- mTLS certificates present in istio-proxy<br>- PeerAuthentication policy (if configured) |
 | `istio-tracing-observability` | Check distributed tracing and metrics | - Trace headers propagated<br>- Envoy metrics exposed<br>- Telemetry configuration<br>- Access logs enabled |
 
+**Common Functionality Tests (reused from other profiles):**
+
+These tests validate that Semantic Router features work correctly through Istio Gateway + VirtualService:
+
+- `chat-completions-request` - Basic API functionality
+- `chat-completions-stress-request` - Sequential stress (1000 requests)
+- `domain-classify` - Classification accuracy (65 cases)
+- `semantic-cache` - Cache hit rate (5 groups)
+- `pii-detection` - PII detection and blocking (10 types)
+- `jailbreak-detection` - Attack detection (10 types)
+- `decision-priority-selection` - Priority-based routing (4 cases)
+- `plugin-chain-execution` - Plugin ordering (4 cases)
+- `rule-condition-logic` - AND/OR operators (6 cases)
+- `decision-fallback-behavior` - Fallback handling (5 cases)
+- `keyword-routing` - Keyword matching (6 cases)
+- `plugin-config-variations` - Config variations (6 cases)
+- `chat-completions-progressive-stress` - Progressive QPS stress test
+
+**Total: 17 test cases** (4 Istio-specific + 13 common functionality)
+
 **Usage:**
 
 ```bash
@@ -608,12 +637,20 @@ make e2e-test E2E_PROFILE=istio E2E_KEEP_CLUSTER=true
 
 **Key Features Tested:**
 
+**Istio Integration:**
 - ✅ **Automatic Sidecar Injection**: Istio automatically injects Envoy proxy sidecars into pods
 - ✅ **Traffic Management**: Requests route through Istio Gateway → VirtualService → Semantic Router
 - ✅ **Security (mTLS)**: Automatic mutual TLS encryption and authentication between services
 - ✅ **Observability**: Distributed tracing, metrics collection, and access logs
 - ✅ **Service Mesh Integration**: Semantic Router operates correctly within Istio mesh
 
+**Semantic Router Functionality (through Istio):**
+- ✅ **LLM Gateway**: Chat completions API with stress testing
+- ✅ **Classification**: Domain-based routing with 65 test cases
+- ✅ **Security Features**: PII detection, jailbreak detection, semantic cache
+- ✅ **Signal-Decision Engine**: Priority-based routing, plugin chains, keyword matching, fallback behavior
+- ✅ **Load Handling**: Progressive stress testing (10-100 QPS)
+
 **Setup Steps (Automated by Profile):**
 
 1. Install Istio control plane using Helm (base, istiod, ingress gateway)

e2e/profiles/istio/profile.go

@@ -161,10 +161,10 @@ func (p *Profile) Teardown(ctx context.Context, opts *framework.TeardownOptions)
 
 // GetTestCases returns the list of test cases for this profile
 func (p *Profile) GetTestCases() []string {
-	// Istio profile focuses on Istio-specific functionality (issue #656)
-	// These tests validate Istio integration: sidecar injection, traffic routing,
-	// mTLS, and observability features
 	return []string{
+		// Istio-specific functionality tests
+		// These validate Istio integration: sidecar injection, traffic routing,
+		// mTLS, and observability features
 		"istio-sidecar-health-check",
 		"istio-traffic-routing",
 		"istio-mtls-verification",