Repository: RedHatQE/openshift-virtualization-tests
Pull request #711:  Fix ServiceMesh tests and adjust to OSSM 3
Author: login: yossisegev
Labels: name: verified
name: size/M
name: can-be-merged
name: branch-main
name: tox:verify-tc-requirement-polarion:passed
description: D/S Testing
name: lgtm-polarion-jenkins
name: lgtm-vsibirsk
name: tox:verify-bugs-are-open:passed
description: D/S Testing
name: lgtm-Anatw
name: lgtm-sbahar619
name: sig-network
name: approved-dshchedr
name: approved-EdDev
Created: 2025-04-08T10:27:54Z | Merged: 2025-04-24T09:38:44Z

OSSM moved from ver. 2 to 3. This fix adjusts to ver. 3 by enabling gateway injection, which is performed by labeling the work namespace with the matching label {istio-injection: enabled}.



Diff:
diff --git a/tests/network/service_mesh/conftest.py b/tests/network/service_mesh/conftest.py
index d6bca928cf..9322fdc2d8 100644
--- a/tests/network/service_mesh/conftest.py
+++ b/tests/network/service_mesh/conftest.py
@@ -32,11 +32,10 @@
     FedoraVirtualMachineForServiceMesh,
     ServiceMeshDeployments,
     ServiceMeshDeploymentService,
-    ServiceMeshMemberRollForTests,
     authentication_request,
 )
 from utilities.constants import PORT_80, TIMEOUT_4MIN, TIMEOUT_10SEC
-from utilities.infra import add_scc_to_service_account, create_ns, unique_name
+from utilities.infra import add_scc_to_service_account, create_ns, label_project, unique_name
 from utilities.virt import running_vm, vm_console_run_commands, wait_for_console
 
 LOGGER = logging.getLogger(__name__)
@@ -175,11 +174,18 @@ def ns_outside_of_service_mesh(admin_client):
     yield from create_ns(admin_client=admin_client, name="outside-mesh")
 
 
+@pytest.fixture(scope="module")
+def service_mesh_tests_namespace(namespace, admin_client):
+    # The namespace used for the ServiceMesh tests must be added the `istio-injection` label.
+    label_project(name=namespace.name, label={"istio-injection": "enabled"}, admin_client=admin_client)
+    return namespace
+
+
 @pytest.fixture(scope="class")
-def httpbin_deployment_service_mesh(namespace):
+def httpbin_deployment_service_mesh(service_mesh_tests_namespace):
     with ServiceMeshDeployments(
         name="httpbin",
-        namespace=namespace.name,
+        namespace=service_mesh_tests_namespace.name,
         version=ServiceMeshDeployments.ApiVersion.V1,
         image=HTTPBIN_IMAGE,
         command=shlex.split(HTTPBIN_COMMAND),
@@ -214,23 +220,16 @@ def httpbin_service_service_mesh(httpbin_deployment_service_mesh, httpbin_servic
         yield sv
 
 
-@pytest.fixture(scope="module")
-def service_mesh_member_roll(namespace):
-    with ServiceMeshMemberRollForTests(members=[namespace.name]) as smmr:
-        yield smmr
-
-
 @pytest.fixture(scope="module")
 def vm_fedora_with_service_mesh_annotation(
     unprivileged_client,
-    namespace,
-    service_mesh_member_roll,
+    service_mesh_tests_namespace,
 ):
     vm_name = "service-mesh-vm"
     with FedoraVirtualMachineForServiceMesh(
         client=unprivileged_client,
         name=vm_name,
-        namespace=namespace.name,
+        namespace=service_mesh_tests_namespace.name,
     ) as vm:
         vm.custom_service_enable(
             service_name=vm_name,
@@ -276,10 +275,10 @@ def outside_mesh_console_ready_vm(
 
 
 @pytest.fixture(scope="class")
-def server_deployment_v1(namespace):
+def server_deployment_v1(service_mesh_tests_namespace):
     with ServiceMeshDeployments(
         name=SERVER_DEMO_NAME,
-        namespace=namespace.name,
+        namespace=service_mesh_tests_namespace.name,
         version=ServiceMeshDeployments.ApiVersion.V1,
         image=SERVER_V1_IMAGE,
         strategy=SERVER_DEPLOYMENT_STRATEGY,
@@ -412,20 +411,21 @@ def change_routing_to_v2(
 
 
 @pytest.fixture(scope="class")
-def peer_authentication_strict_service_mesh(service_mesh_member_roll, namespace):
-    with PeerAuthenticationForTests(name=service_mesh_member_roll.name, namespace=namespace.name) as pa:
+def peer_authentication_strict_service_mesh(service_mesh_tests_namespace):
+    with PeerAuthenticationForTests(
+        name="default",
+        namespace=service_mesh_tests_namespace.name,
+    ) as pa:
         yield pa
 
 
 @pytest.fixture(scope="class")
 def peer_authentication_service_mesh_deployment(
     istio_system_namespace,
-    namespace,
-    service_mesh_member_roll,
+    peer_authentication_strict_service_mesh,
     vm_fedora_with_service_mesh_annotation,
     ns_outside_of_service_mesh,
     httpbin_service_service_mesh,
-    peer_authentication_strict_service_mesh,
     service_mesh_vm_console_connection_ready,
 ):
     wait_service_mesh_components_convergence(
diff --git a/tests/network/utils.py b/tests/network/utils.py
index f9e758ba35..6ca000a30f 100644
--- a/tests/network/utils.py
+++ b/tests/network/utils.py
@@ -7,7 +7,6 @@
 from ocp_resources.deployment import Deployment
 from ocp_resources.node_network_state import NodeNetworkState
 from ocp_resources.service import Service
-from ocp_resources.service_mesh_member_roll import ServiceMeshMemberRoll
 from pyhelper_utils.shell import run_ssh_commands
 from timeout_sampler import TimeoutExpiredError, TimeoutSampler
 
@@ -15,7 +14,6 @@
 from utilities import console
 from utilities.constants import (
     IPV4_STR,
-    ISTIO_SYSTEM_DEFAULT_NS,
     OS_FLAVOR_FEDORA,
     SSH_PORT_22,
     TIMEOUT_1MIN,
@@ -43,7 +41,6 @@
 }}
 EOF
 """
-SERVICE_MESH_VM_MEMORY_REQ = "128M"
 SERVICE_MESH_INJECT_ANNOTATION = "sidecar.istio.io/inject"
 
 
@@ -71,27 +68,6 @@ def to_dict(self):
             self.res["spec"]["ports"][0]["name"] = self.port_name
 
 
-class ServiceMeshMemberRollForTests(ServiceMeshMemberRoll):
-    def __init__(
-        self,
-        members,
-    ):
-        """
-        Service Mesh Member Roll creation
-        Args:
-            members (list): Namespaces to be added to Service Mesh
-        """
-        super().__init__(
-            name="default",
-            namespace=ISTIO_SYSTEM_DEFAULT_NS,
-        )
-        self.members = members
-
-    def to_dict(self):
-        super().to_dict()
-        self.res["spec"] = {"members": self.members}
-
-
 class FedoraVirtualMachineForServiceMesh(VirtualMachineForTests):
     def __init__(
         self,


Reviews:
user: login: polarion-jenkins
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-04-08T10:30:51Z
user: login: nirdothan
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T09:37:23Z
user: login: EdDev
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T10:42:07Z
user: login: EdDev
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T10:47:01Z
user: login: yossisegev
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T10:49:50Z
user: login: polarion-jenkins
state: DISMISSED
author_association: COLLABORATOR
submitted_at: 2025-04-09T10:53:30Z
user: login: yossisegev
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T11:09:37Z
user: login: EdDev
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T11:30:57Z
user: login: yossisegev
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T11:59:51Z
user: login: yossisegev
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T12:37:12Z
user: login: polarion-jenkins
state: DISMISSED
author_association: COLLABORATOR
submitted_at: 2025-04-09T12:39:45Z
user: login: EdDev
body: Very nice, thanks!
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T15:05:00Z
user: login: sbahar619
body: lgtm.
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T07:37:12Z
user: login: Anatw
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T09:47:34Z
user: login: rnetser
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-10T11:53:45Z
user: login: yossisegev
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T13:45:21Z
user: login: EdDev
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-11T03:55:44Z
user: login: polarion-jenkins
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-04-21T18:55:07Z
user: login: polarion-jenkins
state: DISMISSED
author_association: COLLABORATOR
submitted_at: 2025-04-22T11:03:22Z
user: login: yossisegev
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-22T11:07:55Z
user: login: sbahar619
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-23T12:09:14Z
user: login: sbahar619
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-23T12:13:20Z
user: login: sbahar619
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-23T12:17:28Z
user: login: yossisegev
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-23T12:23:50Z
user: login: sbahar619
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-23T12:30:15Z
user: login: yossisegev
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-23T12:30:32Z
user: login: polarion-jenkins
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-04-23T13:05:16Z
user: login: sbahar619
body: lgtm.
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-23T14:27:03Z
user: login: Anatw
body: Thank you.
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-23T14:53:11Z
user: login: dshchedr
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-04-23T21:18:01Z
user: login: EdDev
body: Thank you!

I prefer PRs with proper commits, each treating a specific logic change that can be explored in the future (and less work progress). I know the style used in the project by other SIGs is to keep the work history on the commits, but I find that harder to review. It is not a problem with small changes like this one, but it is very hard with larger ones (for me).

Lets try to do that in the future please.
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-24T04:03:39Z
user: login: vsibirsk
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-04-24T09:38:20Z

Review comments:
diff_hunk: @@ -441,3 +441,8 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module")
+def label_istio_injection_namespace(namespace, admin_client):
+    label_project(name=namespace.name, label={"istio-injection": "enabled"}, admin_client=admin_client)
path: tests/network/service_mesh/conftest.py
user: login: nirdothan
body: Looks good, however per commit message, I'm not sure that it's related to OSSM version, as in U/S it's been in use for a while.
created_at: 2025-04-09T09:36:53Z
author_association: CONTRIBUTOR
diff_hunk: @@ -6,7 +6,10 @@
 )
 from tests.network.utils import assert_authentication_request
 
-pytestmark = pytest.mark.service_mesh
+pytestmark = [
+    pytest.mark.service_mesh,
+    pytest.mark.usefixtures("label_istio_injection_namespace"),
path: tests/network/service_mesh/test_service_mesh.py
user: login: EdDev
body: Is there a difference between setting the fixture here or on definition to specify `autouse=True`?
created_at: 2025-04-09T10:37:58Z
author_association: CONTRIBUTOR
diff_hunk: @@ -441,3 +441,8 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module")
+def label_istio_injection_namespace(namespace, admin_client):
+    label_project(name=namespace.name, label={"istio-injection": "enabled"}, admin_client=admin_client)
path: tests/network/service_mesh/conftest.py
user: login: yossisegev
body: Thank you Nir.
I modified the commit message.
created_at: 2025-04-09T10:39:24Z
author_association: CONTRIBUTOR
diff_hunk: @@ -441,3 +441,8 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module")
+def label_istio_injection_namespace(namespace, admin_client):
path: tests/network/service_mesh/conftest.py
user: login: EdDev
body: Maybe in the spirit of what @sbahar619 suggested, you can use this one to wrap the namespace one.
I.e. rename this to `istio_namespace`, add the label like you do here and return the namespace back.
created_at: 2025-04-09T10:46:57Z
author_association: CONTRIBUTOR
diff_hunk: @@ -6,7 +6,10 @@
 )
 from tests.network.utils import assert_authentication_request
 
-pytestmark = pytest.mark.service_mesh
+pytestmark = [
+    pytest.mark.service_mesh,
+    pytest.mark.usefixtures("label_istio_injection_namespace"),
path: tests/network/service_mesh/test_service_mesh.py
user: login: yossisegev
body: I don't know.
Is there an advantage of one way over the other?
created_at: 2025-04-09T10:48:38Z
author_association: CONTRIBUTOR
diff_hunk: @@ -441,3 +441,8 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module")
+def label_istio_injection_namespace(namespace, admin_client):
path: tests/network/service_mesh/conftest.py
user: login: yossisegev
body: Sounds like an overkill to me.
Going this way will require changing all the namespace references in this module from `namespace` to `istio_namespace`, which contradicts the behavior in all the other tests in this repo.
Can you please explain the rational for doing so?
created_at: 2025-04-09T11:09:37Z
author_association: CONTRIBUTOR
diff_hunk: @@ -441,3 +441,8 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module")
+def label_istio_injection_namespace(namespace, admin_client):
path: tests/network/service_mesh/conftest.py
user: login: EdDev
body: In `tests/network/service_mesh/test_service_mesh.py` there is no direct reference to `namespace`, so I do not see a problem.
The difference is that conceptually, a fixture can represent an operation or a resource, and usually we favor resources/objects. E.g. a `namespace` is an object, but `label_on_namespace` is an operation.

It is clearer when a test actually references the resource and the operation:
```python
def test_foo(namespace, istio_label_on_namespace):
  ....
``` 
If in the test one uses `namespace`, while on the API server it may have the label, on the object itself it may not include it (depends on the implementation). So one works with the original namespace that was first created and not the one that was later updated.

But if you replace `namespace, istio_label_on_namespace` with just `istio_namespace` the problem is no more.
created_at: 2025-04-09T11:29:17Z
author_association: CONTRIBUTOR
diff_hunk: @@ -6,7 +6,10 @@
 )
 from tests.network.utils import assert_authentication_request
 
-pytestmark = pytest.mark.service_mesh
+pytestmark = [
+    pytest.mark.service_mesh,
+    pytest.mark.usefixtures("label_istio_injection_namespace"),
path: tests/network/service_mesh/test_service_mesh.py
user: login: EdDev
body: No need to write `pytest.mark.usefixtures("label_istio_injection_namespace"),`

And it will work if new modules are added here as well without the need to duplicate this.
created_at: 2025-04-09T11:30:43Z
author_association: CONTRIBUTOR
diff_hunk: @@ -441,3 +441,8 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module")
+def label_istio_injection_namespace(namespace, admin_client):
path: tests/network/service_mesh/conftest.py
user: login: yossisegev
body: OK, I see the conceptual point you are raising. I'll change it.
BTW - `namespace` fixture may not be used or referenced in the test module, but it is in the package's conftest. Nevertheless I'll apply this change.
created_at: 2025-04-09T11:59:51Z
author_association: CONTRIBUTOR
diff_hunk: @@ -6,7 +6,10 @@
 )
 from tests.network.utils import assert_authentication_request
 
-pytestmark = pytest.mark.service_mesh
+pytestmark = [
+    pytest.mark.service_mesh,
+    pytest.mark.usefixtures("label_istio_injection_namespace"),
path: tests/network/service_mesh/test_service_mesh.py
user: login: yossisegev
body: Accepted.
created_at: 2025-04-09T12:37:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -441,3 +444,10 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module", autouse=True)
path: tests/network/service_mesh/conftest.py
user: login: rnetser
body: 1. why not create the ns with this label in the first place? 
2. why are you using `autouse`; `autouse` usage should be minimal (if at all)
created_at: 2025-04-10T11:53:41Z
author_association: COLLABORATOR
diff_hunk: @@ -441,3 +444,10 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module", autouse=True)
path: tests/network/service_mesh/conftest.py
user: login: yossisegev
body: > why not create the ns with this label in the first place?

This was already discussed [here](https://github.com/RedHatQE/openshift-virtualization-tests/pull/711#issuecomment-2789243763) and [here](https://github.com/RedHatQE/openshift-virtualization-tests/pull/711#issuecomment-2789237204).
tl;dr: Doing so means changing the repo-wide `namespace` fixture and necessarily affect all the tests. It must remain un-touched as much as possible.
In addition - editing an existing namespace is valid (like `oc create ns new-ns` and then `oc edit ns new-ns`).

> why are you using autouse; autouse usage should be minimal (if at all)

Originally I called it with `usefixtures`, but [Edy asked to autouse it](https://github.com/RedHatQE/openshift-virtualization-tests/pull/711#discussion_r2035090945).

created_at: 2025-04-10T13:45:21Z
author_association: CONTRIBUTOR
diff_hunk: @@ -441,3 +444,10 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module", autouse=True)
path: tests/network/service_mesh/conftest.py
user: login: EdDev
body: What is the problem with `autouse`?
In this case, it says something like: In case any test is collected in this package, a special namespace is needed and created implicitly for all tests (and fixtures here) to use.

If the fixture is already explicitly dependent on by tests in an indirect manner (through other fixtures along the way), then it can and should be dropped.
Is this the case here?
created_at: 2025-04-11T03:55:44Z
author_association: CONTRIBUTOR
diff_hunk: @@ -441,3 +444,10 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module", autouse=True)
path: tests/network/service_mesh/conftest.py
user: login: yossisegev
body: autouse/usefixtures are now entirely removed.
created_at: 2025-04-22T11:07:55Z
author_association: CONTRIBUTOR
diff_hunk: @@ -441,3 +435,10 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module")
+def service_mesh_tests_namespace(namespace, admin_client):
+    # The namespace used for the ServiceMesh tests must be added the `istio-injection` label.
+    label_project(name=namespace.name, label={"istio-injection": "enabled"}, admin_client=admin_client)
path: tests/network/service_mesh/conftest.py
user: login: sbahar619
body: ```suggestion
def service_mesh_tests_namespace():
    # The namespace used for the ServiceMesh tests must be added the `istio-injection` label.
    yield from create_ns(
        name="test-service-mesh-ns",
        labels={"istio-injection": "enabled"},
    )
```
Will that work?
Its more straight forward.
created_at: 2025-04-23T12:09:14Z
author_association: CONTRIBUTOR
diff_hunk: @@ -441,3 +435,10 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module")
+def service_mesh_tests_namespace(namespace, admin_client):
path: tests/network/service_mesh/conftest.py
user: login: sbahar619
body: I think its best to move this fixture to a more top level place in the file based in its fixture scope.
created_at: 2025-04-23T12:13:20Z
author_association: CONTRIBUTOR
diff_hunk: @@ -412,16 +404,18 @@ def change_routing_to_v2(
 
 
 @pytest.fixture(scope="class")
-def peer_authentication_strict_service_mesh(service_mesh_member_roll, namespace):
-    with PeerAuthenticationForTests(name=service_mesh_member_roll.name, namespace=namespace.name) as pa:
+def peer_authentication_strict_service_mesh(service_mesh_tests_namespace):
+    with PeerAuthenticationForTests(
+        name="default",
+        namespace=service_mesh_tests_namespace.name,
+    ) as pa:
         yield pa
 
 
 @pytest.fixture(scope="class")
 def peer_authentication_service_mesh_deployment(
     istio_system_namespace,
-    namespace,
-    service_mesh_member_roll,
+    service_mesh_tests_namespace,
path: tests/network/service_mesh/conftest.py
user: login: sbahar619
body: Redundant, the service_mesh_tests_namespace fixture is call by peer_authentication_strict_service_mesh fixture, so you can just move it up and adjust the order execution.
created_at: 2025-04-23T12:17:27Z
author_association: CONTRIBUTOR
diff_hunk: @@ -441,3 +435,10 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module")
+def service_mesh_tests_namespace(namespace, admin_client):
+    # The namespace used for the ServiceMesh tests must be added the `istio-injection` label.
+    label_project(name=namespace.name, label={"istio-injection": "enabled"}, admin_client=admin_client)
path: tests/network/service_mesh/conftest.py
user: login: yossisegev
body: It should work, but I prefer not to do it this way.
Why? Because I prefer being consistent with the common convention in cnv-tests, where each test module has its dedicated namespace which is created by the `namespace` fixture, and if necessary - apply any needed configuration (in this case - this additional label) on that namespace.
Does this make sense?
created_at: 2025-04-23T12:23:50Z
author_association: CONTRIBUTOR
diff_hunk: @@ -441,3 +435,10 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module")
+def service_mesh_tests_namespace(namespace, admin_client):
+    # The namespace used for the ServiceMesh tests must be added the `istio-injection` label.
+    label_project(name=namespace.name, label={"istio-injection": "enabled"}, admin_client=admin_client)
path: tests/network/service_mesh/conftest.py
user: login: sbahar619
body: Yes, thanks!
created_at: 2025-04-23T12:30:15Z
author_association: CONTRIBUTOR
diff_hunk: @@ -441,3 +435,10 @@ def vmi_http_server(vm_fedora_with_service_mesh_annotation):
         vm=vm_fedora_with_service_mesh_annotation,
         commands=[f'while true ; do  echo -e "HTTP/1.1 200 OK\n\n $(date)" | nc -l -p {SERVICE_MESH_PORT}  ; done &'],
     )
+
+
+@pytest.fixture(scope="module")
+def service_mesh_tests_namespace(namespace, admin_client):
path: tests/network/service_mesh/conftest.py
user: login: yossisegev
body: Done
created_at: 2025-04-23T12:30:32Z
author_association: CONTRIBUTOR

PR comments:
user: login: ghost
created_at: 2025-04-08T10:28:12Z
body: 
Report bugs in [Issues](https://github.com/myakove/github-webhook-server/issues)

The following are automatically added:
 * Add reviewers from OWNER file (in the root of the repository) under reviewers section.
 * Set PR size label.
 * New issue is created for the PR. (Closed when PR is merged/closed)
 * Run [pre-commit](https://pre-commit.ci/) if `.pre-commit-config.yaml` exists in the repo.

Available user actions:
 * To mark PR as WIP comment `/wip` to the PR, To remove it from the PR comment `/wip cancel` to the PR.
 * To block merging of PR comment `/hold`, To un-block merging of PR comment `/hold cancel`.
 * To mark PR as verified comment `/verified` to the PR, to un-verify comment `/verified cancel` to the PR.
        verified label removed on each new commit push.
 * To cherry pick a merged PR comment `/cherry-pick <target branch to cherry-pick to>` in the PR.
    * Multiple target branches can be cherry-picked, separated by spaces. (`/cherry-pick branch1 branch2`)
    * Cherry-pick will be started when PR is merged
 * To build and push container image command `/build-and-push-container` in the PR (tag will be the PR number).
    * You can add extra args to the Podman build command
        * Example: `/build-and-push-container --build-arg OPENSHIFT_PYTHON_WRAPPER_COMMIT=<commit_hash>`
 * To add a label by comment use `/<label name>`, to remove, use `/<label name> cancel`
 * To assign reviewers based on OWNERS file use `/assign-reviewers`
 * To check if PR can be merged use `/check-can-merge`
 * to assign reviewer to PR use `/assign-reviewer @<reviewer>`

<details>
<summary>Supported /retest check runs</summary>

 * `/retest tox`: Retest tox
 * `/retest build-container`: Retest build-container
 * `/retest all`: Retest all

</details>

<details>
<summary>Supported labels</summary>

 * hold
 * verified
 * wip
 * lgtm

</details>
    
author_association: NONE
user: login: yossisegev
created_at: 2025-04-08T10:28:14Z
body: /verified
author_association: CONTRIBUTOR
user: login: yossisegev
created_at: 2025-04-08T10:50:20Z
body: /assign-reviewer @EdDev 
author_association: CONTRIBUTOR
user: login: sbahar619
created_at: 2025-04-09T10:06:45Z
body: What about just add the namespace label at creation time?
At create_ns function as labels argument?
If the label is meant to be permanent, so just create the namespace with the label builtin.


author_association: CONTRIBUTOR
user: login: EdDev
created_at: 2025-04-09T10:44:33Z
body: > What about just add the namespace label at creation time? At create_ns function as labels argument? If the label is meant to be permanent, so just create the namespace with the label builtin.

If you check the implementation, it cannot be done on creation unless an admin client is used.
Also, the current `namespace` fixture is not supporting labels and these will have to be added. Adding that will effect all tests and is not something you want to do as a side-effect of a simple network specific test change.
author_association: CONTRIBUTOR
user: login: yossisegev
created_at: 2025-04-09T10:47:11Z
body: > What about just add the namespace label at creation time? At create_ns function as labels argument? If the label is meant to be permanent, so just create the namespace with the label builtin.

@sbahar619 Thank you for raising it.
That is what I originally planned, but this namespace is is created using the `namespace` fixture, like any other namespace that is created per module in this repo.
Adding the label there will necessarily affect all these namespaces, but my intention is to add this label only to this specific namespace, and I am doing it by editing it after it is already created.
author_association: CONTRIBUTOR
user: login: yossisegev
created_at: 2025-04-09T12:38:12Z
body: /verified
author_association: CONTRIBUTOR
user: login: yossisegev
created_at: 2025-04-21T18:54:52Z
body: /wip
author_association: CONTRIBUTOR
user: login: yossisegev
created_at: 2025-04-21T18:54:56Z
body: /hold
author_association: CONTRIBUTOR
user: login: ghost
created_at: 2025-04-21T18:55:16Z
body: yossisegev is not part of the approver, only approvers can mark pull request with hold
author_association: NONE
user: login: yossisegev
created_at: 2025-04-22T11:08:40Z
body: /hold cancel
author_association: CONTRIBUTOR
user: login: dbasunag1
created_at: 2025-04-22T11:08:58Z
body: yossisegev is not part of the approver, only approvers can mark pull request with hold
author_association: NONE
user: login: yossisegev
created_at: 2025-04-22T11:09:03Z
body: /wip cancel
author_association: CONTRIBUTOR
user: login: yossisegev
created_at: 2025-04-22T11:20:29Z
body: /verified
author_association: CONTRIBUTOR
user: login: yossisegev
created_at: 2025-04-23T13:02:53Z
body: /verified
author_association: CONTRIBUTOR
user: login: EdDev
created_at: 2025-04-24T04:05:50Z
body: /check-can-merge
author_association: CONTRIBUTOR
user: login: yossisegev
created_at: 2025-04-24T06:35:27Z
body: 
/check-can-merge
author_association: CONTRIBUTOR
user: login: dbasunag1
created_at: 2025-04-24T09:42:01Z
body: New container for quay.io/openshift-cnv/openshift-virtualization-tests:latest published
author_association: NONE