Repository: istio/istio
File: tests/integration/helm/util.go (Go)

Code before:

	if installGateway {
		// Why we skip schema validation when installing old gateway charts
		//
		// Context:
		// - With newer Helm versions, validation against values.schema.json is stricter. Older
		//   gateway chart schemas (the “previous minor” we install from the Helm repo here) have
		//   additionalProperties=false at the root and do not list newer top-level keys we include
		//   in our test overrides (e.g., global, revision, profile, _internal_defaults_do_not_set,
		//   platform). Newer Helm enforces this more strictly, causing the install to fail before
		//   rendering.
		// - This is not just a “test-only” mismatch; new Helm + old charts can fail validation in
		//   some user scenarios as well. Backports are being prepared/applied to the older charts
		//   to address this at the source.
		//
		// Why this is safe (and temporary):
		// - In this test we only skip schema validation for the legacy gateway install (when
		//   version != "") to unblock the upgrade flow. We continue to fully validate installs
		//   and upgrades of the charts under test (master).
		// - This does not weaken the validation of current charts, and it avoids upgrade test
		//   failures rooted in old chart schemas plus stricter Helm behavior.
		// - Once the backported schema fixes are published in the Helm repo for the previous
		//   minor, we can remove this flag.
		//
		// TODO(istio/istio#57507): remove --skip-schema-validation once the gateway chart
		// for the previous minor has the backported schema updates.		gwArgs := versionArgs
		gwArgs := versionArgs
		if version != "" {
			gwArgs += " --skip-schema-validation"
		}
		err = h.InstallChart(
			IngressReleaseName, gatewayChartPath, nsConfig.Get(IngressReleaseName),
			gatewayOverrideValuesFile, Timeout, gwArgs)
		if err != nil {
			t.Fatalf("failed to install istio %s chart: %v", GatewayChartsDir, err)
		}
	}

	if ambientProfile || t.Settings().OpenShift {
		// Install cni chart
		err = h.InstallChart(CniReleaseName, cniChartPath, nsConfig.Get(CniReleaseName), overrideValuesFile, Timeout, versionArgs)
		if err != nil {
			t.Fatalf("failed to install istio %s chart: %v", CniChartsDir, err)
		}
	}

	if ambientProfile {

		// Install ztunnel chart
		err = h.InstallChart(ZtunnelReleaseName, ztunnelChartPath, nsConfig.Get(ZtunnelReleaseName), overrideValuesFile, Timeout, versionArgs)
		if err != nil {

Review comment (suggestion):
```suggestion
		// for the previous minor has the backported schema updates.
```

Code after:

	if installGateway {
		// Why we skip schema validation when installing old gateway charts
		//
		// Context:
		// - With newer Helm versions, validation against values.schema.json is stricter. Older
		//   gateway chart schemas (the “previous minor” we install from the Helm repo here) have
		//   additionalProperties=false at the root and do not list newer top-level keys we include
		//   in our test overrides (e.g., global, revision, profile, _internal_defaults_do_not_set,
		//   platform). Newer Helm enforces this more strictly, causing the install to fail before
		//   rendering.
		// - This is not just a “test-only” mismatch; new Helm + old charts can fail validation in
		//   some user scenarios as well. Backports are being prepared/applied to the older charts
		//   to address this at the source.
		//
		// Why this is safe (and temporary):
		// - In this test we only skip schema validation for the legacy gateway install (when
		//   version != "") to unblock the upgrade flow. We continue to fully validate installs
		//   and upgrades of the charts under test (master).
		// - This does not weaken the validation of current charts, and it avoids upgrade test
		//   failures rooted in old chart schemas plus stricter Helm behavior.
		// - Once the backported schema fixes are published in the Helm repo for the previous
		//   minor, we can remove this flag.
		//
		// TODO(istio/istio#57507): remove --skip-schema-validation once the gateway chart
		// for the previous minor has the backported schema updates.
		gwArgs := versionArgs
		if version != "" {
			gwArgs += " --skip-schema-validation"
		}
		err = h.InstallChart(
			IngressReleaseName, gatewayChartPath, nsConfig.Get(IngressReleaseName),
			gatewayOverrideValuesFile, Timeout, gwArgs)
		if err != nil {
			t.Fatalf("failed to install istio %s chart: %v", GatewayChartsDir, err)
		}
	}

	if ambientProfile || t.Settings().OpenShift {
		// Install cni chart
		err = h.InstallChart(CniReleaseName, cniChartPath, nsConfig.Get(CniReleaseName), overrideValuesFile, Timeout, versionArgs)
		if err != nil {
			t.Fatalf("failed to install istio %s chart: %v", CniChartsDir, err)
		}
	}

	if ambientProfile {

		// Install ztunnel chart
		err = h.InstallChart(ZtunnelReleaseName, ztunnelChartPath, nsConfig.Get(ZtunnelReleaseName), overrideValuesFile, Timeout, versionArgs)
		if err != nil {