traffic distribution: move to API repo

Also, the chart accidentally made it a label -- its an annotation,
though.

Fails until istio/api#3328

cni/pkg/nodeagent/net.go

@@ -24,6 +24,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
 
+	"istio.io/api/annotation"
 	"istio.io/istio/cni/pkg/iptables"
 	"istio.io/istio/pkg/slices"
 	dep "istio.io/istio/tools/istio-iptables/pkg/dependencies"
@@ -131,11 +132,11 @@ func (s *NetServer) AddPodToMesh(ctx context.Context, pod *corev1.Pod, podIPs []
 	// Basically, this just disables inbound redirection.
 	// We use the SidecarTrafficExcludeInboundPorts annotation for compatibility (its somewhat widely used) but don't support all values.
 	ingressMode := false
-	if a, f := pod.Annotations["ambient.istio.io/bypassInboundCapture"]; f {
+	if a, f := pod.Annotations[annotation.AmbientBypassInboundCapture.Name]; f {
 		var err error
 		ingressMode, err = strconv.ParseBool(a)
 		if err != nil {
-			log.Warnf("annotation ambient.istio.io/bypassInboundCapture=%q found, but only '*' is supported", a)
+			log.Warnf("annotation %v=%q found, but only '*' is supported", annotation.AmbientBypassInboundCapture.Name, a)
 		}
 	}
 

go.mod

@@ -93,7 +93,7 @@ require (
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 	helm.sh/helm/v3 v3.16.1
-	istio.io/api v1.23.0-alpha.0.0.20241011000314-650491578381
+	istio.io/api v1.24.0-alpha.0.0.20241018201654-7c8ec5b5ab72
 	istio.io/client-go v1.23.0-alpha.0.0.20241011000732-f46eea8919cd
 	k8s.io/api v0.31.1
 	k8s.io/apiextensions-apiserver v0.31.1

go.sum

@@ -639,6 +639,12 @@ honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 istio.io/api v1.23.0-alpha.0.0.20241011000314-650491578381 h1:ZgYTwI0GqRLuany0gLzohY9UW8cVS7cX7gRfGziGnP0=
 istio.io/api v1.23.0-alpha.0.0.20241011000314-650491578381/go.mod h1:MQnRok7RZ20/PE56v0LxmoWH0xVxnCQPNuf9O7PAN1I=
+istio.io/api v1.23.0-alpha.0.0.20241007133624-bfb6855a7760 h1:B/Lpky3Hj8dh8CK3C39+NEPGrwNlTf3hvvrrg5pzeYg=
+istio.io/api v1.23.0-alpha.0.0.20241007133624-bfb6855a7760/go.mod h1:MQnRok7RZ20/PE56v0LxmoWH0xVxnCQPNuf9O7PAN1I=
+istio.io/client-go v1.23.0-alpha.0.0.20241007133923-6216dcee5376 h1:aM+5v210jEo461mnWhjebrlbN42us9TkFxKD2af9zdg=
+istio.io/client-go v1.23.0-alpha.0.0.20241007133923-6216dcee5376/go.mod h1:FMeaDxfTkjxUR+j4Chn7L5TqykTdfUNd3Pq9ZeEVipc=
+istio.io/api v1.24.0-alpha.0.0.20241018201654-7c8ec5b5ab72 h1:AVg/4p5sVhZT6JwBczgvAy9idbVYiCqZFE/QVXNKy/k=
+istio.io/api v1.24.0-alpha.0.0.20241018201654-7c8ec5b5ab72/go.mod h1:MQnRok7RZ20/PE56v0LxmoWH0xVxnCQPNuf9O7PAN1I=
 istio.io/client-go v1.23.0-alpha.0.0.20241011000732-f46eea8919cd h1:rghOYcynTAXYGRJXkZjxAogTbNQE+ROTWPaGTcd84bM=
 istio.io/client-go v1.23.0-alpha.0.0.20241011000732-f46eea8919cd/go.mod h1:oECxINJDBsN7AtQjcZVBQqQ73FHeYw6D3ihspfN7PDs=
 k8s.io/api v0.31.1 h1:Xe1hX/fPW3PXYYv8BlozYqw63ytA92snr96zMW9gWTU=

manifests/charts/istio-control/istio-discovery/files/waypoint.yaml

@@ -294,10 +294,16 @@ apiVersion: v1
 kind: Service
 metadata:
   annotations:
-    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+    {{ toJsonMap
+      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
+      (omit .InfrastructureAnnotations
+        "kubectl.kubernetes.io/last-applied-configuration"
+        "gateway.istio.io/name-override"
+        "gateway.istio.io/service-account"
+        "gateway.istio.io/controller-version"
+      ) | nindent 4 }}
   labels:
     {{- toJsonMap
-      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
       .InfrastructureLabels
       (strdict
         "gateway.networking.k8s.io/gateway-name" .Name

pilot/pkg/serviceregistry/kube/controller/ambient/services.go

@@ -21,6 +21,7 @@ import (
 
 	v1 "k8s.io/api/core/v1"
 
+	apiannotation "istio.io/api/annotation"
 	"istio.io/api/networking/v1alpha3"
 	networkingclient "istio.io/client-go/pkg/apis/networking/v1"
 	"istio.io/istio/pilot/pkg/model"
@@ -148,7 +149,7 @@ func (a *index) constructServiceEntries(svc *networkingclient.ServiceEntry, w *W
 	}
 
 	var lb *workloadapi.LoadBalancing
-	preferClose := strings.EqualFold(svc.Annotations["networking.istio.io/traffic-distribution"], v1.ServiceTrafficDistributionPreferClose)
+	preferClose := strings.EqualFold(svc.Annotations[apiannotation.NetworkingTrafficDistribution.Name], v1.ServiceTrafficDistributionPreferClose)
 	if preferClose {
 		lb = preferCloseLoadBalancer
 	}
@@ -196,7 +197,7 @@ func (a *index) constructService(svc *v1.Service, w *Waypoint) *workloadapi.Serv
 	var lb *workloadapi.LoadBalancing
 
 	// The TrafficDistribution field is quite new, so we allow a legacy annotation option as well
-	preferClose := strings.EqualFold(svc.Annotations["networking.istio.io/traffic-distribution"], v1.ServiceTrafficDistributionPreferClose)
+	preferClose := strings.EqualFold(svc.Annotations[apiannotation.NetworkingTrafficDistribution.Name], v1.ServiceTrafficDistributionPreferClose)
 	if svc.Spec.TrafficDistribution != nil {
 		preferClose = *svc.Spec.TrafficDistribution == v1.ServiceTrafficDistributionPreferClose
 	}