Allow direct ingress to knative services.

[treyhyde]

Fixes #1003

Changes

• 🎁 Allow direct ingress via delegate virtual services

/kind enhancement

Fixes #1003

Knative requires you to use an intermediate hop to a cluster local gateway.

Ingress VS (rewrite authority) -> cluster local gateways -> activator (optional) -> service

This change allows you to delegate your route directly to the service / activator

Ingress VS -> activator (optional) -> service

Release Note

Creates a delegate VirtualService for every knative service to allow for direct ingress to a service without adding additional hops via a cluster-local-gateway

Docs

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: jim-baker-fulcrum / name: Jim Baker (efbad2f)
• ✅ login: treyhyde / name: Trey Hyde (269379e, 5217145, 75434c7, 8179adc, b542319, d4d9c54, ef01947)

[knative-prow]

Welcome @treyhyde! It looks like this is your first PR to knative-extensions/net-istio 🎉

[knative-prow]

Hi @treyhyde. Thanks for your PR.

I'm waiting for a knative-extensions member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[dprotaso]

/ok-to-test
/lgtm

[dprotaso]

whoops
/lgtm cancel

[knative-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: treyhyde
Once this PR has been reviewed and has the lgtm label, please ask for approval from dprotaso. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

❌ Patch coverage is 84.37500% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.91%. Comparing base (f9c7d7e) to head (75434c7).
⚠️ Report is 55 commits behind head on main.

Files with missing lines	Patch %	Lines
...kg/reconciler/ingress/resources/virtual_service.go	90.00%	1 Missing and 2 partials ⚠️
pkg/reconciler/ingress/resources/names/names.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1517      +/-   ##
==========================================
+ Coverage   80.13%   81.91%   +1.78%     
==========================================
  Files          23       23              
  Lines        1928     1543     -385     
==========================================
- Hits         1545     1264     -281     
+ Misses        289      183     -106     
- Partials       94       96       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dprotaso]

@treyhyde quick question - what does your istio installation look like? eg. are you using mesh or just the simple external ingress gateway + cluster local gateway?

[dprotaso]

I think the meat of the delegate should just be (meaning we should trim it down to what the activator needs)

    route:
    - destination:
        host: hello-00001.default.svc.cluster.local
        port:
          number: 80
      headers:
        request:
          set:
            Knative-Serving-Namespace: default
            Knative-Serving-Revision: hello-00001

and then we point the other virtual services to this one.

Note - to handle upgrades I think we should make sure we create the delegate first prior to updating other virtual services

[dprotaso]

Oh this block should have the traffic splits too etc

…

On Thu, Mar 5, 2026 at 20:28 Dave Protasowski ***@***.***> wrote: *dprotaso* left a comment (knative-extensions/net-istio#1517) <#1517 (comment)> I think the meat of the delegate should just be (meaning we should trim it down to what the activator needs) route: - destination: host: hello-00001.default.svc.cluster.local port: number: 80 headers: request: set: Knative-Serving-Namespace: default Knative-Serving-Revision: hello-00001 and then we point the other virtual services to this one. Note - to handle upgrades I think we should make sure we create the delegate first prior to updating other virtual services — Reply to this email directly, view it on GitHub <#1517 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAERAUJ6EMIOSWRSGGVUCL4PISVTAVCNFSM6AAAAACV6GNDRCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DAMBYHEYDAMBXGY> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[treyhyde]

@treyhyde quick question - what does your istio installation look like? eg. are you using mesh or just the simple external ingress gateway + cluster local gateway?

Full mesh but the problem would be the same if I was using just a gateway.

[treyhyde]

I think the meat of the delegate should just be (meaning we should trim it down to what the activator needs)

    route:
    - destination:
        host: hello-00001.default.svc.cluster.local
        port:
          number: 80
      headers:
        request:
          set:
            Knative-Serving-Namespace: default
            Knative-Serving-Revision: hello-00001

and then we point the other virtual services to this one.

Note - to handle upgrades I think we should make sure we create the delegate first prior to updating other virtual services

I tried to keep the change to just the minimal surface. I believe it creates the VS with exactly the same function as the other VSs but without the hosts. If we wanted to do a larger refactoring to base the other VSs on this delegate, we can do that too but it will increase the change surface.

[dprotaso]

I tried to keep the change to just the minimal surface. I believe it creates the VS with exactly the same function as the other VSs but without the hosts. If we wanted to do a larger refactoring to base the other VSs on this delegate, we can do that too but it will increase the change surface.

I think that's fair. Let's just put this change behind a config knob in our config-istio (with the default being off).

See: https://github.com/knative-extensions/net-istio/blob/main/config/400-config-istio.yaml

Let me know if you have any questions.

[knative-prow-robot]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[knative-prow]

@treyhyde: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
unit-tests_net-istio_main	269379e	link	true	/test unit-tests
integration-tests_net-istio_main	269379e	link	true	/test integration-tests
latest_net-istio_main	269379e	link	true	/test latest
latest-mesh_net-istio_main	269379e	link	true	/test latest-mesh
build-tests_net-istio_main	269379e	link	true	/test build-tests

Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[dprotaso]

Looks like you'll have to rebase