We need Istio 1.30 for proper hostuser: false support and afterwards PSS restricted for the CI

[juliusvonkohout]

Validation Checklist

• I confirm that this is a Kubeflow-related issue.
• I am reporting this in the appropriate repository.
• I have followed the Kubeflow installation guidelines.
• The issue report is detailed and includes version numbers where applicable.
• I have considered adding my company to the adopters page to support Kubeflow and help the community, since I expect help from the community for my issue (see 1. and 2.).
• This issue pertains to Kubeflow development.
• I am available to work on this issue.
• You can join the CNCF Slack and access our meetings at the Kubeflow Community website. Our channel on the CNCF Slack is here #kubeflow-platform.

Version

master

Detailed Description

See istio/istio#60005
@Raakshass YOu can get help from @danish9039 and it should unblock #3444

Steps to Reproduce

Enable hostusers: false on pods with Istio sidecars

Screenshots or Videos (Optional)

No response

[Raakshass]

the upstream fix istio/istio#60005 (cherry-pick of #59448) was merged into the release-1.30 branch on april 27. the container network interface user namespace support is confirmed in the branch.

the latest istio 1.30 tag is 1.30.0-rc.0. once the stable 1.30.0 release ships, i will update the istio manifests in common/istio/ from 1.29.2 to 1.30.0 and validate that pods with hostUsers: false work correctly alongside istio sidecars in a kind cluster.

coordinating with @danish9039 on slack to divide the work. this should unblock #3444 afterwards.

[juliusvonkohout]

1.30.0 is fine. You can try already https://github.com/istio/istio/releases/tag/1.30.0-rc.0

[Raakshass]

acknowledged, starting with 1.30.0-rc.0 now. will update the sync script, regenerate the manifests, and open a pull request once kind validation passes.

[juliusvonkohout]

1.30 is there