Run Istio E2E with the Kubernetes Agent backend

[nubtron]

What does this PR do?

Runs the Istio Kind E2E with the Kubernetes Agent backend introduced by #24639.

Both the sidecar and ambient modes are converted:

• The ztunnel_endpoint (ambient, port 15020) uses the in-cluster Service DNS endpoint, http://ztunnel-metrics.istio-system.svc.cluster.local:15020/stats/prometheus, backed by the ztunnel-metrics Service applied via istio/tests/kind/ztunnel_service.yaml.
• The waypoint_endpoint (ambient, port 15090) has no Service exposing its metrics port, so it falls back to the pod IP of the waypoint deployment, fetched via kubectl get pods -n default --selector app=waypoint.
• The istiod_endpoint (both modes, port 15014) has no Service exposing port 15014 (the istio install exposes 15010/15012/15017, not the metrics port), so it falls back to the pod IP of the istiod deployment, fetched via kubectl get pods -n istio-system --selector app=istiod.
• Pod IPs are resolved in the setup functions (after the readiness waits) and cached via save_state/get_state, since dd_environment re-runs in a fresh process after teardown.
• Removes the ExitStack/port_forward setup; the Agent runs in a pod inside the kind cluster (agent_type: kubernetes), eliminating the port-forward startup race.

Motivation

Reduces Kind E2E flakes caused by the Agent running outside the cluster with port forwarding, which introduces startup races (e.g. Connection refused to the forwarded endpoint, or got 0 candidates timing flakes when metrics are not ready). Istio had the highest genuine recurring flake count among the unconverted kind targets (5 test-level fails in the last 30 days, 5 of them flagged known_flaky), plus a 404 endpoint flake — all consistent with the port-forward/timing signature this conversion removes.

Follows the same pattern already applied to argo_workflows (#24827), fluxcd (#24829), and weaviate (#24830), plus the pod-IP fallback pattern from velero (#24645) for ports with no Service.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[cit-pr-commenter-54b7da]

evalya-impact-summary

evalya impact analysis

Impact analysis: 0 selected, 0 skipped (of 0 test tasks)
Publish tasks:   1 (always emitted)
Diff (1 file):
  istio/tests/conftest.py

Debug a specific task: evalya plan impact --path <path> --task <task>

Learn more about CI impact filtering

[dd-octo-sts]

Validation Report

Validation	Description	Status
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	❌

Run ddev validate all changed --fix to attempt to auto-fix supported validations.

Passed validations (20)

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run

[datadog-datadog-prod-us1-2]

   

⚠️ Warnings

🚦 7 Pipeline jobs failed

PR | test / test (linux, ubuntu-22.04, istio, Istio (py3.13-1.13-sidecar), py3.13-1.13-sidecar) / Istio (py3.13-1.13-sidecar)-py3.13-1.13-sidecar — 🔧 Needs a code fix, caused by this PR

View in Datadog · View in GitHub Actions

2 failed tests. AssertionError: Needed at least 1 candidates for 'istio.prometheus.health', got 0 in test_e2e_openmetrics_v1 and 'istio.openmetrics.health', got 0 in test_e2e_openmetrics_v2.

PR | test / test (linux, ubuntu-22.04, istio, Istio (py3.13-1.24-sidecar), py3.13-1.24-sidecar) / Istio (py3.13-1.24-sidecar)-py3.13-1.24-sidecar — 🔧 Needs a code fix, caused by this PR

View in Datadog · View in GitHub Actions

2 failed tests. AssertionError: Needed at least 1 candidates for 'istio.prometheus.health', got 0 and for 'istio.openmetrics.health', got 0.

PR | test / test (linux, ubuntu-22.04, istio, Istio (py3.13-1.29-sidecar), py3.13-1.29-sidecar) / Istio (py3.13-1.29-sidecar)-py3.13-1.29-sidecar — 🔧 Needs a code fix, caused by this PR

View in Datadog · View in GitHub Actions

2 failed tests: Needed at least 1 candidates for 'istio.prometheus.health', got 0 and 'istio.openmetrics.health', got 0 in tests/test_e2e.py.

View all 7 failed jobs.

📋 Copy prompt for your agent

CI on my pull request is failing. Help me find and fix the root cause of each failing job below — they were flagged as caused by changes in this PR, so focus on the diff. For each job, explain the failure and propose a fix.

Branch: nubtron/istio-kubernetes-agent-e2e

PR | test / test (linux, ubuntu-22.04, istio, Istio (py3.13-1.13-sidecar), py3.13-1.13-sidecar) / Istio (py3.13-1.13-sidecar)-py3.13-1.13-sidecar
Commit: 021610c6abf3ca1ccadffbd4ff620b02e806a588
Error (code / test):
2 failed tests. AssertionError: Needed at least 1 candidates for 'istio.prometheus.health', got 0 in test_e2e_openmetrics_v1 and 'istio.openmetrics.health', got 0 in test_e2e_openmetrics_v2.
CI job: https://github.com/DataDog/integrations-core/actions/runs/32128905342/job/95685584757

PR | test / test (linux, ubuntu-22.04, istio, Istio (py3.13-1.24-sidecar), py3.13-1.24-sidecar) / Istio (py3.13-1.24-sidecar)-py3.13-1.24-sidecar
Commit: 021610c6abf3ca1ccadffbd4ff620b02e806a588
Error (code / test):
2 failed tests. AssertionError: Needed at least 1 candidates for 'istio.prometheus.health', got 0 and for 'istio.openmetrics.health', got 0.
CI job: https://github.com/DataDog/integrations-core/actions/runs/32128905342/job/95685584664

PR | test / test (linux, ubuntu-22.04, istio, Istio (py3.13-1.29-sidecar), py3.13-1.29-sidecar) / Istio (py3.13-1.29-sidecar)-py3.13-1.29-sidecar
Commit: 021610c6abf3ca1ccadffbd4ff620b02e806a588
Error (code / test):
2 failed tests: Needed at least 1 candidates for 'istio.prometheus.health', got 0 and 'istio.openmetrics.health', got 0 in tests/test_e2e.py.
CI job: https://github.com/DataDog/integrations-core/actions/runs/32128905342/job/95685584686

🧪 2 Tests failed in 1 job

PR | run — ❌ 2 tests failed

View in GitHub Actions

❌ test_e2e_openmetrics_v1 from test_e2e.py  

Needed at least 1 candidates for 'istio.prometheus.health', got 0
Expected:
        ServiceCheckStub(check_id=None, name='istio.prometheus.health', status=0, tags=None, hostname=None, message=None)
Difference to closest:


Similar submitted:
Score   Most similar

↳ ❄️ test_e2e_openmetrics_v2 from test_e2e.py  

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 13.64%
• Overall Coverage: 75.83% (-12.70%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: ddf4b4b | Docs | View more details | Give us feedback!}