istioctl deletes user namespaces if they are in ICP spec

[ostromart]

https://discuss.istio.io/t/bug-istioctl-deleting-other-namespace/4926

Hi All,

We are facing an issue that I believe might be a bug.

Description:
We are using KIali and we want it to pick data from Prometheus. But, We do not want to install prometheus via Istio. This is because we are already using Prometheus(deployed in a different namespace) and we want Kiali to use the same. To achieve this we added “prometheusNamespace” to values.global in Istiocontrolplane file. it looked something like below:

values: 
    prometheus:
      enabled: false
      replicaCount: 2
    kiali:
      enabled: true
    global:
      prometheusNamespace: testmonitoring

This worked fine. Kilali was picking up data. Later for some reason we removed the istio installation and installed it again. For removing we used the same istiocontrolplane file that we used in the first place to install. But while deletion istio deleted the “testmonitoring” namespace too. For the first time, since the namespace was already there, we did not realise, istion was trying to create it.

by using istio manifest generate we can see that istio is creating the namespace.

istioctl manifest generate -f istiocontrolplane.yaml
Relevant part of out put below:

apiVersion: v1
kind: Namespace
metadata:
  name: testmonitoring
  labels:
    istio-operator-managed: Reconcile
    istio-injection: disabled

We did not expect that. I further tested, by enabling prometheus in the istiocontrolplane file and replacing value of “prometheusNamespace” with a dummy values say “mynamespace”. So istio deployed prometheus in “istio-system” ns and created a blank names space “mynamespace”. This time I expected prometheus to to deployed in dummy namespace, but that did not happen.

In conclusion, if we use existing prometheus in a different namespace, while deletion Istio deletes that namespace with all its content. That is a disaster for us.

Please let me know if my understanding is wrong, or if I missed some documentation. Please rectify this, of let me know a better way to achieve my requirement.

[ostromart]

Duplicate of #20059.