Istio traffic routing incompatible with virtual services containing a period

[kloppmannj]

Checklist:

• I've included steps to reproduce the bug.
• I've included the version of argo rollouts.

Describe the bug

Documentation states that Istio Traffic Management supports leveraging a virtual service defined in a different namespace, however this fails if the virtual service name contains a .

| If the VirtualService is defined in a different namespace than the rollout, its name should be rollout-vsvc.

If not using a different namespace, a virtual service with a period in its name will be assumed to be using a different namespace.

While regular services cannot contain a ., I believe virtual services only need to conform to DNS-1123 subdomain validation which does allow periods.

To Reproduce

These steps were use to reproduce the issue in v1.9.0. It also reproduces in older versions. I do not believe this is a regression, but a long standing limitation.

Kubectl apply the following example manifest:

apiVersion: v1
kind: Namespace
metadata:
  name: example
---
apiVersion: v1
kind: Namespace
metadata:
  name: istio
---
apiVersion: v1
kind: Service
metadata:
  name: example-canary
  namespace: example
spec:
  type: ClusterIP
  selector:
    app: webservice
  ports:
    - name: http
      port: 80
      targetPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: example-stable
  namespace: example
spec:
  type: ClusterIP
  selector:
    app: webservice
  ports:
    - name: http
      port: 80
      targetPort: 80
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: virtualservice.example
  namespace: istio
spec:
  hosts:
    - webservice.example.svc.cluster.local
  gateways:
    - mesh
  http:
    - name: primary
      route:
        - destination:
            host: example-stable.example.svc.cluster.local
            port:
              number: 80
          weight: 100
        - destination:
            host: example-canary.example.svc.cluster.local
            port:
              number: 80
          weight: 0
---
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: webservice
  namespace: example
spec:
  replicas: 1
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: webservice
  template:
    metadata:
      labels:
        app: webservice
    spec:
      containers:
        - name: webservice
          image: nginx:1.27
          ports:
            - containerPort: 80
  strategy:
    canary:
      canaryService: example-canary
      stableService: example-stable
      trafficRouting:
        istio:
          virtualService:
            name: virtualservice.example.istio
            routes:
              - primary
      steps:
        - setWeight: 1
        - pause:
            duration: 10m

The above setup will do the following:

• create namespace example
• create namespace istio
• create cluster ip service example-canary within example
• create cluster ip service example-stable within example
• create virtual service virtualservice.example within istio
• create rollout webservice within example

The rollout object attempts to leverage canary and istio traffic routing using the virtual service from the istio namespace:

      trafficRouting:
        istio:
          virtualService:
            name: virtualservice.example.istio

However due to the current logic, the controller parses this as:

virtual service name      = virtualservice
virtual service namespace = example

Current logic coming from here.

Which results in the following error:

Name:            webservice
Namespace:       example
Status:          ✖ Degraded
Message:         InvalidSpec: The Rollout "webservice" is invalid: spec.strategy.canary.trafficRouting.istio.virtualService.name: Invalid value: "virtualservice": virtualservices.networking.istio.io "virtualservice" not found

Expected behavior

Rollouts controller is able to successfully manage virtual services in separate namespaces, as long as they are named appropriately according to Istio and Kubernetes.

Screenshots

N/A

Version

v1.9.0

Logs

time="2026-04-27T23:05:51Z" level=info msg="Event(v1.ObjectReference{Kind:\"Rollout\", Namespace:\"example\", Name:\"webservice\", UID:\"30552d94-4aba-4d0c-98c4-cd5c98e88b81\", APIVersion:\"argoproj.io/v1alpha1\", ResourceVersion:\"1368\", FieldPath:\"\"}): type: 'Normal' reason: 'RolloutAddedToInformer' Rollout resource added to informer: example/webservice"
time="2026-04-27T23:05:51Z" level=info msg="Rollout resource added to informer: example/webservice" event_reason=RolloutAddedToInformer namespace=example rollout=webservice
time="2026-04-27T23:05:51Z" level=info msg="Istio detected"
time="2026-04-27T23:05:51Z" level=info msg="Starting istio workers"
time="2026-04-27T23:05:51Z" level=info msg="Istio workers (10) started"
time="2026-04-27T23:05:51Z" level=info msg="Started syncing rollout" generation=1 namespace=example resourceVersion=1368 rollout=webservice
time="2026-04-27T23:05:51Z" level=error msg="The Rollout \"webservice\" is invalid: spec.strategy.canary.trafficRouting.istio.virtualService.name: Invalid value: \"virtualservice\": virtualservices.networking.istio.io \"virtualservice\" not found" namespace=example rollout=webservice
time="2026-04-27T23:05:51Z" level=error msg="newRolloutContext returned nil" generation=1 namespace=example resourceVersion=1368 rollout=webservice
time="2026-04-27T23:05:51Z" level=info msg="Reconciliation completed" generation=1 namespace=example resourceVersion=1368 rollout=webservice time_ms=115.25680000000001
time="2026-04-27T23:05:51Z" level=error msg="rollout syncHandler error: spec.strategy.canary.trafficRouting.istio.virtualService.name: Invalid value: \"virtualservice\": virtualservices.networking.istio.io \"virtualservice\" not found" namespace=example rollout=webservice
time="2026-04-27T23:05:51Z" level=info msg="rollout syncHandler queue retries: 2 : key \"example/webservice\"" namespace=example rollout=webservice
time="2026-04-27T23:05:51Z" level=error msg="Unhandled Error" error="spec.strategy.canary.trafficRouting.istio.virtualService.name: Invalid value: \"virtualservice\": virtualservices.networking.istio.io \"virtualservice\" not found" logger=UnhandledError

---

Message from the maintainers:

Impacted by this bug? Give it a 👍. We prioritize the issues with the most 👍.

[kloppmannj]

I'm new here but this would seem like a fairly straightforward contribution.

Something along the lines of:

func GetVirtualServiceNamespaceName(vsv string) (string, string) {
	namespace := ""
	name := ""

	// Strip the well-known cluster.local DNS suffix before parsing name/namespace.
	vsv = strings.TrimSuffix(vsv, ".cluster.local")

	fields := strings.Split(vsv, ".")
	if len(fields) >= 2 {
		// namespaces cannot contain a .
		// Everything prior to the last segment is the virtual service name
		// The last segment is the namespace
		name = strings.Join(fields[:len(fields)-1], ".")
		namespace = fields[len(fields)-1]
	} else if len(fields) == 1 {
		name = fields[0]
	}

	return namespace, name
}

This would unblock the usage of virtual services that contain a .

However even if the virtual service contained a . but existed in the same namespace, the user would still need to append the namespace.