Operator ignores namespace field in structured local-gateways config (service is always created in istio-system)

[miquelcv]

Describe the bug
When configuring Knative Serving with the structured format for local-gateways (the recommended approach), the operator ignores the namespace field and tries to create the knative-local-gateway service in the istio-system namespace by default, instead of the namespace specified (eg. aks-istio-ingress). Only the legacy local-gateway.* key works as expected. This results in errors like:

failed to apply non rbac manifest: namespaces "istio-system" not found

If the istio-system namespace is manually created, the service appears in the wrong namespace, not the user-specified one in local-gateways.

Expected behavior
The operator should respect the namespace value in the structured array local-gateways in the istio config and create the service in that namespace. The legacy and structured config should produce the same behavior.

To Reproduce

1. Deploy a KnativeServing with this config:

   apiVersion: operator.knative.dev/v1beta1
   kind: KnativeServing
   metadata:
     name: knative-serving
     namespace: knative-serving
   spec:
     ingress:
       istio:
         enabled: true
         knative-local-gateway:
           selector:
             app: aks-istio-ingressgateway-internal
     config:
       istio:
         local-gateways: |
           - name: knative-local-gateway
             namespace: knative-serving
             service: knative-local-gateway.aks-istio-ingress.svc.cluster.local

2. Observe the event: failed to apply non rbac manifest: namespaces "istio-system" not found
3. Creating the istio-system namespace causes the service to be created there (not in aks-istio-ingress).

Knative release version
v1.19

Additional context

• It appears to be caused by the operator's UpdateNamespace function (pkg/reconciler/knativeserving/ingress/ingress_service.go), which only checks for the legacy key to set the namespace and ignores the array format.
• This breaks on platforms like AKS with Istio add-on, where gateways are deployed in their own namespaces (eg. aks-istio-ingress).
• Using the legacy configuration: local-gateway.knative-serving.knative-local-gateway: knative-local-gateway.aks-istio-ingress.svc.cluster.local the knative-local-gateway service gets created in aks-istio-ingress namespace as expected.

[DCchoudhury15]

Hi! I would like to work on this issue.
I can take a look at the logic in pkg/reconciler/knativeserving/ingress/ingress_service.go to ensure the structured local-gateways config respects the namespace field as described.
Could you please assign this to me?

[miquelcv]

Thanks for the fix.
I’ve tested it on our AKS setup and everything is working correctly now.
Appreciate your work on this @DCchoudhury15