In Istio ambient mode, the CNI plugin already skips pods whose namespace appears in the install `excludeNamespaces` config, but the CNI node agent still reconciles those pods into the mesh when the namespace or pod is ambient-labeled. That leaves behavior inconsistent: excluded namespaces can still get new enrollments, and pods already enrolled in an excluded namespace stay enrolled.
Make the CNI agent honor `excludeNamespaces` the same way the plugin does:
1. Do not enroll pods in an excluded namespace, even if the namespace and/or pod are labeled for ambient.
2. If a pod in an excluded namespace is already enrolled, remove it from the mesh.
3. Deleting a previously enrolled pod in an excluded namespace must still perform cleanup.
4. Pods in non-excluded namespaces must continue to enroll normally when ambient-enabled.
5. Parsing the comma-separated `excludeNamespaces` value must ignore empty/whitespace-only entries (an empty config must not behave like a list containing "").
Unit-test the enrollment/unenrollment edge cases above.
Interface contract — the change must expose exactly this surface:
cni/pkg/util: SplitExcludeNamespaces(s string) []string — split comma-separated namespaces, trim spaces, drop empty entries.
Work only inside this repository checkout. Make the code change the task
describes, keeping the diff focused — no drive-by refactors.
When you are done, leave your changes committed or in the working tree;
they are collected automatically.
Stay on this snapshot checkout (`task/ycb_istio_c0577d34dff60`). Never checkout, pull, or rebase onto `main`. That branch is a README-only orphan.
Stay on this HEAD. Do not fetch another default branch. Push only on the Cursor-created `crazy-cursor/…` side branch from this HEAD.
Some past runs of this task were launched with a different prompt (the prompt template changed since, or those runs predate this benchmark's stored prompt). Each run persists the exact prompt it sent at launch — that per-launch record is the audit trail; this page shows only the current one.
Reference diff
The task commit's diff against its first parent — the judge's comparison target.