@@ -175,7 +175,7 @@ spec:
               value: tempo
             - name: MINIO_SECRET_KEY
               value: supersecret
-          image: quay.io/minio/minio
+          image: ghcr.io/grafana/tempo-operator/test-utils:sha-0fc5ef0
           name: minio
           ports:
             - containerPort: 9000
 
@@ -194,6 +194,16 @@ func (e *extension) Reconcile(ctx context.Context, comp base.KComponent) error {
 		common.ConfigureIfUnset(&ks.Spec.CommonSpec, monitoring.ObservabilityCMName, monitoring.ObservabilityBackendKey, "none")
 	}
 
+	// Create the policies before the install stage applies resources that trigger
+	// the webhooks: otherwise the Service Mesh deny-all policy blocks the apiserver
+	// from reaching the webhook and the install deadlocks. Missing policies only;
+	// the manifest reconciliation owns their ongoing lifecycle.
+	for _, np := range istioWebhookNetworkPolicies(ks) {
+		if _, err := e.kubeclient.NetworkingV1().NetworkPolicies(np.Namespace).Create(ctx, np, metav1.CreateOptions{}); err != nil && !apierrors.IsAlreadyExists(err) {
+			return fmt.Errorf("failed to create NetworkPolicy %s/%s: %w", np.Namespace, np.Name, err)
+		}
+	}
+
 	if !oldResourceRemoved.Load() {
 		if err := e.cleanupOldResources(ctx, ks.GetNamespace()); err != nil {
 			return err
 
@@ -63,21 +63,24 @@ func defaultIngressClass(ks *operatorv1beta1.KnativeServing) string {
 	return kourierIngressClassName
 }
 
-func generateDefaultIstioNetworkPoliciesIfRequired(ks base.KComponent) ([]mf.Manifest, error) {
-	if !ks.(*operatorv1beta1.KnativeServing).Spec.Ingress.Istio.Enabled {
-		return nil, nil
+// istioWebhookNetworkPolicies builds the NetworkPolicies that keep the Knative
+// webhook and metrics endpoints reachable in a Service Mesh member namespace,
+// where the deny-all policy would otherwise block ingress (including apiserver
+// admission calls). Returns nil when not required (Istio ingress disabled or
+// opted out via annotation).
+func istioWebhookNetworkPolicies(ks *operatorv1beta1.KnativeServing) []*networkingv1.NetworkPolicy {
+	if !ks.Spec.Ingress.Istio.Enabled {
+		return nil
 	}
-
 	if v, ok := ks.GetAnnotations()[disableGeneratingIstioNetPoliciesAnnotation]; ok {
 		if disableGeneration, _ := strconv.ParseBool(v); disableGeneration {
-			return nil, nil
+			return nil
 		}
 	}
 
-	unObjs := []unstructured.Unstructured{{}, {}, {}}
-
-	for i, name := range []string{"webhook", "net-istio-webhook", "allow-from-openshift-monitoring-ns"} {
-		nwp := networkingv1.NetworkPolicy{
+	policies := make([]*networkingv1.NetworkPolicy, 0, 3)
+	for _, name := range []string{"webhook", "net-istio-webhook", "allow-from-openshift-monitoring-ns"} {
+		nwp := &networkingv1.NetworkPolicy{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      name,
 				Namespace: ks.GetNamespace(),
@@ -108,7 +111,20 @@ func generateDefaultIstioNetworkPoliciesIfRequired(ks base.KComponent) ([]mf.Man
 			}}
 		}
 
-		if err := scheme.Scheme.Convert(&nwp, &unObjs[i], nil); err != nil {
+		policies = append(policies, nwp)
+	}
+	return policies
+}
+
+func generateDefaultIstioNetworkPoliciesIfRequired(ks base.KComponent) ([]mf.Manifest, error) {
+	policies := istioWebhookNetworkPolicies(ks.(*operatorv1beta1.KnativeServing))
+	if len(policies) == 0 {
+		return nil, nil
+	}
+
+	unObjs := make([]unstructured.Unstructured, len(policies))
+	for i, p := range policies {
+		if err := scheme.Scheme.Convert(p, &unObjs[i], nil); err != nil {
 			return nil, err
 		}
 	}
 
@@ -1,11 +1,17 @@
 package serving
 
 import (
+	"context"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"knative.dev/operator/pkg/apis/operator/base"
 	operatorv1beta1 "knative.dev/operator/pkg/apis/operator/v1beta1"
+
+	configfake "github.com/openshift-knative/serverless-operator/pkg/client/config/injection/client/fake"
+	routefake "github.com/openshift-knative/serverless-operator/pkg/client/route/injection/client/fake"
+	kubefake "knative.dev/pkg/client/injection/kube/client/fake"
 )
 
 func TestDefaultIngressClass(t *testing.T) {
@@ -63,3 +69,65 @@ func TestDefaultIngressClass(t *testing.T) {
 		})
 	}
 }
+
+// TestReconcileEnsuresWebhookNetworkPolicy verifies that, with Istio ingress
+// enabled, Reconcile eagerly creates the "webhook" NetworkPolicy so the apiserver
+// can reach the validation webhook before the install stage triggers it -
+// without it, the Service Mesh deny-all policy deadlocks the install.
+func TestReconcileEnsuresWebhookNetworkPolicy(t *testing.T) {
+	ks := &operatorv1beta1.KnativeServing{
+		ObjectMeta: metav1.ObjectMeta{Namespace: servingNamespace.Name},
+		Spec: operatorv1beta1.KnativeServingSpec{
+			Ingress: &operatorv1beta1.IngressConfigs{
+				Istio: base.IstioIngressConfiguration{Enabled: true},
+			},
+		},
+	}
+
+	ctx, _ := routefake.With(context.Background())
+	ctx, _ = configfake.With(ctx, defaultIngress)
+	ctx, kube := kubefake.With(ctx, &servingNamespace)
+	ext := newFakeExtension(ctx, t)
+
+	if err := ext.Reconcile(ctx, ks); err != nil {
+		t.Fatalf("Reconcile() returned error: %v", err)
+	}
+
+	np, err := kube.NetworkingV1().NetworkPolicies(servingNamespace.Name).Get(context.Background(), "webhook", metav1.GetOptions{})
+	if err != nil {
+		t.Fatalf("expected 'webhook' NetworkPolicy to exist after Reconcile: %v", err)
+	}
+	if np.Spec.PodSelector.MatchLabels["app"] != "webhook" {
+		t.Errorf("expected podSelector app=webhook, got: %+v", np.Spec.PodSelector)
+	}
+	// Allow-all ingress is a single rule with no "from" peers.
+	if len(np.Spec.Ingress) != 1 || len(np.Spec.Ingress[0].From) != 0 {
+		t.Errorf("expected a single allow-all ingress rule, got: %+v", np.Spec.Ingress)
+	}
+}
+
+// TestReconcileSkipsWebhookNetworkPolicyWithoutIstio verifies that with Istio
+// ingress disabled (e.g. Kourier), Reconcile creates no istio NetworkPolicies.
+func TestReconcileSkipsWebhookNetworkPolicyWithoutIstio(t *testing.T) {
+	ks := &operatorv1beta1.KnativeServing{
+		ObjectMeta: metav1.ObjectMeta{Namespace: servingNamespace.Name},
+		Spec: operatorv1beta1.KnativeServingSpec{
+			Ingress: &operatorv1beta1.IngressConfigs{
+				Kourier: base.KourierIngressConfiguration{Enabled: true},
+			},
+		},
+	}
+
+	ctx, _ := routefake.With(context.Background())
+	ctx, _ = configfake.With(ctx, defaultIngress)
+	ctx, kube := kubefake.With(ctx, &servingNamespace)
+	ext := newFakeExtension(ctx, t)
+
+	if err := ext.Reconcile(ctx, ks); err != nil {
+		t.Fatalf("Reconcile() returned error: %v", err)
+	}
+
+	if _, err := kube.NetworkingV1().NetworkPolicies(servingNamespace.Name).Get(context.Background(), "webhook", metav1.GetOptions{}); err == nil {
+		t.Errorf("did not expect 'webhook' NetworkPolicy to be created when Istio ingress is disabled")
+	}
+}