Added Validations for WorkloadGroups, fixed issue with references.

[hhovsepy]

Describe the change

Added 2 new Validation Warning messages for Workload Groups:
"Warning KIA1701 Service Account not found in this namespace".
"Warning KIA1702 More than one Workload Group with duplicate labels found in the same namespace"
Kiali does not list ServiceAccounts directly from the system but is listing them from the Pods.
That is why the notification severity is Warning not a Error.

Steps to test the PR

Create a WorkloadGroup with non existing Service Account, or with Service Account from other namespace, and with labels which exist in another WG in the same namespace.

apiVersion: networking.istio.io/v1
kind: WorkloadGroup
metadata:
  name: ratings-vm
  namespace: bookinfo
spec:
  metadata:
    labels:
      app: ratings-vm
  template:
    serviceAccount: bookinfo-ratings
---
apiVersion: networking.istio.io/v1
kind: WorkloadEntry
metadata:
  name: ratings-vm
spec:
  address: 2.2.2.2
  labels:
    class: vm
    app: ratings-vm
    version: v3
  serviceAccount: bookinfo-ratings
  network: vm-us-east
---
apiVersion: networking.istio.io/v1
kind: WorkloadGroup
metadata:
  name: ratings-vm2
  namespace: bookinfo
spec:
  metadata:
    labels:
      app: ratings-vm
  template:
    serviceAccount: wrong
---
apiVersion: networking.istio.io/v1
kind: WorkloadEntry
metadata:
  name: ratings-vm2
  namespace: bookinfo
spec:
  address: 2.2.2.2
  labels:
    class: vm2
    app: ratings-vm2
    version: v4
  serviceAccount: bookinfo-ratings
  network: vm-us-east
---
apiVersion: networking.istio.io/v1
kind: WorkloadGroup
metadata:
  name: ratings-vm-no-entry
  namespace: bookinfo
spec:
  template:
    serviceAccount: bookinfo-ratings

Automation testing

Added unit tests.

Issue reference

#8058
Docs: kiali/kiali.io#853

[ferhoyos]

Nice job @hhovsepy, a pair of validations well tested with multiple scenarios. I have been playing a bit with the WorkloadGroup definitions and the validations seem to work as expected 🙂.

I think there is a small mismatch in the workload entry CR.

Not related to this PR, I have a pair of suggestions about Workload Group support in Kiali:

• It is a bit confusing that all Workload Groups status are Not Ready because they don't have pods. I assume that we are limited and we cannot know if they are ready, but I think it is better to show an Unknown status instead of Not Ready.

The same in the Workload group details page:

• Since only the overview tab of a Workload Group shows any information, maybe it would be better to hide the rest of the tabs and just show the overview one. Another option is to show a message in all the tabs that the feature is not available in workload groups (like we already do for logs):

[ferhoyos]

Thanks Hayk for the clarifications, now the PR is ready to be merged.

[hhovsepy]

@ferhoyos added missing comments, hiding the rest of unsupported tabs in WorkloadGroups, also in the test steps added the WorkloadEntries, so the status is not "Not Ready":

[hhovsepy]

@ferhoyos tabs will be hidden in App details page as well:

[ferhoyos]

Thanks, Hayk, for the changes! Now it looks much better.

The issue I see is that the application details page doesn’t explain why the information is limited (e.g., there is no workload group badge anywhere). Additionally, there is no application type like in the workloads, which makes the message somewhat confusing.

My two cents:

• Change the message to something like: "Kiali provides limited information about this application because it contains a non-Kubernetes workload."
• Add the WG or a similar badge to the workload to indicate which one is non-Kubernetes.

[hhovsepy]

Thanks @ferhoyos, changed the message, but the 'W' badge is remained used since we don't display 'WG' or other workload types anywhere.

[ferhoyos]

I didn't mean to substitue the Workload icon by the Workload group one, just adding an icon to the right indicating that it is a workload group or another icon that indicates that it is an unsupported workload.

Anyway, reading the new message it is quite clear that the limited information provided is due to the workload type. Approving the PR.