Validate IOP fields for DNS1123 compliance

[nmnellis]

Bug Description

Istio can get into a bad state and often default back to default values if any DNS1123 fields are set incorrectly. For example if trustDomain is not DNS1123 complaint istio fails to parse the rest of the spec and defaults the trustDomain back to cluster.local. The current set of errors is hard to decipher the root cause of the issue.

Based on the code, we believe that these fields are all required to be compliant if set.

• revision
• cluster name (name field for istioctl x create-remote-secret)
• port names (defined in various resources)
• global.meshConfig.trustDomain
• gateway name
• namespace
• name (general application)
• subset
• values.global.meshNetworks[network].endpoints[].fromRegistry
• service name

Version

Istio 1.12.1

Additional Information

No response

[hanxiaop]

@nmnellis I think it might be helpful if you could update the description to the task list format to track which has already been checked.

[nmnellis]

@nmnellis I think it might be helpful if you could update the description to the task list format to track which has already been checked.

updated, i think revision is the only one currently validated for DNS1123

[hanxiaop]

Things in meshConfig has already been validated.

I have created a PR to validate the remaining fields. However, I am not certain about what 'subset' means here. I think you mean the subset in DestinationRule, not the IOP resource?