Kiali: Cannot inject a fault to a service which is served by a pod with no version: label

[DickChesterwood]

Describe the bug

Hope I'm not doing something daft here ;-)

Up to and including v23.0, it was fine to "suspend traffic" on a service that was selecting a pod with no version: label.

From v24.0 onwards, with the new "inject fault" option, the following error is given:

"admission webhook "validation.istio.io" denied the request: configuration is invalid: HTTP route or redirect is required"

A DestinationRule is created, but no corresponding VirtualService, and hence no fault is observed. It is necessary to "actions -> delete traffic routing" before trying again, presumably due to the DR getting in the way.

I know that version labels are recommended, I didn't think they were required in order to inject faults etc.

If the version label is absolutely needed, perhaps the error message could reflect this?

Versions used
Kiali: 1.24-1.27
Istio: 1.8
Kubernetes flavour and version: minikube 1.19

To Reproduce
Try to inject a fault into a service which is selecting a single pod which is missing the :version label.

(Note that just a DestinationRule is created).

Expected behavior

Either the fault injection should work as in version 1.23 (with the "suspend traffic") option, or the error should be something like "version labels are mandatory when traffic routing". If the latter then the DestinationRule shouldn't be left behind.

[lucasponce]

@DickChesterwood your comment is right, it seems it needs the "version" label up in the workload to enable this one.

I'll take a look to see if we can easily workaround it and if it may have implications in other use cases.

[lucasponce]

Either the fault injection should work as in version 1.23 (with the "suspend traffic") option, or the error should be something like "version labels are mandatory when traffic routing". If the latter then the DestinationRule shouldn't be left behind.

+1

[lucasponce]

Perhaps when a service is backed with a single workload, the version can be skipped from the Kiali Wizard perspective, but when whtere are more than 1 workload I guess it needs to fail or inform to use the "version" label, otherwise traffic shifting would need custom selectors which are not supported for the moment.

[DickChesterwood]

Thanks for this! Is a version relevant if you're just doing a fault injection, delay or timeout?

[lucasponce]

Thanks for this! Is a version relevant if you're just doing a fault injection, delay or timeout?

Not from Istio perspective, for Kiali Wizard that label helped to build the information required to build the VS/DR objects in Request Routing and Traffic Shifting scenarios, and that was reused in Fault Injection and others.

I'll investigate as probably I may find more cornercases that are working as expected.

Thanks for reporting this issue !