feat(kiali): Update Kiali url

[josunect]

Updates OpenShift Kiali local setup so MCP evals can talk to the cluster Route without changing the tracked config.

write-kiali-mcp-config-openshift

• Reads the Kiali OpenShift Route
• Probes /api vs /kiali/api to pick the correct base URL (Sail often has no /kiali prefix)
• Writes an untracked drop-in: dev/config/mcp-configs/zz-kiali-openshift.toml
• That file overrides tracked kiali.toml (localhost:20001) via lexical merge under --config-dir

fix-istiod-validating-webhook

• Creates a Service alias istiod → revisioned istiod-default-v*
• Syncs the istiod-default-validator CA bundle
• Unblocks creating VirtualServices/DestinationRules on Sail (avoids service "istiod" not found / x509 errors)

setup-kiali-openshift

• Runs webhook fix before Bookinfo
• Writes the Kiali MCP overlay after health validation

Summary by CodeRabbit

• New Features
  • Added automatic generation of OpenShift-specific Kiali connection configuration.
  • OpenShift setup now discovers the Kiali route and determines the correct API base path for access.
  • OpenShift setup now installs and validates Bookinfo automatically.
• Bug Fixes
  • Improved Istio webhook compatibility by ensuring the expected validating webhook service alias exists and synchronizing the certificate/CA settings.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: josunect
Once this PR has been reviewed and has the lgtm label, please assign cali0707 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @josunect. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 185efd5c-e073-4e2c-ab19-f3ad3ebacefb

📥 Commits

Reviewing files that changed from the base of the PR and between 677b5ef and 2e71481.

📒 Files selected for processing (1)

• build/openshift/kiali.mk

🚧 Files skipped from review as they are similar to previous changes (1)

• build/openshift/kiali.mk

---

📝 Walkthrough

Walkthrough

OpenShift Kiali setup now repairs the Istio validating webhook, validates Bookinfo through Kiali, discovers the Kiali Route endpoint, and writes an OpenShift-specific MCP configuration overlay.

Changes

OpenShift Kiali setup

Layer / File(s)	Summary
Istio webhook service repair build/openshift/kiali.mk	Adds a target that aliases the revisioned Istio service and updates the validator webhook service name and CA bundle.
Kiali MCP overlay generation build/openshift/kiali.mk	Adds the OpenShift MCP overlay path and a target that discovers Kiali endpoints, optionally obtains a token, probes API paths, and writes the selected URL with insecure = true.
Kiali setup orchestration build/openshift/kiali.mk	Updates setup ordering to repair Istio, install and validate Bookinfo, generate the MCP overlay, and list routes.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant setup-kiali-openshift
  participant Kubernetes
  participant Kiali
  participant MCPConfig
  setup-kiali-openshift->>Kubernetes: repair Istio validating webhook
  setup-kiali-openshift->>Kubernetes: install Bookinfo
  setup-kiali-openshift->>Kiali: validate Bookinfo health
  setup-kiali-openshift->>Kiali: discover Route and probe API paths
  Kiali-->>setup-kiali-openshift: return working endpoint
  setup-kiali-openshift->>MCPConfig: write OpenShift Kiali overlay

Loading

Suggested labels: needs-ok-to-test

Suggested reviewers: manusa, dlom, bentito, cali0707

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: determining and updating the Kiali URL for the OpenShift setup.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

build/openshift/kiali.mk (1)

199-201: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Cloned Service carries over source annotations/labels, not just the deleted fields.

The jq del(...) only strips resourceVersion, uid, creationTimestamp, managedFields, ownerReferences, status, and the ClusterIP fields. Any other metadata.annotations (e.g. Helm's meta.helm.sh/release-name/release-namespace) and all of metadata.labels from istiod-default-v* are copied verbatim onto the new istiod Service. Since .spec.selector (untouched by this cleanup) is what actually determines which pods the alias targets, metadata.labels isn't needed for correctness — but carrying stale Helm-release annotations onto a manually created "istiod" Service can confuse future reconciliation/ownership checks by the Sail/Istio operator against a resource it doesn't actually manage.

♻️ Suggested cleanup

-	  jq 'del(.metadata.resourceVersion,.metadata.uid,.metadata.creationTimestamp,.metadata.managedFields,.metadata.ownerReferences,.status,.spec.clusterIP,.spec.clusterIPs) | .metadata.name="istiod" | .metadata.annotations["mcp.local/alias-for"]=$$rev' --arg rev "$$rev_svc" | \
+	  jq 'del(.metadata.resourceVersion,.metadata.uid,.metadata.creationTimestamp,.metadata.managedFields,.metadata.ownerReferences,.metadata.labels,.metadata.annotations,.status,.spec.clusterIP,.spec.clusterIPs) | .metadata.name="istiod" | .metadata.annotations={"mcp.local/alias-for":$$rev}' --arg rev "$$rev_svc" | \

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@build/openshift/kiali.mk` around lines 199 - 201, Update the jq cleanup in
the Service clone pipeline to remove the source metadata.annotations and
metadata.labels before setting the new name and alias annotation. Preserve the
existing field deletions, selector, and apply behavior, while retaining only the
newly assigned mcp.local/alias-for annotation.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@build/openshift/kiali.mk`:
- Line 153: Update the probe commands around kiali_token and the curl
invocations to avoid placing the bearer token in command-line arguments. Write
the Authorization header to a short-lived, restrictive-permission temporary
file, pass it to curl through a supported configuration or header-file
mechanism, and remove the file after all probes complete, including failure
paths.
- Around line 158-171: Make the base URL selection in the probe logic explicit
by replacing the two independent case statements with an ordered conditional
that documents and enforces the intended priority between base_kiali and
base_root when both probes succeed. Preserve the existing fallback to base_root
when neither probe responds successfully, and keep the HTTP status matching
behavior unchanged.

---

Nitpick comments:
In `@build/openshift/kiali.mk`:
- Around line 199-201: Update the jq cleanup in the Service clone pipeline to
remove the source metadata.annotations and metadata.labels before setting the
new name and alias annotation. Preserve the existing field deletions, selector,
and apply behavior, while retaining only the newly assigned mcp.local/alias-for
annotation.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 54d790fd-6b00-40a8-bde1-b1de463697d5

📥 Commits

Reviewing files that changed from the base of the PR and between a0a1c37 and 677b5ef.

📒 Files selected for processing (1)

• build/openshift/kiali.mk