istiod-default-validator missing if use operator installed istio

[kebe7jun]

Bug Description

The operator and istioctl do not have the same behavior for processing validatingwebhookconfigurations during installation

These logics missing in opetator logic:

istio/operator/cmd/mesh/install.go

Lines 204 to 225 in c919dbe

	if !operatorManageWebhooks && (!exists || isDefaultInstallation) {
	p.Println("Making this installation the default for injection and validation.")
	if rev == "" {
	rev = revtag.DefaultRevisionName
	}
	autoInjectNamespaces := validateEnableNamespacesByDefault(iop)
	o := &revtag.GenerateOptions{
	Tag: revtag.DefaultRevisionName,
	Revision: rev,
	Overwrite: true,
	AutoInjectNamespaces: autoInjectNamespaces,
	}
	// If tag cannot be created could be remote cluster install, don't fail out.
	tagManifests, err := revtag.Generate(context.Background(), kubeClient, o, ns)
	if err == nil {
	err = revtag.Create(kubeClient, tagManifests)
	if err != nil {
	return err
	}
	}
	}

Version

master

Additional Information

No response

Affected product area

• Ambient
• Docs
• Installation
• Networking
• Performance and Scalability
• Extensions and Telemetry
• Security
• Test and Release
• User Experience
• Developer Infrastructure
• Upgrade
• Multi Cluster
• Virtual Machine
• Control Plane Revisions

Is this the right place to submit this?

• This is not a security vulnerability
• This is not a question about how to use Istio

[kebe7jun]

This causes the creation of the Istio resource validation fail, except force the istio.io/rev to default.