Validations: Support exportTo field

[xeviknal]

As of today, kiali validations doesn't consider the exportTo field. This field allows users to specify the scope of each config.

This feature provides a mechanism for service owners and mesh administrators to control the visibility of services across namespace boundaries.

One example:

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-svc-https
  namespace: bookinfo
spec:
  hosts:
  - api.dropboxapi.com
  location: MESH_EXTERNAL
  ports:
  - number: 443
    name: https
    protocol: TLS
  resolution: DNS
  exportTo:
  - '.'
  - foo
  - bar

This service entry is only available for bookinfo, foo, bar namespaces only.

Validations has to be adapted to filter those config by the exportTo field. This might trigger thoughts of cross-namespace validations.

• Support exportTo validation in VirtualServices #4314
• Support exportTo validation in DestinationRules #4315
• Support exportTo validation in ServicesEntries #4316
• Support exportTo validation in Services (networking.istio.io/exportTo annotation) #4317

[xeviknal]

I am clarifying this issue.

The goal of this issue is to make sure that the validations are using the objects visible for that namespace. The model of visibility that the exportTo introduced made possible that objects that have visibility mesh-wide can only be visible in a very specific list of namespaces.

Using the ServiceEntry of the description. Any workload running within the bookinfo namespace can't call the api.dropboxapi.com because it is not exported.

Therefore, in the validations we shouldn't be managing entities that are not visible in that namespace.

[hhovsepy]

All epic subtasks are done.