[Multicluster] provide links to external Kialis without requiring istio secrets

[nrfox]

Today Kialis in "single cluster" mode require secrets to create links to external kialis. This is effectively putting the Kiali instance in "multi cluster" mode. There needs to be a way to for Kiali to generate links to external Kialis without requiring access to external clusters. This can be a simple as adding a config value that Kiali would use to generate these links. Something like externalKialis: {"name": ..., "url": ...}.

[jshaughn]

That seems reasonable. Did the former secrets do anything for us other than establish the link? Users would still have to log into the remote Kiali, etc, right?

[jmazzitelli]

Did the former secrets do anything for us other than establish the link?

AFAIK, that's all the old secrets did for us. It told us the name of the remote cluster and helped us determine the remote kiali URL.

[jshaughn]

So how would we handle the situation that someone was already using the experimental feature and has secrets already, but isn't trying to set up our new MC ability? Just documentation/release notes to delete the secrets and optionally add this proposed config?

[jmazzitelli]

They still need the istio secrets - those are required for istio MC to work. They just need the kiali secrets so kiali can work.

[nrfox]

This isn't working like I would expect. I want to use this feature for Kiali to show multiple clusters on the "mesh" page without giving access to those clusters. My kiali config in the "east" cluster looks like:

kiali_feature_flags:
  clustering:
    kiali_urls:
      - cluster_name: west
        instance_name: kiali
        namespace: istio-system
        url: kiali-west.io

but still I just see "east"

[jmazzitelli]

I didn't look at any of this but... url: kiali-west.io --- with the name of that config setting as "url" I would expect it to be a URL -- protocol included... http://kiali-west.io -- if this is just a hostname, then we should not be calling this "url".

[hhovsepy]

The url param here expects a protocol as well.

[hhovsepy]

@nrfox right, this feature was implemented partly, I saw your PR, so assigning this to you, thank you.