[istio] Add interactive istioctl debug via d8 network istio

[skurbatov]

Summary

d8 network istio starts an interactive istioctl debug session: it applies the namespaced RBAC, pulls the platform debug image, and attaches to a one-shot pod — the same workflow operators previously ran by hand with d8 k.

Problem

• Debugging Istio required applying a ServiceAccount in the debug namespace plus a Role/RoleBinding in the target namespace (pods get/list, pods/portforward create), then d8 k run --rm -it with --overrides for the SA
• The debug image had to be read from ConfigMap d8-system/debug-container on every run
• The two namespaces, leftover pods, and --rm cleanup were easy to get wrong; none of this lived under d8 network

Fix

• New leaf command d8 network istio next to cni-migration
• Resolves the image from d8-system/debug-container (data.image) unless --image is set
• Idempotently creates ServiceAccount istioctl-debug in --namespace, and Role/RoleBinding istioctl-debug in --target-namespace (defaults to --namespace)
• Runs pod istioctl-debug (restartPolicy: Never, stdin/TTY, default command bash), waits until Running, attaches, deletes the pod on exit; RBAC is left in place for reuse
• Replaces a leftover pod of the same name; fails fast on ErrImagePull / ImagePullBackOff / CrashLoopBackOff
• Resets SIGINT/SIGTERM so the first Ctrl-C ends the attach session instead of being swallowed by the d8 root handler

Before / After

Before: apply three RBAC manifests, IMG="$(d8 k -n d8-system get cm debug-container -o jsonpath='{.data.image}')", then d8 k run istioctl-debug --rm -it --overrides=... -- bash.

After: d8 network istio -n <debug-namespace> --target-namespace <target-namespace> — same SA/Role/RoleBinding and the same debug pod, without the manual kubectl steps.

Tests

• TestEnsureRBACCreatesObjects — SA in the debug namespace, Role rules and RoleBinding subject/ref in the target namespace
• TestEnsureRBACIsIdempotentAndUpdatesRules — second apply restores Role rules if they were cleared
• TestResolveDebugImage — --image override, ConfigMap lookup, missing CM / empty image key
• TestBuildDebugPod — SA, automount token, Never restart, stdin/TTY
• TestCreateDebugPodReplacesLeftover — leftover pod is replaced
• TestWaitForPodRunning / TestWaitForPodRunningImagePullError — Running vs terminal wait reason
• TestNewCommandFlags — namespace, target-namespace, image, kubeconfig, context

Notes

Interactive attach is not covered by the fake clientset tests; end-to-end attach against a live cluster was not run in this environment.

[Glitchy-Sheep]

Reviewed the new d8 network istio command. 6 inline comments below: the first four are confirmed by mechanism (signal handling vs cleanup, one-shot mode, KUBECONFIG list, concurrent sessions), the last two depend on the cluster setup (RBAC scope for istioctl, image pull / PSS) and are worth checking on a real DKP cluster.

[Glitchy-Sheep]

Re-checked the second iteration against the branch head (70679bc): the signal/context handling, the one-shot mode removal, the $KUBECONFIG list handling, the per-run pod naming with terminal-only cleanup, and the d8-istio read-only RBAC all look good. The remaining two points (minimal RBAC set, no imagePullSecrets) are accepted as-is, consistent with how d8 kubectl debug uses the same image. Build, vet and tests pass locally, CI is green. LGTM.