Add `kyma alpha diagnose istio` subcommand (programmatic `istioctl analyze`)

[kwiatekus]

Description
Introduce a new subcommand kyma alpha diagnose istio that runs Istio configuration diagnostics (equivalent to istioctl analyze) using the Istio Go analysis pkg and outputs findings (warnings/errors) to stdout (human or JSON/YAML) or an optional file, enabling CI and deeper Day‑2 troubleshooting.

Reason
It takes too much time to gather all the information from the target cluster in order to detect misconfigurations. The cluster user or the support engineer would need to install istioctl separately. Embedding it's capabilities in kyma alpha diagnose would :

• Reduces tooling friction (single CLI).
• Allows structured machine‑/human-readable output for CI gates and support tickets.

Ideas (to refine)

kyma alpha diagnose istio [flags]

Flags

• --namespace/-n <ns>: Limit analysis to a namespace (default: all).
• --all-namespaces/-A: Explicitly analyze all namespaces (mutually exclusive with --namespace).
• --format: Output format (possible values: json, yaml)
• --output: Path to the diagnostic output file. If not provided the output is printed to stdout
• --verbose: Display verbose output, including error details during diagnostics collection
• --timeout : Timeout for analysis

Please be thoughtful of the final binary size when including istio analyse package

Acceptance Criteria

• Running without flags analyses all namespaces and returns warnings/errors similar to istioctl analyze.
• JSON/YAML format modes produce valid content for for jq/yq parsing.
• Command completes under default timeout value
• Match dependency versions with the istio version

Attachments
https://istio.io/latest/docs/ops/diagnostic-tools/istioctl-analyze/
https://github.com/istio/istio/tree/master/pkg/config/analysis

[musztardem]

alpha diagnose istio QA Report

1. Kyma CLI Version

$ ./bin/kyma version
Kyma-CLI Version: local-a126f08f

---

2. --help Flag

$ ./bin/kyma alpha diagnose istio --help
Use this command to quickly assess potential Istio configuration issues in your cluster for troubleshooting and support purposes.

Usage:
  kyma alpha diagnose istio [flags]

Examples:
  # Analyze Istio configuration across all namespaces
  kyma alpha diagnose istio
  # or
  kyma alpha diagnose istio --all-namespaces

  # Analyze Istio configuration in a specific namespace
  kyma alpha diagnose istio --namespace my-namespace

  # Print only warnings and errors
  kyma alpha diagnose istio --level warning

  # Output as JSON to a file
  kyma alpha diagnose istio --format json --output istio-diagnostics.json

Flags:
  -A, --all-namespaces     Analyzes all namespaces
  -f, --format string      Output format (possible values: json, yaml)
      --level string       Output message level (possible values: info, warning, error) (default "warning")
  -n, --namespace string   The namespace that the workload instances belongs to
  -o, --output string      Path to the diagnostic output file. If not provided the output is printed to stdout
      --timeout duration   Timeout for diagnosis (default 30s)
      --verbose            Displays verbose output, including error details during diagnostics collection

Global Flags:
      --context string          The name of the kubeconfig context to use
  -h, --help                    Help for the command
      --kubeconfig string       Path to the Kyma kubeconfig file
      --show-extensions-error   Prints a possible error when fetching extensions fails
      --skip-extensions         Skip fetching extensions from the target Kyma environment

Result: ✅ OK

---

3. Not Dependent on istioctl

3.1. istioctl Installed

$ istioctl --help
Istio configuration command line utility for service operators to
debug and diagnose their Istio mesh.
(...omitted as not relevant; istioctl is installed)

$ ./bin/kyma alpha diagnose istio
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq is missing
      the Istio proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq
(...)

Result: ✅ OK

3.2. istioctl Not Installed

$ istioctl
zsh: command not found: istioctl

$ ./bin/kyma alpha diagnose istio
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq is missing
      the Istio proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq
(...)

Result: ✅ OK

---

4. --all-namespaces Flag

4.1. Includes All Namespaces

$ ./bin/kyma alpha diagnose istio --all-namespaces --level info
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq is missing
      the Istio proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq  # kyma-system
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/nats-manager-645b99648f-m7n7w is missing the Istio
      proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/nats-manager-645b99648f-m7n7w  # kyma-system
- code: IST0102
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0102/
  level: Info
  message: The namespace is not enabled for Istio injection. Run 'kubectl label namespace
      antek-system istio-injection=enabled' to enable it, or 'kubectl label namespace
      antek-system istio-injection=disabled' to explicitly mark it as not needing injection.
  origin: Namespace antek-system  # antek-system
- code: IST0102
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0102/
  level: Info
  message: The namespace is not enabled for Istio injection. Run 'kubectl label namespace
      antek2-system istio-injection=enabled' to enable it, or 'kubectl label namespace
      antek2-system istio-injection=disabled' to explicitly mark it as not needing injection.
  origin: Namespace antek2-system  # antek2-system
- code: IST0102
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0102/
  level: Info
  message: The namespace is not enabled for Istio injection. Run 'kubectl label namespace
      antek3-system istio-injection=enabled' to enable it, or 'kubectl label namespace
      antek3-system istio-injection=disabled' to explicitly mark it as not needing injection.
  origin: Namespace antek3-system  # antek3-system
- code: IST0102
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0102/
  level: Info
  message: The namespace is not enabled for Istio injection. Run 'kubectl label namespace
      default istio-injection=enabled' to enable it, or 'kubectl label namespace default
      istio-injection=disabled' to explicitly mark it as not needing injection.
  origin: Namespace default  # default

Result: ✅ OK

4.2. Returns Same Output With or Without Flag

$ ./bin/kyma alpha diagnose istio > an1
$ ./bin/kyma alpha diagnose istio --all-namespaces > an2

$ sha256sum an1
a9bb59ec0543b57616b6390954299680f09f0740a97fac27b94fd4fd4ac39db7  an1

$ sha256sum an2
a9bb59ec0543b57616b6390954299680f09f0740a97fac27b94fd4fd4ac39db7  an2

Result: ✅ OK

---

5. --namespace Flag

5.1. Returns Result for Single Namespace

$ ./bin/kyma alpha diagnose istio --namespace kyma-system
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq is missing
      the Istio proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/nats-manager-645b99648f-m7n7w is missing the Istio
      proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/nats-manager-645b99648f-m7n7w

Result: ✅ OK

5.2. Subset of Namespaces

$ ./bin/kyma alpha diagnose istio --namespace default --level info
- code: IST0102
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0102/
  level: Info
  message: The namespace is not enabled for Istio injection. Run 'kubectl label namespace
      default istio-injection=enabled' to enable it, or 'kubectl label namespace default
      istio-injection=disabled' to explicitly mark it as not needing injection.
  origin: Namespace default

$ ./bin/kyma alpha diagnose istio --namespace antek-system --level info
- code: IST0102
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0102/
  level: Info
  message: The namespace is not enabled for Istio injection. Run 'kubectl label namespace
      antek-system istio-injection=enabled' to enable it, or 'kubectl label namespace
      antek-system istio-injection=disabled' to explicitly mark it as not needing injection.
  origin: Namespace antek-system

$ ./bin/kyma alpha diagnose istio --namespace default,antek-system --level info
(no output)

Result: ⚠️ No support for subset of namespaces. Maybe worth adding.

5.3. Exclusive With --all-namespaces

$ ./bin/kyma alpha diagnose istio --namespace default --all-namespaces
Error:
failed to validate given flags

Hints:
- flags in group [namespace] can't be used together with [all-namespaces], used [namespace]

Result: ✅ OK

5.4. Namespace With Disabled Istio

$ ./bin/kyma alpha diagnose istio --namespace default --level info
- code: IST0102
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0102/
  level: Info
  message: The namespace is not enabled for Istio injection. Run 'kubectl label namespace
      default istio-injection=enabled' to enable it, or 'kubectl label namespace default
      istio-injection=disabled' to explicitly mark it as not needing injection.
  origin: Namespace default

Result: ✅ OK

5.5. Namespace With Enabled Istio

$ ./bin/kyma alpha diagnose istio --namespace kyma-system
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq is missing
      the Istio proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/nats-manager-645b99648f-m7n7w is missing the Istio
      proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/nats-manager-645b99648f-m7n7w

Result: ✅ OK

---

6. --format Flag

6.1. Default Format

Result: ✅ OK (YAML format visible in all examples above)

6.2. JSON

$ ./bin/kyma alpha diagnose istio -fjson
[
  {
    "code": "IST0103",
    "documentationUrl": "https://istio.io/v1.26/docs/reference/config/analysis/ist0103/",
    "level": "Warning",
    "message": "The pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq is missing the Istio proxy. This can often be resolved by restarting or redeploying the workload.",
    "origin": "Pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq"
  },
  {
    "code": "IST0103",
    "documentationUrl": "https://istio.io/v1.26/docs/reference/config/analysis/ist0103/",
    "level": "Warning",
    "message": "The pod kyma-system/nats-manager-645b99648f-m7n7w is missing the Istio proxy. This can often be resolved by restarting or redeploying the workload.",
    "origin": "Pod kyma-system/nats-manager-645b99648f-m7n7w"
  }
]

Result: ✅ OK

6.3. YAML

$ ./bin/kyma alpha diagnose istio -fyaml
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq is missing
      the Istio proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/nats-manager-645b99648f-m7n7w is missing the Istio
      proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/nats-manager-645b99648f-m7n7w

Result: ✅ OK

---

7. --output Flag

7.1. Default to stdout

Result: ✅ OK

7.2. Path to File

$ ./bin/kyma alpha diagnose istio -o out.yaml

$ cat out.yaml | yq
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq is missing the Istio proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/nats-manager-645b99648f-m7n7w is missing the Istio proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/nats-manager-645b99648f-m7n7w

Result: ✅ OK

---

8. --timeout Flag

8.1. Informs About Timeout on stderr

$ ./bin/kyma alpha diagnose istio --timeout 1ms
Istio analysis cancelled because of timeout

$ ./bin/kyma alpha diagnose istio --timeout 1ms -fjson -o out.json
Istio analysis cancelled because of timeout

$ cat out.json | jq
{}

Result: ✅ OK

---

9. --verbose Flag

9.1. Displays Additional Output

Result: ⚠️ Couldn't get any verbose message; probably flag is not used? e.g. no usage of out.Verbose

---

10. --level Flag

10.1. Defines Minimal Log Level (--level=info displays info, warning, error)

$ ./bin/kyma alpha diagnose istio --level info
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq is missing
      the Istio proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq
(...)
- code: IST0102
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0102/
  level: Info
  message: The namespace is not enabled for Istio injection. Run 'kubectl label namespace
      antek-system istio-injection=enabled' to enable it, or 'kubectl label namespace
      antek-system istio-injection=disabled' to explicitly mark it as not needing injection.
  origin: Namespace antek-system
(...)

$ ./bin/kyma alpha diagnose istio --level warning
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq is missing
      the Istio proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/connectivity-proxy-operator-74cb5fb55-95hqq
- code: IST0103
  documentationUrl: https://istio.io/v1.26/docs/reference/config/analysis/ist0103/
  level: Warning
  message: The pod kyma-system/nats-manager-645b99648f-m7n7w is missing the Istio
      proxy. This can often be resolved by restarting or redeploying the workload.
  origin: Pod kyma-system/nats-manager-645b99648f-m7n7w

$ ./bin/kyma alpha diagnose istio --level error
(no output)

Result: ✅ OK