Resolve Istio hosts only within the observed service domain (#2086)

Istio destination.host is not always a Kubernetes Service. Treating any
dotted host as a local service can connect an external address or an
incomplete DNS name to an unrelated cluster object.

The graph and renderers share the same rule: a short name resolves in
the resource's namespace; a fully qualified name resolves only under the
service domain observed from istiod. External, wildcard, incomplete and
conflicting-domain hosts remain unresolved. Resource and traffic modes
use the same host resolution.

API change: Relationships adds optional string istioServiceDomain, also
carried in Istio node metadata. This supplies standalone resource
drawers with the observation used by topology; it is present only when a
domain is known. An Istio relationships response may therefore be
non-null even when it contains no resource edges. Conflicting or invalid
explicit observations do not authorize FQDN navigation. When no istiod
Deployment is observed (including an external or unobserved control
plane), the existing `cluster.local` default applies; custom domains
require the control plane to be in Radar's cache.

Review focus: domain observation and consistent graph/drawer
interpretation. This is reference resolution, not proof of reachability
or mesh routing configuration.

Validation: full root and relevant shared-module Go suites;
resource/traffic host and observed/conflicting-domain tests; four
rendered host navigation cases; web/shared UI type checks; production
frontend/embed/backend build. Existing renderers and link presentation
are retained.

Visual-test: skipped because these corrections retain the existing
layouts; rendered navigation/evidence tests and real REST/MCP checks
cover the changed behavior.

Author: nadaverell

docs/integrations.md

@@ -692,6 +692,8 @@ See the main [README](../README.md#gitops) for the user-facing overview. This se
 
 **Topology:** Full Istio traffic path — IstioGateway → VirtualService → Service, and DestinationRule → Service configuration edges. See how traffic flows through gateway listeners, virtual service routing rules, and into backend services.
 
+Service links accept short names in the rule's namespace or full `name.namespace.svc.<domain>` names. Radar reads a unique registry domain from standard observed Istiod Deployments' `--domain` argument, using Istio's `cluster.local` default when no override is observed. Conflicting or unresolved control-plane arguments leave FQDN links unresolved. External control planes and nonstandard launch configurations may therefore need additional domain discovery; arbitrary dotted hosts are not treated as local Services.
+
 **VirtualService Detail View:**
 - HTTP/TCP/TLS routing rules with match conditions
 - Destinations with weight distribution bars

packages/k8s-ui/src/components/resources/renderers/IstioDestinationRuleRenderer.tsx

@@ -2,43 +2,43 @@ import { Network } from 'lucide-react'
 import { Section, PropertyList, Property, ConditionsSection, ResourceLink, KeyValueBadgeList } from '../../ui/drawer-components'
 import {
   getDestinationRuleHost,
+  resolveIstioServiceHost,
   getDestinationRuleSubsets,
   getDestinationRuleTrafficPolicy,
   getDestinationRuleLoadBalancer,
 } from '../resource-utils-istio'
 
 interface IstioDestinationRuleRendererProps {
   data: any
+  serviceDomain?: string
   onNavigate?: (ref: { kind: string; namespace: string; name: string }) => void
 }
 
-export function IstioDestinationRuleRenderer({ data, onNavigate }: IstioDestinationRuleRendererProps) {
+export function IstioDestinationRuleRenderer({ data, onNavigate, serviceDomain }: IstioDestinationRuleRendererProps) {
   const host = getDestinationRuleHost(data)
   const subsets = getDestinationRuleSubsets(data)
   const trafficPolicy = getDestinationRuleTrafficPolicy(data)
   const loadBalancer = getDestinationRuleLoadBalancer(data)
   const ns = data.metadata?.namespace || ''
 
-  // Parse host to create service link
-  const hostParts = host.split('.')
-  const svcName = hostParts[0]
-  const svcNs = hostParts.length >= 2 ? hostParts[1] : ns
+  const service = resolveIstioServiceHost(host, ns, serviceDomain)
 
   return (
     <>
       {/* Host reference */}
       <Section title="Destination" icon={Network} defaultExpanded>
         <PropertyList>
           <Property label="Host" value={
-            host !== '-' ? (
+            service ? (
               <ResourceLink
-                name={svcName}
+                name={service.name}
                 kind="services"
-                namespace={svcNs}
+                group=""
+                namespace={service.namespace}
                 label={host}
                 onNavigate={onNavigate}
               />
-            ) : '-'
+            ) : host
           } />
           <Property label="Load Balancer" value={loadBalancer} />
         </PropertyList>

packages/k8s-ui/src/components/resources/renderers/IstioExactReferenceNavigation.test.tsx

@@ -0,0 +1,34 @@
+// @vitest-environment jsdom
+import { act, type ReactNode } from 'react'
+import { createRoot } from 'react-dom/client'
+import { describe, expect, it, vi } from 'vitest'
+import { IstioDestinationRuleRenderer } from './IstioDestinationRuleRenderer'
+
+async function rendered(element: ReactNode, check: (container: HTMLDivElement) => Promise<void> | void) {
+ Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+ const container = document.createElement('div')
+ const root = createRoot(container)
+ try { await act(async () => root.render(element)); await check(container) }
+ finally { await act(async () => root.unmount()); Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: false }) }
+}
+async function click(container: HTMLDivElement, text: string) {
+ const button = [...container.querySelectorAll('button')].find(button => button.textContent === text)
+ expect(button, `missing link ${text}`).toBeDefined()
+ await act(async () => button!.click())
+}
+
+describe('exact reference navigation', () => {
+ it.each([
+  {host:'api.prod.svc.mesh.internal',domain:'mesh.internal',linked:true},
+  {host:'api.prod.svc.cluster.local',domain:undefined,linked:false},
+  {host:'api.prod.svc.external.test',domain:'mesh.internal',linked:false},
+  {host:'api.prod',domain:'mesh.internal',linked:false},
+ ])('links only observed Istio service domains: $host',async ({host,domain,linked})=>{
+  const navigate=vi.fn()
+  await rendered(<IstioDestinationRuleRenderer data={{metadata:{namespace:'app'},spec:{host}}} serviceDomain={domain} onNavigate={navigate}/>,async container=>{
+   const link=[...container.querySelectorAll('button')].find(button=>button.textContent===host)
+   expect(Boolean(link)).toBe(linked)
+   if(link) {await click(container,host);expect(navigate).toHaveBeenCalledWith({kind:'services',group:'',namespace:'prod',name:'api'})}
+  })
+ })
+})

packages/k8s-ui/src/components/resources/renderers/IstioVirtualServiceRenderer.tsx

@@ -7,17 +7,19 @@ import {
   getVirtualServiceHostsList,
   getVirtualServiceGatewaysList,
   getVirtualServiceHttpRoutes,
+  resolveIstioServiceHost,
   getVirtualServiceTcpRoutes,
   getVirtualServiceTlsRoutes,
   getVirtualServiceRouteCount,
 } from '../resource-utils-istio'
 
 interface IstioVirtualServiceRendererProps {
   data: any
+  serviceDomain?: string
   onNavigate?: (ref: { kind: string; namespace: string; name: string }) => void
 }
 
-export function IstioVirtualServiceRenderer({ data, onNavigate }: IstioVirtualServiceRendererProps) {
+export function IstioVirtualServiceRenderer({ data, onNavigate, serviceDomain }: IstioVirtualServiceRendererProps) {
   const status = getVirtualServiceStatus(data)
   const hosts = getVirtualServiceHostsList(data)
   const gateways = getVirtualServiceGatewaysList(data)
@@ -148,6 +150,7 @@ export function IstioVirtualServiceRenderer({ data, onNavigate }: IstioVirtualSe
                       {route.route.map((dest: any, di: number) => {
                         const weight = dest.weight ?? (route.route.length === 1 ? 100 : undefined)
                         const destHost = dest.destination?.host || ''
+                        const service = resolveIstioServiceHost(destHost, ns, serviceDomain)
                         const destPort = dest.destination?.port?.number
                         const destSubset = dest.destination?.subset
 
@@ -164,13 +167,7 @@ export function IstioVirtualServiceRenderer({ data, onNavigate }: IstioVirtualSe
                                 <span className="text-theme-text-secondary font-medium">{weight}%</span>
                               </div>
                             )}
-                            <ResourceLink
-                              name={destHost.split('.')[0]}
-                              kind="services"
-                              namespace={destHost.includes('.') ? destHost.split('.')[1] : ns}
-                              label={destHost}
-                              onNavigate={onNavigate}
-                            />
+                            {service ? <ResourceLink name={service.name} kind="services" group="" namespace={service.namespace} label={destHost} onNavigate={onNavigate} /> : <span className="text-theme-text-primary break-all">{destHost}</span>}
                             {destPort && (
                               <span className="text-theme-text-tertiary">:{destPort}</span>
                             )}

packages/k8s-ui/src/components/resources/resource-utils-istio.ts

@@ -8,13 +8,17 @@ import { pluralize } from '../../utils/pluralize'
 // SHARED HELPERS
 // ============================================================================
 
-function parseIstioHost(host: string): { name: string; namespace: string } {
-  // Istio hosts can be: "reviews", "reviews.default", "reviews.default.svc.cluster.local"
+// FQDNs require the registry domain supplied by the producer. Undotted
+// names use Istio's documented namespace-relative expansion.
+export function resolveIstioServiceHost(host: string, defaultNamespace: string, serviceDomain = ''): { name: string; namespace: string } | undefined {
+  const label = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/
   const parts = host.split('.')
-  return {
-    name: parts[0] || host,
-    namespace: parts.length >= 2 ? parts[1] : '',
+  if (parts.length === 1 && host.length <= 63 && label.test(host)) return { name: host, namespace: defaultNamespace }
+  if (serviceDomain && host.endsWith(`.svc.${serviceDomain}`)) {
+    const service = host.slice(0, -(`.svc.${serviceDomain}`.length)).split('.')
+    if (service.length === 2 && service.every(part => part.length <= 63 && label.test(part))) return { name: service[0], namespace: service[1] }
   }
+  return undefined
 }
 
 // ============================================================================
@@ -103,16 +107,16 @@ export function getVirtualServiceTlsRoutes(resource: any): any[] {
   return resource.spec?.tls || []
 }
 
-export function getVirtualServiceDestinations(resource: any): Array<{ host: string; namespace: string; port?: number; subset?: string; weight?: number }> {
+export function getVirtualServiceDestinations(resource: any, serviceDomain = ''): Array<{ host: string; namespace: string; port?: number; subset?: string; weight?: number }> {
   const destinations: Array<{ host: string; namespace: string; port?: number; subset?: string; weight?: number }> = []
   const httpRoutes = resource.spec?.http || []
   for (const route of httpRoutes) {
     for (const dest of (route.route || [])) {
       if (dest.destination?.host) {
-        const parsed = parseIstioHost(dest.destination.host)
+        const parsed = resolveIstioServiceHost(dest.destination.host, resource.metadata?.namespace || '', serviceDomain)
         destinations.push({
           host: dest.destination.host,
-          namespace: parsed.namespace || resource.metadata?.namespace || '',
+          namespace: parsed?.namespace || '',
           port: dest.destination.port?.number,
           subset: dest.destination.subset,
           weight: dest.weight,

packages/k8s-ui/src/components/shared/ResourceRendererDispatch.tsx

@@ -972,8 +972,8 @@ export function ResourceRendererDispatch({
         {kind === 'azuremanagedcontrolplanes' && <AzureManagedControlPlaneRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'azuremanagedmachinepools' && <AzureManagedMachinePoolRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'azuremachines' && <AzureMachineRenderer data={data} onNavigate={onNavigate} />}
-        {kind === 'virtualservices' && <IstioVirtualServiceRenderer data={data} onNavigate={onNavigate} />}
-        {kind === 'destinationrules' && <IstioDestinationRuleRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'virtualservices' && <IstioVirtualServiceRenderer data={data} onNavigate={onNavigate} serviceDomain={relationships?.istioServiceDomain} />}
+        {kind === 'destinationrules' && <IstioDestinationRuleRenderer data={data} onNavigate={onNavigate} serviceDomain={relationships?.istioServiceDomain} />}
         {kind === 'serviceentries' && <IstioServiceEntryRenderer data={data} />}
         {kind === 'peerauthentications' && <IstioPeerAuthenticationRenderer data={data} />}
         {kind === 'authorizationpolicies' && <IstioAuthorizationPolicyRenderer data={data} />}

packages/k8s-ui/src/types/core.ts

@@ -641,6 +641,8 @@ export interface ResourceRef {
 
 // Computed relationships for a resource
 export interface Relationships {
+  /** Istio registry domain supplied by the producer; omitted when unknown. */
+  istioServiceDomain?: string
   reflection?: {
     source?: ResourceRef
     sourceResourceVersion?: string

pkg/topology/builder.go

@@ -1770,6 +1770,14 @@ func (b *Builder) buildResourcesTopology(opts BuildOptions) (*Topology, error) {
 
 	// 1k. Add Istio VirtualService nodes (CRD - fetched via dynamic cache)
 	// VirtualService edges are created in a second pass after service IDs are populated
+	istioDomain := ""
+	istioDomainLoaded := false
+	loadIstioDomain := func() {
+		if !istioDomainLoaded {
+			istioDomain = b.istioServiceDomain()
+			istioDomainLoaded = true
+		}
+	}
 	var virtualServiceGVR schema.GroupVersionResource
 	hasVirtualServices := false
 	if resourceDiscovery != nil {
@@ -1778,6 +1786,7 @@ func (b *Builder) buildResourcesTopology(opts BuildOptions) (*Topology, error) {
 	virtualServiceIDs := make(map[string]string)             // ns/name -> vsID
 	var virtualServiceResources []*unstructured.Unstructured // Store for second pass
 	if hasVirtualServices && dynamicCache != nil {
+		loadIstioDomain()
 		virtualServices, vsErr := dynamicCache.ListNamespaces(virtualServiceGVR, opts.Namespaces)
 		if vsErr != nil {
 			log.Printf("WARNING [topology] Failed to list Istio VirtualServices: %v", vsErr)
@@ -1814,12 +1823,13 @@ func (b *Builder) buildResourcesTopology(opts BuildOptions) (*Topology, error) {
 				Name:   name,
 				Status: nodeStatus,
 				Data: map[string]any{
-					"namespace":  ns,
-					"hosts":      hosts,
-					"gateways":   gateways,
-					"routeCount": routeCount,
-					"labels":     vs.GetLabels(),
-					"apiVersion": vs.GetAPIVersion(),
+					"namespace":          ns,
+					"hosts":              hosts,
+					"gateways":           gateways,
+					"routeCount":         routeCount,
+					"labels":             vs.GetLabels(),
+					"apiVersion":         vs.GetAPIVersion(),
+					"istioServiceDomain": istioDomain,
 				},
 			})
 
@@ -1837,6 +1847,7 @@ func (b *Builder) buildResourcesTopology(opts BuildOptions) (*Topology, error) {
 	destinationRuleIDs := make(map[string]string)             // ns/name -> drID
 	var destinationRuleResources []*unstructured.Unstructured // Store for second pass
 	if hasDestinationRules && dynamicCache != nil {
+		loadIstioDomain()
 		destinationRules, drErr := dynamicCache.ListNamespaces(destinationRuleGVR, opts.Namespaces)
 		if drErr != nil {
 			log.Printf("WARNING [topology] Failed to list Istio DestinationRules: %v", drErr)
@@ -1866,11 +1877,12 @@ func (b *Builder) buildResourcesTopology(opts BuildOptions) (*Topology, error) {
 				Name:   name,
 				Status: nodeStatus,
 				Data: map[string]any{
-					"namespace":   ns,
-					"host":        host,
-					"subsetCount": len(subsets),
-					"labels":      dr.GetLabels(),
-					"apiVersion":  dr.GetAPIVersion(),
+					"namespace":          ns,
+					"host":               host,
+					"subsetCount":        len(subsets),
+					"labels":             dr.GetLabels(),
+					"apiVersion":         dr.GetAPIVersion(),
+					"istioServiceDomain": istioDomain,
 				},
 			})
 
@@ -4746,7 +4758,7 @@ func (b *Builder) buildResourcesTopology(opts BuildOptions) (*Topology, error) {
 
 		// addVSToSvcEdge is a helper that deduplicates VS→Service edges
 		addVSToSvcEdge := func(protocol string, destHost string) {
-			svcName, svcNs := parseIstioHost(destHost, vsNs)
+			svcName, svcNs := parseIstioHost(destHost, vsNs, istioDomain)
 			svcID, ok := serviceIDs[svcNs+"/"+svcName]
 			if !ok {
 				return
@@ -4840,7 +4852,7 @@ func (b *Builder) buildResourcesTopology(opts BuildOptions) (*Topology, error) {
 			continue
 		}
 
-		svcName, svcNs := parseIstioHost(host, drNs)
+		svcName, svcNs := parseIstioHost(host, drNs, istioDomain)
 		if svcID, ok := serviceIDs[svcNs+"/"+svcName]; ok {
 			edges = append(edges, Edge{
 				ID:     fmt.Sprintf("%s-to-%s", drID, svcID),
@@ -6022,6 +6034,11 @@ func (b *Builder) buildTrafficTopology(opts BuildOptions) (*Topology, error) {
 		}
 	}
 
+	istioDomain := "cluster.local"
+	if len(trafficVirtualServices) > 0 {
+		istioDomain = b.istioServiceDomain()
+	}
+
 	// Step 1: Find services referenced by ingresses
 	for _, ing := range ingresses {
 		if !opts.MatchesNamespaceFilter(ing.Namespace) {
@@ -6087,7 +6104,7 @@ func (b *Builder) buildTrafficTopology(opts BuildOptions) (*Topology, error) {
 					if destHost == "" {
 						continue
 					}
-					svcName, svcNs := parseIstioHost(destHost, vsNs)
+					svcName, svcNs := parseIstioHost(destHost, vsNs, istioDomain)
 					svcKey := svcNs + "/" + svcName
 					servicesFromIstio[svcKey] = true
 				}
@@ -6590,12 +6607,13 @@ func (b *Builder) buildTrafficTopology(opts BuildOptions) (*Topology, error) {
 			Name:   vsName,
 			Status: nodeStatus,
 			Data: map[string]any{
-				"namespace":  vsNs,
-				"hosts":      hosts,
-				"gateways":   gateways,
-				"routeCount": routeCount,
-				"labels":     vs.GetLabels(),
-				"apiVersion": vs.GetAPIVersion(),
+				"namespace":          vsNs,
+				"hosts":              hosts,
+				"gateways":           gateways,
+				"routeCount":         routeCount,
+				"labels":             vs.GetLabels(),
+				"apiVersion":         vs.GetAPIVersion(),
+				"istioServiceDomain": istioDomain,
 			},
 		})
 
@@ -6638,7 +6656,7 @@ func (b *Builder) buildTrafficTopology(opts BuildOptions) (*Topology, error) {
 					if destHost == "" {
 						continue
 					}
-					svcName, svcNs := parseIstioHost(destHost, vsNs)
+					svcName, svcNs := parseIstioHost(destHost, vsNs, istioDomain)
 					svcKey := svcNs + "/" + svcName
 					if _, ok := servicesToInclude[svcKey]; !ok {
 						continue
@@ -8082,18 +8100,6 @@ func matchesHelmRelease(labels map[string]string, hrName, hrNamespace string) bo
 	return false
 }
 
-// parseIstioHost parses an Istio service host reference into service name and namespace.
-// Istio hosts can be: "reviews", "reviews.default", "reviews.default.svc.cluster.local"
-// Returns (serviceName, namespace). If no namespace is found, defaultNs is used.
-func parseIstioHost(host, defaultNs string) (string, string) {
-	parts := strings.Split(host, ".")
-	if len(parts) == 1 {
-		return parts[0], defaultNs
-	}
-	// "reviews.default" or "reviews.default.svc.cluster.local"
-	return parts[0], parts[1]
-}
-
 type workloadRefs struct {
 	configMaps     map[string]bool
 	secrets        map[string]bool