Fix warnings generated from istioctl analyze

[linsun]

Bug Description

istioctl analyze
Warning [IST0108] (Deployment default/bookinfo-productpage-istio-waypoint) Unknown annotation: istio.io/for-service-account
Warning [IST0108] (Pod default/bookinfo-productpage-istio-waypoint-66f9db6966-ghzhz) Unknown annotation: ambient.istio.io/redirection
Warning [IST0108] (Pod default/bookinfo-productpage-istio-waypoint-66f9db6966-ghzhz) Unknown annotation: istio.io/for-service-account
Warning [IST0108] (Pod default/details-v1-7d4d9d5fcb-s2ljz) Unknown annotation: ambient.istio.io/redirection
Warning [IST0108] (Pod default/notsleep-bb6696574-jsb9g) Unknown annotation: ambient.istio.io/redirection
Warning [IST0108] (Pod default/productpage-v1-7b4dbf9c75-9tv67) Unknown annotation: ambient.istio.io/redirection
Warning [IST0108] (Pod default/ratings-v1-85cc46b6d4-ws8hv) Unknown annotation: ambient.istio.io/redirection
Warning [IST0108] (Pod default/reviews-v1-777df99c6d-wxw2s) Unknown annotation: ambient.istio.io/redirection
Warning [IST0108] (Pod default/reviews-v2-cdd8fb88b-x5gq8) Unknown annotation: ambient.istio.io/redirection
Warning [IST0108] (Pod default/reviews-v3-58b6479b-h76r4) Unknown annotation: ambient.istio.io/redirection
Warning [IST0108] (Pod default/sleep-5644bdc767-zv4l9) Unknown annotation: ambient.istio.io/redirection

Might be good to update this message too that we ask user either label for sidecar or ambient.

Info [IST0102] (Namespace default) The namespace is not enabled for Istio injection. Run 'kubectl label namespace default istio-injection=enabled' to enable it, or 'kubectl label namespace default istio-injection=disabled' to explicitly mark it as not needing injection.

Version

1.18-dev

Additional Information

No response

[linsun]

cc @GregHanson if you have bandwidth

[GregHanson]

will do - was wondering if there were any analyze additional messages we should generate for ambient

[hanxiaop]

The annotations depend on those listed in https://github.com/istio/api/blob/master/annotation/annotations.yaml. I believe they will become recognizable once we include them in the YAML.

[GregHanson]

collecting a list of all items here #43437

[GregHanson]

@howardjohn based on #43614, it seems like istio/api#2695 is premature - should I limit the new labels I'm adding in the istio/api PR to just the offending ones from analyze? Or should find a way to keep the changes to istioctl code until ambient naming/api concerns are addressed?

[hanxiaop]

should I limit the new labels I'm adding in the istio/api PR to just the offending ones from analyze

I think we should filter out those that were not added by users. Currently, the result is full of 'Unknown annotation' messages.

[GregHanson]

not stale