do not attempt to mount a cluster secret if none were provided.

[jmazzitelli]

part of: kiali/kiali#7187

[jmazzitelli]

• related operator PR: do not attempt to mount a cluster secret if none were provided. kiali-operator#774

[jmazzitelli]

Test Procedures to see the inaccessible clusters will not get a secret mounted on the deployment:

1. Build the helm charts: make build-helm-charts
2. Create a /tmp/values.yaml file that has two clusters defined - one accessible, one that is not:

clustering:
  clusters:
  - name: accessible-cluster
    secret_name: the-accessible-cluster-secret
  - name: not-accessible-cluster

3. Generate the Deployment yaml from the helm template: helm template --show-only templates/deployment.yaml -f /tmp/values.yaml _output/charts/kiali-server-*-SNAPSHOT.tgz

You should not see any volume or volumeMount definitions for anything related to not-accessible-cluster, but you should see the accessible-cluster mount/mountVolume. To more easily see it, if you have yq installed you can do this:

Examine volume mounts - you should NOT see not-accessible-cluster in here but you should see accessible-cluster:

helm template --show-only templates/deployment.yaml -f /tmp/values.yaml _output/charts/kiali-server-*-SNAPSHOT.tgz | yq e '.spec.template.spec.containers[0].volumeMounts'

That results in something like:

- name: kiali-configuration
  configMap:
    name: kiali
- name: kiali-cert
  secret:
    secretName: istio.kiali-service-account
    optional: true
- name: kiali-secret
  secret:
    secretName: kiali
    optional: true
- name: kiali-cabundle
  configMap:
    name: kiali-cabundle
    optional: true
- name: accessible-cluster
  secret:
    secretName: the-accessible-cluster-secret

and similarly for volumes:

helm template --show-only templates/deployment.yaml -f /tmp/values.yaml _output/charts/kiali-server-*-SNAPSHOT.tgz | yq e '.spec.template.spec.volumes'

which results in:

- name: kiali-configuration
  configMap:
    name: kiali
- name: kiali-cert
  secret:
    secretName: istio.kiali-service-account
    optional: true
- name: kiali-secret
  secret:
    secretName: kiali
    optional: true
- name: kiali-cabundle
  configMap:
    name: kiali-cabundle
    optional: true
- name: accessible-cluster
  secret:
    secretName: the-accessible-cluster-secret