feat(ws): setup virtualservice to route traffic for workspaces

[harshad16]

related: #37
follow-up: #42

Descriptions:

The PR allow controller to connect each workspace with an endpoint that is reachable under the istio mesh.
This virtualservice follow the pattern of unqiue name, so it doesnt collide with notebook v1, if running in the same cluster parallely.

Setup:

The setup require to set the istio deployment in places.
for initial setup:

• deploy istio using from kubeflow manifest repo

  • https://github.com/kubeflow/manifests?tab=readme-ov-file#cert-manager
  • https://github.com/kubeflow/manifests?tab=readme-ov-file#istio
  • https://github.com/kubeflow/manifests?tab=readme-ov-file#oauth2-proxy
  • https://github.com/kubeflow/manifests?tab=readme-ov-file#dex
  • https://github.com/kubeflow/manifests?tab=readme-ov-file#kubeflow-namespace
  • https://github.com/kubeflow/manifests?tab=readme-ov-file#network-policies
  • https://github.com/kubeflow/manifests?tab=readme-ov-file#kubeflow-roles
  • https://github.com/kubeflow/manifests?tab=readme-ov-file#kubeflow-istio-resources

• After deployment of istio, deploy the controller with the image from PR content

  • make deploy IMG=quay.io/harshad16/nbcv2:controller-istio2
  • Deploy sample workspacekind and workspace to connect to workspace
    kubectl apply -k config/samples/

• Port forward the istio ingress:

  • https://github.com/kubeflow/manifests?tab=readme-ov-file#port-forward

• Open the browser, and goto:
  localhost:8080//workspace/<namespace>/<workspace-name>/jupyterlab/lab

CRD change with port in podtemplate:
#507

demo:
Screencast from 2025-07-28 16-43-01.webm

[thesuperzapper]

/ok-to-test

[thesuperzapper]

Note, we should update all other instances which look like /workspace/... path string formatters (do a search over the whole project)

In addition, we should update the doc string of the WorkspaceKind types (in controller) and the doc string of the WorkspaceKind same (which should usually match the go doc string anyway).

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign andyatmiami, paulovmr for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• workspaces/backend/OWNERS
• workspaces/controller/OWNERS
• workspaces/frontend/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[thesuperzapper]

As discussed in meeting, we might want to do something like this (needs to be tested):

// CopyVirtualServiceFields updates a target VirtualService with the fields from a desired VirtualService, returning true if an update is required.
func CopyVirtualServiceFields(desired *istiov1.VirtualService, target *istiov1.VirtualService) bool {
	requireUpdate := false

	// copy `metadata.labels`
	for k, v := range target.Labels {
		if desired.Labels[k] != v {
			requireUpdate = true
		}
	}
	target.Labels = desired.Labels

	// copy `metadata.annotations`
	for k, v := range target.Annotations {
		if desired.Annotations[k] != v {
			requireUpdate = true
		}
	}
	target.Annotations = desired.Annotations

	// copy `spec`
	// NOTE: we use proto.Equal to compare the specs of Istio resources are protobuf messages
	//       and messages with the same value are not considered equal with reflect.DeepEqual
	if !proto.Equal(&target.Spec, &desired.Spec) {
		target.Spec = *desired.Spec.DeepCopy()
		requireUpdate = true
	}

	return requireUpdate
}