Fix bug where analyzer suppressed cluster-level resource messages. (i…

…stio#18935)

Closes istio#18934

galley/pkg/config/processing/snapshotter/analyzingdistributor.go

@@ -140,15 +140,16 @@ func (d *AnalyzingDistributor) analyzeAndDistribute(cancelCh chan struct{}, name
 	d.s.Analyzer.Analyze(ctx)
 	scope.Analysis.Debugf("Finished analyzing the current snapshot, found messages: %v", ctx.messages)
 
-	// Only keep messages for resources in namespaces we want to analyze
-	// If the message doesn't have an origin (meaning we can't determine the namespace) fail open and keep it
-	// If no such limit is specified, keep them all.
+	// Only keep messages for resources in namespaces we want to analyze if the
+	// message doesn't have an origin (meaning we can't determine the
+	// namespace). Also kept are cluster-level resources where the namespace is
+	// the empty string. If no such limit is specified, keep them all.
 	var msgs diag.Messages
 	if len(namespaces) == 0 {
 		msgs = ctx.messages
 	} else {
 		for _, m := range ctx.messages {
-			if m.Origin != nil {
+			if m.Origin != nil && m.Origin.Namespace() != "" {
 				if _, ok := namespaces[m.Origin.Namespace()]; !ok {
 					continue
 				}

galley/pkg/config/processing/snapshotter/analyzingdistributor_test.go

@@ -163,6 +163,42 @@ func TestAnalyzeNamespaceMessageHasNoOrigin(t *testing.T) {
 	g.Expect(u.messages).To(HaveLen(1))
 }
 
+func TestAnalyzeNamespaceMessageHasOriginWithNoNamespace(t *testing.T) {
+	g := NewGomegaWithT(t)
+
+	u := &updaterMock{}
+	a := &analyzerMock{
+		collectionToAccess: data.Collection1,
+		entriesToReport: []*resource.Entry{
+			{
+				Origin: fakeOrigin{
+					friendlyName: "myFriendlyName",
+					// explicitly set namespace to the empty string
+					namespace: "",
+				},
+			},
+		},
+	}
+	d := NewInMemoryDistributor()
+
+	settings := AnalyzingDistributorSettings{
+		StatusUpdater:      u,
+		Analyzer:           analysis.Combine("testCombined", a),
+		Distributor:        d,
+		AnalysisSnapshots:  []string{metadata.Default},
+		TriggerSnapshot:    metadata.Default,
+		CollectionReporter: nil,
+		AnalysisNamespaces: []string{"includedNamespace"},
+	}
+	ad := NewAnalyzingDistributor(settings)
+
+	sDefault := getTestSnapshot()
+
+	ad.Distribute(metadata.Default, sDefault)
+	g.Eventually(func() []*Snapshot { return a.analyzeCalls }).Should(Not(BeEmpty()))
+	g.Expect(u.messages).To(HaveLen(1))
+}
+
 func TestAnalyzeSortsMessages(t *testing.T) {
 	g := NewGomegaWithT(t)
 
@@ -214,3 +250,13 @@ func getTestSnapshot(names ...string) *Snapshot {
 		set: coll.NewSetFromCollections(c),
 	}
 }
+
+var _ resource.Origin = fakeOrigin{}
+
+type fakeOrigin struct {
+	namespace    string
+	friendlyName string
+}
+
+func (f fakeOrigin) Namespace() string    { return f.namespace }
+func (f fakeOrigin) FriendlyName() string { return f.friendlyName }