Add "Validate ZTunnel values" workflow

.github/ISSUE_TEMPLATE/validate-ztunnel-values.md

@@ -0,0 +1 @@
+Sail Operator is missing ZTunnel values from upstream. Please see the [job results](https://github.com/istio-ecosystem/sail-operator/actions/workflows/validate_ztunnel_values.yaml) for details.

.github/workflows/validate_ztunnel_values.yaml

@@ -0,0 +1,33 @@
+---
+name: Validate ZTunnel values
+
+on:
+  schedule:
+    # Run this job every sunday at midnight
+    - cron: "0 0 * * 0"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  validate-ztunnel-values:
+    name: Validate ZTunnel values
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v4
+
+      - name: Run validation
+        run: |
+          make validate-ztunnel-values
+
+      - name: Raise an Issue to report missing ztunnel values
+        if: ${{ failure() }}
+        uses: peter-evans/create-issue-from-file@v5
+        with:
+          title: Missing values detected by validation
+          content-filepath: .github/ISSUE_TEMPLATE/validate-ztunnel-values.md
+          labels: automated, missing ztunnel values
+

Makefile.core.mk

@@ -508,6 +508,11 @@ gen: gen-all-except-bundle bundle ## Generate everything.
 .PHONY: gen-all-except-bundle
 gen-all-except-bundle: operator-name operator-chart controller-gen gen-api gen-charts gen-manifests gen-code gen-api-docs mirror-licenses
 
+.PHONY: validate-ztunnel-values
+validate-ztunnel-values: ## Validate that upstream ztunnel Helm chart fields are present in Sail Operator ZTunnelConfig.
+	@echo "Validating ztunnel values completeness..."
+	go run hack/validate_ztunnel_values/validate_ztunnel_values.go
+
 .PHONY: gen-check
 gen-check: gen restore-manifest-dates check-clean-repo ## Verify that changes in generated resources have been checked in.
 

hack/validate_ztunnel_values/config.yaml

@@ -0,0 +1,13 @@
+# ZTunnel validation configuration
+# Fields listed here will NOT be reported as missing even if they exist in upstream
+# but are not implemented in the Sail Operator ZTunnelConfig
+#
+# Use "section.field" syntax for nested section fields (e.g., "global.networkPolicy")
+
+ignore_missing_fields:
+  # we currently don't have a MeshConfig field in the API and if we can avoid it, we might want to keep it that way
+  - "meshConfig"
+  # FIXME: add this field
+  - "resourceScope"
+  # FIXME: add this field
+  - "global.networkPolicy"