Repository: istio/istio (Go)

Issue:
Should workloadSelector take effect in SE with resolution DNS?
### Is this the right place to submit this?

- [X] This is not a security vulnerability or a crashing bug
- [X] This is not a question about how to use Istio

### Bug Description

According to #49429, workloadSelector doesn't take effect in the SE with resolution DNS. However, I try setting workloadSelector in the SE below, I receive warning but the workloadSelector takes effect actually. So should workloadSelector be disabled in the SE with resolution DNS?
```yaml
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: se-1
spec:
  hosts:
  - www.example.com
  ports:
  - number: 9080
    protocol: HTTP
    name: port-2
    targetPort: 9080
  resolution: DNS
  workloadSelector:
    labels:
      app: httpbin
```

### Version

```Text
client version: 1.21.0
control plane version: 1.22-alpha.da54969573378cea11e528e0197e5c5ca0afe5e7
data plane version: 1.22-alpha.da54969573378cea11e528e0197e5c5ca0afe5e7 (6 proxies)

Client Version: v1.28.2
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.27.3
```


### Additional Information

_No response_


Discussion:
@hzxuzhonghu 
The answer is yes, but we will miss warning like https://github.com/istio/istio/pull/42185/files
 and i am not clear what happens when we have a workload, whose address is not a domain, maybe we have filtered out. Need to have a test.
>and i am not clear what happens when we have a workload, whose address is not a domain, maybe we have filtered out

We donot filter out an valid ip address
both of following two case are valid:
case 1:
```
apiVersion: networking.istio.io/v1
kind: WorkloadEntry
metadata:
  name: httpbin-we
spec:
  address: httpbin.org
  labels:
    app: httpbin-org
  # ports:
  #   http: 8000
---
apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata:
  name: httpbin
spec:
  exportTo:
    - "*"
  hosts:
    - httpbin.org
  location: MESH_EXTERNAL
  ports:
    - name: http
      number: 80
      protocol: HTTP
  resolution: DNS
  workloadSelector:
    labels:
      app: httpbin-org

```

case 2:
```
apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata:
  name: httpbin
spec:
  exportTo:
    - "*"
  hosts:
    - httpbin.org
  location: MESH_EXTERNAL
  ports:
    - name: http
      number: 80
      protocol: HTTP
  resolution: DNS
```
what is different:
```git
         metadata:
           filterMetadata:
             istio:
-              workload: ;;;;
+              workload: httpbin-we;sidecar;httpbin-org;;Kubernetes
       loadBalancingWeight: 1
       locality: {}
```



Patch:
diff --git a/pkg/config/validation/validation.go b/pkg/config/validation/validation.go
index a1c9f807e821..de6fb378a5f3 100644
--- a/pkg/config/validation/validation.go
+++ b/pkg/config/validation/validation.go
@@ -2931,10 +2931,6 @@ var ValidateServiceEntry = RegisterValidateFunc("ValidateServiceEntry",
 				}
 			}
 
-			if serviceEntry.WorkloadSelector != nil {
-				errs = AppendWarningf(errs, "workloadSelector should not be set when resolution mode is %v", serviceEntry.Resolution)
-			}
-
 			if len(serviceEntry.Addresses) > 0 {
 				for _, port := range serviceEntry.Ports {
 					if port == nil {
diff --git a/releasenotes/notes/55567.yaml b/releasenotes/notes/55567.yaml
new file mode 100644
index 000000000000..990c3d64c2ec
--- /dev/null
+++ b/releasenotes/notes/55567.yaml
@@ -0,0 +1,8 @@
+apiVersion: release-notes/v2
+kind: bug-fix
+area: traffic-management
+issue:
+  - 50164
+releaseNotes:
+  - |
+    **Fixed** an issue that validation webhook incorrectly report a warning when a ServiceEntry configures `workloadSelector`` with DNS resolution.


Test patch:
diff --git a/pkg/config/validation/validation_test.go b/pkg/config/validation/validation_test.go
index 02d465ad715c..bedab062d4dd 100644
--- a/pkg/config/validation/validation_test.go
+++ b/pkg/config/validation/validation_test.go
@@ -3854,7 +3854,7 @@ func TestValidateServiceEntries(t *testing.T) {
 				Resolution: networking.ServiceEntry_DNS,
 			},
 			valid:   true,
-			warning: true,
+			warning: false,
 		},
 		{
 			name: "bad selector key", in: &networking.ServiceEntry{