Validate Istio Egress Gateway Traffic
Feature Request
Why
An Istio Egress Gateway can be enabled for a cluster as documented here. However, we must prove that this gateway is being used for all service mesh outbound traffic.
Proposed Solution
Egress traffic a pod may be verifiable by exec'ing into any of the cluster's pods that have an Istio sidecar and a curl
binary present like:
kubectl exec podname -- curl -sSL -o /dev/null -D - https://google.com
...and watching the egress traffic flow from Kiali. However, this may be an insufficient test and further observation and testing is needed to verify the outbound traffic. For example, moving the egressgateway to an isolated node and ensuring all traffic leaves from that egressgateway instance.
Edited by Greg M