Adding sidecar, serviceEntry to whitelist egress

General MR

Summary

This MR introduces a Sidecar and a set of ServiceEntries for Tempo when istio.enabled: true and istio.hardened.enabled: true. This is in support of big-bang&160.

Additionally, during testing it was discovered that the AuthorizationPolicy previously added was preventing Monitoring and Kiali from talking to Tempo, due to a conflict between .Values.sso.enabled && .Values.istio.hardened.enabled. This has been fixed.

Relevant logs/screenshots

(Include any relevant logs/screenshots)

Linked Issue

issue

Upgrade Notices

A Sidecar resource has been added to the Tempo namespace that disallows egress to endpoints that are not part of the Istio service registry (a.k.a REGISTRY_ONLY). The outboundTrafficPolicy.mode in the Sidecar can be configured, however, to be something other than REGISTRY_ONLY if desired by setting istio.hardened.outboundTrafficPolicyMode. This provides a redundant layer of network security in addition to NetworkPolicies. This Sidecar is disabled by default but can be enabled by setting istio.enabled: true and istio.hardened.enabled: true.

Additionally, custom ServiceEntries can be created by populating the istio.hardened.customServiceEntries list.

Closes #48 (closed)

added kindfeature priority6 statusdoing teamService Mesh labels

assigned to @charden

requested review from @seagren.tim

removed statusdoing label

added statusreview label

marked this merge request as ready

added 1 commit

• c72a2fb1 - Thank you

Compare with previous version

resolved all threads

added 1 commit

• 53fe0f3f - TY

Compare with previous version

requested review from @jimmyungerman, @ryan.j.garcia, @piotr.machaj, @steven.donald, @daniel.dides, @staskiewicz.blane, @alieberman, and @dhilgaertner2

resolved all threads

added 1 commit

• 40693910 - Update CHANGELOG.md

Compare with previous version

approved this merge request

enabled an automatic merge when the pipeline for 40693910 succeeds

merged

mentioned in commit bf7a13e2

mentioned in merge request big-bang/bigbang!3891 (merged)