Create a Istio trait

[nicolaferraro]

While developing the Knative integration I've noticed that outgoing connections are not allowed when the pod is embedded into the Istio mesh.

If you want to contact e.g. slack you should add a EgressRule like:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: slack-ext
spec:
  hosts:
  - hooks.slack.com
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNAL

It would be great if we can add a Istio trait that can add those rules automatically (as child resource of the Integration).

Users may be able to run a integration like:

kamel run -t istio.egress.slack=https://hooks.slack.com slack.groovy

That will end up in the Integration resource, in the istio trait and then materialized by the operator.

The next big thing would be to add such egress rules automatically from the code... But we don't have such metadata in Camel. Some endpoints, instead, are self describing, such as .to("http://..").

Does anyone know if there's a "wildcard" authorization for Istio egresses or external services should all be declared?

[lburgazzoli]

@nicolaferraro is this still needed ?

[nicolaferraro]

Yes, but we maybe want to go in another direction. Look at: istio/istio#9304 (comment)

The istio trait may add the traffic.sidecar.istio.io/excludeOutboundIPRanges: 0.0.0.0/0 annotation to the pod template, so that our pods are free to contact the outside world.