clustermesh: enable endpointslice sync by default on headless services

[MrFreezeex]

Please ensure your pull request adheres to the following guidelines:

• For first time contributors, read Submitting a pull request
• All code is covered by unit and/or runtime tests where feasible.
• All commits contain a well written commit description including a title,
  description and a Fixes: #XXX line if the commit addresses a particular
  GitHub issue.
• If your commit description contains a Fixes: <commit-id> tag, then
  please add the commit author[s] as reviewer[s] to this issue.
• All commits are signed off. See the section Developer’s Certificate of Origin
• Provide a title or release-note blurb suitable for the release notes.
• Are you a user of Cilium? Please add yourself to the Users doc
• Thanks for contributing!

As it's highly likely that for an Headless Service the user wants to sync EndpointSlices we should set it by default in this case and make the behavior opt-out instead of opt-in.

It's highly unlikely that this change anything for existing setup as before endpoint slice synchronization were a thing Headless services were ignored. Also EndpointSlice sync is still guarded by a feature flag set in helm/in the configmap.

Make endpointslice clustermesh syncing opt-out for headless services 

[MrFreezeex]

/test

[YutaroHayakawa]

I'm not sure if this is sufficient to be enabled by default. AFAIK, Cilium Ingress/GWAPI works without this endpointslice synchronization, so this is only relevant for the people who wants to integrate third-party controllers which is I would say not a regular use case. What do you think @giorio94?

[giorio94]

I'm not sure if this is sufficient to be enabled by default. AFAIK, Cilium Ingress/GWAPI works without this endpointslice synchronization, so this is only relevant for the people who wants to integrate third-party controllers which is I would say not a regular use case. What do you think @giorio94?

Headless services represent a special case, and they don't currently work as expected if marked as global, because coredns doesn't know about the remote backends (given that the corresponding epslices are not present locally). Given the above, I personally think it is fine to enable endpointslice synchronization by default for them (only if marked as global, obviously), especially because the endpointslice synchronization is already gated by a dedicated feature flag (disabled by default), and thus the change would not affect any existing deployment. Differently, I wouldn't enable endpointslice synchronization by default for all the other service types, as required only by third-party controllers, and potentially associated with scalability concerns.

[giorio94]

Thanks!

[lambdanis]

Docs good. Should this change be highlighted in the upgrade notes too?

[MrFreezeex]

Should this change be highlighted in the upgrade notes too?

Hmmm that's a good point thanks, but I think it should not because the whole feature of endpointslice syncing was not available in the previous stable release so there is no existing users of this and it's still guarded by a helm config/feature flag disabled by default. So it changes the default but only if prior to that you enabled the feature flag (which wasn't here in any releases so far).

[MrFreezeex]

/test

[MrFreezeex]

/ci-integration

[MrFreezeex]

/ci-ginkgo

[MrFreezeex]

(I rebased as an attempt to have less flakes in the CI)

[MrFreezeex]

/test