feat(*) expand Mesh resource to control passthrough

[nickolaev]

Summary

Expanding the Mesh resource with pass-through control capabilities.

apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: default
spec:
  networking
    outbound:
      passthrough: false

The setting defaults to true and needs to be explicitly set to false to disallow access to non-mesh resources.

Documentation

• Link to the website documentation PR

[subnetmarco]

Should it be “true” by default instead?

[jakubdyszkiewicz]

This definitely should be true by default. Otherwise we will be breaking current deployments when we deploy Kuma

[jakubdyszkiewicz]

Can we maybe have E2E test for this? :)

[jakubdyszkiewicz]

nit: you can do just m.GetNetworking().GetOutbound().GetPassthrough() == nil, check implementation of those getters, they handle nulls

[jakubdyszkiewicz]

give some description of steps in this test please, example:

// given Mesh with passthrough false communication is not established
_, err := retry.DoWithRetryE
Expect(err).To(HaveOccurred())

// when applied Mesh with passthrough true
err = YamlK8s(fmt.Sprintf(meshDefaulMtlsOn, "true"))(cluster)

// then communication outside of the Mesh works
_, stderr, err := cluster.ExecWithRetries
Expect(err).ToNot(HaveOccurred())
Expect(stderr).To(ContainSubstring("HTTP/1.1 200 OK"))

[jakubdyszkiewicz]

Just a note for whoever will take care of E2E tests eventually. We need proper builders for our entities. Something like this:

MeshBuilder().WithPassThrough(false).WithMTLS().KubeYAML()

Copy-pasting those YAMLs with parameters over many test is not the best idea IMHO.

[jakubdyszkiewicz]

some typos, other than this 👍 I like that we are adding so much with so little of code :)

[jakubdyszkiewicz]

Outbounf -> Outbound

[jakubdyszkiewicz]

he -> the

[jakubdyszkiewicz]

longne -> longer