OSSM-2187 Allow usage of spec.proxy.networking.protocol.autoDetect

[dgn]

This removes the 'validation' that was effectively removing support for protocol sniffing and allows usage of the fields in 2.2 and 2.3 control planes. We previously removed this feature from OSSM 2.0 because of security concerns, however I cannot find any documentation of these concerns and upstream has been enabling it by default since Istio 1.6, so I consider it safe enough to allow usage. Note that we will still default to disabling it in order not to change behavior in any existing deployments.

We might want to discuss enabling it by default in 2.4

[dgn]

/retest

[dgn]

/retest

[maistra-bot]

@dgn: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
istio-operator_integ-kind-2.3	7a0fa24	link	true	/test integration-kind

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[jewertow]

I tested your change on OCP and I can confirm that it worked. After setting protocol auto detection, istiod had updated env vars:

- name: PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_OUTBOUND
  value: 'true'
- name: PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_INBOUND
  value: 'true'

When I set autoDetect.timeout then istiod updated connected proxies.

There is only one thing that I would change.

if autoDetect.Timeout != "" {
        if err := setHelmStringValue(proxyValues, "protocolDetectionTimeout", autoDetect.Timeout); err != nil {
	        return err
	}
	if err := setHelmStringValue(meshConfigValues, "protocolDetectionTimeout", autoDetect.Timeout); err != nil {
		return err
	}
}

Setting proxyValues has no effect, because istiod respects only MeshConfig, so maybe we could remove it? It works anyway, so you can ignore this suggestion, but this PR is an opportunity to simplify this piece of code.

[dgn]

There is only one thing that I would change.

if autoDetect.Timeout != "" {
        if err := setHelmStringValue(proxyValues, "protocolDetectionTimeout", autoDetect.Timeout); err != nil {
	        return err
	}
	if err := setHelmStringValue(meshConfigValues, "protocolDetectionTimeout", autoDetect.Timeout); err != nil {
		return err
	}
}

Setting proxyValues has no effect, because istiod respects only MeshConfig, so maybe we could remove it? It works anyway, so you can ignore this suggestion, but this PR is an opportunity to simplify this piece of code.

Good catch Jacek! Thank you. I removed that code

[dgn]

/retest