Architecture diagrams, documentation, and other required administrative items

[Collinbrown95]

Description

Diagrams + documentation required to articulate the proposed mechanism to prevent external users from accessing gitlab.k8s.cloud.statcan.ca along with other administrative items that are necessary to move forward with this feature.

TODO

• [x] Background reading on various options available for this feature (e.g. ExternalName service, Istio Service Entry + Egress Gateway, etc).
• [x] Create architecture diagrams outlining proposed plan
• [x] Documentation for proposed plan (https://github.com/StatCan/daaas/issues/1097#issuecomment-1143995480)
• [x] Feedback from CNS (June 2)
• [x] Update diagram and proposal with CNS feedback. Specifically:
  • [x] Include network policy controller for per-namespace egress network policies + ingress network policy with namespace selector.
  • [x] Remove "default" egress gateway and Azure load balancers from diagram
• [x] Start creating ConOps documentation outlining both proposals, depending on the decision of https://github.com/StatCan/daaas/issues/1127 (need to include plan in ConOps for both cases - maintain separate AAW firewall vs. integrate with cloud main firewall).
  • [x] Get VNet architecture diagrams from Danielle
  • [x] Indicate both possible decision paths in https://github.com/StatCan/daaas/issues/1127
• [x] Feedback from Brendan
• [x] Implement feedback from Brendan
• [x] Feedback meeting with Danielle + Michel (June 17)
• [x] Implement feedback from Danielle + Michel
• [x] Submit ConOps/RMI

[thomdan]

Here's the link to the AAW Hybrid data ConOps template: DAaaS Hybrid Data AAW ConOps. I filled in what I could; feel free to modify as needed and reach out if you have questions. I suggest completing this ConOps for connections between AAW & cloud main in general instead of making it specifically for connections to GitLab. This way you'll be covered for other requests. You can also refer to the DAaaS Hybrid Data CAE CAS & FDI ConOps as needed.

[Collinbrown95]

CC: @brendangadd

The ConOps has been submitted for review, so the scope of work for this ticket is finished. We will open an additional issue for any changes required in the review process.