Support for egress gateway component

[strekm]

Description

Atm Kyma Istio comes with Istiod and Ingress gateway enabled by default. Add possibility to enable and configure Istio egress gateway component in similar way as other components. There should be possibility to configure kubernetes resources, HPA.

TODOs:

• [x] ADR
• [ ] threat modelling
• [ ] implementation
• [ ] automated e2e tests
• [ ] tutorial
• [ ] adjust Istio documentation (default Istio setup, CRD, Default resources..., and any other places)
• [ ] adjust Enable Istio access logs operation guide if needed

Reasons

Adding possibility to enable egress gateway

DoD:

• [ ] Create a follow-up issue.
• [ ] Provide unit tests.
• [ ] Provide integration tests.
• [ ] Provide documentation.
• [ ] Test on a production-like environment.
• [ ] Check the outcome of all related pipelines.
• [ ] Verify resource limits.
• [ ] As a PR reviewer, verify code coverage and evaluate if it is acceptable.
• [ ] Create a release and bump in Kyma.
• [ ] Add release notes and What's New notes for Kyma customers.

Attachments

https://github.com/kyma-project/istio/blob/main/docs/user/03-technical-reference/istio-custom-resource/01-30-istio-custom-resource.md

[kyma-bot]

This issue or PR has been automatically marked as stale due to the lack of recent activity. Thank you for your contributions.

This bot triages issues and PRs according to the following rules:

• After 60d of inactivity, lifecycle/stale is applied
• After 7d of inactivity since lifecycle/stale was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Close this issue or PR with /close

If you think that I work incorrectly, kindly raise an issue with the problem.

/lifecycle stale

[abbi-gaurav]

One requirement from a team:

• We need working example on how to configure Istio egress mTLS
• When java application makes external call to some URL istio should make HTTPS connection and if server has appropriate CA attach our client certificate

@strekm, please comment if this would be feasible or not. if not, what are the alternates

[i064689]

@strekm could you please help us with a working example on how to configure Istio egress mTLS

[a-thaler]

We need to understand if the egress gateway is also just another envoy proxy where access logs can be enabled the same way as with ingress gateway, and enrich the documentation accordingly.

[strekm]

We need to understand if the egress gateway is also just another envoy proxy where access logs can be enabled the same way as with ingress gateway, and enrich the documentation accordingly.

@a-thaler egress is just another proxy. i did not find any ingress / egress specific configuration where it comes to access logs so it is safe to assume this is common.