Setup `EgressGateway`

[mathieu-benoit]

• https://cloud.google.com/service-mesh/docs/security/egress-gateways-best-practices
• https://cloud.google.com/service-mesh/docs/security/egress-gateway-gke-tutorial
• https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/
• https://cloud.google.com/service-mesh/docs/gateways#egress
• https://istio.io/latest/docs/ops/best-practices/security/#securing-egress-traffic
• https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages/tree/main/samples/gateways/istio-egressgateway
• https://github.com/crcsmnky/istio-egress-gateway

TODOs:

• [ ] Review NetPol in Egress as per https://cloud.google.com/service-mesh/docs/security/egress-gateways-best-practices#use_kubernetes_network_policies_as_a_firewall_for_pods_and_namespaces

[mathieu-benoit]

Apparently asm-ingress > asm-ingressgateway needs to access:

warn    Error fetching GCP zone: Get "http://metadata.google.internal/computeMetadata/v1/instance/zone": dial tcp: i/o timeout

[mathieu-benoit]

Performance impact? https://istio.io/latest/blog/2019/egress-traffic-control-in-istio-part-3/#performance-considerations