Service Mesh follow-ups after 1.12 release #19698
Description
- Write a proper description to Add support for CiliumEnvoyConfig CRD #18894, including but not limited to:
- limitations, current things that are implemented, envoy resources that can be configured, resources that can't be configured, how this fits into the broader service mesh picture
- which components (cilium-agent, cilium-operator, cilium-proxy) are expected to interact with these resources
- RBAC
- flow of data
- Move Envoy specifics from
pkg/servicetopkg/k8s/watchers, see Add support for CiliumEnvoyConfig CRD #18894 (comment) @pippolo84 for v1.13.0-rc2. This is being tracked in Ingress: No healthy upstream for headless service #23182 - Prepend Envoy resource names with CEC/CCEC namespace (and name?) so that operator does not need to worry about that @pippolo84 for v1.13.0-rc1. Done as part of Prepend Envoy resources with CEC namespace and name #21500
- Add Ingress test with
reserved:ingresspolicy to cilium/cilium-cli connectivity test suite @pippolo84 for v1.13.0-rc2 (waiting for @sayboras to come back for more help). Tracked as part of CFP: Fix Ingress traffic interactions with other Policy enforcement #24536 - Upstream Envoy upstream callback feature now in
cilium/proxy/patches - Allow sharing of External Load Balancers for multiple Ingresses (with non-overlapping hosts/paths). Done as part of CFP: Shared Load Balancer for Ingress #21270
- Support multiple TLSs in envoy downstream context, see ingress: Add cilium ingress controller implementation #18867 (comment). Updated: done as part of ingress/model: Support multiple certs based on SNI #22671
- Standardize watcher/informer pattern, also address ingress: Add cilium ingress controller implementation #18867 (comment). Tracked in Modularization: Ingress #24601 as we are having new Hive and Cell pattern.