feat(kuma-cp) TrafficPermission for ExternalServices

[jakubdyszkiewicz]

Summary

TrafficPermission support for ExternalServices.
With regular services we have a sidecar on both ends, so we execute traffic permission on the destination side.

With ExternalServcies there is no sidecar on the destination end, so we cannot apply the policy.
However, if we have Mesh passthrough false we control all the traffic (if traffic is unfamiliar to a mesh, we block it).

We can use this capability to use TrafficPermission with ExternalServices. This means that if you don't have TrafficPermission for a given ExternalService, we will omit this ExternalService when generating Envoy config.
Omitting a service will result as we don't have ExternalService defined at all meaning that the traffic is blocked.

Implementation

Implementation was tricky because with regular services we just match inbound of the dataplane, because we are blocking incoming traffic. Here we want to block the outgoing traffic from the dataplane.
We cannot match outbound of the dataplane and remove it because we need to mimic the same behavior as the service was in the mesh.

If we were to match outbound, the following policies

type: TrafficPermission
name: backend-to-httpbin
mesh: default
sources:
  - match:
      kuma.io/service: 'backend'
destinations:
  - match:
      kuma.io/service: 'httpbin'
---
type: TrafficPermission
name: web-to-httpbin
mesh: default
sources:
  - match:
      kuma.io/service: 'web'
destinations:
  - match:
      kuma.io/service: 'httpbin'

Would allow the traffic from both backend and web to httpbin, but this is not consistent with the current behavior!
We want to match the most specific policy for httpbin as it was a service in the mesh.

To do this, in the XDS watchdog I take all external services and match them one by one with traffic permissions.
This operation is common for all dataplanes in the given mesh so we could cache this but I don't think this will be a bottleneck with the majority of cases.

Breaking change

This is a breaking change in my opinion and it should be merged only to master because previously we did not require Traffic Permission to External Services, we do now.

Documentation

• In progress