service-mesh: implement secure ingress

[3u13r]

Changes:

• Setup iptables to re-route ingress traffic
• Add default iptables+envoy config which requires clientAuth (on port 15006)
• Add options to except traffic from (1) client auth (Envoy port 15007) or (2) tls completely

TODOs:

• Figure out testing / reducing the deployment count
  • Since we add only one deployment (which also does egress service mesh, we can combine both to one deployment)
  • Testing will be done using the new framework currently being implemented
• Make clientAuth configurable
• Generally refactor config generation a bit
• Discuss if we want to make the IPTables unit testable similar to https://github.com/istio/istio/blob/4993a7d7decf4a09ba8640ad9dea7ac533f9ff76/tools/istio-iptables/pkg/capture/testdata/tproxy.golden
  • We can create a follow up ticket for this
• Document what those IPTable rules do

[burgerdev]

lgtm overall

[malt3]

I’m not sure if I’m overlooking something, but I believe we still need to add this as an e2e test, right?
That can also be a follow-up. I just believe that we need to ensure that the service mesh does not break. EDIT: Just saw #248. Ignore this :)

[3u13r]

cherry-picked the e2e test commit from Markus and updated it to fit the current e2e test requirements.