ExternalServices shouldn't rely on the existence of a TrafficPermission

[lahabana]

Description

When delete default TrafficPermission then ExternalServices don't work at all. Kuma generates outbounds for ES based on the TrafficPermission policy (no permission -> no outbound).

Can we just have a RBAC filter on the external service listener? What happens with Egress?

• Refactor InferProtocol  #8468

[github-actions]

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

[github-actions]

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

[lahabana]

Should we close this now? @lukidzi ?

[slonka]

This is still a problem, we shouldn't close this ☝️

[cbugneac-nex]

I'm on Kuma version 2.4.3 and decided to migrate to MeshTrafficPermission from TrafficPermission. Created default allow all initially to not break working things:

---
apiVersion: kuma.io/v1alpha1
kind: MeshTrafficPermission
metadata:
  namespace: kuma-system
  name: allow-all-default
  labels:
    kuma.io/mesh: default
spec:
  from:
  - default:
      action: AllowWithShadowDeny
    targetRef:
      kind: Mesh
  targetRef:
    kind: Mesh

And now access to ExternalServices doesn't work even if I add explicit MeshTrafficPermissions for ExternalServices.

[lukidzi]

My idea to change the behavior:

• Remove matching service with TrafficPermisson
• Deliver all ExternalServices to Dataplanes when there is no TrafficPermission/MeshTrafficPermission defined
  • If ReachableServices are defined we filter out ExternalServices
  • TrafficPermission/MeshTrafficPermission for ExternalServices has only impact when using Egress

I am not sure the best way to handle Auto ReachableServices, they are relying on the MTP so the user would need to define policy to have access or we could deliver all ES until there is a policy matching ES but it seems a bit complicated.

Can we just have an RBAC filter on the external service listener? What happens with Egress?

I don't think that we should define RBAC in outgoing traffic, just configure RBAC when using egress. Should we allow all when no policy or deny and require the user to define it?