feat(kuma-cp): implement MeshTrafficPermisson for ExternalServices with ZoneEgress

[lukidzi]

Checklist prior to review

• Link to relevant issue as well as docs and UI issues --
• This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like syscall.Mkfifo have equivalent implementation on the other OS --
• Tests (Unit test, E2E tests, manual test on universal and k8s) --
• Do you need to update UPGRADE.md? --
• Does it need to be backported according to the backporting policy? --
• Do you need to explicitly set a > Changelog: entry here or add a ci/ label to run fewer/more tests?

[michaelbeaumont]

I don't get it, isn't this implementing MeshTrafficPermission for ExternalService (assuming ZoneEgress of course, which I believe is meant to become required)? Isn't that the feature here?

[lukidzi]

I don't get it, isn't this implementing MeshTrafficPermission for ExternalService (assuming ZoneEgress of course, which I believe is meant to become required)? Isn't that the feature here?

It's more support for ZoneEgress with ExternalService than ExternalService support. If I understand correctly MeshTrafficPermisson is an inbound policy so even if you have ExternalServices but no ZoneEgress policy won't have an effect.

[michaelbeaumont]

Yeah I know it requires ZoneEgress it's just that for a user the feature is "you can use MeshTrafficPermission with ExternalServices". I mean you targetRef the ExternalService, not a ZoneEgress proxy. I just want the changelog to be useful to users

[lobkovilya]

If I understand correctly MeshTrafficPermisson is an inbound policy so even if you have ExternalServices but no ZoneEgress policy won't have an effect.

Speaking of this, have you had a chance to check MeshTrafficPermission with ZoneEgress when there are no TrafficPermissions? We have the issue #6589, but I'm not sure if it affects deployments with ZoneEgress

[lukidzi]

If I understand correctly MeshTrafficPermisson is an inbound policy so even if you have ExternalServices but no ZoneEgress policy won't have an effect.

Speaking of this, have you had a chance to check MeshTrafficPermission with ZoneEgress when there are no TrafficPermissions? We have the issue #6589, but I'm not sure if it affects deployments with ZoneEgress

We are testing if traffic is blocked without TrafficPermission so I feel like that issue is still relevant.

[lobkovilya]

Right, I just wanted to make sure the issue doesn't affect the case with ZoneEgress