Allow Knative Services to not be exposed via Ingress

[scothis]

Expected Behavior

It should be possible to create a Knative Service that is not exposed via Ingress. This could be an event driven function that is invoked internally and should never be exposed to the public.

The same surgical routing that the Route resource provides for canaries and blue/green deployments is still desired. The only expected difference is that traffic from outside the cluster should be rejected.

Actual Behavior

All Knative Services are exposed publicly via Ingress.

Additional Info

This is an issue I've considered opening in the past. An attendee at SpringOne asked if this was possible. Unfortunately, I don't have more specifics about the particular use case.

/cc @tcnghia

[tcnghia]

Thanks for opening this issue. The same has been raised by many other users. We should prioritize this.

[tcnghia]

Since we are currently using Istio Gateway pods to avoid requiring Istio sidecar for making request to Route's internal domain, we can just simply drop the Route's VirtualService from the Gateway.

We probably will need to find another way to still expose the Route's internal domain for cluster local access without sidecar.

[mattmoor]

We get this ask a lot. Let's consider it for 0.3?

[tcnghia]

/assign @lichuqiang

[ZhiminXiang]

/cc

[sebgoa]

I mentioned this early in August. I would consider this a blocker.

So big +1