fix(istio): support for ExternalIPs in Istio resources

[KarstenSiemer]

Description

✨ Add support for ExternalIPs in Istio Gateway and VirtualService
ℹ️ This commit extends Istio Gateway and VirtualService resources to support ExternalIPs.
The changes include:

• Checking if service has ExternalIPs defined
• If yes, adding them to the list of targets
• If not, continuing with the existing process

👌 Now you can have your Istio resources use externalIPs too! 🎉

Not to be ip-percritical, but don't we all love an ipgrade! 🎈

Fixes #1718
Fixes kubernetes-sigs/aws-load-balancer-controller#3490

Reason being is that aws load balancer controller does not support creating ALBs on service type resources and if provisioned using e.g. terraform, will also not add any status fields to the service.
To still be able to point to targets from the service, externalIPs is required and functional using the ingress provider.
This is however not the case for the Istio implementations, here externalIPs does not pose any effect - this PR shall fix this and align the source providers from Istio with other source providers external-dns provides.

Sample diagram of infrastructure:

Here the NLBs are to provide static pre-allocated IPs to the ALBs.
Which is the suggested solution by AWS for getting static IPs for ALBs. ($$$)

Target accumulation stops after extracting externalIPs, if there are any.
This is because status loadbalancers should be ignored as they might not be the loadbalancer of first contact and externalIPs should mark the external availability endpoint if set.

Plus, it seems like service.go has chosen the same approach in extractLoadBalancerTargets.

Note: This problem should also be fixable by using the targetAnnotationKey at the Istio-Gateway resource.

I have additionally tested this PR in an EKS Cluster for both Istio sources.

Checklist

• Unit tests updated
• End user documentation updated

End user documentation already includes an spec.externalIPs statement, which comes only true after this PR for Istio sources.

2. Otherwise, if the Service has one or more spec.externalIPs, uses the values in that field.

[k8s-ci-robot]

Hi @KarstenSiemer. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[mloiseleur]

It looks good. Thanks @KarstenSiemer !
Wdyt about adding a few words on this in istio tutorial docs ?
/ok-to-test

[mloiseleur]

/lgtm

[KarstenSiemer]

@mloiseleur Yes, I think you are right. A few sentences about target accumulation should be in the istio docs.
I tried to keep it short to not having to add a TL;DR and linked the source service docs to not run into doc duplication problems.
I called it "Istio Ingress Gateway" on purpose, I was unsure because in the lines above it is usually called "Istio Gateway" - but this refers to the CRD of the Gateway and in that CRD it specifically mentions istio: ingressgateway in the selector, which is also where that Kubernetes service originates from.
Do you like the added docs or shall I change something about it?

[mloiseleur]

It's concise and clear.
/lgtm

[KarstenSiemer]

is there still anything I have to do to get this merged?

[szuecs]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: szuecs

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [szuecs]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment