Egress e2e test

[strekm]

Description

Based on https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/ and internal script create automated e2e test. Assuming gardener AWS(?) cluster, having Istio installed. The test should execute following scenario:

• enable egress
• create test istio injected namespace
• deploy curl
• deploy NetworkPolicy to limit egress traffic from test namespace to kube-system and to istio-system
• test that external service a is not reachable
• test that external service b is not reachable
• create corresponding Istio resources to allow routing to external service a only through egress (Gateway, DestinationRule, VirtualService)
• test that external service a is reachable
• test that external service b is not reachable
• clean up

open questions:

• should we test egress traffic from other ns to make sure we are not blocking traffic

ToDos [Developer]

• ...

PRs

• ...

ACs [PO]

• e2e test created, testing outgoing traffic limited to specific service
• e2e test triggered on post and release WH
• ci/cd docu updated if needed

DoD [Developer & Reviewer]

• Provide unit and integration tests.
• Provide documentation.
• Verify if the solution works for both open-source Kyma and SAP BTP, Kyma runtime.
• If you changed the resource limits, explain why it was needed.
• If the default configuration of Istio Operator has been changed, you performed a manual upgrade test to verify that the change can be rolled out correctly.
• Verify that your contributions don't decrease code coverage. If they do, explain why this is the case.
• Add release notes.

Attachments

part of: #419