Enable mTLS in the service-mesh

[piotrmsc]

Description

Enable mTLS globally (mesh-wide) and if necessary support component owners with creating rules disabling mTLS for their component. If disabling is required then it has to be first double checked that it really need plain text communication + mentioned here.
To enable mTLS in eventing enable sidecar in natss-streaming first.
Remember to update our documentation for istio installation as well.

Reasons
Containers that run on a Kyma cluster communicate with each other over plain network connections. Channel security is generally not being enforced.

While containers are deployed with an istio envoy sidecar, istio mTLS is not enabled.

Attachments

[piotrmsc]

There is a problem with nats-streaming when it has sidecar injected and event-bus-publish/subscribe pods have sidecar as well. When the client tries to connect sing nats protocol it has i/o timeout. Istio does not support nats protocol, however, nats documentation mentions it's a plain text format.
What I have managed to achieve is a successful telnet connection from pod with sidecar to nats-streaming and doing simple hello pub/sub flow.
There are 2 issues reflecting the same problem

• in nats-operator Nats-Operator incompatible with istio? nats-io/nats-operator#88
• and in istio itself NATS can not work with istio istio/old_issues_repo#338

I'm still investigating.