SRVCOM-2728: High CPU/memory usage of istio-proxies when adding ksvcs

[pierDipi]

Add Sidecar configuration in tenant's namespaces to restrict egress rules and reduce cpu/memory usage.

Documentation https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/service_mesh/service-mesh-2-x#ossm-routing-sidecar_traffic-management

This command will generate these 2 Sidecar resources

helm template ./ --values tests/values.yaml

# ...
---
# Source: knative-istio-authz-onboarding/templates/common-tenant-sidecar.yaml
# Restrict namespace ns1 sidecars egress rules to tenants specific namespaces so that
# application sidecars don't consumer a ton of memory/cpu.
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: default
  namespace: ns1
spec:
  egress:
    - hosts:
        - "ns1/*"
        
        - "ns2/*"
        
        - "istio-system/*"
        - "knative-serving/*"
        
        - "knative-eventing/*"
---
# Source: knative-istio-authz-onboarding/templates/common-tenant-sidecar.yaml
---
# Restrict namespace ns2 sidecars egress rules to tenants specific namespaces so that
# application sidecars don't consumer a ton of memory/cpu.
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: default
  namespace: ns2
spec:
  egress:
    - hosts:
        - "ns1/*"
        
        - "ns2/*"
        
        - "istio-system/*"
        - "knative-serving/*"
        
        - "knative-eventing/*"

[openshift-ci-robot]

@pierDipi: This pull request references SRVCOM-2728 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.15.0" version, but no target version was set.

In response to this:

Add Sidecar configuration in tenant's namespaces to restrict egress rules and reduce cpu/memory usage.

This command will generate these 2 rules

helm template ./ --values tests/values.yaml

# ...
---
# Source: knative-istio-authz-onboarding/templates/common-tenant-sidecar.yaml
# Restrict namespace ns1 sidecars egress rules to tenants specific namespaces so that
# application sidecars don't consumer a ton of memory/cpu.
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
 name: default
 namespace: ns1
spec:
 egress:
   - hosts:
       - "ns1/*"
       
       - "ns2/*"
       
       - "istio-system/*"
       - "knative-serving/*"
       
       - "knative-eventing/*"
---
# Source: knative-istio-authz-onboarding/templates/common-tenant-sidecar.yaml
---
# Restrict namespace ns2 sidecars egress rules to tenants specific namespaces so that
# application sidecars don't consumer a ton of memory/cpu.
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
 name: default
 namespace: ns2
spec:
 egress:
   - hosts:
       - "ns1/*"
       
       - "ns2/*"
       
       - "istio-system/*"
       - "knative-serving/*"
       
       - "knative-eventing/*"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[pierDipi]

@maschmid is there any way you can double check this in your tests?

[maschmid]

Trying it now.

[maschmid]

/lgtm

It works fine on the 1000 ksvc test. Let's try to merge it and backport, and then we should check all the MT-related SO tests in CI.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: maschmid, pierDipi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [pierDipi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[pierDipi]

/cherry-pick release-1.31

[openshift-cherrypick-robot]

@pierDipi: once the present PR merges, I will cherry-pick it on top of release-1.31 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.31

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-cherrypick-robot]

@pierDipi: new pull request created: #9

In response to this:

/cherry-pick release-1.31

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.