Why enable-mesh-pod-addressability is undocemented and what is the current update of this feature?

[husnialhamdani]

https://github.com/knative/serving/blob/main/vendor/knative.dev/networking/config/config-network.yaml#L187

I found enable-mesh-pod-addressability is so helpful when we enabled Istio mTLS, as there's no more intermittent hanging request to a Knative service,

Why is it undocumented?

Context: we need to use Istio mTLS to achieve Knative-Istio multi-tenancy networking RBAC, what is the best way/approach to have per tenant access restriction?

[orfeas-k]

according to this #10751 (comment), this is unfinished work (although it looks like it's working). Also the code mentions

    # If true, networking plugins can add additional information to deployed
    # applications to make their pods directly accessible via their IPs even if mesh is
    # enabled and thus direct-addressability is usually not possible.
    # Consumers like Knative Serving can use this setting to adjust their behavior
    # accordingly, i.e. to drop fallback solutions for non-pod-addressable systems.
    #
    # NOTE: This flag is in an alpha state and is mostly here to enable internal testing
    #       for now. Use with caution.
    enable-mesh-pod-addressability: "false"

[dprotaso]

Supposedly Istio let's you have pod addressability when there is no port translation in the kubernetes service

I need to investigate this and if that's the case when we can drop that 'knob' attribute as it would just work by default.

That's why we haven't promoted that knob past alpha

[orfeas-k]

@dprotaso FWIW, I was playing around in the context of Kubeflow and requests from activator would be dropped (even with an ALLOW policy from knative-serving namespace) with RBAC: access denied when this flag was unset. When I set it + restarted activator+autoscaler, requests started being successful (with the aforementioned policy always in place).

[dprotaso]

What value did you set it to?

Really all enable-mesh-pod-addressability does is scrape metrics through the revision's k8s service cluster IP. And I believe the activator will route that way as well.

I'm surprised about the RBAC access denied - how is Istio being installed?