Istio supports EndpointSlice objects since release 1.13. It is enabled by default in Istio on Kubernetes 1.21 (OpenShift 4.8) and higher.

Unfortunately this feature breaks traffic between federated clusters, because federation controller uses endpoints lister to get endpoints.

Using endpoint slices can be disabled by setting flag PILOT_USE_ENDPOINT_SLICE=false and then Istiod uses endpoints. This flag is currently disabled in federation test to make it work.

This is not disabled in our operator, so federation will not work for now. We have to decide whether we want to support this feature or not. If we don't, then it's just needed to disable this flag in operator. However it's important to note that EndpointSlice objects were implemented to improve scalability and performance in large deployments. What's more, Endpoints in Kubernetes 1.22 (OpenShift 4.9) and higher will be not updated when an Endpoint resource contains 1000 network endpoints. For more details about Endpoint limitations look at this: https://kubernetes.io/docs/concepts/services-networking/service/#over-capacity-endpoints. Effectively without support for EndpointSlice objects, OSSM will not fully support traffic when user deploys more than 1000 pods of the same service.

Taking into account the above, I think that it's very important to support EndpointSlices.

TODO:

• update function getEgressAddrs to support both Endpoints and EndpointSlices depending on whether EndpointSlices are enabled
• enable support for EndpointSlice in federation test.

QE:

• Does not require any action nor additional tests.