Set kube-apiserver service external traffic policy to local so that a…

[mreiger]

…udit events appear with their real source IP

[mreiger]

Gardener's own extension provider for Alicloud also does this:

https://github.com/gardener/gardener-extension-provider-alicloud/blob/0969fd18ba393658fccf44b07184b4e6d1535fa0/pkg/webhook/utils/service.go#L27

[Gerrit91]

I assume this PR got outdated as there is now the istio-gateway in front of the services, which makes it even harder to reveal client source IPs for the audit logs.

This PR comes with the disadvantage that there is a chance that the API server becomes unavailable when the MetalLB on the worker node that runs the API server instance(s) is rolled / updated / not running properly (weaker availability). (https://metallb.universe.tf/usage/#local-traffic-policy-1)

Maybe there is only a good solution available when we get rid off kube-proxy to prevent SNAT, which is something that Cilium seems to offer. It could be reasonable to just open an issue regarding this requirement for further discussions and close this PR.

[mreiger]

Yes this is now outdated; the problem persists though since the service for the istio gateway has externalTrafficPolicy: Cluster.

There is already an issue: #186. I am closing this PR and we'll discuss how to move forward from here in the issue.