[EKS/fargate] : Support for ISTIO service mesh sidecars

We are very keen to migrate our EKS workloads over to the recently released Fargate integration.

Unfortunately it appears as though it is not currently possible to deploy pods that use ISTIO injected sidecars, which seems to significantly limit the potential use of fargate.

The istio-proxy sidecar itself can be injected successfully but we've not managed to apply the subsequent iptables configuration to direct all traffic via the envoy proxy within the sidecar.

Istio supports two mechanisms for this:

1) istio-init container - this fails as under fargate the pod cannot be deployed within the required NET_ADMIN permission
2) istio-cni - this fails as we cannot schedule daemonsets on fargate, and even if we were to manually reconfigure as a sidecar then we cannot mount the required /opt/cni/bin host volume.

Does the migration to firecracker and the associated move of the fargate agent to outside the VM change the security posture for granting pods NET_ADMIN access? This appears to be the most flexible option, but we'd like to request support for network sidecar proxies be provided by whatever means...

Thank you!

No repository files, tests, or implementation entry points are named. Start by reviewing the EKS Fargate constraints described here, especially NET_ADMIN, daemonsets, and host-volume mounting, then determine whether a supported Istio sidecar networking approach exists; done means a documented and implemented way to route pod traffic through the proxy.

Written by the indexing model from the issue text.