Allow specifying an IP:port for istiod address.

[costinm]

For VM and other non-k8s environments, allow specifying an IP:port address without changing /etc/hosts

The DiscoveryAddress was also used to set the ServerName, for cert validation - typically istiod-REV.istio-system.svc - and gets
resolved in k8s to the cluster IP, and on VMs was using /etc/hosts.

After this change, the DiscoveryAddress can be an IP:port - either the pilot endpoint if it is stable, or the east/west gateway IP -
without having to touch /etc/hosts. The Istiod cert will be validated with the custom SAN.

For VMs and similar environments it is the IP of the east-west gateway or a similar load balancer. Current instructions
modify /etc/hosts to map the name to IP, but sometimes it is not possible or convenient to change /etc/hosts.

This is for internal use, for tools that setup/launch Istiod.

Change-Id: Ibcc1f5a6bd4235d21f4e278d1197749ed6463922

Please provide a description of this PR:

[stevenctl]

Why can't we just use proxy config?

I suppose we should also document that this is an option if you can access pilot directly and don't need to go through a gateway.

Do we run into any TLS issue due to using the IP instead of a valid name?

[costinm]

Re ProxyConfig - it's not supposed to be user-configurable. Some launcher or installer will get the endpoint IP ( or the LB address ), and set it before launching the agent. We currently configure it in /etc/hosts.

I think there is a better way to achieve the same result, will rewrite the PR - we need both IP:port and the 'SAN' to validate, I started with keeping DiscoveryAddress be the URL and overriding the actual IP, but it seems better to go the other way, make the DiscoveryAddress be IP:port and overriding the SAN.

It seems I also need to update Citadel client ( I initially tested with MeshCA, but if citadel is used it needs similar override ).

Sorry for the false start, hold on for few days...

[costinm]

PTAL - switched to overriding the SAN, and added citadel client too. This is far more useful - and may allow more flexibility and consistency if we want to allow Istiod to also support workload identity (again). I don't remember how we lost it, but older releases did support using spiffee identity for pilot.

[howardjohn]

looks good, will leave approval to others as they had comments