Ability to access universal workloads without a zoneIngress

[lahabana]

Description

In the universal case quite often vms are available to the entire network.

It would make sense to be able to access them directly.
This would make universal even easier to setup (you just need to run the cp and the dp).

The implication is that a MeshService may have endpoints to expose directly.

[jakubdyszkiewicz]

endpoints directly? I'm not sure that's a good idea. That's basically External Service

I think kuma-dp on VM should start with Dataplane object that is sent to CP but persisted on Kube. Then you apply MeshService on Kube that selects this DPP

Open questions/things that comes to my mind

• In what namespace persist DPP and where apply MeshService?
• How to handle auth? Do we support both methods of auth on CP then? SA and DP token?

[jakubdyszkiewicz]

Triage: is it flat multizone for all zones or flat zone as opt-in?