search

signadot / community

Issue tracker for Signadot
2 stars 1 forks source link

[new feature] Support for Linkerd #8

Open scott-cotton opened 2 years ago

scott-cotton commented 2 years ago

New feature or functionality What would you like Signadot to do?

Support Linkerd service mesh.

Additional considerations Anything in particular to think about regarding this new feature?

It may be interesting to consider doing this via smi-spec

scirner22 commented 2 years ago

I'm currently evaluating Signadot and we use Linkerd so this feature would be great!

scott-cotton commented 2 years ago

As it turns out, Linkerd has some recent changes w.r.t. the routing we would need, and it is not really ready yet.

Although the Linkerd docs state that it supports smi-spec TrafficSplit without additional configuration, Linkerd 2.12.1 (latest stable) does not install the smi-spec CRDs unless one also installs the smi extension. Without the CRDs, one cannot use TrafficSplit, and without traffic split I believe we cannot support Linkerd, as that appears to be their mechanism for redirecting traffic in-cluster under matching conditions. Unfortunately, the smi extension installs v1alpha1 of TrafficSplit (https://github.com/servicemeshinterface/smi-spec/tree/main/apis/traffic-split), which does not appear to support 'matches', which would be necessary for us to support Linkerd (at least with context prop, see below).

@scirner22 are you using the CNI plugin? Are you using the smi plugin? Would using l5d-dst-override on signadot endpoint urls for single fork sandboxes be worth investigating for your use?

scirner22 commented 2 years ago

That looks accurate to me. When I investigated this it appeared Linkerd will not support the header based routing features of TrafficSplit until 2.13.

At least for our use case, something like l5d-dst-override would not help much because we're dependent on the request going through our api gateway so that authentication can happen which will add some needed headers. This being a test environment I have the luxury of turning off Linkerd at the namespace level so that I can inject the Signadot sidecar for the time being. This will allow me to stand up a full POC environment.

Thanks for looking into a solution here - I appreciate it!

scott-cotton commented 2 years ago

For reference, this issue tracks Linkerd header based routing. https://github.com/linkerd/linkerd2/issues/3165

joebowbeer commented 1 year ago

Header based routing was released in Linkerd 2.13 (2.14 is latest)

https://linkerd.io/2.14/tasks/configuring-dynamic-request-routing/

scott-cotton commented 1 year ago

Header based routing was released in Linkerd 2.13 (2.14 is latest)

https://linkerd.io/2.14/tasks/configuring-dynamic-request-routing/

thanks for helping keep the issue up to date -- and yes, we are well aware of that.

foxish commented 2 months ago

This is likely something we may implement via https://github.com/signadot/community/issues/53