dzueck opened a new issue, #8970: URL: https://github.com/apache/texera/issues/8970
### Feature Summary This feature is based off this discussion #6059. Right now all traffic between Texera services in the k8s deployment is plain text. This includes the webserver and other micro services talking to Postgres, LakeFS, RustFS and Lakekeeper, as well as traffic from compute units, which can run arbitrary code submitted by users. Anyone who can see the pod network can read credentials and data in transit. Add support for running Texera under a service mesh ([Linkerd](https://linkerd.io/)) so that traffic between pods is automatically encrypted with mTLS. This should be an option the deployer can easily enable, and it should have no effect on deployments that do not have the mesh installed. ### Proposed Solution or Design Linkerd adds its proxy to any pod that has the `linkerd.io/inject: enabled` annotation, so support can be added almost entirely through `values.yaml`: - Add a `podAnnotations` option to the Texera templates and set the Linkerd annotations for every service in `values.yaml`. - Use the existing annotation options of the third party charts (Postgres, RustFS, LakeFS, Lakekeeper, Envoy Gateway) to do the same for those pods. - Compute units and JupyterLab pods are created at runtime by the managing services, so annotate their namespaces instead of the pods. If Linkerd is not installed, nothing reads these annotations, so the deployment behaves exactly as it does today. ### Affected Area Deployment / Infrastructure -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
