Re:Istio moved to CNCF Graduation stage
by agracey on Wednesday July 12, 2023 @11:12PM
(#36704604)
https://linkerd.io/ is a much lighter-weight alternative but you do still get some of the fancy things like mtls without needing any manual configuration. Install it, label your namespaces, and let it do it's thing!
[ Parent
| on HN ]
Re:Istio moved to CNCF Graduation stage
by vbezhenar on Wednesday July 12, 2023 @11:19PM
(#36704641)
I don't think that I need mtls and extra CPU load for useless (to me) encryption does not sound so good. Can I opt-out of this specific feature?
Also I'm worried about its pervasiveness. Is it possible to enable those side-cars only on selected pods?
Re:Istio moved to CNCF Graduation stage
by __warlord__ on Thursday July 13, 2023 @01:00AM
(#36705182)
At least in Istio yes, you can annotate pods or namespaces to be part of your service mesh.
So to answer my own question:
It's not possible to disable mtls with meshed services, no configuration option for this particular feature.
There's no pervasiveness with linkerd, one need to add `linkerd.io/inject: enabled` annotation to the target service and restart deployment.