Linkerd without kubernetes

[prdoyle]

What's the likelihood that Linkerd could one day run without Kubernetes? Is that a possibility at all? Is it on anyone's radar?

What would it take to make that happen?

[ihcsim]

@prdoyle: @olix0r mentioned this in his CNCF webinar yesterday. LMWYT. If you have specifics in mind, would love to work with you to put together a RFC.

[olix0r]

As a starting point, we may want to build upon something like our mock destination controller -- I'm somewhat partial to the idea of implementing a more general control plane in Rust, though ;)

Here are some of the concrete things we'll need consider:

• How does the proxy get configured with a workload? Basically, how would you implement linkerd inject for this platform?
• How does the application get configured to use the proxy? Or, what takes the place of proxy-init/linkerd-cni for this platform?
• How does service discovery work on this platform? Are there dedicated IP addresses for each logical service? Must service discovery be implemented via HTTP headers?
• How does workload identity work on this platform? Does a workload have a secret/token it can use to prove itself to an identity service? How would you validate workload CSRs?

If I were to implement this, I would focus on these core concepts before addressing any of the visibility/UI/etc.

[prdoyle]

Thanks so much for this. Looks like I have a lot of reading to do...

[prdoyle]

@olix0r - Sorry for the delay; this is a spare-time activity at the moment.

This isn't my specialty, so I hope you can excuse my ignorance, but here are a few initial thoughts on those questions...

To make this concrete, suppose the app were built as a collection of Docker images, and then deployed with docker-compose, possibly using --scale to run multiple copies of each service. Each image has an entrypoint script that boots the proxy (taking the place of linkerd inject), runs proxy-init to set up iptables, and then boots the main service binary. (I don't see anything k8s-specific in proxy-init; did I miss it?)

Servce discovery - not sure of the relationship between linkerd and service discovery. Does linkerd report a node's existence to the control plane in some way? Or is linkerd a passive consumer of service discovery managed by k8s?

CSRs - Not sure what to do about that. I don't know much about them. Maybe we can defer that for the moment?

What do you think so far?

[prdoyle]

Potentially related work here: https://discourse.linkerd.io/t/linkerd2-proxy-unmeshed/1091