Support for service meshes

Services meshes are the state-of-the-art technology to secure all communication within and between Kubernetes clusters. To achieve this, service meshes typically intercept and redirect the traffic to/from the Pods using proxy containers that are injected into the application Pods. Those proxies can then secure the communication between Pods using mTLS. In such scenarios, the service mesh control plane takes care of the complex and error-prone certificate management for the various mTLS connections, while being transparent to the actual application workloads.

The installation and configuration of a service mesh is the responsibility of the cluster operator and not part of the SOT installation process. However, it is in recommended to make use of service meshes to secure all communication between SOT modules running in the same cluster.

While, the final choice of the used service mesh technology is the responsibility of the cluster operator, SOT comes with built-in integration support for the Linkerd service mesh project (https://linkerd.io/) as well as the Istio service mesh project (https://istio.io/). These integrations allow to automatically configure a SOT installations to make use of Linkerd or Istio. More details about the required configurations, can be found in the "ServiceMeshConfiguration" section of this document.

To integrate with other service mesh technologies and projects, the required integration settings, e.g., additional annotations, have to be manually created and are out of scope of the automated SOT installation.