Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Soften language used about service meshes with Akka in documentation #32336

Open
jroper opened this issue Mar 1, 2024 · 1 comment
Open

Soften language used about service meshes with Akka in documentation #32336

jroper opened this issue Mar 1, 2024 · 1 comment

Comments

@jroper
Copy link
Contributor

jroper commented Mar 1, 2024

The Remote Security page says:

Encryption and authentication via a service mesh is not an option for Akka Cluster as described in Service mesh.

The Remoting page that it links to says:

In a Kubernetes environment, many people turn to a service mesh such as Istio, Linkerd or Consul to authenticate and encrypt their network communications, however this is not an option for Akka cluster communication. The goal of a service mesh is to ensure that services do not need to be aware of where and how the services they talk to are deployed, a service mesh hide this, a client thinks its only talking to one logical service, while the service mesh handles concerns such as load balancing, encryption, authentication and authorization, and so on. Akka clusters however need to understand how and where the individual nodes are deployed, in order to implement their stateful features such as sharding, replication and peer-to-peer messaging. When deploying a service that uses Akka Cluster to a service mesh, the Akka Cluster communication must bypass the service mesh.

While these two statements are 100% correct, they are likely to mislead users into thinking that Akka cannot be used with a service mesh, and that Akka cannot benefit from what a service mesh has to offer. Of course, this is not true, Akka services talking to other HTTP services, or even talking to other Akka services using HTTP, as opposed to communicating within a cluster, can benefit greatly from what a service mesh has to offer, including transparent mTLS, workload identity and authorization, and routing policies used to implement deployment strategies such as blue/green, A/B and canary, etc.

I think therefore we should soften the language here to say things along the lines of "While a service mesh can complement Akka deployments well, particularly for HTTP and gRPC communication between Akka services, communication between nodes of an Akka cluster cannot be done through a service mesh." I think it would also benefit if we had some documentation somewhere that we can link to from these places about how Akka applications may take advantage of a service mesh, and include some high level instructions of what needs to be done to ensure Akka clustering still works. We do currently have this, but that's Istio specific and buried deep within the Akka Management documentation.

@TylerJewell
Copy link

To address this, there should probably be a section in the Akka Management docs added that discuss specific areas of concern that any operator should consider when deploying Akka with a service mesh. Perhaps a part of the Cluster Bootstrap section, https://doc.akka.io/docs/akka-management/current/bootstrap/index.html#akka-cluster-bootstrap.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants