Support service meshes

[cjellick]

See obot-platform/obot#456 for more details, but the idea is to improve networking and security posture of acorn apps by creating the proper underlying service mesh resources when launching an acorn app

[cjellick]

We want mTLS and visibility (linkerd)

[StrongMonkey]

We have developed a linkerd plugin to support service mesh.

Repo: https://github.com/acorn-io/acorn-linkerd-plugin

It currently provides:

• Automatically inject linkerd sidecar to every acorn to privode mTLS and traffic metrics
• It will shutdown jobs that is completed but have a pending sidecar Feature: Add lifecycle hooks to pods from jobs automatically linkerd/linkerd2#8006
• Configures network policy to ensure project-level isolation.

QA

To verify the functionality above, we can test the following behavior

• When launching an acorn app, the sidecar will injected. Can verify this by doing acorn logs, you should be able to see logs from linkerd sidecar

• When launching acorn app with job defined, it should complete and not hang.

• The acorn app can't not reach to apps in different projects(either though k8s service discovery or pod IP). However, it should be able to reach app that is in the same project.

[cjellick]

Need to figure out if we want to expose this in the acorn docs

[cjellick]

As discussed, we will need docs for this explaining how to leverage this integration in acorn

[cjellick]

@g-linville what remains here is adding docs explaining our linkerd integration. They should:

1. call out that the feature is experimental
2. explain you need to install the plugin (hopefully with some reasonably easy steps to do so)
3. explain the benefits you get (automatically putting apps on to the mesh and cross project isolation)

Can you pick this up? (And turn around some docs within 24 hours of now).

Doesn't have to be super comprehensive, just reasonably helpful

[cjellick]

We've decided to bump this out of the release entirely, pending a re-evaluation of our mesh solution in hub