POC - State Sharing

[shaun-nx]

Questions to answer, and things to consider, during this POC

• 1. Should zone_sync be enabled by default?
• 2. Can it be secure, by default? (Current implementation of Headless Services does not use TLS)
• 3. Do we require a flag/cli argument?
• 4. Should this capability be toggled dynamically? (i.e. when enabling capabilities that take advantage of this)
• 5. What would be the effort to decouple this capability from our OIDC implementation
• 6. Do we need to refactor logic of current rate limiting where we divide by replicas?
• 7. Identify independent functionality that needs to be in place to avoid one large change
• 8. Identify if a TMA is required

[github-actions]

Hi @shaun-nx thanks for reporting!

Be sure to check out the docs and the Contributing Guidelines while you wait for a human to take a look at this 🙂

Cheers!

[jjngx]

Questions to answer, and things to consider, during this POC

• 1. Should zone_sync be enabled by default?

No, we do not want to enable the functionality if it's not used.

• 2. Can it be secure, by default? (Current implementation of Headless Services does not use TLS)

TBD

• 3. Do we require a flag/cli argument?

Yes. We want to be explicit. Add validation.

• 4. Should this capability be toggled dynamically? (i.e. when enabling capabilities that take advantage of this)

No. See above - we want to be explicit, validate and "fail fast".

• 5. What would be the effort to decouple this capability from our OIDC implementation

TBD (?)

• 6. Do we need to refactor logic of current rate limiting where we divide by replicas?

Yes, for OSS and N+. TBD. The current implementation will still be used for OSS.

• 7. Identify independent functionality that needs to be in place to avoid one large change

TBD

• 8. Identify if a TMA is required

Yes, it will be required. See communication between NGINX instances (NIC - pods).