Adopt Scuttle

[wleese]

Describe the feature request

In our Kubernetes environments that use Istio, we require an open source tool called "scuttle" (https://github.com/kvij/scuttle) to:

1. Start the application only when the network stack is ready (also mostly solved by init-containers)
2. Stop the envoy proxy container, when the actual application has finished running (NOT solved by init-containers)

The problem with scuttle is not technical per se, it is the fact that it is maintained by a single person, and has seen many forks due to lack of maintenance in the past. The original company that developed scuttle, no longer seems to be operational: https://github.com/redboxllc/scuttle / https://www.redbox.com/.

Some a security point of view, we'd prefer to have more solid ownership of this tool that is used extensively in our environment.

We would like to ask the Istio project to adopt scuttle, to secure ownership of this vital tool.

Describe alternatives you've considered

Affected product area (please put an X in all that apply)

[ ] Ambient
[ ] Docs
[ ] Dual Stack
[ ] Installation
[x] Networking
[ ] Performance and Scalability
[ ] Extensions and Telemetry
[ ] Security
[ ] Test and Release
[x] User Experience
[ ] Developer Infrastructure

Affected features (please put an X in all that apply)

[ ] Multi Cluster
[ ] Virtual Machine
[ ] Multi Control Plane

Additional context

Related to:
#11130 - App container unable to connect to network before sidecar is fully running #11130
#11659 - Istio & CronJob

[keithmattix]

Once Kubernetes sidecars progress to be on by default, is there still a need for scuttle?

[wleese]

@keithmattix would sidecars solve both issues:

#11130 - App container unable to connect to network before sidecar is fully running
#11659 - Istio & CronJob

?
Based on what I've read, that would seem so.

However.
That said, we're on GKE and it will still take a long time until 1.28 is rolled out in our environment. So regardless, I still believe this request is a valid one. The scuttle code base is small, the problem well understood and no new features have been added for a long time now. It would be a great service to provide/adopt this tool until the problems it solves are truly a thing of the past.

[keithmattix]

Yes the Kubernetes sidecar feature solves both of those: https://istio.io/latest/blog/2023/native-sidecars/

I'm not officially a maintainer so I'll refrain from speaking definitively, but based on my conversations with folks like @howardjohn and others, it's probably unlikely what we'll absorb another project that is inherently temporary. Instead, it would be in incredibly useful to take this new feature for a spin in a local or GKE alpha cluster and provide the community with feedback

[wleese]

@keithmattix Thanks for your input.

We're a company running thousands of applications on many clusters. Sadly we cannot move to new versions just because they're available to download. Instead, we have to move more slowly.

[howardjohn]

This is not likely to be picked up by Istio core. If there was a group of folks needing a neutral home to maintain it istio-ecosystem may be a viable path.

[wleese]

@howardjohn how would I move ahead in proposing scuttle is adopted by istio-ecosystem? I do not mind where it lands, as long as it somehow is owned by a party that is unlikely to disappear / lose interest in basic maintenance / be abused in a supply chain attack.

[howardjohn]

I think it would require 2+ parties to be interested in maintaining, then we can talk to steering to get a repo provisioned possibly.

It sounds like your issue is maintenance, though. That isn't solved by a repo, its solved by volunteers

[istio-policy-bot]

🧭 This issue or pull request has been automatically marked as stale because it has not had activity from an Istio team member since 2023-09-14. It will be closed on 2024-03-27 unless an Istio team member takes action. Please see this wiki page for more information. Thank you for your contributions.

Created by the issue and PR lifecycle manager.

[howardjohn]

Given the release of https://istio.io/latest/blog/2023/native-sidecars/ I don't think Istio will adopt any first class support for other solutions.