You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Telepresence is a very feature rich tool, designed to handle a large majority of use-cases. You can use it as a cluster VPN only, or use one of its three different ways (replace, intercept, or ingest) to engage with the cluster's resources.
9
+
10
+
Telepresence is intended to be installed in the cluster by an administrator and then let clients connect with a very limited set of permissions. This model is generally required by larger companies.
11
+
12
+
The client can be either completely contained in Docker or run directly on the workstation. The latter will require the creation of a virtual network device, and hence admin access.
13
+
14
+
## mirrord
15
+
16
+
Mirrord was designed with simplicity in mind. You install the CLI tool, and that's it. It will do the rest automatically under the hood.
17
+
18
+
Mirrord solves the same problem as Telepresence, but in a different way. Instead of providing a proper network
19
+
device and remotely mounted filesystems, mirrord will link the client application with a `mirrord-layer` shared library. This library will intercept accesses to the network, file system, and environment variables, and reroute them to a corresponding process in the cluster (the `mirrord-agent`) which then interacts with the targeted pod.
20
+
21
+
### Limitations
22
+
23
+
While mirrotd is simple to set up, the chosen approach has several limitations, both on the client and the cluster side.
24
+
25
+
### Limitations when using dynamic loading:
26
+
27
+
1. It will only work on Linux and macOS platforms. There's no native support on Windows.
28
+
2. It will only work with dynamically linked executables.
29
+
3. It cannot be used with docker unless you rebuild the container and inject the `mirrord-layer` into it.
30
+
4.`DYLD_INSERT_LIBRARIES` causes various problems on macOS (SIP prevents it from being used), especially on silicon-based machines where mirrord will require Rosetta.
31
+
5. Should Apple decide to protect their intel-based platform the same way as the silicon-based one in a future release, then mirrord will likely be problematic to use on that platform.
32
+
33
+
### Cluster Permissions
34
+
35
+
Mirrord does not require a sidecar. Instead they install a the `mirror-agent` into the namespace of the pod that it impersonates. That agent requires several permissions that a cluster admin might consider a security risk:
36
+
37
+
*`CAP_NET_ADMIN` and `CAP_NET_RAW` - required for modifying routing tables
38
+
*`CAP_SYS_PTRACE` - required for reading target pod environment
39
+
*`CAP_SYS_ADMIN` - required for joining target pod network namespace
40
+
41
+
Unless using "mirrord for Teams" (proprietary), all users must have permissions to create the job running the `mirror-agent` in the cluster.
42
+
43
+
## Comparison Telepresence vs mirrord
44
+
45
+
This comparison chart applies to the Open Source editions of both products.
| Installed using a JSON-schema validated Helm chart | ✅ | ❌ |
70
+
| Client need no special RBAC permissions | ✅ | ❌ |
71
+
72
+
[^1]: Telepresence will not require root access on the workstation when running in docker mode.
73
+
74
+
[^2]: The remote service will only restart when a traffic-agent sidecar is installed. Pod disruption budgets or pre-installed agents can be used to avoid interruptions.
75
+
76
+
[^3]: A traffic-agent is necessary when engaging with a pod. It is unnecessary when using Telepresence as a VPN.
Copy file name to clipboardexpand all lines: versioned_docs/version-2.22/faqs.md
+28-27
Original file line number
Diff line number
Diff line change
@@ -6,11 +6,11 @@ hide_table_of_contents: true
6
6
7
7
# FAQs
8
8
9
-
** Why Telepresence?**
9
+
###Why Telepresence
10
10
11
11
Modern microservices-based applications that are deployed into Kubernetes often consist of tens or hundreds of services. The resource constraints and number of these services means that it is often difficult to impossible to run all of this on a local development machine, which makes fast development and debugging very challenging. The fast [inner development loop](concepts/devloop.md) from previous software projects is often a distant memory for cloud developers.
12
12
13
-
Telepresence enables you to connect your local development machine seamlessly to the cluster via a twoway proxying mechanism. This enables you to code locally and run the majority of your services within a remote Kubernetes cluster -- which in the cloud means you have access to effectively unlimited resources.
13
+
Telepresence enables you to connect your local development machine seamlessly to the cluster via a two-way proxying mechanism. This enables you to code locally and run the majority of your services within a remote Kubernetes cluster — which in the cloud means you have access to effectively unlimited resources.
14
14
15
15
Ultimately, this empowers you to develop services locally and still test integrations with dependent services or data stores running in the remote cluster.
16
16
@@ -22,79 +22,80 @@ You can also "intercept" any requests made to a service. This is similar to repl
22
22
23
23
Finally, you can "ingest" a service. Again, similar to a "replace", but nothing changes in the cluster during an "ingest", and no traffic is routed to the workstation.
24
24
25
-
** What operating systems does Telepresence work on?**
25
+
####What operating systems does Telepresence work on?
26
26
27
-
Telepresence currently works natively on macOS (Intel and Apple Silicon), Linux, and Windows.
27
+
Telepresence currently works natively on macOS, Linux, and Windows.
28
28
29
-
** What protocols can be intercepted by Telepresence?**
29
+
#### What architecture does Telepresence work on?
30
+
31
+
All Telepresence binaries are released for both AMD (Intel) and ARM (Apple Silicon) chips.
32
+
33
+
#### What protocols can be intercepted by Telepresence?
30
34
31
35
Both TCP and UDP are supported.
32
36
33
-
** When using Telepresence run a cluster service locally, are the Kubernetes cluster environment variables proxied on my local machine?**
37
+
####When using Telepresence to run a cluster service locally, are the Kubernetes cluster environment variables proxied on my local machine?
34
38
35
39
Yes, you can either set the container's environment variables on your machine or write the variables to a file to use with Docker or another build process. You can also directly pass the environments to a handler that runs locally. Please see [the environment variable reference doc](reference/environment.md) for more information.
36
40
37
-
** When using Telepresence to run a cluster service locally, can the associated container volume mounts also be mounted by my local machine?**
41
+
####When using Telepresence to run a cluster service locally, can the associated container volume mounts also be mounted by my local machine?
38
42
39
-
Yes, please see [the volume mounts reference doc](reference/volume.md) for more information.
43
+
Yes, and when running Docker, they can be used as docker volumes. Please see [the volume mounts reference doc](reference/volume.md) for more information.
40
44
41
-
** When connected to a Kubernetes cluster via Telepresence, can I access cluster-based services via their DNS name?**
45
+
####When connected to a Kubernetes cluster via Telepresence, can I access cluster-based services via their DNS name?
42
46
43
47
Yes. After you have successfully connected to your cluster via `telepresence connect -n <my_service_namespace>` you will be able to access any service in the connected namespace in your cluster via their DNS name.
44
48
45
49
This means you can curl endpoints directly e.g. `curl <my_service_name>:8080/mypath`.
46
50
47
51
You can also access services in other namespaces using their namespaced qualified name, e.g.`curl <my_service_name>.<my_other_namespace>:8080/mypath`.
48
52
49
-
You can connect to databases or middleware running in the cluster, such as MySQL, PostgreSQL and RabbitMQ, via their service name.
53
+
In essence, Telepresence makes the DNS of the connected namespace available locally. This means that you can connect to all databases or middleware running in the cluster, such as MySQL, PostgreSQL and RabbitMQ, via their service name.
50
54
51
-
** When connected to a Kubernetes cluster via Telepresence, can I access cloud-based services and data stores via their DNS name?**
55
+
####When connected to a Kubernetes cluster via Telepresence, can I access cloud-based services and data stores via their DNS name?
52
56
53
57
You can connect to cloud-based data stores and services that are directly addressable within the cluster (e.g. when using an [ExternalName](https://kubernetes.io/docs/concepts/services-networking/service/#externalname) Service type), such as AWS RDS, Google pub-sub, or Azure SQL Database.
54
58
55
-
56
-
57
-
58
-
** Will Telepresence be able to engage with workloads running on a private cluster or cluster running within a virtual private cloud (VPC)?**
59
+
#### Will Telepresence be able to engage with workloads running on a private cluster or cluster running within a virtual private cloud (VPC)?
59
60
60
61
Yes, but it doesn't need to have a publicly accessible IP address.
61
62
62
63
The cluster must also have access to an external registry to be able to download the traffic-manager and traffic-agent images that are deployed when connecting with Telepresence.
63
64
64
-
** Why does running Telepresence require sudo access for the local daemon unless it runs in a Docker container?**
65
+
####Why does running Telepresence require sudo access for the local daemon unless it runs in a Docker container?
65
66
66
67
The local daemon needs sudo to create a VIF (Virtual Network Interface) for outbound routing and DNS. Root access is needed to do that unless the daemon runs in a Docker container.
67
68
68
-
** What components get installed in the cluster when running Telepresence?**
69
+
####What components get installed in the cluster when running Telepresence?
69
70
70
-
A single `traffic-manager` service is deployed in the `ambassador`namespace within your cluster, and this manages resilient intercepts and connections between your local machine and the cluster.
71
+
A `traffic-manager` service is deployed in a namespace of your choice (default 'ambassador') within your cluster, and this manages resilient intercepts and connections between your local machine and the cluster.
71
72
72
-
A Traffic Agent container is injected per pod that is being engaged. The first time a `replace`, an `ingest`, or an `intercept` is made on a workload, all pods associated with this workload will be restarted with the Traffic Agent automatically injected.
73
+
A Traffic Agent container is injected per pod that is being engaged. The injection happens the first time a `replace`, an `ingest`, or an `intercept` is made on a workload, unless you choose to control the injection using an annotation, in which case the injection happens when the `traffic-manager` is installed.
73
74
74
-
** How can I remove all the Telepresence components installed within my cluster?**
75
+
####How can I remove all the Telepresence components installed within my cluster?
75
76
76
77
You can run the command `telepresence helm uninstall` to remove everything from the cluster, including the `traffic-manager`, and all the `traffic-agent` containers injected into each pod being engaged.
77
78
79
+
You also can run the command `telepresence uninstall <workload>` to remove the injected `traffic-agent` containers injected into each pod for that workload.
80
+
78
81
Also run `telepresence quit -s` to stop all local daemons running.
79
82
80
-
** What language is Telepresence written in?**
83
+
####What language is Telepresence written in?
81
84
82
85
All components of the Telepresence application and cluster components are written using Go.
83
86
84
-
** How does Telepresence connect and tunnel into the Kubernetes cluster?**
87
+
####How does Telepresence connect and tunnel into the Kubernetes cluster?
85
88
86
89
The connection between your laptop and cluster is established by using
87
90
the `kubectl port-forward` machinery (though without actually spawning
88
91
a separate program) to establish a TLS encrypted connection to Telepresence
89
92
Traffic Manager and Traffic Agents in the cluster, and running Telepresence's custom VPN
90
93
protocol over that connection.
91
94
92
-
<aname="idps"></a>
93
-
94
-
** Is Telepresence OSS open source?**
95
+
#### Is Telepresence OSS open source?
95
96
96
-
Yes it is! You'll find both source code and documentation in the [Telepresence GitHub repository](https://github.com/telepresenceio/telepresence), licensed using the [apache License Version 2.0](https://github.com/telepresenceio/telepresence?tab=License-1-ov-file#readme).
97
+
Yes, it is! You'll find both source code and documentation in the [Telepresence GitHub repository](https://github.com/telepresenceio/telepresence), licensed using the [apache License Version 2.0](https://github.com/telepresenceio/telepresence?tab=License-1-ov-file#readme).
97
98
98
-
** How do I share my feedback on Telepresence?**
99
+
####How do I share my feedback on Telepresence?
99
100
100
101
Your feedback is always appreciated and helps us build a product that provides as much value as possible for our community. You can chat with us directly on our #telepresence-oss channel at the [CNCF Slack](https://slack.cncf.io), and also report issues or create pull-requests on the GitHub repository.
0 commit comments