Support for Hub and Spoke Connectivity?

[awm-achi]

We have a central management cluster, and edge clusters. We would like to connect the edge clusters to the central cluster, without exposing the edge cluster services to other edge cluster services but I can't seem to figure out how to get it to work. Research online says disabling service-sync should work, but that causes all services to be disabled, directly exposed services included. Is there any guidance or documentation about how service-sync works, or how I might configure my connectivity to work the way I want it to?

[grs]

There are two approaches I can suggest. One is to have a single skupper network extending to all the edges, but disable service-sync and manually create the services for all the edges in the management cluster (with skupper service create).

The second would be to have a separate 'network' linking each edge to the central cluster. This would require a distinct namespace to be used for each edge on the central cluster, through which the services for that edge would be accessed.

[grs]

Ok, I think I understand, so I can use Skupper expose service --port yyyy --address on the edge cluster and just do Skupper service create on the main cluster?

Yes, that is correct.

And is there a way to do multiple ports? Or is it just Skupper service create again?

You can add multiple ports after the service name, e.g. skupper service create foo 8080 8081 8082

[awm-achi]

Ok and if I need to share a service from the hub down to the edge cluster is it the same process? Service expose on the central cluster and service create on the edge?

[grs]

correct

[awm-achi]

Ok this worked! Will there ever be a feature toggle to block indirect connections? Since it seems like Skupper knows which connections are indirect it seems like something that might be useful.

[grs]

Certainly we recognise the need for more control over the exposure of services. I doubt it would be in the form of allowing or disallowing indirect connections, but this is the first time I've heard that requested so I will think on it some more.