Connector: what is it?

[rmbaxter67]

Referring back to the kickoff #12 and the high-level diagram, what is the Connector?

Current options are

• HAProxy
• kubernetes sidecar

Related to: tre-federation#9 TRE-to-TRE-connectivity

[manics]

Or both, e.g. in some cases it may be different for servers and clients?

A K8S sidecar on the clients effectively means the Netbird management node controls access, since each client/workspace needs a sidecar which has to be registered with Netbird. In the HAProxy setup HAProxy is registered with Netbird, but the local TRE node controls who can access the endpoint since they configure HAProxy.

[rmbaxter67]

For my money, the HAProxy model maps better to the model in the Fed Arch Blueprint of a "Security Server" gateway under the control of the local TRE, but possibly sharing config across the network. It also allows for non-K8s infrastructure inside the TRE to be networked out through the Connector (yes?).

[JimMadge]

Maybe it is better to think about this in terms of whether you are connecting a peer or network? Talking about sidecars is quite K8s-sepecific.

I'm not sure about the reverse proxy requirement,

• If you want to connect a peer, you connect the service (either by installing netbird, or using a sidecar container)
• If you want to connect a network, you deploy a routing peer (whether that is a container or VM)

https://docs.netbird.io/use-cases/site-to-site#understanding-remote-access-scenarios

[manics]

Sounds like Netbird could do everything we need without additional Ambassador pattern/haproxy, but requires configuring everything centrally through management/dashboard node. Do we want centralised control over how organisations connect to mesh?

Why is Haproxy suggested by DIRECTOR?

Netbird has API so could build own application on top.

Compare three options:

• Turing will look at Netbird peering
• Lancs: sidecar
• HIC: Ambassador