Adding HA support

[canthefason]

Note: Due to an Istio limitation, the App Identity and Access adapter currently stores user session information internally and does not persist the information across replicas or over failover configurations. When using the adapter, limit your workloads to a single replica until the limitation is addressed.

Regarding the note above, could you elaborate a little bit on this Istio limitation? We're evaluating this adapter at the moment, however running a single instance of it on a multi-tenant cluster makes it a bit risky for us.

That said, we would like to discuss more about the mitigation strategies for this problem and see if there is any help that we can provide.

[sirajmansour]

Same here, we're looking at this and i was hoping we could get some details at least around the issue maybe we could help fix it. Any feedback would be appreciated @sandmman @smguilia @ishangulhane @icemann92 ?

[canthefason]

I suspect that it might be because Istio doesn't support the session based model mentioned over here.

In the existence of a single instance, to avoid any sort of bottlenecks that a single might cause, it would make sense to add a match predicate to the rule. Doing so would drastically reduce the number of requests reaching to the adapter.

[sirajmansour]

@canthefason i can't see why a session-less model wouldn't work as HA.

By the looks of it, IBM abandoned this project ?