Ad
More Related Content
What's hot (20)
Similar to Service Mesh on Kubernetes with Istio (20)
![[APIdays Paris 2019] API Management in Service Mesh Using Istio and WSO2 API ...](https://cdn.slidesharecdn.com/ss_thumbnails/apimanagementformicroservicesonaservicemeshusingistio-191216045155-thumbnail.jpg?width=560&fit=bounds)
Ad
More from Michelle Holley (20)
Ad
Recently uploaded (20)
![Pixologic ZBrush Crack Plus Activation Key [Latest 2025] New Version](https://cdn.slidesharecdn.com/ss_thumbnails/fashionevolution2-250322112409-f76abaa7-250428124909-b51264ff-250504160528-fc2bb1c5-thumbnail.jpg?width=560&fit=bounds)
![Download Wondershare Filmora Crack [2025] With Latest](https://cdn.slidesharecdn.com/ss_thumbnails/neo4j-howkgsareshapingthefutureofgenerativeaiatawssummitlondonapril2024-240426125209-2d9db05d-250419-250428115407-a04afffa-thumbnail.jpg?width=560&fit=bounds)
![Get & Download Wondershare Filmora Crack Latest [2025]](https://cdn.slidesharecdn.com/ss_thumbnails/revolutionizingresidentialwi-fi-250422112639-60fb726f-250429170801-59e1b240-thumbnail.jpg?width=560&fit=bounds)
Service Mesh on Kubernetes with Istio
- 1. © 2017 Kumulus Technologies@rstarmer Service Mesh on Kubernetes With Istio
- 2. © 2017 Kumulus Technologies Who are we? Robert Starmer: @rstarmer CTO/Founder of Kumulus Technologies OpenStack Ops contributor since 2012 Supporting Cloud enablement for Enterprise OpenStack, Kubernetes, BareMetal to App CD Kumulus Technologies: @kumulustech Systems consultants supporting cloud migration & integration Kumulus Tech Newsletter: https://kumul.us/newsletter/ Five Minutes of Cloud: https://youtube.com/fiveminutesofcloud
- 3. © 2017 Kumulus Technologies Use the following account to create your course account: http://bit.ly/Istio_k8s [email protected] @rstarmer Access Course Resources
- 4. © 2017 Kumulus Technologies@rstarmer Agenda Microservices, Kubernetes and Istio ● Microservices ● Kubernetes ● Istio ● Service Mesh ● Mutual TLS (security) ● Routing ● Tracing/Metrics ● Fault Injection ● Lab - Get Kubernetes, Istio, Launch an App ● Lab - Routing
- 5. © 2017 Kumulus Technologies@rstarmer Microservices (Day 2 Operations) Microservices are small nuggets of function, and that sounds like it could be simple, but as complexity grows, successful operations require: ● Visibility (Observability) ● Monitoring ● Metrics ● Tracing ● Traffic management ● Policy Enforcement ● Security ● Resilience and efficiency A service mesh (an application network for services) can provide the above.
- 6. © 2017 Kumulus Technologies@rstarmer Kubernetes kubectl, ajax, etc etcd node devops user scheduler controller manager service proxy API server kubelet Kubernetes provides an infrastructure management service node
- 7. © 2017 Kumulus Technologies@rstarmer Istio Architecture Pod svcB Envoy Pod svcA Envoy Service A Service B Mixer Istio-AuthPilot TLS Certs to EnvoysConfig Data to Envoys Control Plane REST API HTTP, gRPC, TCP with/out TLS HTTP, gRPC, TCP with/out TLS Policy Checks, Telemetry
- 8. © 2017 Kumulus Technologies@rstarmer Istio Istio is a service mesh (microservices platform) providing: ● Observability ● Monitoring ● Metrics ● Tracing ● Traffic Management ● Policy ● Security ● Service Mesh Kubernetes “native” via platform adapter plugins - also plugs into Mesos, Cloud Foundry, …
- 9. © 2017 Kumulus Technologies@rstarmer Istio - Pilot Control plane for distributed Envoy instances Configures Istio deployment and pushes out configuration to other system components System of Record for Service Mesh Routing and resiliency rules Exposes API for service discovery, load balancing, routing tables Envoy Envoy Envoy PilotPlatform Adapter Abstract Model Envoy API Rules API Kubernetes CloudFoundry Mesos ...
- 10. © 2017 Kumulus Technologies@rstarmer Envoy Proxy Out of process load balancer: - High performance server/small memory footprint HTTP/2 and GRCP support: - Transparent HTTP/1.1 to HTTP/2 proxy. APIs for Config Management: - Configuration management via API alone Advanced Load Balancing: - Retries, Circuit Breaking, Health Checks, Rate Limits Observability - L7 visibility, distributed flow tracing In Istio: - Envoy container is injected with istioctl kube-inject or kubernetes initializer - Controls pod ingress/egress routing - Config is via API from Pilot Example Application Envoy Ingress Envoy
- 11. © 2017 Kumulus Technologies@rstarmer Istio - Mixer Attribute processor that controls the runtime behavior of mesh-attached services Envoy generates attributes Mixer then generates calls to backend infrastructure through adapters Handlers provide integration for 3rd party tools (Prometheus, Grafana, custom tools, …) All of these “Istio” pieces are expressed as Kubernetes custom resources (CRDs) Infrastructure Backends Envoy Service Mixer I
- 12. © 2017 Kumulus Technologies@rstarmer Mutual TLS Available by default, but not required When enabled, provides automatic service-to-service encryption Istio has a built in CA that watches for k8s service accounts and creates certificate keypair secrets in k8s Secrets are automatically mounted when pod is created Pilot generates appropriate Envoy config and deploys it End-to-end mTLS session generated for each connection.
- 13. © 2017 Kumulus Technologies@rstarmer Ingress/Egress Istio assumes that all traffic entering/exiting the service mesh transits through Envoy proxies. Deploying the Envoy proxy in front of services, operators can conduct A/B testing, deploy canary services, etc. for user-facing services. Routing traffic to external web services (e.g video service API) via the sidecar Envoy allows operators to add failure recovery features (e.g.timeouts, retries, circuit breakers, etc.) and obtain detailed metrics on the connections to these services. Pod svcB Envoy Pod svcA Envoy Service A Service B Envoy Ingress Envoy (Ingress controller in k8s) Pod
- 14. © 2017 Kumulus Technologies@rstarmer Pod Pilot Request Routing - Service Versions Pod svcB.1 Envoy Pod svcB.0 Envoy Version: v1.0, production Version: v1.1.alpha, staging Pod Envoy svcA Rules API ServiceA ServiceB serviceB.example.com http:serviceB.example.com
- 15. © 2017 Kumulus Technologies@rstarmer Service Observability/Visibility Monitoring & tracing should not be an afterthought Ideally a monitoring/tracing system should provide: ● Metrics without instrumenting apps ● Consistent metrics across fleet ● Trace flow of requests across services ● Portable across metric backend providers Istio adapters seamlessly integrate a number of tools: Prometheus - gathers metrics from Istio Mixer Grafana - produces dashboards from Prometheus metrics Service Graph - generates visualizations of dependencies between services. Zipkin - distributed tracing
- 16. © 2017 Kumulus Technologies@rstarmer Application/service Resilience with Istio As the number of microservices increase, failure is expected (inevitable?). Fault- tolerance is applications is (should be) a requirement. Istio provides fault tolerance/resilience with no impact on application code. Istio provides multiple, built-in features to provide fault tolerance: Timeouts, Retries with timeout budget, Circuit breakers, Health checks AZ-aware load balancing w/ automatic failover Control connection pool size and request load Systematic fault injection
- 17. © 2017 Kumulus Technologies@rstarmer Istio Lab Istio on Kubernetes
- 18. © 2017 Kumulus Technologies@rstarmer Example Microservice Application with Istio Product Page Reviews-v1 Reviews-v2 Reviews-v3 Details Ratingsrequests Envoy Envoy Envoy Envoy Envoy Envoy Ingress Envoy Running an application with Istio requires no changes to the app itself. We simply need to configure and run the services in an Istio-enabled environment, with Envoy sidecars injected alongside each service.
- 19. © 2017 Kumulus Technologies@rstarmer Get Started - Deploy Kubernetes Easiest approach: Launch in the cloud GKE Azure AWS with Kops Or, launch on your own hardware Vagrant/Ansible (kubespray) Kubeadm/Minikube