What is a Service Mesh and what can it do for your Microservices
0 likes122 views
e’ll explore what a service mesh is and what it can do for your microservices. Are the claims of observability, resiliency, and WAF features real? Are they useful during development, production, or both? Using pictures and demos, we’ll find out! This session will also briefly cover how a service mesh works, giving us a mental model with which to explore and evaluate after the talk. Matt will show a simple installation and demo, giving us all the knowledge to go home and try for ourself.
Ad
More Related Content
What's hot (20)
Similar to What is a Service Mesh and what can it do for your Microservices (20)
Ad
More from Matt Turner (18)
Ad
Recently uploaded (20)
What is a Service Mesh and what can it do for your Microservices
- 1. What is a Service Mesh? DevOps Thames Valley, Reading UK | January 2020 @mt165 | mt165.co.uk
- 2. Part I: Do You Need a Service Mesh?
- 3. Outline ● What are we talking about this? ● How did we get here? ● What is a Service Mesh anyway? ● Demo! ● What can a Service Mesh do? ● Common counter-arguments ● So: Do you need a Service Mesh?
- 4. Pop Quiz!
- 5. Why are we talking about this?
- 6. Business Value ● Top Line ● Bottom Line ● Time to Market & Speed of Iteration ● Risk Reduction
- 8. Pod Pod Pod Break the Monolith Namespace A Namespace B Namespace C Namespace A Namespace B Namespace C
- 9. ...don’t just distribute it!
- 10. How did we get here?
- 17. Do you need a service mesh? @mt165 In-process libraries and frameworks
- 20. Must-have primitives ● Service Discovery ● Fault Tolerance ○ Circuit breakers ○ Back pressure ● Observability ○ Logging ○ Metrics ○ Tracing
- 21. Do you need a service mesh? @mt165 Declarative Infrastructure
- 22. Do you need a service mesh? @mt165 And declarative infrastructure
- 23. Do you need a service mesh? @mt165 And declarative infrastructure
- 24. Assertion: A Service Mesh is the best of both
- 25. Question: What is a Service Mesh?
- 26. They work by adding a proxy to every service
- 27. And a control plane
- 28. “A service mesh provides a transparent and language-independent way to flexibly and easily automate application network functions” - Google (istio vendor)
- 29. “A service mesh provides a transparent and language-independent way to flexibly and easily automate application network functions”
- 30. “A service mesh provides a transparent and language-independent way to flexibly and easily automate application network functions”
- 31. “A service mesh provides a transparent and language-independent way to flexibly and easily automate application network functions”
- 32. “A service mesh provides a transparent and language-independent way to flexibly and easily automate application network functions”
- 33. “A service mesh provides a transparent and language-independent way to flexibly and easily automate application network functions” Host: users Host: users X-testing: true Host: users Pod.namespace: staging users-v1 users-v2 users-mock
- 34. Demo Time!
- 35. Pray to the demo gods...
- 36. Pray to the demo gods... The old...
- 37. Pray to the demo gods... The old... ...and the new
- 38. Service Meshes can do much more
- 39. Observability
- 41. Declarative Traffic Management Everyone gets reviews v1 Except Jason
- 42. Security - ACLs
- 43. Security - mTLS
- 44. Security - mTLS
- 45. But!
- 46. But I have an Edge Proxy! ✅ Ingress proxy ✅ Sidecar model terminates security closer to the app
- 47. But I have an API Gateway! ✅ Rate limiting ✅ Access control ✅ JWT validation ❌ OIDC ❌ Bot blocking
- 48. But I have a CDN! Keep it
- 49. But I have a WAF! ✅ CORS header injection ❌ Injection attack prevention
- 50. But I have an APM system! ✅ Logs ✅ Metrics ✅ Tracing ✅ Multiple, arbitrary telemetry backends ❌ JVM, .Net CLR insight
- 51. But I have an ESB! ✅ Retries etc ✅ Flexible service discovery / late binding ✅ No client/server distinction; better than a middle proxy ❌ Broadcast / pubsub
- 52. So: Do you need a Service Mesh?
- 53. Yes!
- 54. There are many options
- 55. Istio has the most momentum
- 56. Istio has wide backing Google, IBM, Lyft, RedHat, Cisco, and more
- 57. Istio and Linkerd are (quite) easy to install WIll be managed soon Go home and try it!
- 58. Recap ● Why were we talking about this? ● How did we get here? ● What is a Service Mesh anyway? ● Demo! ● What can a Service Mesh do? ● Common counter-arguments ● So: Do you need a Service Mesh?
- 59. 🍺
- 60. Part II: The Life of a Packet Through Istio
- 61. Objectives Learn how a packet traverses an Istio/Envoy/Kubernetes system See what control plane calls are made in that process Build a useful mental model for reasoning about, and debugging Istio
- 62. Prerequisites Basic networking knowledge Intermediate Kubernetes knowledge An understanding of what Istio is and does
- 63. Outline ● Networking and Containers ● Pilot and Routing ● Mixer and Policy ● Citadel and mTLS
- 65. Service AIngress
- 66. Service A
- 74. Sidecar Injection pid user ipc net 192.168.0.42 eth0 lo sockets iptables routes docker.io/istio/proxyv2 /istio-iptables -p 15001 -u 1337 ...
- 79. Services $ kubectl get service -o wide service-b NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR service-b ClusterIP 10.98.84.169 <none> 80/TCP 90s app=service-b
- 80. Service DNS exposure $ dig service-b.default.svc.cluster.local. ;; ANSWER SECTION: service-b.default.svc.cluster.local. 5 IN A 10.98.84.169
- 81. Pods $ kubectl get pods -o wide | grep service-b service-b-644856485c-4rk88 1/1 Running 0 7m46s 10.32.0.4 kind-1-control-plane <none> service-b-644856485c-dc2zv 1/1 Running 0 7m46s 10.32.0.6 kind-1-control-plane <none> service-b-644856485c-gr75k 1/1 Running 0 7m46s 10.32.0.5 kind-1-control-plane <none>
- 82. Endpoints $ kubectl get endpoints service-b NAME ENDPOINTS AGE service-b 10.32.0.4:8080,10.32.0.5:8080,10.32.0.6:8080 8m55s
- 83. Endpoints $ kubectl get endpoints service-b -o yaml ... subsets: - addresses: - ip: 10.32.0.4 nodeName: kind-1-control-plane targetRef: kind: Pod … ports: - name: http port: 8080 protocol: TCP
- 84. Envoy SvcA Pilot Control Plane API Service A Config to Envoys
- 85. Envoy SvcA Pilot Control Plane API Service A Config to Envoys k8s consul zk Data plane API
- 86. Pilot ● Ingress Routing ● Traffic Mirroring ● Traffic Shifting ● Canary Deployments ● Circuit Breaking ● Fault Injection
- 87. Mixer and Policy
- 88. Envoy SvcA Pilot Control Plane API Service A Service B Config to Envoys
- 89. Envoy SvcA Envoy SvcB Pilot Mixer Control Plane API Service A Service B Config to Envoys Policy checks, Telemetry
- 90. IP 5-tuple (src_addr, src_port, dst_addr, dst_port, proto)
- 91. IP Router Architecture Interrupt Kernel module User process DATA PLANE CONTROL PLANE OSPF ARPBGP STP Router Information Base Forwarding Information Base
- 92. IP Router Architecture DATA PLANE CONTROL PLANE OSPF ARPBGP STP PILOT MIXER ENVOYInterrupt Kernel module User process Router Information Base Forwarding Information Base
- 93. Envoy SvcA Envoy SvcB Pilot Mixer Control Plane API Service A Service B Config to Envoys prom ES REPORT CHECK RBAC Rate limit Mixer fat client Mixer fat client
- 94. Mixer ● Check ○ ACLs / Authorization ○ Rate Limiting ● Report ○ Logs ○ Metrics ○ Tracing
- 95. Envoy SvcA Envoy SvcB Pilot Mixer Control Plane API Service A Service B Config to Envoys Policy checks, Telemetry
- 96. Envoy SvcA Envoy SvcB Pilot Mixer Citadel Control Plane API Service A Service B Config to Envoys TLS certs to Envoys Policy checks, Telemetry
- 97. Envoy SvcA Envoy SvcB Pilot Mixer Citadel Control Plane API Service A Service B Config to Envoys TLS certs to Envoys Policy checks, Telemetry
- 98. Envoy SvcA Envoy SvcB Pilot Mixer Citadel Control Plane API Service A Service B Config to Envoys TLS certs to Envoys Policy checks, Telemetry Envoy Envoy Envoy Envoy Envoy Envoy Envoy Envoy Ingress Egress
- 99. Envoy SvcA Envoy SvcB Pilot Mixer Citadel Control Plane API Service A Service B Config to Envoys TLS certs to Envoys Policy checks, Telemetry API Serveretcd kubectl
- 100. Envoy SvcA Envoy SvcB Pilot Mixer Citadel Control Plane API Service A Service B Config to Envoys TLS certs to Envoys Policy checks, Telemetry Galleyetcd kubectl
- 101. Outline ● Context and Introduction ● Networking and Containers ● Pilot and Routing ● Mixer and Policy ● Citadel and mTLS
- 102. Recap We learned: ● How a packet traverses an Istio/Envoy/Kubernetes system ● What control plane calls are made in that process ● A useful mental model for reasoning about, and debugging Istio