Things I wish someone had told me about Istio, Omer Levi Hevroni
Download as PPTX, PDF•1 like•367 views
The document discusses the implementation of Istio in production environments, highlighting its architecture and the challenges faced during deployment, such as service mesh observability and high availability. It emphasizes the importance of monitoring tools like Jaeger, Kiali, and Grafana, as well as the potential resource usage implications of Istio. The author concludes with key takeaways, noting the complexity of production deployments and considerations for alternative service mesh solutions.
Things I wish someone had told me about Istio, Omer Levi Hevroni
- 1. Week: xx/x-xx/x Istio in Production? @omerlh Photo by Yossef Ordentlich
- 2. Why? @omerlh
- 4. Registration Authentication Analytics Messages Content Notifications Notifications Worker Notifications Dispatcher Users Worker Users DB Users API Analytics Worker Messages DB Content API @omerlh
- 5. @omerlh Number of Deployments Over Time
- 6. • AuthN/AuthZ • Visibility • Deployments Micro Services Challenges @omerlh
- 7. Service Mesh Observability Traffic Routing Fault Injection mTLS @omerlhCREDIT: COURTESY OF BOOMERANG
- 17. • High Availability (single point of failure) • Tracing and visibility? • Cross-Cluster communication (fail-over) Multi Clusters Trade-Offs @omerlh
- 19. High Availability Deployment • Monitoring? Dashboards? • What we should care about? • Make sure everything is highly-available • Multiple instances • HPA @omerlh
- 22. • Jaeger • Kiali • Grafana • Prometheus Istio Come With Friends @omerlh
- 23. @omerlh
- 24. @omerlh
- 25. @omerlh
- 26. • Jaeger • Kiali • Grafana • Prometheus What about them? Istio Come With Friends @omerlh
- 30. Let’s turn it on @omerlh
- 35. Rollout Started Rollback @omerlh Number of Pods Over Time
- 37. • Sidecar added (request: 100 ml CPU) • Sidecar consume a lot more CPU • HPA kick in • Sidecar keep consume more • HPA keep scale Post Mortem @omerlh
- 39. • Enable istio on a namespace • Restart one pod • Wait a few minutes • Keep restarting pods gradually • Repeat this process per service A bit Safer Approach @omerlh
- 40. @omerlh
- 46. WHY????? @omerlh Source: The Pajamas
- 49. Registration Authentication Analytics Messages Content Notifications Notifications Worker Notifications Dispatcher Users Worker Users DB Users API Analytics Worker Messages DB Content API @omerlh
- 50. • AuthN/AuthZ • Visibility • Deployments Challenges @omerlh
- 51. • A production deployment is not trivial • Be prepared for a long journey • Kiali and Jaeger are very valuable • Not sure yet istio worth it Main Takeaways @omerlh
- 52. • Istio might not play well with cronjobs • Proxy leaks info with headers • Service name issues • Tracing is not that trivial Things Worth Knowing @omerlh
- 53. • API Gateway (Gloo/Kong)? • AWS AppMesh? Linkerd? Istio being more mature? • Service Mesh Interface? • Service Mesh Hub/SuperGloo? Back To The Drawing Table @omerlh
Editor's Notes
- #3: ???
- #4: 305 million customers that trust us with their input
- #5: ???
- #6: ???
- #7: What about Istio helper components?
- #8: Buzzword
- #10: Me want this
- #11: Dumpster fire
- #13: I’m a builder, this is what I love doing and doing it from a really early age Doing it professionally for the last 8 years I’m from Israel, married etc Who else is a builder? This talk is for you!
- #14: Today I’m working at Soluto, our missing is to help people with their technology My job is DevSecOps, or as I see it - helping the entire team to build a more secure software I’m achieving it via many approaches, including education, reviewing and threat modeling – but what I love the most is threat modeling
- #15: ???
- #18: What about Istio helper components?
- #22: ???
- #23: What about Istio helper components?
- #27: What about Istio helper components?
- #31: ???
- #32: Show me the magic – istio proxy
- #33: What about Istio helper components?
- #34: What about Istio helper components?
- #35: The problem
- #36: The story of push notification API
- #37: Dumpster fire
- #38: Manual injection?
- #40: Manual injection?
- #42: ???
- #43: The story of push notification API
- #44: The story of push notification API
- #48: Default request and why you should care
- #49: ???
- #50: ???
- #51: What about Istio helper components?
- #55: ???