clouds, containers, functions, applications, and their management

calcotestudios.com/talks

github.com/leecalcote

Girish Ranganathan

Principal Architect,

SolarWinds

Show of Hands

Microservices

The more, the merrier?

Benefits

First few services are relatively easy

Democratization of language and technology choice

Faster delivery, service teams running independently, rolling updates

@lcalcote

Challenges

Next 10 or so may introduce pain

Language and framework-specific libraries

Distributed environments, ephemeral infrastructure, out-moded tooling

Why use a Service Mesh?

to avoid...

Bloated service code
Duplicating work to make services production-ready
- Load balancing, auto scaling, rate limiting, traffic routing...
Inconsistency across services
- Retry, tls, failover, deadlines, cancellation, etc., for each language, framework
- Siloed implementations lead to fragmented, non-uniform policy application and difficult debugging
Diffusing responsibility of service management

@lcalcote

Which is why...

I have a container orchestrator.

@lcalcote

Core

Capabilities

Cluster Management
- Host Discovery
- Host Health Monitoring
Scheduling
Orchestrator Updates and Host Maintenance
Service Discovery
Networking and Load Balancing
Stateful Services
Multi-Tenant, Multi-Region

Additional

Key Capabilities

Application Health and Performance Monitoring
Application Deployments
Application Secrets

@lcalcote

minimal capabilities required to qualify as a container orchestrator

Istio relies on these capabilities.

Which is why...

I have an API gateway.

@lcalcote

Microservices API Gateways

Ambassador uses Envoy
Kong uses Nginx
OpenResty uses Nginx
Traefik

What do we need?

• Observability

• Logging
• Metrics
• Tracing

• Traffic Control

• Resiliency

• Efficiency
• Security

• Policy

@lcalcote

a Service Mesh

What is a Service Mesh?

a dedicated layer for managing service-to-service communication

@lcalcote

So, a microservices platform?

obviously.

Orchestrators don't bring all that you need

and neither do service meshes,

but they do get you closer.

Missing: application lifecycle management, but not by much

partially.

a services-first network

Missing: distributed debugging; provide nascent visibility (topology)

@lcalcote

DEV

OPS

Layer 5

where Dev and Ops meet

Problem: too much infrastructure code in services

Workshop Materials

visit layer5.io

1) Join Layer5 Slack account.

2) Use 8.8.8.8 as your name server.

Lab 1- Deploying Kubernetes

@lcalcote

Open PWK
Deploy master node
- use external DNS
- save your `kubeadm join` command output
Install overlay networking
Add two more nodes to the cluster

layer5.io

What is Istio?

an open platform to connect, manage, and secure microservices

@lcalcote

Observability
Resiliency
Traffic Control
Security
Policy Enforcement

istio.io

github.com/istio

@IstioMesh

Observability

what gets people hooked on service metrics

@lcalcote

Goals

Metrics without instrumenting apps
Consistent metrics across fleet
Trace flow of requests across services
Portable across metric back-end providers

You get a metric! You get a metric! Everyone gets a metric!

Traffic Control

control over chaos

@lcalcote

Traffic splitting
- L7 tag based routing?
Traffic steering
- Look at the contents of a request and route it to a specific set of instances.
Ingress and egress routing

Resilency

Systematic fault injection
Timeouts and Retries with timeout budget
Circuit breakers and Health checks
Control connection pool size and request load

content-based traffic steering

Istio Architecture

@lcalcote

Control Plane

Data Plane

Touches every packet/request in the system.
Responsible for service discovery, health checking, routing, load balancing, authentication, authorization, and observability.

Provides policy and configuration for services in the mesh.
Takes a set of isolated stateless sidecar proxies and turns them into a service mesh.
Does not touch any packets/requests in the system.

Pilot

Citadel

Mixer

Control Plane

Data Plane

istio-system namespace

policy check

Foo Pod

Proxy Sidecar

Service Foo

tls certs

discovery & config

Foo Container

Bar Pod

Proxy Sidecar

Service Bar

Bar Container

Out-of-band telemetry propagation

telemetry

reports

Control flow during request processing

application traffic

Application traffic

application namespace

telemetry reports

Istio Architecture

@lcalcote

Service Proxy Sidecar

- A C++ based L4/L7 proxy

- Low memory footprint

- In production at Lyft™

@lcalcote

Capabilities:

API driven config updates → no reloads
Zone-aware load balancing w/ failover
Traffic routing and splitting
Health checks, circuit breakers, timeouts, retry budgets, fault injection…
HTTP/2 & gRPC
Transparent proxying
Designed for observability

the included battery

Data Plane

Pod

Proxy sidecar

App Container

What's Pilot for?

@lcalcote

provides service discovery to sidecars

manages sidecar configuration

Pilot

Citadel

Control Plane

the head of the ship

Mixer

istio-system namespace

system of record for service mesh

}

provides abstraction from underlying platforms

What's Mixer for?

Point of integration with infrastructure back ends
- Intermediates between Istio and back ends, under operator control
- Enables platform and environment mobility
Responsible for policy evaluation and telemetry reporting
- Provides granular control over operational policies and telemetry
Has a rich configuration model
- Intent-based config abstracts most infrastructure concerns

@lcalcote

Pilot

Citadel

Mixer

Control Plane

istio-system namespace

an attribute-processing and routing machine

operator-focused

Precondition checking
Quota management
Telemetry reporting

Mixer

@lcalcote

Mixer

Control Plane

Data Plane

istio-system namespace

Foo Pod

Proxy Sidecar

Service Foo

Foo Container

Out-of-band telemetry propagation

Control flow during request processing

application traffic

Application traffic

application namespace

telemetry reports

an attribute processing engine

What's Citadel for?

@lcalcote

Verifiable identity
- Issues certs
- Certs distributed to service proxies
- Mounted as a Kubernetes secret
Secure naming / addressing
Traffic encryption

Pilot

Citadel

Control Plane

security at scale

Mixer

istio-system namespace

security by default

Orchestrate Key & Certificate:

Generation
Deployment
Rotation
Revocation

Lab 2 - Deploying Istio

@lcalcote

Installing Istio
Setting up `istioctl`
Verify install
Configuring add-ons

layer5.io

Lab 2.2 - Configuring Mixer Add-ons and Adapters

@lcalcote

layer5.io

Istio Adapter for SolarWinds

Open Source Adapters and Add-ons

(servicegraph)

Lab 3 - Deploying Sample App

@lcalcote

Multi-language, multi-service application
Manual sidecar injection
Verify install

layer5.io

Lab 3 - BookInfo Sample App

Reviews v1

Reviews Pod

@lcalcote

Reviews v2

Reviews v3

Product Pod

Details Container

Details Pod

Ratings Container

Ratings Pod

Product Container

Reviews Service

Lab 3 - BookInfo Sample App

Reviews v1

Reviews Pod

@lcalcote

Reviews v2

Reviews v3

Product Pod

Details Container

Details Pod

Ratings Container

Ratings Pod

Product Container

Nginx sidecar

Reviews Service

Nginx sidecar

Envoy ingress

Lab 4 - Expose BookInfo via Istio Ingress Gateway

@lcalcote

Inspecting the Istio Ingress Gateway
Configure Istio Ingress Gateway for Bookinfo
Inspect the Istio proxy of the productpage pod

layer5.io

Envoy ingress

Meshery

visit layer5.io for more

service mesh playground

Now Available

compliments of NGINX

gingergeek.com

Lee Calcote

Thank you. Questions?

clouds, containers, functions,

and their management

@lcalcote

calcotestudios.com/talks

layer5io.slack.com

Girish Ranganathan

distributed systems, golang, operating at-scale,

@ingenious_G

Lab 5 - Telemetry

@lcalcote

Generate Load on Bookinfo
View in monitoring tools

layer5.io

Pilot

Citadel

Mixer

Control Plane

istio-system namespace

AppOptics™

@lcalcote

Uses pluggable adapters to extend its functionality
- Adapters run within the Mixer process
Adapters are modules that interface to infrastructure backends
- (logging, metrics, quotas, etc.)
Multi-interface adapters are possible
- (e.g., SolarWinds® adapter sends logs and metrics)