Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Proxyless Service Mesh with gRPC

Yuki Ito
December 22, 2020

Proxyless Service Mesh with gRPC

Yuki Ito

December 22, 2020
Tweet

More Decks by Yuki Ito

Other Decks in Technology

Transcript

  1. Recap: KubeCon + CloudNativeCon NA 2020 Proxyless Service Mesh with

    gRPC Menghan Li, Google Kubernetes Meetup Tokyo #37 Yuki Ito https://sched.co/ekI8
  2. Microserivces Era Service Pod Service Pod Service Pod Service Pod

    Service Pod Service Pod Service Pod Service Pod
  3. Service Mesh https://istio.io/latest/docs/concepts/what-is-istio/ The term service mesh is used to

    describe the network of microservices that make up such applications and the interactions between them.
  4. x Discovery Service API •Listener Discovery Service •Route Discovery Service

    •Cluster Discovery Service •Endpoint Discovery Service
  5. x Discovery Service API •Listener Discovery Service •Route Discovery Service

    •Cluster Discovery Service •Endpoint Discovery Service
  6. Envoy Envoy is an L7 proxy and communication bus designed

    for large modern service oriented architectures. The project was born out of the belief that:ɹ The network should be transparent to applications. When network and application problems do occur it should be easy to determine the source of the problem. https://www.envoyproxy.io/docs/envoy/v1.16.2/intro/what_is_envoy
  7. x Discovery Service API •Listener Discovery Service •Route Discovery Service

    •Cluster Discovery Service •Endpoint Discovery Service
  8. e.g. Cluster Discovery Service service ClusterDiscoveryService { rpc StreamClusters(stream discovery.v3.DiscoveryRequest)

    returns (stream discovery.v3.DiscoveryResponse) { } rpc DeltaClusters(stream discovery.v3.DeltaDiscoveryRequest) returns (stream discovery.v3.DeltaDiscoveryResponse) { } rpc FetchClusters(discovery.v3.DiscoveryRequest) returns (discovery.v3.DiscoveryResponse) { } } cds.proto https://github.com/envoyproxy/envoy/blob/master/api/envoy/service/cluster/v3/cds.proto
  9. Aggregated Discovery Service service AggregatedDiscoveryService { rpc StreamAggregatedResources(stream DiscoveryRequest) returns

    (stream DiscoveryResponse) { } rpc DeltaAggregatedResources(stream DeltaDiscoveryRequest) returns (stream DeltaDiscoveryResponse) { } } ads.proto https://github.com/envoyproxy/envoy/blob/master/api/envoy/service/discovery/v3/ads.proto
  10. Aggregated Discovery Service gRPC will support the Aggregate Discovery Service

    (ADS) variant of xDS, where all of these resource types are obtained on a single gRPC stream... we have no plans to support any non-aggregated variants of xDS... https://github.com/grpc/proposal/blob/master/A27-xds-global-load-balancing.md
  11. Without xDS Pod 10.28.1.11 Pod 10.28.1.12 Pod 10.28.1.13 Kubernetes Service

    serivce.foo.svc.cluster.local service.foo.svc.cluster.local
  12. Without xDS Pod 10.28.1.11 Pod 10.28.1.12 Pod 10.28.1.13 Kubernetes Headless

    Service hs-serivce.foo.svc.cluster.local 10.28.1.11 10.28.1.12 10.28.1.13 hs-service.foo.svc.cluster.local
  13. Bootstrap Configuration { "xds_servers": [ { "server_uri": "localhost:50050", "channel_creds": [

    { "type": "insecure" } ] } ], "node": { "id": "foo", "cluster": "bar" }, "server_features": [ "xds_v3" ] }
  14. Bootstrap Configuration { "xds_servers": [ { "server_uri": "localhost:50050", "channel_creds": [

    { "type": "insecure" } ] } ], "node": { "id": "foo", "cluster": "bar" }, "server_features": [ "xds_v3" ] }
  15. Bootstrap Configuration { "xds_servers": [ { "server_uri": "localhost:50050", "channel_creds": [

    { "type": "insecure" } ] } ], "node": { "id": "foo", "cluster": "bar" }, "server_features": [ "xds_v3" ] } GRPC_XDS_BOOTSTRAP=/path/to/bootstrap.json
  16. Deployment Proxyless Mesh { "xds_servers": [ { "server_uri": "localhost:50050", "channel_creds":

    [ { "type": "insecure" } ] } ], "node": { "id": "foo", "cluster": "bar" }, "server_features": [ "xds_v3" ] } GRPC_XDS_BOOTSTRAP=/path/to/bootstrap.json
  17. Inbound Traffic PREROUTING ISTIO_INBOUND ISTIO_IN_REDIRECT ISTIO_OUTPUT POSTROUTING OUTPUT istio-proxy PORT:

    15006 Application Linux Kernel Space (iptables / netfilter) Linux User Space ᶃ ᶄ ᶅ ᶆ ᶇ ᶈ ᶉ ᶊ
  18. Outbound Traffic OUTPUT ISTIO_REDIRECT POSTROUTING ISTIO_OUTPUT istio-proxy PORT: 15001 Application

    Linux Kernel Space (iptables / netfilter) Linux User Space ᶃ ᶄ ᶅ ᶆ ᶈ ᶇ ᶉ ᶊ ᶋ