Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Istio в разрезе: что умеет и не умеет самый поп...

flant
March 17, 2023

Istio в разрезе: что умеет и не умеет самый популярный Service Mesh

Доклад ведущего разработчика Kubernetes-платформы Deckhouse (https://deckhouse.ru/) Андрея Половова на DevOpsConf 2023.

flant

March 17, 2023
Tweet

More Decks by flant

Other Decks in Technology

Transcript

  1. Intro Service Mesh gRPC Load Balancing Mutual TLS Authorization Locality

    Load Balancing Weighted Load Balancer End-user Authentication
  2. Intro Service Mesh Traffic Shifting gRPC Load Balancing Mutual TLS

    A/B Tests Authorization Locality Load Balancing Weighted Load Balancer Canary Deployment End-user Authentication Fault Injection
  3. Intro Service Mesh Traffic Shifting End-user Authentication gRPC Load Balancing

    Mutual TLS A/B Tests Authorization Request Timeout Circuit Breaker Locality Load Balancing Canary Deployment Weighted Load Balancer Fault Injection
  4. Intro Service Mesh Traffic Shifting End-user Authentication gRPC Load Balancing

    Mutual TLS A/B Tests Authorization Request Timeout Circuit Breaker Locality Load Balancing Canary Deployment Weighted Load Balancer Fault Injection Multicluster Federation
  5. Intro Service Mesh Zone-aware Routing Traffic Shifting Metric Exporting &

    Tracing End-user Authentication Weighted Load Balancer gRPC Load Balancing Mutual TLS A/B Tests Fault Injection Authorization Egress Gateway Request Timeout Circuit Breaker Locality Load Balancing Canary Deployment Multicluster Federation
  6. Intro Service Mesh Zone-aware Routing Traffic Shifting Metric Exporting &

    Tracing End-user Authentication Weighted Load Balancer gRPC Load Balancing Mutual TLS A/B Tests Fault Injection Authorization Egress Gateway Request Timeout Circuit Breaker Locality Load Balancing Canary Deployment Multicluster Federation
  7. Intro Service Mesh Zone-aware Routing Traffic Shifting Metric Exporting &

    Tracing End-user Authentication Weighted Load Balancer gRPC Load Balancing Mutual TLS A/B Tests Fault Injection Authorization Egress Gateway Request Timeout Circuit Breaker Locality Load Balancing Canary Deployment Multicluster Federation Observability
  8. Intro Service Mesh Zone-aware Routing Traffic Shifting Metric Exporting &

    Tracing End-user Authentication Weighted Load Balancer gRPC Load Balancing Mutual TLS A/B Tests Fault Injection Authorization Egress Gateway Request Timeout Circuit Breaker Locality Load Balancing Canary Deployment Multicluster Federation Observability
  9. istio-proxy istiod front back db istio-proxy istio-proxy Weighted Load Balancer

    gRPC Load Balancing Mutual TLS Authorization Circuit Breaker Locality Load Balancing
  10. istio-proxy istiod front back db istio-proxy istio-proxy Weighted Load Balancer

    gRPC Load Balancing Mutual TLS Authorization Circuit Breaker Locality Load Balancing
  11. istio-proxy istiod front back db istio-proxy istio-proxy Weighted Load Balancer

    gRPC Load Balancing Mutual TLS Authorization Circuit Breaker Locality Load Balancing
  12. istio-proxy istiod front back db istio-proxy istio-proxy Weighted Load Balancer

    gRPC Load Balancing Mutual TLS Authorization Circuit Breaker Locality Load Balancing
  13. istiod back db istio-proxy istio-proxy Weighted Load Balancer gRPC Load

    Balancing Mutual TLS Authorization Circuit Breaker Locality Load Balancing istio-proxy front
  14. downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route

    handle tls Listener 10.24.0.8:443 handle stats authorization route listener 10.24.0.8:443 > Pod > istio-proxy > envoy
  15. downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route

    handle tls Listener 10.24.0.8:443 handle stats authorization route listener 10.24.0.8:443 > Pod > istio-proxy > envoy
  16. downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route

    handle tls Listener 10.24.0.8:443 handle stats authorization route listener 10.24.0.8:443 > Pod > istio-proxy > envoy
  17. downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route

    handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 10.24.0.8:443 > Pod > istio-proxy > envoy
  18. downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route

    handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 10.24.0.8:443 handle stats > Pod > istio-proxy > envoy
  19. downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route

    handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 10.24.0.8:443 handle stats authorization > Pod > istio-proxy > envoy
  20. downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route

    handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 10.24.0.8:443 handle stats authorization route > Pod > istio-proxy > envoy
  21. downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route

    handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster foo.example.com > Pod > istio-proxy > envoy
  22. downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route

    handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster foo.example.com endpoints ip:port ip:port ip:port > Pod > istio-proxy > envoy
  23. downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route

    handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster foo.example.com endpoints ip:port ip:port ip:port load balance > Pod > istio-proxy > envoy
  24. downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route

    handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster foo.example.com endpoints ip:port ip:port ip:port load balance select endpoint connect outlier detection > Pod > istio-proxy > envoy
  25. downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route

    handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster foo.example.com endpoints ip:port ip:port ip:port load balance select endpoint connect outlier detection handle tls > Pod > istio-proxy > envoy
  26. downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route

    handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster foo.example.com endpoints ip:port ip:port ip:port load balance select endpoint connect outlier detection handle tls handle stats > Pod > istio-proxy > envoy
  27. downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route

    handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster foo.example.com endpoints ip:port ip:port ip:port load balance select endpoint connect outlier detection handle tls handle stats > Pod > istio-proxy > envoy
  28. istio-proxy istio-proxy front back db istio-proxy Service back clusterIP: 10.222.0.78

    ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service front
  29. istio-proxy istio-proxy front back db istio-proxy Service back clusterIP: 10.222.0.78

    ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 Service front
  30. istio-proxy istio-proxy front back db istio-proxy Service back clusterIP: 10.222.0.78

    ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 Service front
  31. istio-proxy istio-proxy front back db istio-proxy Service back clusterIP: 10.222.0.78

    ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 Service front 10.111.2.3 10.111.4.3 10.111.3.3 10.111.2.5 10.111.2.4 10.111.2.3 10.111.2.5 10.111.2.4 10.111.3.3
  32. istio-proxy istio-proxy front back db istio-proxy Service back clusterIP: 10.222.0.78

    ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 Service front 10.111.2.3 10.111.4.3 10.111.3.3 istiod 10.111.2.5 10.111.2.4 10.111.2.3 10.111.2.5 10.111.2.4 10.111.3.3
  33. istio-proxy istio-proxy front back db istio-proxy Service back clusterIP: 10.222.0.78

    ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 Service front 10.111.2.3 10.111.4.3 10.111.3.3 10.111.2.5 10.111.2.4 10.111.2.3 10.111.2.5 10.111.2.4 10.111.3.3 istiod
  34. istio-proxy istio-proxy front back db istio-proxy Service back clusterIP: 10.222.0.78

    ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 Service front 10.111.2.3 10.111.4.3 10.111.3.3 10.111.2.5 10.111.2.4 10.111.2.3 10.111.2.5 10.111.2.4 10.111.3.3 istiod
  35. istio-proxy istio-proxy istiod front back db istio-proxy Service back clusterIP:

    10.222.0.78 ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 Service front 10.111.4.3 10.111.2.5 10.111.2.4 10.111.2.3 10.111.2.5 10.111.2.4 10.111.3.3
  36. istio-proxy istio-proxy istiod front back db istio-proxy Service back clusterIP:

    10.222.0.78 ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 Service front 10.111.4.3 10.111.2.5 10.111.2.4 10.111.2.3 10.111.2.5 10.111.2.4 10.111.3.3
  37. > From kubernetes to envoy handle tls listener 10.24.0.8:443 handle

    stats authorization route cluster foo.example.com endpoints ip:port ip:port ip:port load balance select endpoint connect outlier detection handle tls handle stats
  38. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front route listener endpoints cluster ip:port ip:port ip:port
  39. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 route listener endpoints cluster ip:port ip:port ip:port
  40. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 route listener endpoints cluster ip:port ip:port ip:port
  41. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 route listener endpoints cluster ip:port ip:port ip:port
  42. Service back clusterIP: 10.222.0.5 ports: - name: http port: 8080

    Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 route listener endpoints cluster ip:port ip:port ip:port clusterIP: 10.222.0.78 ports: - name: http port: 8080 Service front 10.111.2.5 10.111.2.4 10.111.2.3
  43. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 route listener endpoints cluster ip:port ip:port ip:port
  44. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster front ip:port ip:port ip:port route listener
  45. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster front ip:port ip:port ip:port route listener
  46. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 route listener
  47. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 route listener
  48. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener
  49. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener
  50. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 listener 10.111.3.4:8080 10.111.3.3:8080 route
  51. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener
  52. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener TCP IP:port
  53. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 HTTP Host route listener TCP IP:port
  54. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 HTTP Host route listener TCP IP:port TLS SNI
  55. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 HTTP Host route listener TCP IP:port TLS SNI
  56. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 HTTP Host route listener TCP IP:port TLS SNI
  57. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 HTTP Host route listener TCP IP:port TLS SNI
  58. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 HTTP Host route listener TCP IP:port TLS SNI
  59. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener HTTP Host TCP IP:port TLS SNI
  60. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener
  61. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener route listener 10.222.0.42:3306
  62. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener route listener 10.222.0.42:3306 route
  63. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener listener 10.222.0.42:3306 tcp_proxy
  64. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 listener 10.222.0.42:3306 tcp_proxy route listener 0.0.0.0:8080
  65. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 listener 10.222.0.42:3306 tcp_proxy route listener 0.0.0.0:8080
  66. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener 0.0.0.0:8080 tcp_proxy listener 10.222.0.42:3306
  67. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener 0.0.0.0:8080 tcp_proxy listener 10.222.0.42:3306 istio-proxy 0.0.0.0:15001 front istio-agent
  68. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener 0.0.0.0:8080 tcp_proxy listener 10.222.0.42:3306 istio-proxy 0.0.0.0:15001 front istio-agent
  69. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener 0.0.0.0:8080 tcp_proxy listener 10.222.0.42:3306
  70. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener 0.0.0.0:8080 tcp_proxy listener 10.222.0.42:3306 listener 0.0.0.0:15001
  71. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener 0.0.0.0:8080 tcp_proxy listener 10.222.0.42:3306 listener 0.0.0.0:15001
  72. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener 0.0.0.0:8080 tcp_proxy listener 10.222.0.42:3306 listener 0.0.0.0:15001 use_original_dst
  73. Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080

    clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener 0.0.0.0:8080 tcp_proxy listener 10.222.0.42:3306 listener 0.0.0.0:15001 use_original_dst
  74. > Request lifecycle istio-proxy front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78

    handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route listener 0.0.0.0:8080
  75. > Request lifecycle istio-proxy front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78

    handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 0.0.0.0:8080
  76. > Request lifecycle istio-proxy front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78

    handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 0.0.0.0:8080 handle stats
  77. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 0.0.0.0:8080 handle stats authorization istio-agent
  78. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 0.0.0.0:8080 handle stats authorization route istio-agent
  79. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 0.0.0.0:8080 handle stats authorization route cluster back cluster front istio-agent
  80. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 0.0.0.0:8080 handle stats authorization route cluster back cluster front istio-agent
  81. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back istio-agent
  82. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back istio-agent
  83. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back load balance istio-agent
  84. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back load balance select endpoint istio-agent
  85. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints load balance select endpoint 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 istio-agent
  86. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints load balance select endpoint 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 istio-agent
  87. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints load balance select endpoint connect 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 istio-agent
  88. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints load balance select endpoint connect outlier detection 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 istio-agent
  89. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints load balance select endpoint connect outlier detection handle tls 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 istio-agent
  90. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints load balance select endpoint connect outlier detection handle tls handle stats 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 istio-agent
  91. > Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints load balance select endpoint connect outlier detection handle tls handle stats istio-proxy back 10.111.3.3:8080 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 istio-agent
  92. istio-proxy front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle tls Listener

    10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back handle tls authorization route load balance select endpoint connect outlier detection handle tls
  93. > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls PeerAuthentication
  94. > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls PeerAuthentication DestinationRule
  95. > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls PeerAuthentication DestinationRule
  96. > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls PeerAuthentication AuthorizationPolicy DestinationRule
  97. > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls PeerAuthentication AuthorizationPolicy VirtualService DestinationRule
  98. > Istio API > PeerAuthentication front 0.0.0.0:15001 istio-agent GET http://back:8080

    10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls AuthorizationPolicy VirtualService DestinationRule handle tls PeerAuthentication
  99. > Istio API > PeerAuthentication <STRICT> PeerAuthentication apiVersion: security.istio.io/v1beta1 kind:

    PeerAuthentication metadata: name: mtls-on namespace: myns spec: mtls: mode: XXX <DISABLE>
  100. > Istio API > PeerAuthentication <PERMISSIVE> <STRICT> PeerAuthentication apiVersion: security.istio.io/v1beta1

    kind: PeerAuthentication metadata: name: mtls-on namespace: myns spec: mtls: mode: XXX <DISABLE>
  101. > Istio API > PeerAuthentication <STRICT> PeerAuthentication apiVersion: security.istio.io/v1beta1 kind:

    PeerAuthentication metadata: name: mtls-on namespace: myns spec: mtls: mode: XXX <DISABLE> <PERMISSIVE> FTP SMTP MYSQL … +
  102. <STRICT> PeerAuthentication apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: mtls-on namespace:

    myns spec: mtls: mode: XXX <DISABLE> <PERMISSIVE> + FTP SMTP MYSQL … > Istio API > PeerAuthentication =
  103. > Istio API > PeerAuthentication <PERMISSIVE> <STRICT> PeerAuthentication apiVersion: security.istio.io/v1beta1

    kind: PeerAuthentication metadata: name: mtls-on namespace: myns spec: mtls: mode: XXX <DISABLE>
  104. > Istio API > PeerAuthentication front 0.0.0.0:15001 istio-agent GET http://back:8080

    10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls AuthorizationPolicy VirtualService DestinationRule PeerAuthentication handle tls
  105. > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls AuthorizationPolicy VirtualService DestinationRule
  106. > Istio API > DestinationRule front 0.0.0.0:15001 istio-agent GET http://back:8080

    10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection back authorization route AuthorizationPolicy VirtualService handle tls DestinationRule
  107. > Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: XXX
  108. > Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: XXX
  109. > Istio API > DestinationRule <DISABLE> apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: XXX DestinationRule
  110. > Istio API > DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata:

    name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: XXX DestinationRule <DISABLE> <ISTIO_MUTUAL>
  111. > Istio API > DestinationRule <DISABLE> <ISTIO_MUTUAL> <MUTUAL> apiVersion: networking.istio.io/v1beta1

    kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: XXX DestinationRule
  112. > Istio API > DestinationRule <DISABLE> <ISTIO_MUTUAL> <MUTUAL> apiVersion: networking.istio.io/v1beta1

    kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: XXX <SIMPLE> DestinationRule
  113. > Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO_MUTUAL
  114. > Istio API > DestinationRule PeerAuthentication apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication

    metadata: name: mtls-on namespace: myns spec: mtls: mode: STRICT DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO_MUTUAL
  115. > Istio API > DestinationRule PeerAuthentication apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication

    metadata: name: mtls-on namespace: myns spec: mtls: mode: STRICT DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO_MUTUAL
  116. > Istio API > DestinationRule Mutual TLS PeerAuthentication apiVersion: security.istio.io/v1beta1

    kind: PeerAuthentication metadata: name: mtls-on namespace: myns spec: mtls: mode: STRICT DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO_MUTUAL
  117. PeerAuthentication apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: mtls-on namespace: myns

    spec: mtls: mode: STRICT DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL > Istio API > DestinationRule Mutual TLS
  118. PeerAuthentication apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: mtls-on namespace: myns

    spec: mtls: mode: STRICT DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL > Istio API > DestinationRule Mutual TLS
  119. back > Istio API > DestinationRule front 0.0.0.0:15001 istio-agent GET

    http://back:8080 10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route handle tls DestinationRule
  120. back > Istio API > DestinationRule front 0.0.0.0:15001 istio-agent GET

    http://back:8080 10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection handle tls authorization route DestinationRule
  121. back > Istio API > DestinationRule front 0.0.0.0:15001 istio-agent GET

    http://back:8080 10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection handle tls authorization route DestinationRule load balance select endpoint connect outlier detection
  122. back > Istio API > DestinationRule front 0.0.0.0:15001 istio-agent GET

    http://back:8080 10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection handle tls authorization route DestinationRule load balance select endpoint connect outlier detection Балансировка Тюнинг TCP Circuit Breaking
  123. > Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m
  124. > Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m
  125. > Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m Балансировка
  126. > Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m Балансировка Тюнинг TCP
  127. > Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m Балансировка Тюнинг TCP Circuit Breaking
  128. > Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m Балансировка Тюнинг TCP Circuit Breaking
  129. > Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m
  130. > Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m
  131. > Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m
  132. > Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m
  133. > Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule

    metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m https://github.com/istio/istio/issues/10537 Dec 18, 2018 Istio
  134. back > Istio API > DestinationRule front 0.0.0.0:15001 istio-agent GET

    http://back:8080 10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection handle tls authorization route DestinationRule load balance select endpoint connect outlier detection Балансировка Тюнинг TCP Circuit Breaking
  135. back > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78

    handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle tls DestinationRule handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route
  136. back > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78

    handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle tls DestinationRule handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route Авторизация
  137. > Istio API > AuthorizationPolicy front 0.0.0.0:15001 istio-agent GET http://back:8080

    10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle tls DestinationRule handle stats 10.111.2.5:8080 istio-proxy back 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route authorization AuthorizationPolicy Авторизация
  138. > Istio API > AuthorizationPolicy AuthorizationPolicy apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy

    metadata: name: httpbin namespace: foo spec: selector: matchLabels: app: httpbin action: ALLOW rules: - from: - source: principals: ["cluster.local/ns/default/sa/sleep"] - source: namespaces: ["test"] to: - operation: methods: ["GET"] paths: ["/info*"] when: - key: request.auth.claims[iss] values: ["https://accounts.google.com"] - key: request.headers[X-Secret] values: ["la-resistance"]
  139. > Istio API > AuthorizationPolicy AuthorizationPolicy apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy

    metadata: name: httpbin namespace: foo spec: selector: matchLabels: app: httpbin action: ALLOW rules: - from: - source: principals: ["cluster.local/ns/default/sa/sleep"] - source: namespaces: ["test"] to: - operation: methods: ["GET"] paths: ["/info*"] when: - key: request.auth.claims[iss] values: ["https://accounts.google.com"] - key: request.headers[X-Secret] values: ["la-resistance"]
  140. > Istio API > AuthorizationPolicy AuthorizationPolicy apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy

    metadata: name: httpbin namespace: foo spec: selector: matchLabels: app: httpbin action: ALLOW rules: - from: - source: principals: ["cluster.local/ns/default/sa/sleep"] - source: namespaces: ["test"] to: - operation: methods: ["GET"] paths: ["/info*"] when: - key: request.auth.claims[iss] values: ["https://accounts.google.com"] - key: request.headers[X-Secret] values: ["la-resistance"]
  141. > Istio API > AuthorizationPolicy AuthorizationPolicy apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy

    metadata: name: httpbin namespace: foo spec: selector: matchLabels: app: httpbin action: ALLOW rules: - from: - source: principals: ["cluster.local/ns/default/sa/sleep"] - source: namespaces: ["test"] to: - operation: methods: ["GET"] paths: ["/info*"] when: - key: request.auth.claims[iss] values: ["https://accounts.google.com"] - key: request.headers[X-Secret] values: ["la-resistance"]
  142. > Istio API > AuthorizationPolicy AuthorizationPolicy apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy

    metadata: name: httpbin namespace: foo spec: selector: matchLabels: app: httpbin action: ALLOW rules: - from: - source: principals: ["cluster.local/ns/default/sa/sleep"] - source: namespaces: ["test"] to: - operation: methods: ["GET"] paths: ["/info*"] when: - key: request.auth.claims[iss] values: ["https://accounts.google.com"] - key: request.headers[X-Secret] values: ["la-resistance"]
  143. > Istio API > AuthorizationPolicy AuthorizationPolicy apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy

    metadata: name: httpbin namespace: foo spec: selector: matchLabels: app: httpbin action: ALLOW rules: - from: - source: principals: ["cluster.local/ns/default/sa/sleep"] - source: namespaces: ["test"] to: - operation: methods: ["GET"] paths: ["/info*"] when: - key: request.auth.claims[iss] values: ["https://accounts.google.com"] - key: request.headers[X-Secret] values: ["la-resistance"]
  144. > Istio API > AuthorizationPolicy AuthorizationPolicy apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy

    metadata: name: httpbin namespace: foo spec: selector: matchLabels: app: httpbin action: ALLOW rules: - from: - source: principals: ["cluster.local/ns/default/sa/sleep"] - source: namespaces: ["test"] to: - operation: methods: ["GET"] paths: ["/info*"] when: - key: request.auth.claims[iss] values: ["https://accounts.google.com"] - key: request.headers[X-Secret] values: ["la-resistance"]
  145. > Istio API > AuthorizationPolicy AuthorizationPolicy apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy

    metadata: name: httpbin namespace: foo spec: selector: matchLabels: app: httpbin action: ALLOW rules: - from: - source: principals: ["cluster.local/ns/default/sa/sleep"] - source: namespaces: ["test"] to: - operation: methods: ["GET"] paths: ["/info*"] when: - key: request.auth.claims[iss] values: ["https://accounts.google.com"] - key: request.headers[X-Secret] values: ["la-resistance"]
  146. > Istio API > AuthorizationPolicy AuthorizationPolicy apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy

    metadata: name: httpbin namespace: foo spec: selector: matchLabels: app: httpbin action: ALLOW rules: - from: - source: principals: ["cluster.local/ns/default/sa/sleep"] - source: namespaces: ["test"] to: - operation: methods: ["GET"] paths: ["/info*"] when: - key: request.auth.claims[iss] values: ["https://accounts.google.com"] - key: request.headers[X-Secret] values: ["la-resistance"]
  147. > Istio API > AuthorizationPolicy AuthorizationPolicy Алгоритм принятия решения apiVersion:

    security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: httpbin namespace: foo spec: selector: matchLabels: app: httpbin action: ALLOW rules: - from: - source: principals: ["cluster.local/ns/default/sa/sleep"] - source: namespaces: ["test"] to: - operation: methods: ["GET"] paths: ["/info*"] when: - key: request.auth.claims[iss] values: ["https://accounts.google.com"] - key: request.headers[X-Secret] values: ["la-resistance"] deckhouse.ru deckhouse.ru
  148. > Istio API > AuthorizationPolicy front 0.0.0.0:15001 istio-agent GET http://back:8080

    10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle tls DestinationRule handle stats 10.111.2.5:8080 istio-proxy back 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route authorization AuthorizationPolicy Авторизация
  149. > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle tls DestinationRule handle stats 10.111.2.5:8080 istio-proxy back 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route authorization
  150. > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle tls DestinationRule handle stats 10.111.2.5:8080 istio-proxy back 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route authorization Хитрая маршрутизация
  151. > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle tls DestinationRule handle stats 10.111.2.5:8080 istio-proxy back 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route authorization Хитрая маршрутизация route VirtualService
  152. back back istio-proxy front Service back back / > Istio

    API > VirtualService back Service admin admin
  153. back back istio-proxy front Service back back / > Istio

    API > VirtualService back Service admin admin admin /
  154. back back istio-proxy front Service back back > Istio API

    > VirtualService back Service admin admin / VirtualService / admin /
  155. back back istio-proxy front Service back back > Istio API

    > VirtualService back Service admin admin / VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back spec: hosts: - back http: - match: - uri: prefix: "/admin" route: - destination: host: admin - route: - destination: host: back / admin /
  156. back back istio-proxy front Service back back > Istio API

    > VirtualService back Service admin admin VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back spec: hosts: - back http: - match: - uri: prefix: "/admin" route: - destination: host: admin - route: - destination: host: back / admin /
  157. back back istio-proxy front Service back back > Istio API

    > VirtualService back Service admin admin VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back spec: hosts: - back http: - match: - uri: prefix: "/admin" route: - destination: host: admin - route: - destination: host: back / /admin /
  158. back back istio-proxy front Service back back > Istio API

    > VirtualService back Service admin admin VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back spec: hosts: - back http: - match: - uri: prefix: "/admin" route: - destination: host: admin - route: - destination: host: back / admin /
  159. back back istio-proxy front Service back back > Istio API

    > VirtualService back Service admin admin VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back spec: hosts: - back http: - match: - uri: prefix: "/admin" route: - destination: host: admin - route: - destination: host: back / admin / /
  160. back back istio-proxy front Service back back > Istio API

    > VirtualService back Service admin admin VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back spec: hosts: - back http: - match: - uri: prefix: "/admin" route: - destination: host: admin - route: - destination: host: back / admin /
  161. back back istio-proxy front Service back back > Istio API

    > VirtualService back Service admin admin VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back spec: hosts: - back http: - match: - uri: prefix: "/admin" route: - destination: host: admin - route: - destination: host: back / admin /
  162. back back istio-proxy front Service back back > Istio API

    > VirtualService back Service admin admin VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back spec: hosts: - back http: - match: - uri: prefix: "/admin" route: - destination: host: admin - route: - destination: host: back / admin /
  163. back back istio-proxy front Service back back > Istio API

    > VirtualService back Canary Deployment /
  164. back back istio-proxy front Service back back > Istio API

    > VirtualService > Canary back-canary /
  165. back back istio-proxy front Service back back > Istio API

    > VirtualService > Canary back-canary /
  166. back back istio-proxy front Service back back back / >

    Istio API > VirtualService > Canary back-canary
  167. back back istio-proxy front Service back back back / >

    Istio API > VirtualService > Canary endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 back-canary
  168. back back istio-proxy front Service back back back / >

    Istio API > VirtualService > Canary endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 10.111.9.7:8080 back-canary
  169. back back istio-proxy front Service back back back / >

    Istio API > VirtualService > Canary endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 10.111.9.7:8080 LB back-canary
  170. back back istio-proxy front Service back back back / >

    Istio API > VirtualService > Canary endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 10.111.9.7:8080 LB back-canary
  171. back back istio-proxy front Service back back back / >

    Istio API > VirtualService > Canary endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 10.111.9.7:8080 LB back-canary
  172. back back istio-proxy front Service back back back / >

    Istio API > VirtualService > Canary back-canary
  173. back back istio-proxy front Service back back back / >

    Istio API > VirtualService > Canary back-canary
  174. back back istio-proxy front Service back back back Service back-canary

    back-canary / > Istio API > VirtualService > Canary
  175. back back istio-proxy front Service back back back Service back-canary

    back-canary / back-canary > Istio API > VirtualService > Canary
  176. istio-proxy front Service back-canary back-canary / back-canary > Istio API

    > VirtualService > Canary back back Service back back back
  177. istio-proxy front Service back-canary back-canary / back-canary > Istio API

    > VirtualService > Canary back back Service back back back VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back-canary
  178. istio-proxy front Service back-canary back-canary / back-canary > Istio API

    > VirtualService > Canary back back Service back back back VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back-canary Weighted Load Balancer
  179. istio-proxy front Service back-canary back-canary / back-canary > Istio API

    > VirtualService > Canary back back Service back back back VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back-canary
  180. istio-proxy front Service back-canary back-canary / back-canary > Istio API

    > VirtualService > Canary back back Service back back back VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back-canary
  181. istio-proxy front Service back-canary back-canary / back-canary > Istio API

    > VirtualService > Canary back back Service back back back VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back-canary
  182. istio-proxy front Service back-canary back-canary / back-canary > Istio API

    > VirtualService > Canary back back Service back back back VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back-canary
  183. istio-proxy front Service back-canary back-canary / back-canary > Istio API

    > VirtualService > Canary back back Service back back back VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back-canary
  184. istio-proxy front Service back-canary back-canary / VirtualService apiVersion: networking.istio.io/v1beta1 kind:

    VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back-canary back-canary > Istio API > VirtualService > Canary back back Service back back back
  185. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back back back-canary
  186. istio-proxy front back-canary / > Istio API > VirtualService >

    Canary > Istio-way back back Service back back back back
  187. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back back back back-canary
  188. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back back back back-canary
  189. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back back back back-canary endpoints load balance select endpoint connect outlier detection handle tls
  190. back istio-proxy front / > Istio API > VirtualService >

    Canary > Istio-way back back Service back back back back-canary endpoints load balance select endpoint connect outlier detection handle tls
  191. load balance select endpoint connect outlier detection handle tls back

    istio-proxy front endpoints / > Istio API > VirtualService > Canary > Istio-way back back Service back back back back-canary endpoints load balance select endpoint connect outlier detection handle tls
  192. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls back back-canary
  193. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls back back-canary
  194. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls back back-canary
  195. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls back back-canary
  196. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back back-canary endpoints load balance select endpoint connect outlier detection handle tls back subset
  197. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back back-canary endpoints load balance select endpoint connect outlier detection handle tls back
  198. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back back-canary endpoints load balance select endpoint connect outlier detection handle tls back
  199. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls back back-canary
  200. > Istio API > VirtualService > Canary > Istio-way front

    0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 authorization handle tls handle tls PeerAuthentication AuthorizationPolicy 10.111.3.3:8080 back load balance select endpoint connect outlier detection DestinationRule Хитрая маршрутизация route VirtualService
  201. > Istio API > VirtualService > Canary > Istio-way front

    0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back handle stats authorization route handle tls PeerAuthentication AuthorizationPolicy istio-proxy 10.111.3.3:8080 back load balance select endpoint connect outlier detection handle tls DestinationRule Хитрая маршрутизация route VirtualService endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080
  202. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls back back-canary
  203. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls back back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new
  204. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new endpoints load balance select endpoint connect outlier detection handle tls back
  205. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls back back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new
  206. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back back-canary endpoints load balance select endpoint connect outlier detection handle tls back DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new
  207. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back back-canary endpoints load balance select endpoint connect outlier detection handle tls DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new canary
  208. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back back-canary endpoints load balance select endpoint connect outlier detection handle tls canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new
  209. istio-proxy front > Istio API > VirtualService > Canary >

    Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls canary back-canary / DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new
  210. istio-proxy front > Istio API > VirtualService > Canary >

    Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls canary back-canary / DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new
  211. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls canary back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back subset: canary
  212. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls canary back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back subset: canary
  213. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls canary back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back subset: canary
  214. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls canary back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back subset: canary
  215. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls canary back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back subset: canary
  216. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls canary back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back subset: canary
  217. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls canary back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back subset: canary
  218. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls canary back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back subset: canary
  219. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls canary back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back subset: canary
  220. istio-proxy front / > Istio API > VirtualService > Canary

    > Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls canary back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back subset: canary
  221. > Istio API > VirtualService front 0.0.0.0:15001 istio-agent GET http://back:8080

    10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 authorization route handle tls back route load balance select endpoint connect outlier detection handle tls VirtualService DestinationRule endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 Хитрая маршрутизация
  222. > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back route load balance select endpoint connect outlier detection handle tls endpoints 10.111.2.5:8080 10.111.2.4:8080 authorization route handle tls 10.111.3.3:8080
  223. > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls PeerAuthentication AuthorizationPolicy VirtualService DestinationRule endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080
  224. > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle

    tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls PeerAuthentication AuthorizationPolicy VirtualService DestinationRule endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 — ИНТЕРФЕЙС ДЛЯ
  225. • Что с безопасностью? • Что, если что-то сломается? •

    Что с масштабированием? • Что с latency?
  226. • Что с безопасностью? • Что, если что-то сломается? •

    Что с масштабированием? • Что с latency?
  227. • Что с безопасностью? • Что, если что-то сломается? •

    Что с масштабированием? • Что с latency?
  228. • Что с безопасностью? • Что, если что-то сломается? •

    Что с масштабированием? • Что с latency? ~2.5ms / request
  229. • Что с безопасностью? • Что, если что-то сломается? •

    Что с масштабированием? • Что с latency? ~2.5ms / request
  230. • Что с безопасностью? • Что, если что-то сломается? •

    Что с масштабированием? • Что с latency? ~2.5ms / request
  231. • Что с безопасностью? • Что, если что-то сломается? •

    Что с масштабированием? • Что с latency? API Server ~2.5ms / request
  232. • Что с безопасностью? • Что, если что-то сломается? •

    Что с масштабированием? • Что с latency? Root CA API Server ~2.5ms / request
  233. • Что с безопасностью? • Что, если что-то сломается? •

    Что с масштабированием? • Что с latency? Root CA SA token API Server ~2.5ms / request
  234. Root CA SA token API Server • Что с безопасностью?

    • Что, если что-то сломается? • Что с масштабированием? • Что с latency? ~2.5ms / request
  235. • Что с безопасностью? • Что, если что-то сломается? •

    Что с масштабированием? • Что с latency?
  236. • Что с безопасностью? • Что, если что-то сломается? •

    Что с масштабированием? • Что с latency?
  237. • Что с безопасностью? • Что, если что-то сломается? •

    Что с масштабированием? • Что с latency?
  238. istio-proxy istiod front back db istio-proxy istio-proxy istio-proxy account istio-proxy

    warehouse > Масштабирование Асинхронно
  239. front back db istio-proxy istio-proxy istio-proxy account istio-proxy warehouse istio-proxy

    istiod Sidecar apiVersion: networking.istio.io/v1beta1 kind: Sidecar metadata: name: default namespace: myns spec: egress: - hosts: - "myns/*" - "istio-system/*" > Масштабирование
  240. front back db istio-proxy istio-proxy istio-proxy account istio-proxy warehouse istio-proxy

    istiod Sidecar apiVersion: networking.istio.io/v1beta1 kind: Sidecar metadata: name: default namespace: myns spec: egress: - hosts: - "myns/*" - "istio-system/*" > Масштабирование
  241. front back db istio-proxy istio-proxy istio-proxy account istio-proxy warehouse istio-proxy

    istiod Sidecar apiVersion: networking.istio.io/v1beta1 kind: Sidecar metadata: name: default namespace: myns spec: egress: - hosts: - "myns/*" - "istio-system/*" > Масштабирование
  242. front back db istio-proxy istio-proxy istio-proxy account istio-proxy warehouse istio-proxy

    istiod Sidecar apiVersion: networking.istio.io/v1beta1 kind: Sidecar metadata: name: default namespace: myns spec: egress: - hosts: - "myns/*" - "istio-system/*" > Масштабирование
  243. front back db istio-proxy istio-proxy istio-proxy account istio-proxy warehouse istio-proxy

    istiod Sidecar apiVersion: networking.istio.io/v1beta1 kind: Sidecar metadata: name: default namespace: myns spec: egress: - hosts: - "myns/*" - "istio-system/*" > Масштабирование
  244. istiod istiod front back db istio-proxy istio-proxy istio-proxy account istio-proxy

    warehouse istio-proxy istiod > Масштабирование
  245. front back db istio-proxy istio-proxy istio-proxy account istio-proxy warehouse istio-proxy

    istiod > Масштабирование istiod istiod istiod
  246. front back db istio-proxy istio-proxy istio-proxy account istio-proxy warehouse istio-proxy

    istiod ISTIO_DELTA_XDS > Масштабирование Youtube QR istiod istiod istiod
  247. istiod istiod istiod front back db istio-proxy istio-proxy istio-proxy account

    istio-proxy warehouse istio-proxy istiod > Масштабирование ISTIO_DELTA_XDS
  248. front back db istio-proxy istio-proxy istio-proxy account istio-proxy warehouse istio-proxy

    istiod ISTIO_DELTA_XDS > Масштабирование istio.io qr istiod istiod istiod
  249. front back db istio-proxy istio-proxy istio-proxy account istio-proxy warehouse istio-proxy

    istiod ISTIO_DELTA_XDS Ambient Mesh > Масштабирование istio.io qr istiod istiod istiod Istio
  250. istiod istiod istiod front back db istio-proxy istio-proxy istio-proxy account

    istio-proxy warehouse istio-proxy istiod ISTIO_DELTA_XDS Ambient Mesh > Масштабирование Istio
  251. Павел Тишков RnD Алёна Лунина Оформление презентации Спасибо! Дмитрий Зайцев

    Куратор доклада Антон Климов Оформление презентации флант
  252. Спасибо! Вы! Павел Тишков RnD Алёна Лунина Оформление презентации Дмитрий

    Зайцев Куратор доклада Антон Климов Оформление презентации
  253. deckhouse.io Андрей Половов Ведущий разработчик Kubernetes-платформы Deckhouse Флант DevOps и

    Kubernetes, обслуживание 24/7 habr.com/ru/company/flant youtube.com/c/Флант flant.ru t.me/flant_ru t.me/andreypolovov andrey.polovov@flant.com istio.io Ещё один доклад Оценить доклад