Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Istio: Will a Service Mesh become the new Serv...

Frank Munz
October 25, 2018

Istio: Will a Service Mesh become the new Service Bus?

Hey. There is a good recording of this presentation if you care:
https://www.youtube.com/watch?v=fDmJf9kWFws

Let’s face it: Kubernetes is the new platform for a modern microservices-based application architecture. However, until now it has been less clear how certain core requirements such as security/policy enforcement, traffic routing, in-depth telemetry, and reporting can be implemented for microservices. This presentation will get you up to date with Istio and Envoy and explain how it compares to the enterprise service bus you have been using for a decade. It includes live demos of Istio core concepts that will give you, as a developer, a head start.

Examples on AWS EKS managed Kubernetes service.
Keywords: Istio / Envoy / Enterprise Service Bus / AWS EKS / Kubernetes / Jaeger / Grafana / Prometheus

Link to presentation:
https://www.youtube.com/watch?v=fDmJf9kWFws

Frank Munz

October 25, 2018
Tweet

More Decks by Frank Munz

Other Decks in Technology

Transcript

  1. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Dr. Frank Munz Technical Evangelist, AWS @frankmunz Istio Will a Service Mesh become the new Service Bus?
  2. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. About me • Software Architect / DevOps Engineer • Technical Evangelist @ AWS • Published an AWS book (some years ago) • Containers, serverless and a sprinkle of ML & big / fast data @frankmunz
  3. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. 8 Years Back in Time: Enterprise Service Bus + SOA ESB = Service Virtualization Layer • Configuration driven • Reduces complexity #cx: squared -> linear with ESB • VETO pattern = Validate, Enrich, Transform, Operate
  4. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Enterprise Service Bus (ESB) Cross cutting concerns such as loose coupling, location transparency, throttling, monitoring, security, audit trails, etc.
  5. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Splitting the Monolith – A. Cockroft @ AWS https://youtu.be/aBcG57Gw9k0
  6. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Enterprise SW Modernization -> Microservices Building Blocks / Technical Architecture • Containers • Serverless • AWS Lambda • Other cloud services • Do NOT stuff everything into a container! • AWS API Gateway, Kinesis, Aurora, EKS, ECS, etc. -> Container / K8s will not make other services redundant
  7. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Challenges of Containers at Scale • More transient • More distributed and complex • Networking • Scheduling / Resource Management • Not virtualized, but isolated: containers share Linux kernel -> Tooling and orchestration required
  8. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Open source container management platform Helps you run containers at scale Gives you primitives for building modern applications What is Kubernetes (K8s)?
  9. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. “Run Kubernetes for me.”
  10. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Availability Zone 1 Availability Zone 2 Availability Zone 3 Kubectl EKS Architecture
  11. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. EKS is Kubernetes Certified + Heptio IAM Authenticator (open sourced) VPC Networking (open sourced)
  12. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Kubernetes Ressources (incomplete list) Ressource Pod Basic K8s unit, co-located containers Namespace Non-overlapping group of ressources Replica Set Keeps pod replicas running Service Exposes pod at single stable IP Deployment Rolling update of pods Ingress Expose service with static IP to external client Admission Controller Run code after API request, e.g. inject sidecar
  13. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. OSS Hystrix: code changes required Service Mesh: decentral, language agnostic https://www.infoq.com/articles/microservices-post-kubernetes Shift in Infrastructure Logic ESB: clustered monolith
  14. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Istio Service Mesh • Connect, secure, and observe services • Shift in where functionality is located • Istio control plane • Data plane = set of all proxies • Envoy proxy as sidecar in K8s pod • Automatic / manual injection of proxy
  15. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Istio Service Mesh with Envoy Proxy Add a 5s delay to 10% of all requests
  16. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Envoy Proxy • Level 7 proxy • HTTP, HTTP/2, gRPC, AWS Dynamo DB, MongoDB • C++11 code base , only 8 MB (statically linked) • No language or framework dependencies • No code changes
  17. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Service Mesh Cross cutting concerns such as retries, timeouts, circuit breaking, fault injection, client-side load balancing, service discovery, security, metrics-collection, A/B deployments, and traffic mirroring/ routing
  18. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Service Mesh But Docker / Kubernetes can do rolling updates! Yes, but Istio sparates traffic flow from replica deployment
  19. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. A bath tub full of cold water? 1pod 25% deployment … or just wetten your feet? Istio 3% traffic
  20. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Install Istio with Helm $ helm install --wait --name istio \ --namespace istio-system \ install/kubernetes/helm/istio \ --set grafana.enabled=true \ --set tracing.enabled=true \ --set servicegraph.enabled=true $ # K8s label turn on automatic sidecar injection $ kubectl label namespace default istioinjection=enabled
  21. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Snap @AWS Summit in New York 2018 https://youtu.be/mCVdcz01Z-g?t=2052
  22. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Summary • Architect wisely. Consider containers, serverless, and cloud services • Running K8s is hard, use a managed K8s service like AWS EKS • Service Meshes like Istio complement K8s • AWS EKS is unforked, upstream K8s. You can install open-source Istio with Envoy as a helm chart
  23. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Summary Envoy Proxy • CNCF incubator project • Implements cross-cutting concerns (many of which were implemented by ESB) • Auto sidecar injection with AWS EKS • Ties into Jaeger, Grafana, other CNCF projects
  24. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. References Ø Introduction to modern network load balancing and proxying https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying- a57f6ff80236 Ø InfoQ: Microservices in a Post-Kubernetes Era https://www.infoq.com/articles/microservices-post-kubernetes Ø Getting Started with Istio on Amazon EKS https://aws.amazon.com/blogs/opensource/getting-started-istio-eks/ Ø EKS Workshop (K8s, Helm, CI/CD, Grafana, Kabana) https://eksworkshop.com/introduction/ Ø Istio Book https://www.manning.com/books/istio-in-action Ø AWS EKS Documentation https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html
  25. © 2018, Amazon Web Services, Inc. or its Affiliates. All

    rights reserved. Dr. Frank Munz Technical Evangelist, AWS Thank you! @frankmunz