Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Stop reinventing the wheel with Istio

Stop reinventing the wheel with Istio

Containers provide a consistent and reproducible environment to run our services. Orchestration systems like Kubernetes help us to manage and scale our container cluster with a consistent API. This is a good start for a loosely coupled microservices architecture but it is not enough. How do you control the flow of traffic and enforce policies between services? How do you visualize service dependencies and quickly identify issues? How can you provide verifiable service identities, handle and test for failures? You can implement your own custom solutions or you can rely on Istio, an open platform to connect, manage and secure microservices. In this talk, we will take a look at some of the key capabilities of Istio and see how it can help with your microservices network.

Mete Atamel

March 05, 2019
Tweet

More Decks by Mete Atamel

Other Decks in Technology

Transcript

  1. Confidential & Proprietary Stop reinventing the wheel with Istio Mete

    Atamel Developer Advocate at Google @meteatamel
  2. Confidential & Proprietary What is a container? Lightweight Hermetically sealed

    Isolated Easily deployable Introspectable Composable Linux (or Windows) processes A lightweight way to virtualize applications
  3. 5 Docker: Tooling for the masses FROM debian:latest RUN apt-get

    update RUN apt-get install -y nginx CMD [“nginx”,”-g”,”daemon off;”] EXPOSE 80 Docker is a container runtime and image format Dockerfile defines the dependencies, environment and the code to run Container is a consistent invocation of a Dockerfile
  4. Confidential & Proprietary Containers are not enough Service Discovery Redundancy

    Scheduling Scaling up & down Rolling out & back Resiliency Config & Secrets Health Checks
  5. Confidential & Proprietary Kubernetes Κυβερνήτης means “governor” in Greek •

    Manages container clusters • Inspired and informed by Google’s internal container system called Borg • Supports multiple cloud and bare-metal environments • 100% Open source, written in Go Manage applications, not machines
  6. Confidential & Proprietary Microservices in Kubernetes world Service Pods Each

    pod containers one or more containers Nodes Role: frontend Role: frontend Role: frontend Role: frontend Replication controller Replicas: 3 Env: prod microservice labels Service communication channel Blueprint “pod template” Env: prod Env: prod Env: prod registry containers
  7. Confidential & Proprietary Kubernetes is not enough either Dependency Visualisation

    Tracing Metrics Logging Circuit Breaking Service Identity & Auth Fault Injection Traffic Flow & Policies Failover
  8. Ιστιο means “sail” in Greek Istio: An open framework for

    connecting, securing, managing and monitoring services
  9. Confidential & Proprietary Service architecture without Istio Users Cloud SQL

    frontend pictures payments auth External Payment Processor
  10. Confidential & Proprietary Service architecture with Istio Users Cloud SQL

    frontend pictures payments auth External Payment Processor proxy proxy proxy proxy public ingress private ingress egress
  11. Confidential & Proprietary Istio in a single slide Platform support:

    Kubernetes (Nomad, Mesos, Cloud Foundry) Current version: 1.0.6 Observability: Metrics, metrics query/visualization, trace spans, dependency visualisation Service Identity & Security: Verifiable service identity, mutual auth Traffic Management: • Dynamic traffic control • Ingress/egress routing • Timeouts, retries and fault injection • Policy enforcement and quote management
  12. 16 $ gcloud beta container clusters create istio-demo \ --addons=Istio

    --istio-config=auth=MTLS_STRICT \ --cluster-version=latest \ --machine-type=n1-standard-2 \ --num-nodes=4 Creating cluster istio-demo in europe-west4-a Created[https://container.googleapis.com/v1beta1/projects/istio-project2517/zones/europe-west4-a/clus ters/istio-demo] NAME LOCATION MASTER_VERSION MASTER_IP MACHINE_TYPE NODE_VERSION NUM_NODES STATUS istio-demo europe-west4-a 1.12.5-gke.5 35.204.5.121 n1-standard-2 1.12.5-gke.5 4 RUNNING $ kubectl create clusterrolebinding cluster-admin-binding \ --clusterrole=cluster-admin \ --user=$(gcloud config get-value core/account) clusterrolebinding "cluster-admin-binding" created
  13. Confidential & Proprietary Istio Architecture Mixer Citadel frontend payments proxy

    proxy Pilot Discovery & config data to Envoy sidecars TLS certs to Envoy sidecars Policy checks, telemetry Traffic transparently proxied — unaware of Envoy sidecars Control Plane HTTP/1.1, HTTP/2, gRPC with or without TLS
  14. Confidential & Proprietary Install Prometheus $ curl https://storage.googleapis.com/gke-release/istio/release/1.0.3-gke.3/patches/instal l-prometheus.yaml |

    kubectl apply -n istio-system -f - service "prometheus" created deployment.extensions "prometheus" created $ kubectl get svc prometheus -n istio-system NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE prometheus ClusterIP 10.31.250.92 <none> 9090/TCP
  15. Confidential & Proprietary Install Grafana $ curl https://storage.googleapis.com/gke-release/istio/release/1.0.3-gke.3/patches/instal l-grafana.yaml |

    kubectl apply -n istio-system -f - service "grafana" created deployment.extensions "grafana" created $ kubectl get svc grafana -n istio-system NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE grafana ClusterIP 10.31.251.158 <none> 3000/TCP
  16. Confidential & Proprietary Install ServiceGraph $ curl https://storage.googleapis.com/gke-release/istio/release/1.0.3-gke.3/patches/instal l-servicegraph.yaml |

    kubectl apply -n istio-system -f - service "servicegraph" created deployment.extensions "servicegraph" created $ kubectl get svc servicegraph -n istio-system NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) servicegraph ClusterIP 10.31.251.158 <none> 8088/TCP
  17. Confidential & Proprietary Install Tracing (Jaeger, Zipkin) $ curl https://storage.googleapis.com/gke-release/istio/release/1.0.3-gke.3/patches/instal

    l-tracing.yaml | kubectl apply -n istio-system -f - service "jaeger-query" created service "jaeger-collector" created service "jaeger-agent" created service "zipkin" created service "tracing" created $ kubectl get svc jaeger-query -n istio-system NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) jaeger-query ClusterIP 10.31.251.158 <none> 16686/TCP
  18. Confidential & Proprietary Traffic Management Istio’s traffic management decouples traffic

    flow from infrastructure Discovery & load balancing across services Dynamic request routing for A/B testing, gradual rollouts, canary releases Failure recovery using timeouts, retries, and circuit breakers Fault injection to test the compatibility of recovery policies across services
  19. Confidential & Proprietary Failure Handling Out-of-the-box opt-in failure recovery features

    such as: • Default timeout for HTTP requests is 15 seconds but configurable • The number of retries for a given HTTP request • Limits on number of concurrent connections • Circuit breakers can be set based on a number of criteria such as connection and request limits
  20. Confidential & Proprietary Fault Injection The faults can be either

    delays or aborts. Examples: • 5 second delay in 10% of the requests to the “v1” version of the service • Return HTTP 400 error for 10% of the requests to the service “v1” frontend movies proxy proxy stars proxy timeout: 100ms retries: 3 300ms timeout: 200ms retries: 2 400ms