Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Fastly Yamagoya Meetup: Leveraging Cloud Portab...

Fastly Yamagoya Meetup: Leveraging Cloud Portability with Fastly

sakajunquality

October 23, 2019
Tweet

More Decks by sakajunquality

Other Decks in Technology

Transcript

  1. Ubie, Inc. - Medical Startup - Founded in 2017 -

    30+ employee - 15+ engineers - Business - Clinical decision making support - Operation efficiency support
  2. Agenda How Fastly helps - Migrating services across vendors -

    Migrating services within a cloud - Making more portability in architecture
  3. - Kubernetes: Open-source container orchestration platform. - Istio: Open-source Service

    Mesh platform. - Envoy: Open-source service proxy. Used in Istio dataplane. - GKE: GCP’s managed version of GKE. - Istio on GKE: GKE’s addon to install Istio. Terminologies
  4. 1st Migration in Ubie - Migrated from Heroku to GCP

    - Microservices w/ Kubernetes (GKE) - Data and ML services - Google’s Startup Support - etc...
  5. 1st Migration in Ubie - Two existing service - Frontend

    service - Old backend service - Older than the company! - One new service - New backend service - in Kotlin
  6. Fast Configuration Activation - DNS could take much time -

    Required a quick rollout and rollback - Not enough e2e test (at that time) - Personally not enough knowledge with applications (at that time) - Rolled-back once actually
  7. L7 Load Balancing - Outgoing traffic is sometimes limited in

    medical institutions - e.g. Domain name, IP address etc… - Meanwhile we want to use multiple services - Several backends are running and called from client-side
  8. L7 Load Balancing - With Fastly, we’re using L7 path

    based routing Service A Service B Service C / /log /static Client
  9. L7 Load Balancing - With Fastly, we’re using L7 path

    based routing - Can choose the best backend Service A Service B Service C / /log /static Client
  10. Dev Experience - Logging - Access log export to Google

    BigQuery - Most of logs are stored in BigQuery - Configuration via API - terraform
  11. Architecture Migration - Increase in # of users - Increase

    in # of services - Increase in # of developers - Changing softwares - Insufficient design - etc...
  12. 2nd Migration in Ubie - Changing Kubernetes (GKE) cluster -

    Installing Istio - Public to Private Cluster - Some new features - Changing logical deployment - namespaces
  13. Istio - Open-source Service Mesh platform - Originally from Google

    and etc… - Service Discovery / Traffic Control / Observability
  14. Why Istio? - Single Ingress-Gateway - More and more services

    are deployed - 2 services -> ~10 services - Client-side load balancing and its telemetry - Internal traffic has increased
  15. Why Istio? - Ingress Gateway Service A Service B Service

    C Service A Service B Service C Ingress Gateway ... ... Redundant origin config... Single origin config Separated Ingress LBs...
  16. Why Istio? - Internal traffic Service A Service B Service

    A Service B ILB It used to be using internal GCLB Need an additional configurations...
  17. Logical Deployment - namespace = virtual separation of cluster -

    Frequently used with access control - namespace is separated into teams at first - => startup’s teams change often!! - Change to 1 namespace for 1 service
  18. Security - WAF - Same rule for different backend infra

    - +2 - Customer on-boarding process - Not white-boxed rules - Access Restriction with VCL - Restrictions are not affected by backend infra
  19. The “God” Cluster - Pros - Resource Utilization - Less

    things to consider e.g. CI/CD Canary release ... - Less things to manage - Cons - Version updates - Testing new features - Cluster outage directly goes to service disruption
  20. Updates - Kubernetes (OSS) - Quortaly major updates - Security

    Patches - GKE (Managed) - OSS + GCP specific updates - Istio (OSS) - Frequent updates - Istio on GKE (Half-managed)
  21. Updates - Kubernetes (OSS) - Quortaly major updates - Security

    Patches - GKE (Managed) - OSS + GCP specific updates - Istio (OSS) - Frequent updates - Istio on GKE (Half-managed) So many chance to destroy the whole service!!
  22. 3rd Migration in Ubie - Migrating to multi-clusters - Like

    a East-West traffic - Migrating to OSS Istio - “Istio on GKE” has limitations… - Test alpha/experimental features in production safely
  23. 3rd Migration in Ubie Service Service Service Service Tenant 1

    Tenant 2 Round Robin Do not allow cross-cluster internal requests
  24. Remove the whole cluster Service Service Service Service Tenant 1

    Tenant 2 The whole service keeps running with the rest of clusters!
  25. External Requests - Load Balance with Fastly - Origin to

    Istio Ingress Gateway Origin configuration
  26. External Requests Still working with the following problems... - Health

    Check - Kubernetes cluster level? - Each service level? - Session Stickiness - Definition of client... - Canary-based rollouts
  27. Internal Requests - Client-side load balancing with envoy in Istio

    - All the internal requests stays in the cluster
  28. Takeaways - With Fastly, it’s really easy to migrate services

    and improve architecture. - Even if architecture design is not good enough - In Ubie, external traffic management w/ Fastly + internal traffic management w/ Istio combination works well
  29. So many Good points with Fastly! - Quick Rolled-out/back -

    Dev Experience - Support - Security - Custom VCL