Service Mesh Magic (AWS App Mesh)

Slide 1

Slide 1 text

Slide 2

Slide 2 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. About me • Software Architect / DevOps Engineer • Technical Evangelist @ AWS • Published an AWS book • Containers, serverless and a sprinkle of ML & big / fast data @frankmunz

Slide 3

Slide 3 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. 10+ Years Back in Time: SOA ESB = Service Virtualization Layer • Reduces complexity, #cx: squared -> linear with ESB • VETO pattern • CCC = versioning, monitoring, security, etc.

Slide 4

Slide 4 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Modern Application Architecture: Microservices Building Blocks • Containers • Serverless (e.g. AWS Lambda) • 165 AWS services • Do NOT stuﬀ everything into container! -> Container / K8s will not make other cloud services redundant • EC2

Slide 5

Slide 5 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Challenges of Containers at Scale • More transient • More distributed and complex • Networking • Scheduling / Resource Management • Not virtualized, but isolated: containers share Linux kernel -> Tooling and orchestration required

Slide 6

Slide 6 text

Slide 7

Slide 7 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon ECS Easiest way to deploy and manage containers at scale Integration with entire AWS platform ALB, Auto Scaling, Batch, Elastic Beanstalk, CloudFormation, CloudTrail, CloudWatch Events, CloudWatch Logs, CloudWatch Metrics, ECR, EC2 Spot, IAM, NLB, Parameter Store, and VPC Scales to support clusters of any size Service integrations (like ALB and NLB) are at container level 1 2 3

Slide 8

Slide 8 text

Slide 9

Slide 9 text

Slide 10

Slide 10 text

Slide 11

Slide 11 text

Slide 12

Slide 12 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. OSSC libraries: code changes required, language specific Service Mesh: decentral, language agnostic, polyglot, light-weight https://www.infoq.com/articles/microservices-post-kubernetes Need for a Service Mesh ESB: clustered monolith

Slide 13

Slide 13 text

Slide 14

Slide 14 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Open Source: Istio Service Mesh Connect, secure, and observe services • Shift in where functionality is located • Control plane = Istio • Data plane = set of all Envoy proxies • Envoy proxy as sidecar in K8s pod • Automatic or manual injection of proxy with EKS

Slide 15

Slide 15 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Envoy Proxy • Level 7 proxy • HTTP, HTTP/2, gRPC, Amazon Dynamo DB, MongoDB • C++11 code base , only 8 MB (statically linked) • No language or framework dependencies • Rquires no code changes • Battle proven open source, started at Lyft • Envoy is not tightly coupled to Istio

Slide 16

Slide 16 text

Slide 17

Slide 17 text

Slide 18

Slide 18 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. A bath tub full of cold water ? K8s rolling update 25% 1 pod at a time … or just wetten your feet? Service Mesh 3% Traffic routing ! ! ! " # ! $❄$❄$❄ Fancy a Swim in the Arctic Sea ? Blue / Green 100% All services at once Microservices Update Strategies

Slide 19

Slide 19 text

Slide 20

Slide 20 text

Slide 21

Slide 21 text

Slide 22

Slide 22 text

Slide 23

Slide 23 text

Slide 24

Slide 24 text

Slide 25

Slide 25 text

Slide 26

Slide 26 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Based on Envoy proxy Start App Mesh from the AWS CLI, console or SDK There is no additional charge for using AWS App Mesh Supports any third-party tool that works with Envoy App Mesh

Slide 27

Slide 27 text

Slide 28

Slide 28 text

Slide 29

Slide 29 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Install AppMesh # AppMesh Installation with Grafana/Prometheus # and Envoy, AWS X-Ray daemon sidecar # and StatsD Prometheus exporter $ helm install -n aws-appmesh \ --namespace appmesh-system \ https://github.com/PaulMaddox/ \ aws-appmesh-helm/releases/ \ latest/download/aws-appmesh.tgz https://github.com/PaulMaddox/aws-appmesh-helm

Slide 30

Slide 30 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Install Demo App # create ns & enable auto-injection $ kubectl create ns appmesh-demo $ kubectl label namespace appmesh-demo appmesh.k8s.aws/sidecarInjectorWebhook=enabled # deploy the demo $ helm install -n aws-appmesh-demo \ --namespace appmesh-demo \ https://github.com/.../aws-appmesh-demo.tgz

Slide 31

Slide 31 text

Slide 32

Slide 32 text

Slide 33

Slide 33 text

Slide 34

Slide 34 text

Slide 35

Slide 35 text

Slide 36

Slide 36 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Logging HTTP access logging Amazon CloudWatch Logs Available as container logs on Amazon ECS, Amazon EKS, AWS Fargate Metrics CloudWatch metrics StatsD (with tags) Prometheus Tracing AWS X-Ray Other Envoy tracing drivers Observability

Slide 37

Slide 37 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Traﬃc shaping Load balancing Weighted targets Service discovery (DNS + AWS Cloud Map) Health checks Retries* Timeouts* Circuit breakers* *Coming soon Routing controls Protocols support (HTTP, TCP, gRPC*) Path-based Header-based* Cookie-based* Host-based* Traffic Management

Slide 38

Slide 38 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. App Mesh constructs Mesh Virtual node Virtual router and routes Virtual service Create and manage these in App Mesh API, CLI, SDK, or AWS Management Console Proxies Services Service discovery Conﬁgure and run proxies and services on Amazon ECS, Fargate, Amazon EKS, Amazon EC2 Service discovery with AWS Cloud Map

Slide 39

Slide 39 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. App Mesh Ressources App Mesh Ressource Service Mesh Logical boundary for network traffic between the services that reside within it Virtual Node Logical pointer to a particular task group (ECS service) or Kubernetes deployment (FQDN). Virtual Service Abstraction of a real service that is provided by a virtual node directly or indirectly by means of a virtual router Virtual Router Handles traffic for one or more virtual services Route Associated with a virtual router, and it directs traffic that matches a service name prefix to one or more virtual nodes.

Slide 40

Slide 40 text

Slide 41

Slide 41 text

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Summary • Architect wisely • Running K8s is hard, use a managed K8s service • EKS is unforked upstream K8s • A Service Mesh complements K8s: It adds observability and traffic management • AWS App Mesh is free to use and works across compute services • Service mesh can help to containerize and transition to micro services architecture

Slide 42

Slide 42 text

Slide 43

Slide 43 text