Istio в разрезе: что умеет и не умеет самый популярный Service Mesh

Istio в разрезе: что умеет и не умеет самый популярный
Service Mesh

Istio в разрезе : что умеет и не умеет самый
популярный Service Mesh

Intro Service Mesh

Intro Service Mesh Mutual TLS

Intro Service Mesh Mutual TLS Authorization End-user Authentication

Intro Service Mesh gRPC Load Balancing Mutual TLS Authorization Locality
Load Balancing Weighted Load Balancer End-user Authentication

Intro Service Mesh Trafﬁc Shifting gRPC Load Balancing Mutual TLS
A/B Tests Authorization Locality Load Balancing Weighted Load Balancer Canary Deployment End-user Authentication Fault Injection

Intro Service Mesh Trafﬁc Shifting End-user Authentication gRPC Load Balancing
Mutual TLS A/B Tests Authorization Request Timeout Circuit Breaker Locality Load Balancing Canary Deployment Weighted Load Balancer Fault Injection

Intro Service Mesh Trafﬁc Shifting End-user Authentication gRPC Load Balancing
Mutual TLS A/B Tests Authorization Request Timeout Circuit Breaker Locality Load Balancing Canary Deployment Weighted Load Balancer Fault Injection Multicluster Federation

Intro Service Mesh Zone-aware Routing Trafﬁc Shifting Metric Exporting &
Tracing End-user Authentication Weighted Load Balancer gRPC Load Balancing Mutual TLS A/B Tests Fault Injection Authorization Egress Gateway Request Timeout Circuit Breaker Locality Load Balancing Canary Deployment Multicluster Federation

Intro Service Mesh Zone-aware Routing Trafﬁc Shifting Metric Exporting &
Tracing End-user Authentication Weighted Load Balancer gRPC Load Balancing Mutual TLS A/B Tests Fault Injection Authorization Egress Gateway Request Timeout Circuit Breaker Locality Load Balancing Canary Deployment Multicluster Federation Observability

Intro PeerAuthentication AuthorizationPolicy VirtualService DestinationRule Sidecar ServiceEntry EnvoyFilter

Intro Observability

front back db

istiod front back db

front back db Control Plane istiod

istiod front back db

istio-proxy istiod front back db istio-proxy istio-proxy

istiod front back db Data Plane istio-proxy istio-proxy istio-proxy

istio-proxy istiod front back db istio-proxy istio-proxy

istio-proxy istiod front back db istio-proxy istio-proxy Weighted Load Balancer
gRPC Load Balancing Mutual TLS Authorization Circuit Breaker Locality Load Balancing

istiod back db istio-proxy istio-proxy Weighted Load Balancer gRPC Load
Balancing Mutual TLS Authorization Circuit Breaker Locality Load Balancing istio-proxy front

front > Pod

istio-proxy front > Pod

istio-proxy front > Pod > istio-proxy

istio-proxy front > Pod > istio-proxy > envoy

> Pod > istio-proxy > envoy

> Pod > istio-proxy > envoy downstream HTTP TCP

> Pod > istio-proxy > envoy downstream HTTP TCP upstream

> Pod > istio-proxy > envoy downstream HTTP TCP envoy
API upstream

downstream upstream > Pod > istio-proxy > envoy

downstream upstream handle tls Listener 10.24.0.8:443 handle stats authorization route
handle tls Listener 10.24.0.8:443 handle stats authorization route listener 10.24.0.8:443 > Pod > istio-proxy > envoy

handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 10.24.0.8:443 > Pod > istio-proxy > envoy

handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 10.24.0.8:443 handle stats > Pod > istio-proxy > envoy

handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 10.24.0.8:443 handle stats authorization > Pod > istio-proxy > envoy

handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 10.24.0.8:443 handle stats authorization route > Pod > istio-proxy > envoy

handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster foo.example.com > Pod > istio-proxy > envoy

handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster foo.example.com endpoints ip:port ip:port ip:port > Pod > istio-proxy > envoy

handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster foo.example.com endpoints ip:port ip:port ip:port load balance > Pod > istio-proxy > envoy

handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster foo.example.com endpoints ip:port ip:port ip:port load balance select endpoint connect outlier detection > Pod > istio-proxy > envoy

handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster foo.example.com endpoints ip:port ip:port ip:port load balance select endpoint connect outlier detection handle tls > Pod > istio-proxy > envoy

handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster foo.example.com endpoints ip:port ip:port ip:port load balance select endpoint connect outlier detection handle tls handle stats > Pod > istio-proxy > envoy

istio-proxy > Pod > istio-proxy > envoy front

istio-proxy > Pod > istio-proxy front

> Pod > istio-proxy istio-proxy front

> Pod > istio-proxy front istio-proxy

> Pod > istio-proxy istio-proxy front

> Pod > istio-proxy istio-proxy front ?

> Pod > istio-proxy front istio-proxy ? ?

> Pod > istio-proxy front istio-proxy

> Pod > istio-proxy front istio-proxy DNAT

> Pod > istio-proxy istio-proxy front DNAT --to-destination ???

> Pod > istio-proxy front istio-proxy DNAT --to-destination 0.0.0.0:15001 ???

> Pod > istio-proxy istio-proxy front DNAT --to-destination 127.0.0.1:15001 0.0.0.0:15001

> Pod > istio-proxy front istio-proxy 0.0.0.0:15001 DNAT --to-destination 127.0.0.1:15001
0.0.0.0:15006 DNAT --to-destination 127.0.0.1:15006

> Pod > istio-proxy front istio-proxy 0.0.0.0:15001 DNAT --to-destination 127.0.0.1:15001

> Pod > istio-proxy istio-proxy 0.0.0.0:15001 front DNAT --to-destination 127.0.0.1:15001
?

istio-agent

istiod istio-agent XDS

istiod istio-agent XDS envoy API

istio-proxy istio-proxy front back db istio-proxy

istio-proxy istio-proxy front back db istio-proxy clusterIP: 10.222.0.78 ports: -
name: http port: 8080 Service front

istio-proxy istio-proxy front back db istio-proxy Service back clusterIP: 10.222.0.78
ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service front

ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 Service front

ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 Service front 10.111.2.3 10.111.4.3 10.111.3.3 10.111.2.5 10.111.2.4 10.111.2.3 10.111.2.5 10.111.2.4 10.111.3.3

ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 Service front 10.111.2.3 10.111.4.3 10.111.3.3 istiod 10.111.2.5 10.111.2.4 10.111.2.3 10.111.2.5 10.111.2.4 10.111.3.3

ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 Service front 10.111.2.3 10.111.4.3 10.111.3.3 10.111.2.5 10.111.2.4 10.111.2.3 10.111.2.5 10.111.2.4 10.111.3.3 istiod

istio-proxy istio-proxy istiod front back db istio-proxy Service back clusterIP:
10.222.0.78 ports: - name: http port: 8080 clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 Service front 10.111.4.3 10.111.2.5 10.111.2.4 10.111.2.3 10.111.2.5 10.111.2.4 10.111.3.3

> From kubernetes to envoy handle tls listener 10.24.0.8:443 handle
stats authorization route cluster foo.example.com endpoints ip:port ip:port ip:port load balance select endpoint connect outlier detection handle tls handle stats

> From kubernetes to envoy listener 10.24.0.8:443 route cluster foo.example.com
endpoints ip:port ip:port ip:port

> From kubernetes to envoy route listener endpoints cluster ip:port
ip:port ip:port

Service back clusterIP: 10.222.0.78 ports: - name: http port: 8080
clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front route listener endpoints cluster ip:port ip:port ip:port

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 route listener endpoints cluster ip:port ip:port ip:port

Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 route listener endpoints cluster ip:port ip:port ip:port clusterIP: 10.222.0.78 ports: - name: http port: 8080 Service front 10.111.2.5 10.111.2.4 10.111.2.3

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 route listener endpoints cluster ip:port ip:port ip:port

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster front ip:port ip:port ip:port route listener

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 route listener

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 listener 10.111.3.4:8080 10.111.3.3:8080 route

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener TCP IP:port

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 HTTP Host route listener TCP IP:port

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 HTTP Host route listener TCP IP:port TLS SNI

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener HTTP Host TCP IP:port TLS SNI

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener route listener 10.222.0.42:3306

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener route listener 10.222.0.42:3306 route

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener listener 10.222.0.42:3306 tcp_proxy

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 listener 10.222.0.42:3306 tcp_proxy route listener 0.0.0.0:8080

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener 0.0.0.0:8080 tcp_proxy listener 10.222.0.42:3306

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener 0.0.0.0:8080 tcp_proxy listener 10.222.0.42:3306 istio-proxy 0.0.0.0:15001 front istio-agent

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener 0.0.0.0:8080 tcp_proxy listener 10.222.0.42:3306

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener 0.0.0.0:8080 tcp_proxy listener 10.222.0.42:3306 listener 0.0.0.0:15001

clusterIP: 10.222.0.5 ports: - name: http port: 8080 Service db clusterIP: 10.222.0.42 ports: - name: mysql port: 3306 > From kubernetes to envoy Service front 10.111.2.5 10.111.2.4 10.111.2.3 10.111.3.5 10.111.3.4 10.111.3.3 10.111.4.3 endpoints cluster db 10.111.4.3:3306 endpoints cluster front 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 endpoints cluster back 10.111.3.5:8080 10.111.3.4:8080 10.111.3.3:8080 route listener 0.0.0.0:8080 tcp_proxy listener 10.222.0.42:3306 listener 0.0.0.0:15001 use_original_dst

istio-proxy istio-proxy front back db istio-proxy

> Request lifecycle istio-proxy back db istio-proxy istio-proxy front

> Request lifecycle istio-proxy front istio-agent

> Request lifecycle istio-proxy front istio-agent listener 0.0.0.0:8080 listener 10.222.0.42:3306

> Request lifecycle istio-proxy front 0.0.0.0:15001 istio-agent listener 0.0.0.0:8080 listener
10.222.0.42:3306

> Request lifecycle istio-proxy front 0.0.0.0:15001 istio-agent GET http://back:8080 listener
0.0.0.0:8080 listener 10.222.0.42:3306

> Request lifecycle istio-proxy front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78
listener 0.0.0.0:8080 listener 10.222.0.42:3306

> Request lifecycle listener 10.222.0.42:3306 istio-proxy front 0.0.0.0:15001 istio-agent GET
http://back:8080 10.222.0.78 listener 0.0.0.0:8080

handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route listener 0.0.0.0:8080

handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 0.0.0.0:8080

handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 0.0.0.0:8080 handle stats

> Request lifecycle istio-proxy front 0.0.0.0:15001 GET http://back:8080 10.222.0.78 handle
tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 0.0.0.0:8080 handle stats authorization istio-agent

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 0.0.0.0:8080 handle stats authorization route istio-agent

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls listener 0.0.0.0:8080 handle stats authorization route cluster back cluster front istio-agent

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back istio-agent

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back load balance istio-agent

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back load balance select endpoint istio-agent

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints load balance select endpoint 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 istio-agent

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints load balance select endpoint connect 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 istio-agent

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints load balance select endpoint connect outlier detection 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 istio-agent

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints load balance select endpoint connect outlier detection handle tls 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 istio-agent

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints load balance select endpoint connect outlier detection handle tls handle stats 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 istio-agent

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance handle tls listener 0.0.0.0:8080 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints load balance select endpoint connect outlier detection handle tls handle stats istio-proxy back 10.111.3.3:8080 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 istio-agent

istio-proxy front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle tls Listener
10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back handle tls authorization route load balance select endpoint connect outlier detection handle tls

> Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle
tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls PeerAuthentication

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls PeerAuthentication DestinationRule

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls PeerAuthentication AuthorizationPolicy DestinationRule

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls PeerAuthentication AuthorizationPolicy VirtualService DestinationRule

> Istio API > PeerAuthentication front 0.0.0.0:15001 istio-agent GET http://back:8080
10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls AuthorizationPolicy VirtualService DestinationRule handle tls PeerAuthentication

> Istio API > PeerAuthentication PeerAuthentication apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication
metadata: name: mtls-on namespace: myns spec: mtls: mode: XXX

PeerAuthentication apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: mtls-on namespace: myns
spec: mtls: mode: XXX > Istio API > PeerAuthentication

spec: mtls: mode: XXX > Istio API > PeerAuthentication <DISABLE>

> Istio API > PeerAuthentication <STRICT> PeerAuthentication apiVersion: security.istio.io/v1beta1 kind:
PeerAuthentication metadata: name: mtls-on namespace: myns spec: mtls: mode: XXX <DISABLE>

> Istio API > PeerAuthentication <PERMISSIVE> <STRICT> PeerAuthentication apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication metadata: name: mtls-on namespace: myns spec: mtls: mode: XXX <DISABLE>

> Istio API > PeerAuthentication <STRICT> PeerAuthentication apiVersion: security.istio.io/v1beta1 kind:
PeerAuthentication metadata: name: mtls-on namespace: myns spec: mtls: mode: XXX <DISABLE> <PERMISSIVE> FTP SMTP MYSQL … +

<STRICT> PeerAuthentication apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication metadata: name: mtls-on namespace:
myns spec: mtls: mode: XXX <DISABLE> <PERMISSIVE> + FTP SMTP MYSQL … > Istio API > PeerAuthentication =

> Istio API > PeerAuthentication <PERMISSIVE> <STRICT> PeerAuthentication apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication metadata: name: mtls-on namespace: myns spec: mtls: mode: XXX <DISABLE>

> Istio API > PeerAuthentication PeerAuthentication apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication
metadata: name: mtls-on namespace: myns spec: mtls: mode: STRICT

> Istio API > PeerAuthentication front 0.0.0.0:15001 istio-agent GET http://back:8080
10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls AuthorizationPolicy VirtualService DestinationRule PeerAuthentication handle tls

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls AuthorizationPolicy VirtualService DestinationRule

> Istio API > DestinationRule front 0.0.0.0:15001 istio-agent GET http://back:8080
10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection back authorization route AuthorizationPolicy VirtualService handle tls DestinationRule

> Istio API > DestinationRule DestinationRule DestinationRule

> Istio API > DestinationRule DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule
metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: XXX

> Istio API > DestinationRule <DISABLE> apiVersion: networking.istio.io/v1beta1 kind: DestinationRule
metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: XXX DestinationRule

> Istio API > DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata:
name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: XXX DestinationRule <DISABLE> <ISTIO_MUTUAL>

> Istio API > DestinationRule <DISABLE> <ISTIO_MUTUAL> <MUTUAL> apiVersion: networking.istio.io/v1beta1
kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: XXX DestinationRule

> Istio API > DestinationRule <DISABLE> <ISTIO_MUTUAL> <MUTUAL> apiVersion: networking.istio.io/v1beta1
kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: XXX <SIMPLE> DestinationRule

metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO_MUTUAL

> Istio API > DestinationRule PeerAuthentication apiVersion: security.istio.io/v1beta1 kind: PeerAuthentication
metadata: name: mtls-on namespace: myns spec: mtls: mode: STRICT DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO_MUTUAL

> Istio API > DestinationRule Mutual TLS PeerAuthentication apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication metadata: name: mtls-on namespace: myns spec: mtls: mode: STRICT DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO_MUTUAL

spec: mtls: mode: STRICT DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: mtls-on namespace: myns spec: host: *.myns.svc trafficPolicy: tls: mode: ISTIO-MUTUAL > Istio API > DestinationRule Mutual TLS

back > Istio API > DestinationRule front 0.0.0.0:15001 istio-agent GET
http://back:8080 10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route handle tls DestinationRule

http://back:8080 10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection handle tls authorization route DestinationRule

http://back:8080 10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection handle tls authorization route DestinationRule load balance select endpoint connect outlier detection

http://back:8080 10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection handle tls authorization route DestinationRule load balance select endpoint connect outlier detection Балансировка Тюнинг TCP Circuit Breaking

> Istio API > DestinationRule DestinationRule

metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m

metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m Балансировка

metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m Балансировка Тюнинг TCP

metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m Балансировка Тюнинг TCP Circuit Breaking

istio-proxy front back istio-proxy > Istio API > DestinationRule

istio-proxy front back istio-proxy istio-proxy front istio-proxy front > Istio
API > DestinationRule

metadata: name: mypolicy spec: host: back trafficPolicy: loadBalancer: consistentHash: httpCookie: name: user ttl: 0s connectionPool: tcp: maxConnections: 1 http: maxRequestsPerConnection: 10 outlierDetection: consecutive5xxErrors: 7 interval: 5m baseEjectionTime: 15m https://github.com/istio/istio/issues/10537 Dec 18, 2018 Istio

http://back:8080 10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection handle tls authorization route DestinationRule load balance select endpoint connect outlier detection Балансировка Тюнинг TCP Circuit Breaking

back > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78
handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle tls DestinationRule handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route

back > Istio API front 0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78
handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle tls DestinationRule handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route Авторизация

> Istio API > AuthorizationPolicy front 0.0.0.0:15001 istio-agent GET http://back:8080
10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle tls DestinationRule handle stats 10.111.2.5:8080 istio-proxy back 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route authorization AuthorizationPolicy Авторизация

> Istio API > AuthorizationPolicy AuthorizationPolicy

> Istio API > AuthorizationPolicy AuthorizationPolicy apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy
metadata: name: httpbin namespace: foo spec: selector: matchLabels: app: httpbin action: ALLOW rules: - from: - source: principals: ["cluster.local/ns/default/sa/sleep"] - source: namespaces: ["test"] to: - operation: methods: ["GET"] paths: ["/info*"] when: - key: request.auth.claims[iss] values: ["https://accounts.google.com"] - key: request.headers[X-Secret] values: ["la-resistance"]

> Istio API > AuthorizationPolicy AuthorizationPolicy Алгоритм принятия решения apiVersion:
security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: httpbin namespace: foo spec: selector: matchLabels: app: httpbin action: ALLOW rules: - from: - source: principals: ["cluster.local/ns/default/sa/sleep"] - source: namespaces: ["test"] to: - operation: methods: ["GET"] paths: ["/info*"] when: - key: request.auth.claims[iss] values: ["https://accounts.google.com"] - key: request.headers[X-Secret] values: ["la-resistance"] deckhouse.ru deckhouse.ru

istio-proxy front back istio-proxy > Istio API > AuthorizationPolicy

> Istio API > AuthorizationPolicy front 0.0.0.0:15001 istio-agent GET http://back:8080
10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle tls DestinationRule handle stats 10.111.2.5:8080 istio-proxy back 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route authorization AuthorizationPolicy Авторизация

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle tls DestinationRule handle stats 10.111.2.5:8080 istio-proxy back 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route authorization

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle tls DestinationRule handle stats 10.111.2.5:8080 istio-proxy back 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route authorization Хитрая маршрутизация

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle tls DestinationRule handle stats 10.111.2.5:8080 istio-proxy back 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 handle tls load balance select endpoint connect outlier detection authorization route authorization Хитрая маршрутизация route VirtualService

istio-proxy front > Istio API > VirtualService

istio-proxy front Service back > Istio API > VirtualService

back back istio-proxy front Service back back > Istio API
> VirtualService

back back istio-proxy front Service back back / > Istio
API > VirtualService

API > VirtualService back Service admin admin

API > VirtualService back Service admin admin admin /

> VirtualService back Service admin admin / VirtualService / admin /

> VirtualService back Service admin admin / VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back spec: hosts: - back http: - match: - uri: prefix: "/admin" route: - destination: host: admin - route: - destination: host: back / admin /

> VirtualService back Service admin admin VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back spec: hosts: - back http: - match: - uri: prefix: "/admin" route: - destination: host: admin - route: - destination: host: back / admin /

> VirtualService back Service admin admin VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back spec: hosts: - back http: - match: - uri: prefix: "/admin" route: - destination: host: admin - route: - destination: host: back / /admin /

> VirtualService back Service admin admin VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back spec: hosts: - back http: - match: - uri: prefix: "/admin" route: - destination: host: admin - route: - destination: host: back / admin / /

> VirtualService /

> VirtualService back /

> VirtualService back Canary Deployment /

> VirtualService > Canary back /

> VirtualService > Canary back-canary /

back back istio-proxy front Service back back back / >
Istio API > VirtualService > Canary back-canary

Istio API > VirtualService > Canary endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 back-canary

Istio API > VirtualService > Canary endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 10.111.9.7:8080 back-canary

Istio API > VirtualService > Canary endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.2.3:8080 10.111.9.7:8080 LB back-canary

Istio API > VirtualService > Canary back-canary

back back istio-proxy front Service back back back back-canary /
> Istio API > VirtualService > Canary

back back istio-proxy front Service back back back Service back-canary
back-canary / > Istio API > VirtualService > Canary

back back istio-proxy front Service back back back Service back-canary
back-canary / back-canary > Istio API > VirtualService > Canary

istio-proxy front Service back-canary back-canary / back-canary > Istio API
> VirtualService > Canary back back Service back back back

> VirtualService > Canary back back Service back back back VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back-canary

> VirtualService > Canary back back Service back back back VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back-canary Weighted Load Balancer

> VirtualService > Canary back back Service back back back VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back-canary

istio-proxy front Service back-canary back-canary / VirtualService apiVersion: networking.istio.io/v1beta1 kind:
VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back-canary back-canary > Istio API > VirtualService > Canary back back Service back back back

istio-proxy front / > Istio API > VirtualService > Canary
> Istio-way back back Service back back back back-canary

istio-proxy front back-canary / > Istio API > VirtualService >
Canary > Istio-way back back Service back back back back

> Istio-way back back Service back back back back back-canary

> Istio-way back back Service back back back back back-canary endpoints load balance select endpoint connect outlier detection handle tls

back istio-proxy front / > Istio API > VirtualService >
Canary > Istio-way back back Service back back back back-canary endpoints load balance select endpoint connect outlier detection handle tls

load balance select endpoint connect outlier detection handle tls back
istio-proxy front endpoints / > Istio API > VirtualService > Canary > Istio-way back back Service back back back back-canary endpoints load balance select endpoint connect outlier detection handle tls

> Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls back back-canary

> Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back back-canary endpoints load balance select endpoint connect outlier detection handle tls back subset

> Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back back-canary endpoints load balance select endpoint connect outlier detection handle tls back

> Istio API > VirtualService > Canary > Istio-way front
0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 authorization handle tls handle tls PeerAuthentication AuthorizationPolicy 10.111.3.3:8080 back load balance select endpoint connect outlier detection DestinationRule Хитрая маршрутизация route VirtualService

> Istio API > VirtualService > Canary > Istio-way front
0.0.0.0:15001 istio-agent GET http://back:8080 10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back handle stats authorization route handle tls PeerAuthentication AuthorizationPolicy istio-proxy 10.111.3.3:8080 back load balance select endpoint connect outlier detection handle tls DestinationRule Хитрая маршрутизация route VirtualService endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080

> Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls back back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new

> Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new endpoints load balance select endpoint connect outlier detection handle tls back

> Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls back back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new

> Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back back-canary endpoints load balance select endpoint connect outlier detection handle tls back DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new

> Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back back-canary endpoints load balance select endpoint connect outlier detection handle tls DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new canary

> Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back back-canary endpoints load balance select endpoint connect outlier detection handle tls canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new

istio-proxy front > Istio API > VirtualService > Canary >
Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls canary back-canary / DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new

> Istio-way back back Service back back endpoints load balance select endpoint connect outlier detection handle tls back endpoints load balance select endpoint connect outlier detection handle tls canary back-canary DestinationRule apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: back-canary spec: host: back subsets: - name: canary labels: version: new VirtualService apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: back-canary spec: hosts: - back http: - route: - weight: 90 destination: host: back - weight: 10 destination: host: back subset: canary

> Istio API > VirtualService front 0.0.0.0:15001 istio-agent GET http://back:8080
10.222.0.78 handle tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 authorization route handle tls back route load balance select endpoint connect outlier detection handle tls VirtualService DestinationRule endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 Хитрая маршрутизация

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back route load balance select endpoint connect outlier detection handle tls endpoints 10.111.2.5:8080 10.111.2.4:8080 authorization route handle tls 10.111.3.3:8080

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls PeerAuthentication AuthorizationPolicy VirtualService DestinationRule endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080

tls Listener 10.24.0.8:443 handle stats authorization route handle tls Listener 10.24.0.8:443 handle stats authorization route connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance listener 0.0.0.0:8080 handle stats connect Cluster foo.example.c om outlier detection handle tls handle stats select endpoint endpoints ip:port ip:port ip:port load balance cluster back endpoints handle stats 10.111.2.5:8080 istio-proxy 10.111.3.3:8080 10.111.2.4:8080 10.111.3.3:8080 back authorization route load balance select endpoint connect outlier detection handle tls handle tls PeerAuthentication AuthorizationPolicy VirtualService DestinationRule endpoints 10.111.2.5:8080 10.111.2.4:8080 10.111.3.3:8080 — ИНТЕРФЕЙС ДЛЯ

Observability

• Что с latency?

• Что с latency? • Что с безопасностью?

• Что с безопасностью? • Что, если что-то сломается? •
Что с latency?

Что с масштабированием? • Что с latency?

Что с масштабированием? • Что с latency? ~2.5ms / request

Что с масштабированием? • Что с latency? API Server ~2.5ms / request

Что с масштабированием? • Что с latency? Root CA API Server ~2.5ms / request

Что с масштабированием? • Что с latency? Root CA SA token API Server ~2.5ms / request

Root CA SA token API Server • Что с безопасностью?
• Что, если что-то сломается? • Что с масштабированием? • Что с latency? ~2.5ms / request

> Ломаем компоненты

istio-proxy istiod front back db istio-proxy istio-proxy > Ломаем компоненты

istio-proxy istiod front back db istio-proxy istio-proxy checkout > Ломаем
компоненты

istio-proxy front back db istio-proxy istio-proxy checkout istiod > Ломаем

компоненты istio-proxy admin

компоненты istio-proxy admin Pending…

istio-proxy front back db istio-proxy istio-proxy checkout > Ломаем компоненты
istiod istio-proxy admin Pending…

компоненты istio-proxy admin Pending…

> Масштабирование

istio-proxy istiod front back db istio-proxy istio-proxy > Масштабирование

istio-proxy istiod front back db istio-proxy istio-proxy istio-proxy account istio-proxy
warehouse > Масштабирование

istio-proxy istiod front db istio-proxy istio-proxy istio-proxy account istio-proxy warehouse
back > Масштабирование

istio-proxy istiod front back db istio-proxy istio-proxy istio-proxy istio-proxy warehouse
account > Масштабирование

warehouse > Масштабирование Асинхронно

front back db istio-proxy istio-proxy istio-proxy account istio-proxy warehouse istio-proxy
istiod > Масштабирование

istiod Sidecar > Масштабирование

istiod Sidecar apiVersion: networking.istio.io/v1beta1 kind: Sidecar metadata: name: default namespace: myns spec: egress: - hosts: - "myns/*" - "istio-system/*" > Масштабирование

istiod > Масштабирование

istiod istiod front back db istio-proxy istio-proxy istio-proxy account istio-proxy
warehouse istio-proxy istiod > Масштабирование

istiod > Масштабирование istiod istiod istiod

istiod ISTIO_DELTA_XDS > Масштабирование Youtube QR istiod istiod istiod

istiod istiod istiod front back db istio-proxy istio-proxy istio-proxy account
istio-proxy warehouse istio-proxy istiod > Масштабирование ISTIO_DELTA_XDS

istiod ISTIO_DELTA_XDS > Масштабирование istio.io qr istiod istiod istiod

istiod ISTIO_DELTA_XDS Ambient Mesh > Масштабирование istio.io qr istiod istiod istiod Istio

istiod istiod istiod front back db istio-proxy istio-proxy istio-proxy account
istio-proxy warehouse istio-proxy istiod ISTIO_DELTA_XDS Ambient Mesh > Масштабирование Istio

Павел Тишков RnD Алёна Лунина Оформление презентации Спасибо! Дмитрий Зайцев
Куратор доклада Антон Климов Оформление презентации флант

Спасибо! Вы! Павел Тишков RnD Алёна Лунина Оформление презентации Дмитрий
Зайцев Куратор доклада Антон Климов Оформление презентации

deckhouse.io Андрей Половов Ведущий разработчик Kubernetes-платформы Deckhouse Флант DevOps и
Kubernetes, обслуживание 24/7 habr.com/ru/company/flant youtube.com/c/Флант flant.ru t.me/flant_ru t.me/andreypolovov andrey.polovov@flant.com istio.io Ещё один доклад Оценить доклад

Istio в разрезе: что умеет и не умеет самый популярный Service Mesh

Istio в разрезе: что умеет и не умеет самый популярный Service Mesh

More Decks by flant

Other Decks in Technology

Featured

Transcript