Navigating the Service Mesh Ecosystem (Nov 2018)

A look at how to navigate the service mesh ecosystem. Aimed at architects and end-users, this presentation provides questions to ask when determining if a service mesh is right for you. If it IS right for you, then how do you start picking and choosing between the various CNCF-hosted projects? This is a vendor-neutral exploration to prepare you to answer those questions for yourself.

Co-presented presentation (Diogenes Rittori & George Miranda) at KubeCon China 2018.

Transcript

1. Navigating the Service Mesh Ecosystem
2. Diogenes Rettori Product Marketing Director, Pivotal Marketing Director, Solo.io @rettori Introductions George Miranda Director of Community, Buoyant Community, PagerDuty @gmiranda23
3. Thanks to our sponsors
4. @rettori @gmiranda23 - Application Focused Network Its capabilities exist to benefit a network of applications--not the network itself - Addresses needs of distributed systems Once you have multiple applications that interface with themselves, you’re in the realm of distributed systems What is a Service Mesh?
5. @rettori @gmiranda23 The network is reliable. Latency is zero. Bandwidth is infinite. The network is secure. Topology doesn’t change There is one administrator. Transport cost is zero. The network is homogeneous. Fallacies of Distributed Systems What is a Service Mesh? Circuit breaking and load balancing Timeouts and retries Rating and limiting Mutual TLS Service discovery Role-based access control gRPC and Protobuf Dynamic routing — A/B, canary deployments Service Mesh features
6. @rettori @gmiranda23 STOP!!! The Service Mesh is NOT FOR YOU (Go watch another session)
7. @rettori @gmiranda23 Can you name ALL of the services you manage?
8. @rettori @gmiranda23 Do you know how many times you deploy new code per month?
9. @rettori @gmiranda23 Do you know which services failed and why?
10. @rettori @gmiranda23 Do you want to use a service mesh to tell your friends you are using one?
11. @rettori @gmiranda23 Yes? STOP!!! The Service Mesh is NOT FOR YOU (Go watch another session)
12. @rettori @gmiranda23 Okay You have a real problem (don’t go to another session) Which Service Mesh should you use?
13. @rettori @gmiranda23 A landscape of CNCF service mesh options
14. @rettori @gmiranda23 ( Version 1)
15. @rettori @gmiranda23 Linkerd (v1) • Released February 2016 (almost 3 years!) • 400B+ production requests/month • Multi-platform (Docker, K8s, DC/OS, ECS, etc) • Original “service mesh” built on Finagle library (Scala) • Resiliency (latency-aware load balancing, retries, circuit breaking) • Security (TLS by default) • Policy (per-request routing) • Observability (service metrics, distributed tracing) • Performance (10K+ requests per second, per instance) • Support for H2, gRPC, HTTP/1.x, and all TCP traffic • https://linkerd.io/1/
16. @rettori @gmiranda23
17. @rettori @gmiranda23 Envoy • A service proxy for modern services architectures • Open sourced by (@mattklein123) and Lyft.com October 2016 • C++, highly performant, non-blocking architecture • Low tail latencies at scale/load (P99) • L3/4 filter at its core with many L7 filters out of the box • HTTP 2, gRPC support (upstream/downstream) • API-driven, dynamic configuration • Amenable to shared-proxy/sidecar-proxy deployment models • Foundation for more advanced application proxies • https://www.envoyproxy.io
18. @rettori @gmiranda23 (* not technically CNCF)
19. @rettori @gmiranda23 Istio • Launched May 2017 bootstrapped with Lyft, IBM, Google • Provides a control plane for service proxies (default Envoy) • Brings clustering control and observability • Fine grained routing • mTLS/RBAC/security • Resiliency • Policy control • Observability • http://istio.io
20. @rettori @gmiranda23 (Version 2)
21. @rettori @gmiranda23 Linkerd (v2) • Released December 2017, only supports Kubernetes • Extensible (GO control plane, bundles Prometheus & Grafana) • Performance (Rust proxy: sub 1ms p99 latency, ~1MB sidecar) • Observability (tap & per-route metrics) • Security (Automatic transparent TLS) • Easy to adopt & give service owners control ◦ Incrementally add pods/services ◦ No platform wide deployment needed ◦ Zero-Config support for HTTP, HTTP/2, WebSockets, & all TCP traffic ◦ Automatic proxy injection (experimental & requires K8s 1.9+) • https://linkerd.io
22. @rettori @gmiranda23 What about other service mesh options?
23. @rettori @gmiranda23 Summary Questions to ask yourself • Am I ready for a Service Mesh? • What problems are you having today? • What platforms do you need to support? • What functionality do you already have? • How much observability do your services have today? • Who owns services in Production? Developers or platform ops? • Centralized or decentralized functionality? • What support expectations do you have?
24. @rettori @gmiranda23 More Resources Which Service Mesh Should I Use? https://pduty.me/which_mesh Service Mesh Introduction Book https://pduty.me/servicemesh Istio Introduction Book https://pduty.me/istio_book 4 Reasons Why You Need Istio https://pduty.me/istio_talk