Managing Kubernetes with Istio

Managing Kubernetes with Istio Managing Kubernetes with Istio

@moficodes Level Set

@moficodes Microservices

@moficodes Containers

@moficodes Container Orchestration

@moficodes Kubernetes and Beyond

@moficodes Agenda • Learn what service mesh is • Why
does Kubernetes need a service mesh? • How does Istio help manage Kubernetes?

Mofizur Rahman Developer Advocate, IBM Do Container Stuff, Collect Stickers,
Write go code @moficodes

@moficodes Kubernetes is Great

@moficodes Kubernetes Features • Replicasets • Horizontal Auto Scaling •
Health Check • Self Healing • Rolling Deployment • Rollback • Resource Quota • Service Discovery • Load Balancing • Networking • Cross Cloud • Secret Management • Batch Execution • Storage orchestration

@moficodes So Why this Talk?

@moficodes

@moficodes User Application Database Monolith

@moficodes Monolith (In Reality) User Application Database

@moficodes Microservice User API Gateway Service Database Message Queue

@moficodes Kubernetes is not Enough on its OWN

@moficodes Cloud Native applications needs certain things

@moficodes Traffic Management

@moficodes Observability

@moficodes Policy Enforcement

@moficodes Security

@moficodes What Do We Do • Ingress and Traffic Management
• Tracing and Observability • Metrics and Analytics • Identity and Security

@moficodes

@moficodes That’s a lot of work

@moficodes We have to “Manage” Kubernetes

@moficodes Now also Manage 4+ 3rd party tool?

@moficodes This Doesn’t Seem Right

@moficodes What do we do?

@moficodes Option 1: Give up!

@moficodes

@moficodes We are problem solvers

@moficodes Option 2: Manage it all

@moficodes Won’t be the first Time

@moficodes We recreate wheels all the time

@moficodes Remember this slide? • Replicasets • Horizontal Auto Scaling
• Health Check • Self Healing • Rolling Deployment • Rollback • Resource Quota • Service Discovery • Load Balancing • Networking • Cross Cloud • Secret Management • Batch Execution • Storage orchestration

@moficodes We had similar features being built at almost every
org

@moficodes Skill is not the issue, time is.

@moficodes Option 3: Use a service mesh!

@moficodes What is this service mesh thing you speak of!

@moficodes Collection of best in class solutions

@moficodes Control and monitor service-to-service traffic

@moficodes Invisible to Dev teams

@moficodes Let’s talk about Istio

@moficodes Open source project

@moficodes Lyft IBM Google

@moficodes Istio Components Envoy Sidecar Proxy Mixer Enforce Access, Collect
Metric Pilot Propagate rules to Sidecars Citadel Service to Service and end-user AuthN and AuthZ

@moficodes Istio Features 47 Traffic Management Fine-grained control with rich
routing rules, retries, failovers, and fault injection Observability Automatic metrics, logs, and traces for all traffic within a cluster, including cluster ingress and egress

@moficodes Istio Features 48 Security Strong identity-based AuthN and AuthZ
layer, secure by default for ingress, egress and service-to-service traffic Policy Enforcement Extensible policy engine supporting access controls, rate limits and quotas.

@moficodes How does it work?

@moficodes Sidecar Proxy

@moficodes Istio Architecture

@moficodes

@moficodes Envoy High performance proxy which mediates inbound and outbound
traffic. • Dynamic service discovery • Load balancing • TLS termination • HTTP/2 and gRPC proxies • Circuit breakers • Health checks • Split traffic • Fault injection • Rich metrics

@moficodes Istio Architecture

@moficodes

@moficodes Istio Architecture Istiod

@moficodes Traffic Management • Integrated Ingress and Egress • Error
handling, retries, circuit breaking • Application knowledge can be leveraged for intelligent routing • Fault injection for end-to-end testing

@moficodes VirtualService Defines the rules that control how requests for
a service are routed within an Istio service mesh.

@moficodes DestinationRule Configures the set of policies to be applied
to a request after VirtualService routing has occurred.

@moficodes ServiceEntry Is commonly used to enable requests to services
outside of an Istio service mesh.

@moficodes Gateway Configures a load balancer operating at the edge
of the mesh for HTTP/TCP ingress traffic to a mesh application or egress traffic to external services.

@moficodes Sidecar Configures one or more sidecar proxies attached to
application workloads running inside the mesh.

@moficodes Telemetry • Istio’s Mixer is stateless and does not
manage any persistent storage of its own • Capable of accumulating a large amount of transient ephemeral state • Designed to be a highly reliable, goal is > 99.999% uptime for any individual instance • Many adapters available: Prometheus, Cloud providers, Datadog, Solarwinds…

@moficodes Adapters Modular and extensible component to abstract the details
of different policy and telemetry backend systems

@moficodes Performance and Scalability • Code level micro-benchmarks • Synthetic
end-to-end benchmarks across various scenarios • Realistic complex app end-to-end benchmarks across various settings • Automation to ensure performance doesn’t regress

@moficodes Security • Traffic encryption to defend against the man-in-the-middle
attacks • Mutual TLS and fine-grained access policies to provide flexible access control • Auditing tools to monitor all of it

@moficodes Installing Istio

@moficodes Manually istioctl Operator Managed

@moficodes

@moficodes Demo github.com/IBM/bee-travels-istio

@moficodes

@moficodes Final Thoughts There is no free lunch in this
world. Istio gives you a lot of things built in but it uses some CPU and memory resources.

@moficodes Takeaways • Servicemesh (Istio) extends kubernetes capabilities • It
can make some very difficult k8s things easier

@moficodes Thank You! I would love to hear your question,
comments, stories. @moficodes

Managing Kubernetes with Istio

Managing Kubernetes with Istio

More Decks by Mofizur Rahman

Other Decks in Technology

Featured

Transcript