Service Mesh - Beyond the Hype (Distributed Systems Meetup)

Slide 1

Slide 1 text

@build1point0  Service Mesh Beyond the Hype

Slide 2

Slide 2 text

@build1point0  @build1point0 | anubhavmishra $ whoami Anubhav Mishra Technical Advisor to the CTO, HashiCorp

Slide 3

Slide 3 text

@build1point0 

Slide 4

Slide 4 text

@build1point0 

Slide 5

Slide 5 text

@build1point0  Atlantis Open Source

Slide 6

Slide 6 text

@build1point0  GETTING STARTED WITH HASHICORP VAULT THEVAULTBOOK.COM

Slide 7

Slide 7 text

@build1point0  Gopher Artwork by Ashley McNamara

Slide 8

Slide 8 text

@build1point0 

Slide 9

Slide 9 text

@build1point0  Leading Cloud Infrastructure Automation Our software stack enables the provisioning, securing, connecting and running of apps and the infrastructure to support them. We unlock the cloud operating model for every business Founded 2012 Employees 1000 Funding 349M About HashiCorp Run Development Connect Networking Secure   Security Provision Operations

Slide 10

Slide 10 text

@build1point0  Service Mesh Beyond the Hype

Slide 11

Slide 11 text

@build1point0  Service Mesh Beyond the Hype

Slide 12

Slide 12 text

@build1point0 

Slide 13

Slide 13 text

@build1point0  https://buoyant.io/2017/04/25/whats-a-service-mesh-and-why-do-i-need-one/

Slide 14

Slide 14 text

@build1point0 

Slide 15

Slide 15 text

@build1point0 

Slide 16

Slide 16 text

@build1point0 

Slide 17

Slide 17 text

@build1point0  Smart Networking Basics

Slide 18

Slide 18 text

@build1point0  Service A Service B

Slide 19

Slide 19 text

@build1point0  Service A Service B Service B Service B ? Multiple Instances

Slide 20

Slide 20 text

@build1point0  Service A Service B Service B Service B ? Multiple Instances Service Discovery

Slide 21

Slide 21 text

@build1point0  Service A Service B

Slide 22

Slide 22 text

@build1point0  Service A Service B Request Failed

Slide 23

Slide 23 text

@build1point0  Service A Service B Request Failed Retries

Slide 24

Slide 24 text

@build1point0  Service A Service B Assigning Identity Cert: serviceA.foo.com Cert: serviceB.foo.com

Slide 25

Slide 25 text

@build1point0  Service A Service B Cert: serviceA.foo.com Cert: serviceB.foo.com Mutual TLS Assigning Identity

Slide 26

Slide 26 text

@build1point0  Service A Service B Cert: serviceA.foo.com Cert: serviceB.foo.com Mutual TLS Authorizing traffic Allow?

Slide 27

Slide 27 text

@build1point0  Challenges Service Discovery & Routing Service Retries, Circuit Breaking….. Service Identity & Authorization Observability

Slide 28

Slide 28 text

@build1point0  Smart Networking - First Principles Dumb Pipe or Smart Network/Mesh Protocol Awareness

Slide 29

Slide 29 text

@build1point0  Smart Networking - First Principles Dumb Pipe or Smart Network/Mesh Protocol Awareness

Slide 30

Slide 30 text

@build1point0  Smart Networking - First Principles Dumb Pipe or Smart Network/Mesh Protocol Awareness Service A Service B

Slide 31

Slide 31 text

@build1point0  Dumb Pipe Pros: Simplicity for Networks Smart Applications (“What you see is what you get”) Easily Customizable Cons: Redundant Code Every Application has to Implement the Code (Polyglot?)

Slide 32

Slide 32 text

@build1point0  Smart Networking - First Principles Dumb Pipe or Smart Network/Mesh Protocol Awareness Proxy Proxy Service A Service B

Slide 33

Slide 33 text

@build1point0  Smart Network/Mesh Pros: Little to no Application Code changes are required Features like Traffic Shaping, Service Discovery and Network Policy Control come out of the Box Cons: Smart Network becomes an Implicit Dependency of the Application Harder to Reason about the Whole System

Slide 34

Slide 34 text

@build1point0  Service Mesh

Slide 35

Slide 35 text

@build1point0  Service Mesh aka Smart Network Proxy Proxy Service A Service B

Slide 36

Slide 36 text

@build1point0  Service Mesh aka Smart Network Proxy Proxy Service A Service B Conﬁgure

Slide 37

Slide 37 text

@build1point0  Service Mesh aka Smart Network Proxy Proxy Service A Service B Conﬁgure Two parts

Slide 38

Slide 38 text

@build1point0  Separation of Control and Data Plane Control Plane Data Plane

Slide 39

Slide 39 text

@build1point0  Separation of Control and Data Plane Control Plane Data Plane • Traffic Routing / Shaping • Conﬁguring the Data Plane • Policy Enforcement • Provide Service Discovery Data to Data Plane

Slide 40

Slide 40 text

@build1point0  Separation of Control and Data Plane Control Plane Data Plane

Slide 41

Slide 41 text

@build1point0  Separation of Control and Data Plane Control Plane Data Plane • Forward Request from the Applications • Health Checking • Load Balancing • Circuit Breaking • Timeouts

Slide 42

Slide 42 text

@build1point0  Separation of Control and Data Plane Control Plane Data Plane • Forward Request from the Applications • Health Checking • Load Balancing • Circuit Breaking • Timeouts …..

Slide 43

Slide 43 text

@build1point0  Smart Networking - First Principles Dumb Pipe or Smart Network/Mesh Protocol Awareness Layer 4 vs Layer 7

Slide 44

Slide 44 text

@build1point0  Protocol Awareness Layer 4 vs Layer 7 TCP, UDP vs HTTP “Universally” Compatible High Performance Difficult to provide Sophisticated request aware features Layer 4

Slide 45

Slide 45 text

@build1point0  Protocol Awareness Layer 4 vs Layer 7 TCP, UDP vs HTTP Perform complex routing decisions Header and Path based routing Can yield lower performance Layer 7

Slide 46

Slide 46 text

@build1point0  Service Mesh In Action

Slide 47

Slide 47 text

∕

Slide 48

Slide 48 text

@build1point0  Consul Usage Launched in 2014 20K+ GitHub Stars 1M+ Downloads monthly Customers running 50,000+ agents "Most widely deployed service discovery tool on AWS"

Slide 49

Slide 49 text

@build1point0  Public Users

Slide 50

Slide 50 text

∕ Consul Connect

Slide 51

Slide 51 text

∕ Secure service-to-service communication with automatic TLS encryption and identity-based authorization that works everywhere. Consul Connect

Slide 52

Slide 52 text

IP1 IP2 PLAIN TCP

Slide 53

Slide 53 text

IP2 IP1 IP1 IP2 MUTUAL TLS PLAIN TCP WEB DB API

Slide 54

Slide 54 text

IP2 IP1 IP1 IP2 MUTUAL TLS PLAIN TCP PROXY DB API PROXY

Slide 55

Slide 55 text

IP2 IP1 IP1 IP2 MUTUAL TLS PLAIN TCP PROXY DB API PROXY

Slide 56

Slide 56 text

IP2 IP1 IP1 IP2 MUTUAL TLS PLAIN TCP PROXY DB API PROXY

Slide 57

Slide 57 text

IP2 IP1 IP1 IP2 MUTUAL TLS PLAIN TCP PROXY DB API PROXY

Slide 58

Slide 58 text

∕ Connect Layer 7 Features

Slide 59

Slide 59 text

∕ "web.service.consul"

Slide 60

Slide 60 text

∕ HTTP Routing Traffic Splitting Custom Resolution "web.service.consul"

Slide 61

Slide 61 text

∕ HTTP Routing Traffic Splitting Custom Resolution "web.service.consul"

Slide 62

Slide 62 text

∕ ▪ Path (exact, prefix, regex) ▪ Header ▪ Query Params ▪ HTTP Methods HTTP Routing

Slide 63

Slide 63 text

Kind = "service-router" Name = "web" Routes = [ { Match { HTTP { PathPrefix = "/admin" PrefixRewrite = "/" } } Destination { Service = "admin" }, } ... ] C O D E E D I T O R

Slide 64

Slide 64 text

Kind = "service-router" Name = "web" Routes = [ { Match { HTTP { PathPrefix = "/admin" PrefixRewrite = "/" } } Destination { Service = "admin" }, } ... ] C O D E E D I T O R

Slide 65

Slide 65 text

Kind = "service-router" Name = "web" Routes = [ { Match { HTTP { PathPrefix = "/admin" PrefixRewrite = "/" } } Destination { Service = "admin" }, } ... ] C O D E E D I T O R

Slide 66

Slide 66 text

∕ HTTP Routing Traffic Splitting Custom Resolution "web.service.consul" /admin => service: "admin" path: "/"

Slide 67

Slide 67 text

Kind = "service-splitter" Name = "admin" Splits = [ { Weight = 10 ServiceSubset = "v2" }, { Weight = 90 ServiceSubset = "v1" }, ] C O D E E D I T O R

Slide 68

Slide 68 text

Kind = "service-splitter" Name = "admin" Splits = [ { Weight = 10 ServiceSubset = "v2" }, { Weight = 90 ServiceSubset = "v1" }, ] C O D E E D I T O R

Slide 69

Slide 69 text

Kind = "service-splitter" Name = "admin" Splits = [ { Weight = 10 ServiceSubset = "v2" }, { Weight = 90 ServiceSubset = "v1" }, ] C O D E E D I T O R

Slide 70

Slide 70 text

∕ HTTP Routing Traffic Splitting Custom Resolution "web.service.consul" /admin => service: "admin" path: "/" Subset: "v2"

Slide 71

Slide 71 text

Kind = "service-resolver" Name = "admin" DefaultSubset = "v1" Subsets = { "v1" = { Filter = "Service.Meta.version == 1" }, "v2" = { Filter = "Service.Meta.version == 2" }, } C O D E E D I T O R

Slide 72

Slide 72 text

Kind = "service-resolver" Name = "admin" DefaultSubset = "v1" Subsets = { "v1" = { Filter = "Service.Meta.version == 1" }, "v2" = { Filter = "Service.Meta.version == 2" }, } C O D E E D I T O R

Slide 73

Slide 73 text

Kind = "service-resolver" Name = "admin" DefaultSubset = "v1" Subsets = { "v1" = { Filter = "Service.Meta.version == 1" }, "v2" = { Filter = "Service.Meta.version == 2" }, } C O D E E D I T O R

Slide 74

Slide 74 text

Kind = "service-resolver" Name = "admin" DefaultSubset = "v1" Subsets = { "v1" = { Filter = "Service.Meta.version == 1" }, "v2" = { Filter = "Service.Meta.version == 2" }, } C O D E E D I T O R

Slide 75

Slide 75 text

∕ HTTP Routing Traffic Splitting Custom Resolution "web.service.consul" V2 v1 V2 /admin => service: "admin" path: "/" Subset: "v2" Meta.Version == 2

Slide 76

Slide 76 text

∕ 10.0.1.1/24 IP2 IP1 WEB DB API

Slide 77

Slide 77 text

∕ 10.0.2.1/24 10.0.1.1/24 IP2 IP1 WEB DB API X

Slide 78

Slide 78 text

∕ 10.0.2.1/24 10.0.1.1/24 IP2 IP1 WEB DB API X Requires complex, manual network configuration to make work.

Slide 79

Slide 79 text

∕

Slide 80

Slide 80 text

∕ Mesh Gateways

Slide 81

Slide 81 text

∕ Secure service-to-service communication across networks with full end-to-end encryption that works everywhere. Mesh Gateway

Slide 82

Slide 82 text

∕ 10.0.2.1/24 10.0.1.1/24 IP2 IP1 WEB DB API X

Slide 83

Slide 83 text

∕ 10.0.2.1/24 10.0.1.1/24 IP2 IP1 WEB DB API CONNECT MESH GATEWAY CONNECT MESH GATEWAY

Slide 84

Slide 84 text

∕ GW GW GW

Slide 85

Slide 85 text

@build1point0  Demo

Slide 86

Slide 86 text

∕ ▪ Gateways cannot decrypt payloads – Do not have keys, only end service has the private key – Works by inspecting SNI headers ▪ Intentions enforced across datacenters Security

Slide 87

Slide 87 text

∕ 10.0.2.1/24 10.0.1.1/24 IP2 IP1 WEB DB API CONNECT MESH GATEWAY CONNECT MESH GATEWAY Allow "API" to "DB" Deny "Web" to "DB"

Slide 88

Slide 88 text

∕ Visualization

Slide 89

Slide 89 text

∕ Visualization

Slide 90

Slide 90 text

∕ Consul is a full-featured service mesh that supports multi-cloud, multi-region scale. Consul

Slide 91

Slide 91 text

Thank You Anubhav Mishra @build1point0 https://mishra.dev/service-mesh-distributed-systems-meetup