Slide 1

Slide 1 text

Service Mesh fixing Microservice Architecture for good 2 9 . 0 9 . 2 0 2 0 1 Hanna Prinz

Slide 2

Slide 2 text

~ Fix your Microservices by throwing a Mesh at it! ~

Slide 3

Slide 3 text

How did we get here? @INNOQ @HannaPrinz

Slide 4

Slide 4 text

Monolith Microservices @INNOQ @HannaPrinz

Slide 5

Slide 5 text

Microservices @INNOQ @HannaPrinz

Slide 6

Slide 6 text

Timeout Circuit Breaking Encryption Retry collect & emit Metrics Decryption Authorization Routing @INNOQ @HannaPrinz

Slide 7

Slide 7 text

Service Mesh Metrics Config Retry Timeout Circuit Breaker Routing Encrypt Decrpyt Authorization Metrics ... } @INNOQ @HannaPrinz

Slide 8

Slide 8 text

Microservices with Service Mesh Service Mesh Evolution Monolith Microservices In Theory Microservices in Practice @INNOQ @HannaPrinz

Slide 9

Slide 9 text

Infrastruktur-Service Y Service Mesh Architecture Microservice 1 Microservice 2 Proxy Proxy Control Plane App Infrastructure-Service X Application Data Plane Control Plane Infrastructure @INNOQ @HannaPrinz

Slide 10

Slide 10 text

Hurray, Technology! @INNOQ @HannaPrinz

Slide 11

Slide 11 text

Service Mesh Features @INNOQ @HannaPrinz Observability Resilience Routing Security

Slide 12

Slide 12 text

Monitoring A Service Mesh can automatically deliver all 4 "Golden Signals": Latency Traffic Volume Errors (Status Codes) Saturation ... but it cannot look into the Microservices' Business Logic https://landing.google.com/sre/sre-book/chapters/monitoring-distributed-systems/#xref_monitoring_golden-signals @INNOQ @HannaPrinz

Slide 13

Slide 13 text

Monitoring with a Service Mesh Record Network Traffic Metrics -> Latency / Response Time -> HTTP Status Codes -> Requests per Second ... make them available to a Monitoring-System ... and visualize them with dashboards @INNOQ @HannaPrinz

Slide 14

Slide 14 text

Order Shipping Invoicing Postgres Demo Application Service use neither code nor libraries for monitoring! https://github.com/ewolff/microservice-istio

Slide 15

Slide 15 text

@INNOQ @HannaPrinz Istio

Slide 16

Slide 16 text

Service Mesh Features @INNOQ @HannaPrinz Observability Resilience Routing Security

Slide 17

Slide 17 text

Routing Typically implemented in the Edge Router / API Gateway e.g. NGINX, Envoy, Ambassador, Traefik Instance A Instance B Load Balancing Instance A Instance B Path-based Routing /a /b Instance A Instance B Blue/Green Deployment Instance A Instance B A/B-Testing 50% 50% Instance A Instance B Canary Releasing Berlin World 17 @INNOQ @HannaPrinz

Slide 18

Slide 18 text

Routing with a Service Mesh Microservice 1 Microservice 2 Proxy Proxy Control Plane App Application Data Plane Control Plane Routing Rules 18 @INNOQ @HannaPrinz

Slide 19

Slide 19 text

Routing with a Service Mesh GET /new GET / 90% 10% Service 1 Service 2A Proxy Proxy Service 2B Proxy Complex Routing Rules for A/B Testing and Canary Releasing Service 1 Service 2 Proxy Proxy Service 2 Proxy PRODUKTION STAGING Traffic Mirroring locality=Berlin locality=* 19 @INNOQ @HannaPrinz

Slide 20

Slide 20 text

Service Mesh Features @INNOQ @HannaPrinz Observability Resilience Routing Security

Slide 21

Slide 21 text

Resilience What if a service is not available as expected? Goal: Overall system continues to function ... with restrictions where necessary Methods: Retry, Timeout, Circuit Breaking 21 500 @INNOQ @HannaPrinz

Slide 22

Slide 22 text

Resilience with a Service Mesh Microservice 1 Microservice 2 Proxy Proxy Control Plane App Application Data Plane Control Plane Resilience Rules 22 @INNOQ @HannaPrinz

Slide 23

Slide 23 text

Resilience with a Service Mesh Fault Injection Delay Injection Service 1 Service 2 Proxy Proxy Timeout Retry Service 1 Service 2 Proxy Proxy 4s 502 23 @INNOQ @HannaPrinz

Slide 24

Slide 24 text

Service Mesh Features @INNOQ @HannaPrinz Observability Resilience Routing Security

Slide 25

Slide 25 text

Security with a Service Mesh Microservice 1 Microservice 2 Proxy Proxy Application Data Plane Control Plane Control Plane App Authorization Rules TLS-Certificate 25 @INNOQ @HannaPrinz

Slide 26

Slide 26 text

Security with a Service Mesh Service 1 Service 2 Proxy Proxy Authentication with mTLS Authorization Service 1 Service 2 Proxy Proxy GET /api GET / Authorization Rule TLS-Certificate 26 @INNOQ @HannaPrinz "Service 1"

Slide 27

Slide 27 text

Service Mesh Features Network metrics and access logs Emit tracing data to backend Timeouts & Retries Circuit Breaking Business metrics or logs Passing on tracing headers Alerting Use cache or standard responses in Circuit Breaker Automatic Canary Releasing Authentication with mTLS Authorization Complex routing rules Canary Releasing & A/B-Testing Observability Resilience Routing Security @INNOQ @HannaPrinz

Slide 28

Slide 28 text

Service Mesh Market @INNOQ @HannaPrinz

Slide 29

Slide 29 text

Service Mesh Implementations Istio @INNOQ @HannaPrinz

Slide 30

Slide 30 text

@INNOQ @HannaPrinz

Slide 31

Slide 31 text

Nice Table. @INNOQ @HannaPrinz

Slide 32

Slide 32 text

Let's not forget about the price @INNOQ @HannaPrinz

Slide 33

Slide 33 text

33 Latency •Additional ~3ms Latency - for each call between services! •Depending on the service mesh implementation & your architecture Highly depending on your project → make your own benchmark! @INNOQ @HannaPrinz

Slide 34

Slide 34 text

34 Resources •Additional containers for Control Plane & sidecars •→ increased CPU & memory consumption •Resource overhead is depending on •... the service mesh implementation •... the number of services/pods •... the traffic volume → make your own benchmark! @INNOQ @HannaPrinz

Slide 35

Slide 35 text

35 Complexity •non-happy-path customization •Moving functionality from services into the mesh (Retry/Timeout, mTLS) •Organizational aspects: Who owns the service mesh config? •Debugging •Debugging •Debugging @INNOQ @HannaPrinz ... but the real price of a Service Mesh is

Slide 36

Slide 36 text

apiVersion: networking.istio.io/v1alpha3 kind: EnvoyFilter metadata: name: istio-attributegen-filter spec: workloadSelector: labels: app: reviews configPatches: - applyTo: HTTP_FILTER match: context: SIDECAR_INBOUND proxy: proxyVersion: '1\.6.*' listener: filterChain: filter: name: "envoy.http_connection_manager" subFilter: name: "istio.stats" patch: operation: INSERT_BEFORE value: name: istio.attributegen typed_config: "@type": type.googleapis.com/udpa.type.v1.TypedStruct type_url: type.googleapis.com/envoy.extensions.filters.http.wa value: config: configuration: | { "attributes": [ { "output_attribute": "istio_operationId", "match": [ { "value": "GET /users", "condition": "request.url_path == '/users' && }, { "value": "POST /order", "condition": "request.url_path == '/order' && }, { "value": "GET /invoice/{id}", "condition": "request.url_path.matches('^/invo && request.method == 'GET'" } ] } ] } vm_config: runtime: envoy.wasm.runtime.null code: local: { inline_string: "envoy.wasm.attributegen" } Service Mesh Magic is build on a lot of YAML apiVersion: networking.istio.io/v1alpha3 kind: EnvoyFilter metadata: name: istio-attributegen-filter spec: workloadSelector: labels: app: reviews configPatches: - applyTo: HTTP_FILTER match: context: SIDECAR_INBOUND proxy: proxyVersion: '1\.6.*' listener: filterChain: filter: name: "envoy.http_connection_manager" subFilter: name: "istio.stats" patch: operation: INSERT_BEFORE value: name: istio.attributegen typed_config: "@type": type.googleapis.com/udpa.type.v1.TypedStruct type_url: type.googleapis.com/envoy.extensions.filters.http.was value: config: configuration: | { "attributes": [ { "output_attribute": "istio_operationId", "match": [ { "value": "GET /users", "condition": "request.url_path == '/users' && r }, { "value": "POST /order", "condition": "request.url_path == '/order' && r }, { "value": "GET /invoice/{id}", "condition": "request.url_path.matches('^/invoi && request.method == 'GET'" } ] } ] } vm_config: runtime: envoy.wasm.runtime.null code: local: { inline_string: "envoy.wasm.attributegen" }

Slide 37

Slide 37 text

TL;DR @INNOQ @HannaPrinz

Slide 38

Slide 38 text

Service Mesh Solves many essential problems of microservices + Another complex piece of technology – ... without changing the code! Increased latency and resource consumption 38 @INNOQ @HannaPrinz

Slide 39

Slide 39 text

Decision support Service Mesh Indicators Selection criteria • Many microservices, many synchronous calls • Many unsolved problems in monitoring, routing, resilience and/or security • Most services run in Kubernetes • Which features are really missing? • Existing infrastructure - Kubernetes, Consul, AWS, ... • Temporal and cognitive capacity in the team • Activity of the Community @INNOQ @HannaPrinz Objective: As much complexity as necessary, but as little as possible

Slide 40

Slide 40 text

Complexity? Uhm... @INNOQ @HannaPrinz

Slide 41

Slide 41 text

Monolith Microservices @INNOQ @HannaPrinz Modules?

Slide 42

Slide 42 text

"don't distribute your objects." ☝ https://martinfowler.com/articles/distributed-objects-microservices.html Martin Fowler @INNOQ @HannaPrinz

Slide 43

Slide 43 text

Alternatives? @INNOQ @HannaPrinz https://www.infoq.com/articles/architecture-trends-2020/

Slide 44

Slide 44 text

Try not to need a Service Mesh

Slide 45

Slide 45 text

More Service Mesh • Service Mesh Comparison at servicemesh.es https://servicemesh.es/ • Blog Post: Happy without a Service Mesh https://innoq.com/en/blog/happy-without-a-service-mesh/ • Example-Application with Istio and Linkerd Tutorial on GitHub https://github.com/ewolff/microservice-istio https://github.com/ewolff/microservice-linkerd • Linkerd Tutorial https://linkerd.io/2/tasks/ • Istio Tutorial https://istio.io/docs/setup/getting-started/ @INNOQ @HannaPrinz

Slide 46

Slide 46 text

Krischerstr. 100 40789 Monheim am Rhein Germany +49 2173 3366-0 Ohlauer Str. 43 10999 Berlin Germany +49 2173 3366-0 Ludwigstr. 180E 63067 Offenbach Germany +49 2173 3366-0 Kreuzstr. 16 80331 München Germany +49 2173 3366-0 Hermannstrasse 13 20095 Hamburg Germany +49 2173 3366-0 Gewerbestr. 11 CH-6330 Cham Switzerland +41 41 743 0116 innoQ Deutschland GmbH innoQ Schweiz GmbH www.innoq.com Thank you! Questions? Hanna Prinz [email protected] @HannaPrinz Icons made by srip, Smashicons, Nikita Golubev, Freepik, surang and Darius Dan from www.flaticon.com and licensed by CC 3.0 BY Service Mesh Primer - 2nd Edition Free at leanpub.com/service-mesh-primer