Tweet
Tweet

Slide 1

Slide 1 text

@build1point0  Service Mesh Beyond the Hype

Slide 2

Slide 2 text

@build1point0  @build1point0 $ whoami Anubhav Mishra Technical Advisor to the CTO, HashiCorp

Slide 3

Slide 3 text

@build1point0 

Slide 4

Slide 4 text

@build1point0 

Slide 5

Slide 5 text

@build1point0 

Slide 6

Slide 6 text

@build1point0 

Slide 7

Slide 7 text

@build1point0  Open Source

Slide 8

Slide 8 text

@build1point0  Atlan&s Open Source

Slide 9

Slide 9 text

@build1point0  VAULT IN ACTION BOOK

Slide 10

Slide 10 text

@build1point0  Gopher Artwork by Ashley McNamara

Slide 11

Slide 11 text

@build1point0 

Slide 12

Slide 12 text

PRIVATE CLOUD AWS AZURE GCP Run Development Connect Networking Secure 
 Security Provision Operations HashiCorp Suite

Slide 13

Slide 13 text

@build1point0  Service Mesh Beyond the Hype

Slide 14

Slide 14 text

@build1point0  Service Mesh Beyond the Hype

Slide 15

Slide 15 text

@build1point0 

Slide 16

Slide 16 text

@build1point0  https://buoyant.io/2017/04/25/whats-a-service-mesh-and-why-do-i-need-one/

Slide 17

Slide 17 text

@build1point0 

Slide 18

Slide 18 text

@build1point0 

Slide 19

Slide 19 text

@build1point0 

Slide 20

Slide 20 text

@build1point0  Smart Networking Basics

Slide 21

Slide 21 text

@build1point0  Service A Service B

Slide 22

Slide 22 text

@build1point0  Service A Service B Service B Service B ? Multiple Instances

Slide 23

Slide 23 text

@build1point0  Service A Service B Service B Service B ? Multiple Instances Service Discovery

Slide 24

Slide 24 text

@build1point0  Service A Service B

Slide 25

Slide 25 text

@build1point0  Service A Service B Request Failed

Slide 26

Slide 26 text

@build1point0  Service A Service B Request Failed Retries

Slide 27

Slide 27 text

@build1point0  Service A Service B Assigning Identity Cert: serviceA.foo.com Cert: serviceB.foo.com

Slide 28

Slide 28 text

@build1point0  Service A Service B Cert: serviceA.foo.com Cert: serviceB.foo.com Mutual TLS Assigning Identity

Slide 29

Slide 29 text

@build1point0  Service A Service B Cert: serviceA.foo.com Cert: serviceB.foo.com Mutual TLS Authorizing traffic Allow?

Slide 30

Slide 30 text

@build1point0  Challenges Service Discovery & Routing Service Retries, Circuit Breaking….. Service Identity & Authorization Observability

Slide 31

Slide 31 text

@build1point0  Smart Networking - First Principles Dumb Pipe or Smart Network/Mesh Protocol Awareness

Slide 32

Slide 32 text

@build1point0  Smart Networking - First Principles Dumb Pipe or Smart Network/Mesh Protocol Awareness

Slide 33

Slide 33 text

@build1point0  Smart Networking - First Principles Dumb Pipe or Smart Network/Mesh Protocol Awareness Service A Service B

Slide 34

Slide 34 text

@build1point0  Dumb Pipe Pros: Simplicity for Networks Smart Applications (“What you see is what you get”) Easily Customizable Cons: Redundant Code Every Application has to Implement the Code (Polyglot?)

Slide 35

Slide 35 text

@build1point0  Smart Networking - First Principles Dumb Pipe or Smart Network/Mesh Protocol Awareness Proxy Proxy Service A Service B

Slide 36

Slide 36 text

@build1point0  Smart Network/Mesh Pros: Little to no Application Code changes are required Features like Traffic Shaping, Service Discovery and Network Policy Control come out of the Box Cons: Smart Network becomes an Implicit Dependency of the Application Harder to Reason about the Whole System

Slide 37

Slide 37 text

@build1point0  Service Mesh

Slide 38

Slide 38 text

@build1point0  Service Mesh aka Smart Network Proxy Proxy Service A Service B

Slide 39

Slide 39 text

@build1point0  Service Mesh aka Smart Network Proxy Proxy Service A Service B Configure

Slide 40

Slide 40 text

@build1point0  Service Mesh aka Smart Network Proxy Proxy Service A Service B Configure Two parts

Slide 41

Slide 41 text

@build1point0  Separation of Control and Data Plane Control Plane Data Plane

Slide 42

Slide 42 text

@build1point0  Separation of Control and Data Plane Control Plane Data Plane • Traffic Routing / Shaping • Configuring the Data Plane • Policy Enforcement • Provide Service Discovery Data to Data Plane

Slide 43

Slide 43 text

@build1point0  Separation of Control and Data Plane Control Plane Data Plane

Slide 44

Slide 44 text

@build1point0  Separation of Control and Data Plane Control Plane Data Plane • Forward Request from the Applications • Health Checking • Load Balancing • Circuit Breaking • Timeouts

Slide 45

Slide 45 text

@build1point0  Separation of Control and Data Plane Control Plane Data Plane • Forward Request from the Applications • Health Checking • Load Balancing • Circuit Breaking • Timeouts …..

Slide 46

Slide 46 text

@build1point0  Smart Networking - First Principles Dumb Pipe or Smart Network/Mesh Protocol Awareness Layer 4 vs Layer 7

Slide 47

Slide 47 text

@build1point0  Protocol Awareness Layer 4 vs Layer 7 TCP, UDP vs HTTP “Universally” Compatible High Performance Difficult to provide Sophisticated request aware features Layer 4

Slide 48

Slide 48 text

@build1point0  Protocol Awareness Layer 4 vs Layer 7 TCP, UDP vs HTTP Perform complex routing decisions Header and Path based routing Can yield lower performance Layer 7

Slide 49

Slide 49 text

@build1point0  Service Mesh In Action

Slide 50

Slide 50 text

∕

Slide 51

Slide 51 text

@build1point0  Consul Usage Launched in 2014 17K+ GitHub Stars 1M+ Downloads monthly Customers running 50,000+ agents "Most widely deployed service discovery tool on AWS"

Slide 52

Slide 52 text

@build1point0  Public Users

Slide 53

Slide 53 text

∕ Last Year: Consul Connect

Slide 54

Slide 54 text

∕ Secure service-to-service communication with automatic TLS encryption and identity-based authorization that works everywhere. Consul Connect

Slide 55

Slide 55 text

IP1 IP2

Slide 56

Slide 56 text

IP1 IP2 PLAIN TCP

Slide 57

Slide 57 text

IP2 IP1 IP1 IP2 PLAIN TCP WEB DB API

Slide 58

Slide 58 text

IP2 IP1 IP1 IP2 MUTUAL TLS PLAIN TCP WEB DB API

Slide 59

Slide 59 text

IP2 IP1 IP1 IP2 MUTUAL TLS PLAIN TCP WEB DB API

Slide 60

Slide 60 text

IP2 IP1 IP1 IP2 MUTUAL TLS PLAIN TCP PROXY DB API PROXY

Slide 61

Slide 61 text

IP2 IP1 IP1 IP2 MUTUAL TLS PLAIN TCP PROXY DB API PROXY

Slide 62

Slide 62 text

IP2 IP1 IP1 IP2 MUTUAL TLS PLAIN TCP PROXY DB API PROXY

Slide 63

Slide 63 text

IP2 IP1 IP1 IP2 MUTUAL TLS PLAIN TCP PROXY DB API PROXY

Slide 64

Slide 64 text

IP2 IP1 IP1 IP2 MUTUAL TLS PLAIN TCP PROXY DB API PROXY

Slide 65

Slide 65 text

@build1point0  Demo

Slide 66

Slide 66 text

∕ Connect Layer 7 Features

Slide 67

Slide 67 text

∕ "web.service.consul"

Slide 68

Slide 68 text

∕ HTTP Routing Traffic Splitting Custom Resolution "web.service.consul"

Slide 69

Slide 69 text

∕ HTTP Routing Traffic Splitting Custom Resolution "web.service.consul"

Slide 70

Slide 70 text

∕ ▪ Path (exact, prefix, regex) ▪ Header ▪ Query Params ▪ HTTP Methods HTTP Routing

Slide 71

Slide 71 text

Kind = "service-router" Name = "web" Routes = [ { Match { HTTP { PathPrefix = "/admin" PrefixRewrite = "/" } } Destination { Service = "admin" }, } ... ] C O D E E D I T O R

Slide 72

Slide 72 text

Kind = "service-router" Name = "web" Routes = [ { Match { HTTP { PathPrefix = "/admin" PrefixRewrite = "/" } } Destination { Service = "admin" }, } ... ] C O D E E D I T O R

Slide 73

Slide 73 text

Kind = "service-router" Name = "web" Routes = [ { Match { HTTP { PathPrefix = "/admin" PrefixRewrite = "/" } } Destination { Service = "admin" }, } ... ] C O D E E D I T O R

Slide 74

Slide 74 text

∕ HTTP Routing Traffic Splitting Custom Resolution "web.service.consul" /admin => service: "admin"
 path: "/"

Slide 75

Slide 75 text

Kind = "service-splitter" Name = "admin" Splits = [ { Weight = 10 ServiceSubset = "v2" }, { Weight = 90 ServiceSubset = "v1" }, ] C O D E E D I T O R

Slide 76

Slide 76 text

Kind = "service-splitter" Name = "admin" Splits = [ { Weight = 10 ServiceSubset = "v2" }, { Weight = 90 ServiceSubset = "v1" }, ] C O D E E D I T O R

Slide 77

Slide 77 text

Kind = "service-splitter" Name = "admin" Splits = [ { Weight = 10 ServiceSubset = "v2" }, { Weight = 90 ServiceSubset = "v1" }, ] C O D E E D I T O R

Slide 78

Slide 78 text

∕ HTTP Routing Traffic Splitting Custom Resolution "web.service.consul" /admin => service: "admin"
 path: "/" Subset: "v2"

Slide 79

Slide 79 text

Kind = "service-resolver" Name = "admin" DefaultSubset = "v1" Subsets = { "v1" = { Filter = "Service.Meta.version == 1" }, "v2" = { Filter = "Service.Meta.version == 2" }, } C O D E E D I T O R

Slide 80

Slide 80 text

Kind = "service-resolver" Name = "admin" DefaultSubset = "v1" Subsets = { "v1" = { Filter = "Service.Meta.version == 1" }, "v2" = { Filter = "Service.Meta.version == 2" }, } C O D E E D I T O R

Slide 81

Slide 81 text

Kind = "service-resolver" Name = "admin" DefaultSubset = "v1" Subsets = { "v1" = { Filter = "Service.Meta.version == 1" }, "v2" = { Filter = "Service.Meta.version == 2" }, } C O D E E D I T O R

Slide 82

Slide 82 text

Kind = "service-resolver" Name = "admin" DefaultSubset = "v1" Subsets = { "v1" = { Filter = "Service.Meta.version == 1" }, "v2" = { Filter = "Service.Meta.version == 2" }, } C O D E E D I T O R

Slide 83

Slide 83 text

∕ HTTP Routing Traffic Splitting Custom Resolution "web.service.consul" V2 v1 V2 /admin => service: "admin"
 path: "/" Subset: "v2" Meta.Version == 2

Slide 84

Slide 84 text

@build1point0  Demo

Slide 85

Slide 85 text

∕ 10.0.1.1/24 IP2 IP1 WEB DB API

Slide 86

Slide 86 text

∕ 10.0.2.1/24 10.0.1.1/24 IP2 IP1 WEB DB API X

Slide 87

Slide 87 text

∕ 10.0.2.1/24 10.0.1.1/24 IP2 IP1 WEB DB API X Requires complex, manual network configuration to make work.

Slide 88

Slide 88 text

∕

Slide 89

Slide 89 text

∕ Mesh Gateways

Slide 90

Slide 90 text

∕ Secure service-to-service communication across networks with full end-to-end encryption that works everywhere. Mesh Gateway

Slide 91

Slide 91 text

∕ 10.0.2.1/24 10.0.1.1/24 IP2 IP1 WEB DB API X

Slide 92

Slide 92 text

∕ 10.0.2.1/24 10.0.1.1/24 IP2 IP1 WEB DB API CONNECT 
 MESH 
 GATEWAY CONNECT 
 MESH 
 GATEWAY

Slide 93

Slide 93 text

∕ GW GW GW

Slide 94

Slide 94 text

@build1point0  Demo

Slide 95

Slide 95 text

∕ ▪ Gateways cannot decrypt payloads – Do not have keys, only end service has the private key – Works by inspecting SNI headers ▪ Intentions enforced across datacenters Security

Slide 96

Slide 96 text

∕ 10.0.2.1/24 10.0.1.1/24 IP2 IP1 WEB DB API CONNECT 
 MESH 
 GATEWAY CONNECT 
 MESH 
 GATEWAY Allow "API" to "DB" Deny "Web" to "DB"

Slide 97

Slide 97 text

∕ Consul is a full-featured service mesh that supports multi-cloud, multi-region scale. Consul

Slide 98

Slide 98 text

Thank You Anubhav Mishra @build1point0