Gloo Mesh Enterprise Webinar 12.10.2020

Slide 1

Slide 1 text

Gloo Mesh Enterprise Christian Posta Field CTO – Solo.io

Slide 2

Slide 2 text

Slide 3

Slide 3 text

3 | Copyright © 2020 Solo.io Gloo Platform What do we offer? Gloo API Infrastructure Platform - A portfolio of products to enable, secure, and observe application connectivity at the edge and between services across clusters and clouds What does the platform include? Gloo API Infrastructure: • Gloo Mesh – Enterprise Istio with multi-cluster, VM, multi-mesh, and Wasm management • Gloo Edge - A powerful next generation API gateway built on Envoy Proxy • Gloo Portal - Developer portal to catalog and expose running APIs. • Gloo Extensions - Developer tooling to extend Envoy with WebAssembly

Slide 4

Slide 4 text

Slide 5

Slide 5 text

5 | Copyright © 2020 Service mesh technologies provide the following: • Service discovery / Load balancing • Secure service-to-service communication • Traffic control / shaping / shifting • Policy / Intention based access control • Traffic metric collection • Service resilience • API / programmable interface

Slide 6

Slide 6 text

6 | Copyright © 2020 Service proxy lives with application instance Account Communicate on the network Proxy responsible for enriching the network communication with: • Circuit breaking • Load balancing • Timeout, retry • Service discovery • Metric collection Other service

Slide 7

Slide 7 text

7 | Copyright © 2020 Service proxy + control plane Account User Control Plane mTLS Control plane responsible for • Configuration translation • Telemetry, tracing collection • Platform service discovery • Policy declaration Policy enforcement

Slide 8

Slide 8 text

Slide 9

Slide 9 text

Slide 10

Slide 10 text

10 | Copyright © 2020 Challenges in service mesh adoption • Which one to choose? • Who will provide support, long-term support? • Multi-tenancy issues within a single cluster? • Managing multiple clusters • Fitting with existing services (sidecar lifecycle, race conditions, etc) • Delineation between developers and operations • What about legacy / hybrid environments?

Slide 11

Slide 11 text

Slide 12

Slide 12 text

12 | Copyright © 2020 Multi-Cluster Operations Consistent configuration and orchestration across multiple clusters and VMs Istio Production and long-terms support (LTS, N-3) with patches and hotfixes for validated upstream Istio Role Based API Delegate ownership of configuration and policy by persona, including: developers, SREs, and admins WebAssembly Extend the service-mesh control plane with WebAssembly modules; manage their deployment and lifecycle across clusters Observability Operational visibility with a single pane of glass across multiple service mesh clusters Gloo Mesh Enterprise Enterprise Istio for single cluster, multi-cluster and multi-platform configuration. Focus on ease of use, powerful best practices built in, security, and extensibility Global Failover Routing Cross-cluster failover rand locality aware routing Multi-Mesh Multi-platform service mesh support (AWS App Mesh and Azure Open Service Mesh) across clouds and zones Security End to end security across clusters and meshes for zero trust networks https://www.solo.io/products/gloo-mesh/

Slide 13

Slide 13 text

Slide 14

Slide 14 text

Slide 15

Slide 15 text

15 | Copyright © 2020 Services deployed in single cluster: Enterprise Istio • Upstream first • Specialty builds available (FIPS, ARM, etc) • Long Term Support (LTS) N-3 • Critical security patches • Production break-fix • One hour SLA Severity 1 • Install / upgrade • Architecture and operational guidance, best practices Account User Kubernetes Cluster Istiod

Slide 16

Slide 16 text

Slide 17

Slide 17 text

Slide 18

Slide 18 text

18 | Copyright © 2020 Example: Service Team (provider) Sidecar • Service dependencies • Hostname routing • CORS • Traffic splitting • Rate limiting • Fault injection • Circuit breaking VirtualService DestinationRule Configured with these Istio resources for each service Account Service Sidecar VirtualService DestinationRule User Service VirtualService (ingress) VirtualService (ingress)

Slide 19

Slide 19 text

19 | Copyright © 2020 Example: Service Team (consumer) • Timeouts • Retries • Retry budget • Locality aware load balancing • Circuit breaking Sidecar VirtualService DestinationRule Configured with these Istio resources for each service Account Service Sidecar VirtualService DestinationRule User Service

Slide 20

Slide 20 text

20 | Copyright © 2020 Problem: Contention…Who owns these resources!? Sidecar VirtualService DestinationRule VirtualService (ingress) Istio’s API closely mimics Envoy’s. It’s low level and does not lend itself to multi-team ownership and delineation

Slide 21

Slide 21 text

21 | Copyright © 2020 Example: Platform owner(s) • Kubernetes owner, network/security ops • What services should/should not communicate? • What calls can cross organizational boundaries? • Identity propagation • Traffic encrypted • Default resilience settings • High availability of solution ServiceEntry Configured with these Istio resources PeerAuthentication AuthorizationPolicy Gateway EnvoyFilter WorkloadEntry

Slide 22

Slide 22 text

22 | Copyright © 2020 Gloo Mesh: simplified role-based API Account User Kubernetes Cluster Istiod SRE Platform Team Service Team (provider) Service Team (consumer) Gloo Mesh Management Plane Translate to Istio TrafficPolicy AccessPolicy Gloo Mesh API simplifies the model to selection of source and target: Source -> policy -> Target

Slide 23

Slide 23 text

Slide 24

Slide 24 text

Slide 25

Slide 25 text

25 | Copyright © 2020 Deploy Istio across multiple clusters for high availability and isolation Cluster 1 Account Istiod User Ingress Cluster 2 Orders Istiod Ingress User AWS EKS Orders Istiod Ingress User Account

Slide 26

Slide 26 text

26 | Copyright © 2020 Problem: configuration semantics and explosion Cluster 1 Account Istiod User Ingress Cluster 2 Orders Istiod Ingress User Cluster 3 Orders Istiod Ingress User Account Account VS User VS Account DR User DR Account SC Account SE3 User SC User SE2 User SE3 Orders VS User VS Orders DR User DR Orders SC Orders SE3 User SC User SE1 User SE3 Orders VS User VS Orders DR User DR Orders SC Orders SE3 User SC User SE1 User SE3 Account VS Account DR Account SC Config boundary Config boundary Config boundary

Slide 27

Slide 27 text

27 | Copyright © 2020 Problems operating multiple clusters and control planes • Making clusters aware of dependent services on other clusters (service discovery / partitioning) • Unifying identity domains / limited trust networks • Often need to write multiple configurations in multiple clusters just to accomplish something simple (like traffic routing) • Consistent security • Defining failover semantics (locality, priority, etc) • Isolating fault domains (trust, configuration, etc)

Slide 28

Slide 28 text

Slide 29

Slide 29 text

29 | Copyright © 2020 Gloo Mesh management plane for federation Cluster 1 Account Istiod User Ingress Cluster 2 Orders Istiod Ingress User AWS EKS Orders Istiod Ingress User Account Gloo Mesh Management Plane Service Teams / SRE / Platform Team Translate and orchestrate TrafficPolicy AccessPolicy

Slide 30

Slide 30 text

30 | Copyright © 2020 Gloo Mesh multi-cluster configuration Gloo Mesh Management Plane Translate and orchestrate Istiod Cluster 1 Istiod Cluster 2 Istiod Eks/Gke/Aks Source(s) Target(s) Applied Policy TrafficPolicy Source(s) Target(s) Applied Policy AccessPolicy TrafficPolicy TrafficPolicy TrafficPolicy AccessPolicy AccessPolicy AccessPolicy

Slide 31

Slide 31 text

Slide 32

Slide 32 text

Slide 33

Slide 33 text

Slide 34

Slide 34 text

34 | Copyright © 2020 Gloo Mesh multi-cluster configuration Gloo Mesh Management Plane Translate and orchestrate Istiod Cluster 1 Istiod Cluster 2 AWS AppMesh EKS/ECS/EC2 Source(s) Target(s) Applied Policy TrafficPolicy Source(s) Target(s) Applied Policy AccessPolicy TrafficPolicy TrafficPolicy TrafficPolicy AccessPolicy AccessPolicy AccessPolicy

Slide 35

Slide 35 text

Slide 36

Slide 36 text

Slide 37

Slide 37 text

37 | Copyright © 2020 Extend Envoy Proxy with Web Assembly (Wasm) EXTERNAL AUTH RATE LIMITING ROUTER UPSTREAM WASM gRPC TRANSCODER Why WebAssembly? • Polyglot: Envoy Filters are written in C++ and Wasm expands to any language • Secure and Reliable: Wasm runs in isolated VM, can dynamically update w/o Envoy restarts, no hard dependencies or cascading failures • Speed: Near native performance • Sustainable: Eliminates need to recompile and maintain a build of Envoy

Slide 38

Slide 38 text

38 | Copyright © 2020 Gloo Mesh extensibility with WebAssembly Cluster 1 Account Istiod User Ingress Cluster 2 Orders Istiod Ingress User AWS EKS Orders Istiod Ingress User Account Gloo Mesh Management Plane SRE / Platform Team Deploy Wasm WasmDeployment Wasm registry

Slide 39

Slide 39 text

39 | Copyright © 2020 Gloo Mesh Wasm support • Simplified tooling to bootstrap Wasm modules in Rust, C++, TinyGo, AssemblyScript • Infrastructure to build, push, share, deploy Wasm into Istio service mesh • Wasm Registry • Multi-cluster management, orchestration of Wasm lifecycle

Slide 40

Slide 40 text

Slide 41

Slide 41 text

41 | Copyright © 2020 The benefits of Gloo Mesh Capability Without Gloo Mesh With Gloo Mesh Istio support N-1, community best effort N-3 LTS, 1hr sev-1 SLA, architecture/operations guidance Role-based API High contention Tailor API to user Multi-cluster traffic and authorization policy Local and complex Global, simplified Extensibility Limited, manual Enterprise ready, multi- cluster Management Local CLI, gitops Global API, CLI, UI, gitops

Slide 42

Slide 42 text

42 | Copyright © 2020 Feature readiness Capability Current Target stable Istio support Stable, supported Now Role-based API Beta, supported January 2021 Multi-cluster traffic and authorization policy Beta, supported January 2021 Extensibility Alpha, tech preview March 2021 Management Beta. supported January 2021

Slide 43

Slide 43 text

43 | Copyright © 2020 ● Enterprise Istio support, LTS (upstream, FIPS, ARM, validated builds, security patches for N-3) ● Istio expertise, architecture, security, etc. ● Role based API ● Multi-cluster management plane ● Identity federation ● Unified, multi-cluster API, configuration ● Failover, locality-based routing, adaptive traffic shifting ● Web assembly extensions Phased Approach to Adopting Gloo Mesh Enterprise