How Many Proxies Do You Need

Slide 1

Slide 1 text

How many proxies do you need? Liz Rice | @lizrice Chief Open Source Officer, Isovalent Emeritus Chair, CNCF Technical Oversight Committee Thomas Graf | @tgraf_ CTO & Co-founder, Isovalent Chair, eBPF Foundation GB

Slide 2

Slide 2 text

Service Mesh

Slide 3

Slide 3 text

Service Mesh Origins

Slide 4

Slide 4 text

Service Mesh with Sidecars

Slide 5

Slide 5 text

Complex Injection Many, many Sidecars Sidecar Complications

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

Let’s remove sidecars!

Slide 8

Slide 8 text

- Cilium Service Mesh beta tester, Jan 2022 “ While we're big fans of Envoy we're not hugely fond of the sidecar model and the extra latency & complexity involved ”

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

userspace kernel Reduce resource usage Sidecars are a little bit inefficient [...] you have to allocate the RAM and CPU for that sidecar for kind of the worst-case usage that you expect for that pod. – Ethan Jackson, Ambient Mesh, Google, Kubernetes Podcast #189

Slide 11

Slide 11 text

userspace kernel userspace kernel Reduce resource usage

Slide 12

Slide 12 text

userspace kernel userspace kernel eBPF maps Reduce resource usage

Slide 13

Slide 13 text

@lizrice The network cost of sidecar proxies

Slide 14

Slide 14 text

userspace kernel userspace kernel Solving the Injection Problem

Slide 15

Slide 15 text

userspace pod containe r sidecar container userspace pod container sidecar container my-app.yaml containers: - name: my-app ... - name: my-app-init … - name: my-sidecar ... The operational cost of sidecars

Slide 16

Slide 16 text

If not sidecars, where should proxies be?

Slide 17

Slide 17 text

Delegating responsibility to user space userspace kernel Cilium eBPF delegates - L7 termination to Envoy proxy - L7 observability to Envoy proxy - L7 network policy to Envoy proxy - L7 identity to SPIFFE or cert-manager

Slide 18

Slide 18 text

Delegating responsibility to user space

Slide 19

Slide 19 text

Traffic Management - L3/L4 forwarding & Load-balancing - Canary, Topology Aware Routing - Multi-Cluster Routing Security - Network Policy - mTLS Observability - Tracing, OpenTelemetry, & Metrics - HTTP, TLS, DNS, TCP, UDP, … eBPF Native (no proxy needed) Proxy Traffic Management - L7 Load-balancing & Ingress Resilience - Retries, L7 Rate Limiting Security - TLS Termination & Origination - L7 Network Policy* *Roadmap for eBPF Native When eBPF can’t support it Whenever possible

Slide 20

Slide 20 text

Proxy per pod (sidecar model) userspace kernel - Share pod’s namespaces and cgroups → Resources for app + proxy - Proxy access to pod’s service account → Secrets / identity management directly from app Cilium Status: → Supported via Istio Integration on top of Cilium CNI

Slide 21

Slide 21 text

Proxy on the node - Proxy is co-located on same node → No additional proxies needed on network → No ability to share proxy for single tenant across nodes Cilium Service Mesh Status: → Defaulting to Per-Node Model → Flexible deployment granularity on the roadmap userspace kernel

Slide 22

Slide 22 text

Proxy on the network userspace kernel - Proxy is located on network → Requires additional network hops → Ability to share proxy for individual tenants across nodes Cilium Service Mesh Status: → Evaluating interest in ztunnel/HBONE to support Waypoint proxies userspace kernel

Slide 23

Slide 23 text

Increased performance, reduced complexity Increased isolation Proxy per app Proxy per namespace Proxy per node

Slide 24

Slide 24 text

What about encryption?

Slide 25

Slide 25 text

Cilium network level encryption userspace kernel Encryption at L3 - no need to traverse proxy Uses node identity. Do you trust your nodes?

Slide 26

Slide 26 text

Cilium Next-Gen Mutual Authentication - Works for any protocol (UDP, SCTP, …) - IPsec/Wireguard can use TLS negoiated service-specific keys - User space mTLS authentication - Proxy-free in-kernel datapath - Keeps secrets out of L7 proxies More information: https://isovalent.com/blog/post/2022-05-03-servicemesh-security

Slide 27

Slide 27 text

NetworkPolicy - mTLS Policy Require authentication for connections to backends

Slide 28

Slide 28 text

SPIFFE Integration Tracking CFP / PR: https://github.com/cilium/cilium/issues/4016 CiliumIdentity SPIFFE ID Logical Identity X.509 Certificate

Slide 29

Slide 29 text

What about observability?

Slide 30

Slide 30 text

New Strategic Partnership to provide -based Observability & Monitoring https://grafana.com/blog/2022/10/24/grafana-and-cilium-deep-ebpf-powered-obser vability-for-kubernetes-and-cloud-native-infrastructure/

Slide 31

Slide 31 text

Embedded dashboards in hubble-ui Network Observability

Slide 32

Slide 32 text

Golden Signal Dashboards Tracing & HTTP Observability

Slide 33

Slide 33 text

Your Service Mesh choices

Slide 34

Slide 34 text

Data plane Control plane Configuration Ingress Gateway API Services EnvoyConfig SPIFFE Network Policy Kubernetes cert-manager Cilium Service Mesh mTLS Traffic Management Identity Management Observability Envoy Secrets Service Discovery Stable Available in Dev Branch WIP / Roadmap +

Slide 35

Slide 35 text

Original L7 Load-balancing standard in K8s Simple Supported since Cilium 1.12 Services Ingress Layer 7 Traffic Management Options EnvoyConfig Use of K8s services with annotations Simple Support coming In Cilium 1.13 Pull Request: cilium/cilium#21244 Raw Envoy Config via CustomResource Advanced Users & Integrations Supported since Cilium 1.12 Gateway API Originally labelled Ingress v2. Richer in features. Simple Support for v0.5.1 coming in Cilium 1.13 Pull Request: cilium/cilium#21749

Slide 36

Slide 36 text

Ingress HTTP Path Prefix based Routing

Slide 37

Slide 37 text

Service + Annotations Simple way to enable gRPC weighted-least-request load-balancing

Slide 38

Slide 38 text

Service + Annotations + Multi-Cluster Compatible with multi-cluster load-balancing