Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Istio and the Service Mesh Architecture
Search
Manatsawin Hanmongkolchai
September 08, 2018
Programming
3
1k
Istio and the Service Mesh Architecture
DevOps BKK 2018
Manatsawin Hanmongkolchai
September 08, 2018
Tweet
Share
More Decks by Manatsawin Hanmongkolchai
See All by Manatsawin Hanmongkolchai
Nix: Declarative OS
whs
0
77
gRPC load balancing with xDS
whs
0
940
ArgoCD
whs
0
420
Writing Babel Plugin
whs
0
180
What's new in Cloud Next 2019
whs
0
290
A Date with gRPC
whs
1
1.4k
ตีแผ่ Microservice ด้วย Tracing
whs
0
360
Next Generation Smart Home
whs
0
960
State Management with MobX
whs
2
340
Other Decks in Programming
See All in Programming
High-Level Programming Languages in AI Era -Human Thought and Mind-
hayat01sh1da
PRO
0
810
おやつのお供はお決まりですか?@WWDC25 Recap -Japan-\(region).swift
shingangan
0
140
iOS 26にアップデートすると実機でのHot Reloadができない?
umigishiaoi
0
130
PicoRuby on Rails
makicamel
2
140
AI コーディングエージェントの時代へ:JetBrains が描く開発の未来
masaruhr
1
200
チームで開発し事業を加速するための"良い"設計の考え方 @ サポーターズCoLab 2025-07-08
agatan
1
440
PHP 8.4の新機能「プロパティフック」から学ぶオブジェクト指向設計とリスコフの置換原則
kentaroutakeda
2
970
RailsGirls IZUMO スポンサーLT
16bitidol
0
190
MCPを使ってイベントソーシングのAIコーディングを効率化する / Streamlining Event Sourcing AI Coding with MCP
tomohisa
0
120
ふつうの技術スタックでアート作品を作ってみる
akira888
1
910
Azure AI Foundryではじめてのマルチエージェントワークフロー
seosoft
0
190
イベントストーミング図からコードへの変換手順 / Procedure for Converting Event Storming Diagrams to Code
nrslib
2
880
Featured
See All Featured
Adopting Sorbet at Scale
ufuk
77
9.5k
Distributed Sagas: A Protocol for Coordinating Microservices
caitiem20
331
22k
Designing Experiences People Love
moore
142
24k
Improving Core Web Vitals using Speculation Rules API
sergeychernyshev
18
980
[Rails World 2023 - Day 1 Closing Keynote] - The Magic of Rails
eileencodes
35
2.4k
Measuring & Analyzing Core Web Vitals
bluesmoon
7
510
The Psychology of Web Performance [Beyond Tellerrand 2023]
tammyeverts
48
2.9k
KATA
mclloyd
30
14k
Build your cross-platform service in a week with App Engine
jlugia
231
18k
The Power of CSS Pseudo Elements
geoffreycrofte
77
5.9k
Keith and Marios Guide to Fast Websites
keithpitt
411
22k
The Straight Up "How To Draw Better" Workshop
denniskardys
235
140k
Transcript
Istio and the Service Mesh Architecture DevOps BKK 2018
About me • Manatsawin Hanmongkolchai • Junior Architect at Wongnai
How I sold Istio to my team
How Wongnai monitor microservices
Microservice monitoring • In-service metrics eg. controller time
Microservice monitoring • AWS X-Ray SDK
Microservice monitoring • Sentry
Microservice monitoring • ELB Error Rate
Microservice monitoring These must be integrated into your service AWS
X-Ray
Microservice monitoring The problem in microservice world • Service can
be written in many languages. Not all tools support every languages
Microservice monitoring The problem in microservice world • People in
a rush skip implementing proper monitoring
Meet Istio
Service mesh Istio handle interservice connection Sidecar
How Istio sidecar work? Istio use admission controller to install
2 containers in your pod
How Istio sidecar work? 1. Init container to setup transparent
proxy iptables rule (as root) 2. Envoy running alongside your app as the transparent proxy
What Istio can do for you Monitoring • Network calls
• Tracing
Network monitoring Istio provide insight into your network in layer
7
Total requests 4xx 5xx
Request count of service Response time
Service network monitoring Measured client side Request count Success rate
Resp. time Speed (for TCP) Measured server side
Who call me?
Distributed Tracing • All incoming/outgoing HTTP calls are traced to
Jaeger • Needs to propagate OpenTracing headers from incoming call to outgoing call to track calls correctly
Distributed Tracing • Easiest way is to just integrate Zipkin
OpenTracing into your app
Distributed Tracing
Distributed Tracing
What Istio can do for you • Traffic Management ◦
Routing ▪ Traffic Shifting ▪ Mirror ◦ Fault Injection ◦ Circuit Breaker
Routing • Kubernetes service operates in Layer 4 Cluster IP
Backend Backend Backend Req Req Req Req Req Req
Routing • Istio operate in layer 7 and can do
per-call load balancing Envoy Req Req Req Req Req Req Backend Backend Backend
Split traffic • Split traffic between service (eg. 1% to
new version)
Mirror traffic • Test in production by cloning traffic Envoy
Live version Test version Req
Fault Injection • Intentionally making service worse • Why? Let’s
hear a story
Fault Injection Site Reliability Engineering How Google runs production systems
landing.google.com /sre/book/
#WongnaiIsHiring • Wongnai is looking for our first Site Reliability
Engineer • careers.wongnai.com
Chubby
Fault Injection Over time, we found that the failures of
the global instance of Chubby consistently generated service outages.
Fault Injection As it turns out, true global Chubby outages
are so infrequent that service owners began to add dependencies to Chubby assuming that it would never go down.
Fault Injection The solution to this Chubby scenario is interesting:
SRE makes sure that global Chubby meets, but does not significantly exceed, its service level objective.
Fault Injection In any given quarter, if a true failure
has not dropped availability below the target, a controlled outage will be synthesized by intentionally taking down the system.
Fault Injection • Slow down services ◦ Delay 80% of
requests for 5 seconds • Make errors ◦ Return 500 error code for 80% of requests
Circuit Breaker Remove a backend from service if it return
too many errors in a row Frontend Backend Work Queue 503 Timeout F5
Summary Istio provide visibility and configurability to your network. This
is traditionally done by adding library, but in a microservice world you need a cross language solution
The catch Here’s what we found while moving to Istio
• While requiring zero code changes, your service must already be well behaved cloud application
The catch • Do not connect directly to pod IP
(eg. no service discovery - just use cluster IP and avoid headless service)
The catch • Do not mix port type in the
cluster (eg. don’t run HTTP server on port 6379 with another pod running TCP service at the same port)
The catch • Set the Host header to the destination.
Don’t connect to gateway and set Host header to cooking. ◦ This case is really hard to debug...
The catch • External services (ie. outside Kubernetes) but in
the capturing IP range must have ServiceEntry defined ◦ ServiceEntry is cluster-wide
Slides on speakerdeck.com/whs