21st Docker Switzerland Meetup - ISTIO
1 like197 views
The document discusses Istio, an open source service mesh that provides traffic management, resilience, and security for microservices applications. It begins with an overview of microservices and common challenges in managing microservices applications. It then introduces Istio and its components that address these challenges, such as intelligent routing, policy enforcement, and telemetry collection. Specific Istio features like traffic control, splitting, and mirroring are demonstrated. Finally, it provides instructions for getting started with Istio and links for additional information.
21st Docker Switzerland Meetup - ISTIO
- 1. ISTIO NIKLAUS HIRT (DEVOPS / CLOUD ARCHITECT)
- 3. MICROSERVICES ▸Decomposing an application into single function modules which are independently deployed and operated ▸Accelerate delivery by minimizing communication and coordination between people
- 4. ARCHITECTURE
- 5. THE TRADE OFF Improved delivery velocity in exchange for increased operational complexity Hailo microservices
- 6. MICROSERVICES ARE HARD ▸Applications aren’t running in green-field environments ▸Network layer is hard to manage ▸Tooling is nascent
- 7. CHALLENGES
- 8. COMMON DEVOPS CHALLENGE 1 ▸How do I roll out a newer version of my microservice without down time? ▸How do I ensure traffic continue to go to the current version before the newer version is tested and ready?
- 9. COMMON DEVOPS CHALLENGE 2 ▸How do I do canary testing? ▸I want to leverage crowdsourced testing. How do I test the new version with a subset of users? ▸How do I proceed to a full rollout after satisfactory testing of the new version?
- 10. COMMON DEVOPS CHALLENGE 3 ▸How do I do A/B testing? • Release a new version to a subset of users in a precise way ▸I have launched B in the dark, but how can I keep B to myself or a small testing group?
- 11. OTHER COMMON DEVOPS CHALLENGES 4. Things don’t always go correctly in production... How do I inject fault to my microservices to prepare myself? 5. My services can only handle certain rate, how can I limit rate for some of my services? 6. I need to view and monitor what is going on with each of my services when crisis arises. 7. How can I secure my services .
- 13. It’s doable, but… Requires a lot of coding
- 14. Service Mesh Dedicated infrastructure layer to make service-to-service communication fast, safe and reliable
- 15. ISTIO A service mesh designed to connect, manage and secure micro services
- 16. ISTIO Launched in May 2017 by Google, Lyft and IBM A service mesh designed to connect, manage and secure micro services
- 17. ISTIO Open Source Launched in May 2017 by Google, Lyft and IBM A service mesh designed to connect, manage and secure micro services
- 18. ISTIO Open Source Zero Code Changes Launched in May 2017 by Google, Lyft and IBM A service mesh designed to connect, manage and secure micro services
- 19. FEATURES
- 20. INTELLIGENT ROUTING AND LOAD BALANCING ‣ Conduct traffic between services with dynamic route configuration ‣ A/B tests ‣ Canary releases ‣ Gradually upgrade versions Red/Black deployments
- 21. RESILIENCE ACROSS LANGUAGES AND PLATFORMS ‣ Increase reliability by shielding applications from flaky networks and cascading failures in adverse conditions
- 22. FLEET-WIDE POLICY ENFORCEMENT ‣ Apply organizational policy to the interaction between services ‣ Ensure access policies are enforced ‣ Make sure resources are fairly distributed among consumers.
- 23. IN-DEPTH TELEMETRY AND REPORTING ‣ Understand the dependencies between services, the nature and flow of traffic between them, and quickly identify issues with distributed tracing.
- 24. ARCHITECTURE
- 25. ARCHITECTURE
- 26. COMPONENTS OF ISTIO ‣ Envoy proxy, to mediate all inbound and outbound traffic for all services in the service mesh. ‣ Pilot Programming envoys and responsible for service discovery, registration and load balancing ‣ Citadel provides strong service-to-service and end-user authentication using mutual TLS, with built-in identity and credential management ‣ Mixer Responsible for enforcing access control and usage policies and collecting telemetry data
- 27. ISTIO ▸Operates at Layer 7 , which is the “service” or “RPC” layer of your network application ▸A rich set of attributes to base policy decisions on, so policies can be applied based on virtual host, URL, or other HTTP headers ▸Flexibility in processing ▸Allows it to be distributed ▸Istio Proxy is implemented inside the pod, as a Envoy sidecar container in the same network namespace
- 28. ISTIO – CUSTOM RESOURCE DEFINITIONS kind: Gateway metadata: name: helloworld-gateway spec: selector: istio: ingressgateway servers: - hosts: - '*' port: name: http number: 80 protocol: HTTP kind: DestinationRule metadata: name: helloworld-destination spec: host: helloworld subsets: - name: v1 labels: version: v1 - name: v2 labels: version: v2 kind: VirtualService metadata: name: helloworld spec: hosts: - "*" gateways: - helloworld-gateway http: - match: - uri: exact: /hello route: - destination: host: helloworld subset: v1 weight: 90 - destination: host: helloworld subset: v2 weight: 10 POD HelloWorld version = v1 POD HelloWorld version = v2
- 29. TRAFFIC CONTROL CHALLENGE 1 ROLL OUT NEW VERSION WITHOUT DOWNTIME OR CHANGING CODE version: v2.0 env: us-prod version: v1.5 env: us-prod 100% 0% // A simple traffic control rule destination: serviceB.example.cluster.local match: source: serviceA.example.cluster.local route: - labels: version: v1.5 env: us-prod weight: 100
- 30. TRAFFIC CONTROL CHALLENGE 1 ROLL OUT NEW VERSION WITHOUT DOWNTIME OR CHANGING CODE version: v2.0 env: us-prod version: v1.5 env: us-prod 0% 0%100% // A simple traffic control rule destination: serviceB.example.cluster.local match: source: serviceA.example.cluster.local route: - labels: version: v2.0 env: us-prod weight: 100
- 31. TRAFFIC SPLITTING CHALLENGE 2 HOW TO DO CANARY TESTING version: v2.0-alpha env: us-staging version: v1.5 env: us-prod // A simple traffic splitting rule destination: serviceB.example.cluster.local match: source: serviceA.example.cluster.local route: - labels: version: v1.5 env: us-prod weight: 95 - labels: version: v2.0-alpha env: us-staging weight: 5
- 32. TRAFFIC STEERNIG CHALLENGE 3 HOW TO DO A/B TESTING version: v2 version: v1 version: v2 version: v1 // Content-based traffic steering destination: serviceB.example.cluster.local match: httpHeaders: user-agent: regex: ^(.*?;)?(iPhone)(;.*)?$ precedence: 2 route: - labels: version: v2
- 33. TRAFFIC MIRRORING version: v2.0-alpha env: us-staging version: v1.5 env: us-prod100% 100% •Responses to any mirrored traffic is ignored; traffic is mirrored as “fire-and-forget” •You’ll need to have the 0-weighted route to hint to Istio to create the proper Envoy // A simple traffic splitting rule destination: serviceB.example.cluster.local match: source: serviceA.example.cluster.local route: - labels: version: v1.5 env: us-prod weight: 100 - labels: version: v2.0-alpha env: us-staging weight: 0 mirror: name: httpbin labels: version: v2.0-alpha env: us-staging CHALLENGE 4 THINGS DON’T ALWAYS GO CORRECTLY IN PRODUCTION...
- 34. RESILIENCY CHALLENGE 4 THINGS DON’T ALWAYS GO CORRECTLY IN PRODUCTION...
- 35. RESILIENCY CHALLENGE 4 THINGS DON’T ALWAYS GO CORRECTLY IN PRODUCTION...
- 36. RESILIENCY TESTING hosts: - ratings http: - fault: abort: percent: 10 httpStatus: 400 route: - destination: host: ratings subset: v1 hosts: - ratings http: - fault: delay: percent: 10 fixedDelay: 5s route: - destination: host: ratings subset: v1 CHALLENGE 4 HOW DO I INJECT FAULT TO MY MICROSERVICES TO PREPARE MYSELF?
- 37. RATE LIMITING CHALLENGE 5 HOW CAN I LIMIT RATE FOR SOME OF MY SERVICES?
- 38. TELEMETRY ‣ Monitoring & tracing should not be an afterthought in the infrastructure ‣ Goals ‣ Metrics without instrumenting apps ‣ Consistent metrics across fleet ‣ Trace flow of requests across services ‣ Portable across metric backend providers CHALLENGE 6 I NEED TO VIEW WHAT IS GOING ON WHEN CRISIS ARISES
- 39. SECURITY CHALLENGE 7 HOW CAN I SECURE MY SERVICES? ‣ Authentication ‣ Transport authentication, also known as service-to-service authentication ‣ Origin authentication, also known as end-user authentication ‣ Authorization ‣ Based on RBAC ‣ Namespace-level, service-level and method-level access control for services
- 40. USING ISTIO IN CONCERT WITH CALICO ▸ Policy operates at Layer 7 , which is the “service” or “RPC” layer of your network application. ▸ A rich set of attributes to base policy decisions on, so policies can be applied based on virtual host, URL, or other HTTP headers. ▸ Flexibility in processing. ▸ Allows it to be distributed ▸ Istio Proxy is implemented inside the pod, as a Envoy sidecar container in the same network namespace. ▸ Operates at Layer 3, which is the network layer ▸ Has the advantage of being universal (DNS, SQL, real-time streaming, …) ▸ Can extend beyond the service mesh (including to bare metal or VM endpoints not under the control of Kubernetes). ▸ Calico’s policy is enforced at the host node, outside the network namespace of the guest pods. ▸ Based on iptables, which are packet filters implemented in the standard Linux kernel, it is extremely fast.
- 41. USING ISTIO IN CONCERT WITH CALICO “RPC” — L7 Layer “Network” — L3-4 Userspace Implementation Kernel Pod Enforcement Point Node Ideal for applying policy in support of operational goals, like service routing, retries, circuit-breaking, etc Strengths Universal, highly efficient, and isolated from the pods, making it ideal for applying policy in support of security goals
- 42. ADDRESSING DEVOPS CHALLENGES # CHALLENGE ISTIO SOLUTION CHALLENGE 1 ROLL OUT NEW VERSION WITHOUT DOWNTIME OR CHANGING CODE TRAFFIC CONTROL CHALLENGE 2 HOW TO DO CANARY TESTING TRAFFIC SPLITTING CHALLENGE 3 HOW TO DO A/B TESTING TRAFFIC STEERNIG CHALLENGE 4 THINGS DON’T ALWAYS GO CORRECTLY IN PRODUCTION... TRAFFIC MIRRORING RESILIENCY RESILIENCY TESTING CHALLENGE5 HOW CAN I LIMIT RATE FOR SOME OF MY SERVICES? RATE LIMITING CHALLENGE 6 I NEED TO VIEW AND MONITOR WHAT IS GOING ON WHEN CRISIS ARISES TELEMETRY CHALLENGE 7 HOW CAN I SECURE MY SERVICES? AUTHENTICATION AUTHORIZATION CALICO
- 43. GETTING STARTED ‣ Go to https://istio.io/ ‣ Download ISTIO Release With Kubectl $ kubectl apply -f install/kubernetes/helm/istio/templates/crds.yaml $ kubectl apply -f install/kubernetes/istio-demo.yaml With HELM Templating $ kubectl create namespace istio-system $ helm template --name istio --namespace istio-system --set grafana.enabled=true --set servicegraph.enabled=true --set kiali.enabled=true > istio.yaml $ kubectl apply -f istio.yaml
- 44. GETTING STARTED ‣ IBMs ISTIO 101 Hands On ‣ Go to https://github.com/IBM/istio101
- 45. COMMUNITY PARTNERS ‣ Vmware ‣ RedHat ‣ Microsoft ‣ Tigera ‣ Cisco ‣ Pivotal ‣ Weave works ‣ Datawire ‣ Scytale (SPIFEE) ‣ And more…
- 46. USEFUL LINKS ‣ Web istio.io ‣ Twitter: @Istiomesh ‣ Istio 101: https://github.com/IBM/istio101 ‣ Traffic management using Istio: https://ibm.co/2F7xSnf ‣ Resiliency and fault-tolerance using Istio: https://bit.ly/2qStF2B ‣ Reliable application roll out and operations using Istio: https://bit.ly/2K9IRQX
- 47. SOME DOCS IBM Cloud Private for Dummies http://ibm.biz/BdZedY Cloud Adoption and Transformation Consultancy http://ibm.biz/BdYFCx The de facto guide to improving your enterprise with the cloud, created by distinguished members of our Solution Engineering team http://ibm.biz/playbook Deploying and Operating Production Applications on Kubernetes in Hybrid Cloud Environments http://ibm.biz/k8sintheenterprise
- 48. CONTACT ME Niklaus Hirt: nikh@ch.ibm.com
- 49. DEMO
- 50. DEMO – BOOKINFO APP The Bookinfo application is broken into four separate microservices: • productpage. The productpage microservice calls the details and reviews microservices to populate the page. • details. The details microservice contains book information. • reviews. The reviews microservice contains book reviews. It also calls the ratings microservice. • ratings. The ratings microservice contains book ranking information that accompanies a book review. There are 3 versions of the reviews microservice: • Version v1 doesn’t call the ratings service. • Version v2 calls the ratings service, and displays each rating as 1 to 5 black stars. • Version v3 calls the ratings service, and displays each rating as 1 to 5 red stars.
- 51. THANK YOU!