![Observability - Metrics and Access Logging
[2020-11-25T21:26:18.409Z] "GET /status/418 HTTP/1.1" 418 - via_upstream
- "-" 0 135 3 1 "-" "curl/7.73.0-DEV"
"84961386-6d84-929d-98bd-c5aee93b5c88" "httpbin:8000" "127.0.0.1:80"
inbound|8000|| 127.0.0.1:41854 10.44.1.27:80 10.44.1.23:37652
outbound_.8000_._.httpbin.foo.svc.cluster.local default
[2020-11-25T21:26:18.409Z] "GET /status/418 HTTP/1.1" 418 - via_upstream
- "-" 0 135 3 1 "-" "curl/7.73.0-DEV"
"84961386-6d84-929d-98bd-c5aee93b5c88" "httpbin:8000" "127.0.0.1:80"
inbound|8000|| 127.0.0.1:41854 10.44.1.27:80 10.44.1.23:37652
outbound_.8000_._.httpbin.foo.svc.cluster.local default
[2020-11-25T21:26:18.409Z] "GET /status/418 HTTP/1.1" 418 - via_upstream
- "-" 0 135 3 1 "-" "curl/7.73.0-DEV"
"84961386-6d84-929d-98bd-c5aee93b5c88" "httpbin:8000" "127.0.0.1:80"
inbound|8000|| 127.0.0.1:41854 10.44.1.27:80 10.44.1.23:37652
outbound_.8000_._.httpbin.foo.svc.cluster.local default
metrics](https://image.slidesharecdn.com/istio-servicemesh-for-developers-and-platform-engineers-meetup-sgp-23may2023-230630023916-027af4ab/85/Istio-Service-Mesh-for-Developers-and-Platform-Engineers-29-320.jpg)
Istio Service Mesh for Developers and Platform Engineers
- 1. Sai, Field Engineer @ Solo.io Istio Service Mesh For Developers & Platform Engineers
- 3. Home Lab NOW
- 4. Business Drivers for Application Modernization Reduce Costs / Shift Capex to Opex Access to Innovation Increase flexibility and Capacity of Infrastructure Increase Velocity of Development Reduce Risk Monolithic Microservices
- 5. The Way We Build Applications Monolithic On-Prem Built on a VM+OS Large Teams Microservices Cloud Built on Kubernetes Agile Teams
- 6. Challenges with Microservices ● How to observe interactions among services? ● How to secure service to service communication? ● How to manage transient failures? ● How to control traffic?
- 7. Online Boutique Microservices Demo Source: https://github.com/GoogleCloudPlatform/microservices-demo
- 8. Application Networking Challenges ● Service discovery ● Load balancing ● Timeouts ● Retry / Budgets ● Circuit breaking ● Tracing, observability ● Secure transport ● Extension Challenges
- 10. Data Plane & Control Plane
- 11. Why Envoy for Service Mesh Data Plane ● Neutral Foundation (CNCF) ● Large, diverse, vibrant community ● Built ground up for dynamic services environment ● Dynamic configuration, driven by API ● Highly extensible ● L7 filters (HTTP/1, HTTP/2, gRPC, redis, mysql, Kafka, etc) ● Deep signals telemetry out of the box ● Versatile deployment options
- 12. Istio - Open Source Service Mesh 2017 Istio Launched Data Plane Enhancements 2019-20 7 New Community Releases 1000s Production Users ~ 1000 Community Contributors 2022 CNCF 2019-2022
- 14. Istio Service Mesh Architecture
- 15. Istio Deployment (Sidecar Architecture)
- 16. Use Cases
- 17. Too Much TRUST!
- 19. Secure Networking - Server Side TLS
- 20. Secure Networking - mTLS
- 21. Network Security in Kubernetes Default State !!! Desired State “Zero Trust Security”
- 22. DIY … Whoops ! ○ 81% of companies experienced a certificate-related outage in the past two years ○ 65% are concerned about the increased workload and risk of outages caused by shorter SSL/TLS certificate lifespans. ○ Human error was a major contributing factor in 95% of breaches
- 23. Istio to the Rescue !
- 24. Resiliency - There will be Failures Common Mitigations ● Waiting indefinitely is bad ● Trying again is good ● Degrade gracefully when services are overwhelmed
- 25. Timeout - Don’t wait Indefinitely
- 26. Retry - Trying Again is Good 👍
- 27. Circuit Breaker - Degrade gracefully
- 28. Observability - Insights for Competitive Advantage Building a Uniform Approach ● Understand traffic patterns ● Determine service health ● Anticipate outages ● Detect dangerous activity ● Audit access
- 29. Observability - Metrics and Access Logging [2020-11-25T21:26:18.409Z] "GET /status/418 HTTP/1.1" 418 - via_upstream - "-" 0 135 3 1 "-" "curl/7.73.0-DEV" "84961386-6d84-929d-98bd-c5aee93b5c88" "httpbin:8000" "127.0.0.1:80" inbound|8000|| 127.0.0.1:41854 10.44.1.27:80 10.44.1.23:37652 outbound_.8000_._.httpbin.foo.svc.cluster.local default [2020-11-25T21:26:18.409Z] "GET /status/418 HTTP/1.1" 418 - via_upstream - "-" 0 135 3 1 "-" "curl/7.73.0-DEV" "84961386-6d84-929d-98bd-c5aee93b5c88" "httpbin:8000" "127.0.0.1:80" inbound|8000|| 127.0.0.1:41854 10.44.1.27:80 10.44.1.23:37652 outbound_.8000_._.httpbin.foo.svc.cluster.local default [2020-11-25T21:26:18.409Z] "GET /status/418 HTTP/1.1" 418 - via_upstream - "-" 0 135 3 1 "-" "curl/7.73.0-DEV" "84961386-6d84-929d-98bd-c5aee93b5c88" "httpbin:8000" "127.0.0.1:80" inbound|8000|| 127.0.0.1:41854 10.44.1.27:80 10.44.1.23:37652 outbound_.8000_._.httpbin.foo.svc.cluster.local default metrics
- 30. RECAP
- 31. Business Drivers for Adopting Istio
- 32. Life without ServiceMesh `vs` Life with ServiceMesh Business Logic Security Logic Traffic Management Logic Golden Metrics/ Observability Logic Resiliency Logic Managed by Developer - Multiple Tasks - Multiple Frameworks - Language Specific - Poor Dev Experience - 100s of Manual Steps Business Logic Security Logic Traffic Management Logic Golden Metrics/ Observability Logic Resiliency Logic Managed by Developer - Focus on Biz Logic - Developer Productivity Managed by ServiceMesh - Automated Workflow - Deploy Consistent Infrastructure Layer - Eliminate Language Specific Libraries - Consistent Security & Observability across LOBs Before Service Mesh After Service Mesh Microservice App Microservice App
- 33. Istio Deployment (Sidecar Architecture)
- 34. Istio Ambient Mesh (Sidecar-less Architecture) A recent, open source contribution to the Istio project, that defines a new sidecar-less data plane. Improve Performance Simplify Operations Cost Reduction https://istio.io/latest/blog/2022/introducing-ambient-mesh/
- 35. Istio Deployment (Sidecar-less Architecture)
- 36. Something to think about …
- 37. Something to think about …
- 38. ● the Istio Ingress Gateway doesn’t provide the capabilities of an enterprise API gateway ● It’s complex to use and to manage, especially in a multi-cloud context ● mTLS across the clusters ● Lifecycle management for control planes and istio gateways ● Global Observability (centralized metrics and access logging) ● Long term support Something to think about …
- 39. Learn More …
- 40. Learn More … 10,000+ students have attended hands-on workshops 1,800+ engineers have achieved certifications NPS Score 75 https://academy.solo.io