More Related Content
What's hot
What's hot (20)
Similar to Istio Service Mesh for Developers and Platform Engineers
Similar to Istio Service Mesh for Developers and Platform Engineers (20)
Recently uploaded
Recently uploaded (20)
Istio Service Mesh for Developers and Platform Engineers
- 1. Sai, Field Engineer @ Solo.io Istio Service Mesh For Developers & Platform Engineers
- 3. Home Lab NOW
- 4. Business Drivers for Application Modernization Reduce Costs / Shift Capex to Opex Access to Innovation Increase flexibility and Capacity of Infrastructure Increase Velocity of Development Reduce Risk Monolithic Microservices
- 5. The Way We Build Applications Monolithic On-Prem Built on a VM+OS Large Teams Microservices Cloud Built on Kubernetes Agile Teams
- 6. Challenges with Microservices ● How to observe interactions among services? ● How to secure service to service communication? ● How to manage transient failures? ● How to control traffic?
- 7. Online Boutique Microservices Demo Source: https://github.com/GoogleCloudPlatform/microservices-demo
- 8. Application Networking Challenges ● Service discovery ● Load balancing ● Timeouts ● Retry / Budgets ● Circuit breaking ● Tracing, observability ● Secure transport ● Extension Challenges
- 10. Data Plane & Control Plane
- 11. Why Envoy for Service Mesh Data Plane ● Neutral Foundation (CNCF) ● Large, diverse, vibrant community ● Built ground up for dynamic services environment ● Dynamic configuration, driven by API ● Highly extensible ● L7 filters (HTTP/1, HTTP/2, gRPC, redis, mysql, Kafka, etc) ● Deep signals telemetry out of the box ● Versatile deployment options
- 12. Istio - Open Source Service Mesh 2017 Istio Launched Data Plane Enhancements 2019-20 7 New Community Releases 1000s Production Users ~ 1000 Community Contributors 2022 CNCF 2019-2022
- 14. Istio Service Mesh Architecture
- 15. Istio Deployment (Sidecar Architecture)
- 16. Use Cases
- 17. Too Much TRUST!
- 19. Secure Networking - Server Side TLS
- 20. Secure Networking - mTLS
- 21. Network Security in Kubernetes Default State !!! Desired State “Zero Trust Security”
- 22. DIY … Whoops ! ○ 81% of companies experienced a certificate-related outage in the past two years ○ 65% are concerned about the increased workload and risk of outages caused by shorter SSL/TLS certificate lifespans. ○ Human error was a major contributing factor in 95% of breaches
- 23. Istio to the Rescue !
- 24. Resiliency - There will be Failures Common Mitigations ● Waiting indefinitely is bad ● Trying again is good ● Degrade gracefully when services are overwhelmed
- 25. Timeout - Don’t wait Indefinitely
- 26. Retry - Trying Again is Good 👍
- 27. Circuit Breaker - Degrade gracefully
- 28. Observability - Insights for Competitive Advantage Building a Uniform Approach ● Understand traffic patterns ● Determine service health ● Anticipate outages ● Detect dangerous activity ● Audit access
- 29. Observability - Metrics and Access Logging [2020-11-25T21:26:18.409Z] "GET /status/418 HTTP/1.1" 418 - via_upstream - "-" 0 135 3 1 "-" "curl/7.73.0-DEV" "84961386-6d84-929d-98bd-c5aee93b5c88" "httpbin:8000" "127.0.0.1:80" inbound|8000|| 127.0.0.1:41854 10.44.1.27:80 10.44.1.23:37652 outbound_.8000_._.httpbin.foo.svc.cluster.local default [2020-11-25T21:26:18.409Z] "GET /status/418 HTTP/1.1" 418 - via_upstream - "-" 0 135 3 1 "-" "curl/7.73.0-DEV" "84961386-6d84-929d-98bd-c5aee93b5c88" "httpbin:8000" "127.0.0.1:80" inbound|8000|| 127.0.0.1:41854 10.44.1.27:80 10.44.1.23:37652 outbound_.8000_._.httpbin.foo.svc.cluster.local default [2020-11-25T21:26:18.409Z] "GET /status/418 HTTP/1.1" 418 - via_upstream - "-" 0 135 3 1 "-" "curl/7.73.0-DEV" "84961386-6d84-929d-98bd-c5aee93b5c88" "httpbin:8000" "127.0.0.1:80" inbound|8000|| 127.0.0.1:41854 10.44.1.27:80 10.44.1.23:37652 outbound_.8000_._.httpbin.foo.svc.cluster.local default metrics
- 30. RECAP
- 31. Business Drivers for Adopting Istio
- 32. Life without ServiceMesh `vs` Life with ServiceMesh Business Logic Security Logic Traffic Management Logic Golden Metrics/ Observability Logic Resiliency Logic Managed by Developer - Multiple Tasks - Multiple Frameworks - Language Specific - Poor Dev Experience - 100s of Manual Steps Business Logic Security Logic Traffic Management Logic Golden Metrics/ Observability Logic Resiliency Logic Managed by Developer - Focus on Biz Logic - Developer Productivity Managed by ServiceMesh - Automated Workflow - Deploy Consistent Infrastructure Layer - Eliminate Language Specific Libraries - Consistent Security & Observability across LOBs Before Service Mesh After Service Mesh Microservice App Microservice App
- 33. Istio Deployment (Sidecar Architecture)
- 34. Istio Ambient Mesh (Sidecar-less Architecture) A recent, open source contribution to the Istio project, that defines a new sidecar-less data plane. Improve Performance Simplify Operations Cost Reduction https://istio.io/latest/blog/2022/introducing-ambient-mesh/
- 35. Istio Deployment (Sidecar-less Architecture)
- 36. Something to think about …
- 37. Something to think about …
- 38. ● the Istio Ingress Gateway doesn’t provide the capabilities of an enterprise API gateway ● It’s complex to use and to manage, especially in a multi-cloud context ● mTLS across the clusters ● Lifecycle management for control planes and istio gateways ● Global Observability (centralized metrics and access logging) ● Long term support Something to think about …
- 39. Learn More …
- 40. Learn More … 10,000+ students have attended hands-on workshops 1,800+ engineers have achieved certifications NPS Score 75 https://academy.solo.io