Enabling Multi-Cloud with Istio Stretching an Istio service mesh between Public & Private Clouds. John Joyce Robert Li

Transcription

1 Enabling Multi-Cloud with Istio Stretching an Istio service mesh between Public & Private Clouds John Joyce Robert Li

2 Introduction

3 Extending an Application across Multiple Clouds Public Cloud microservice microservice Application Service microservice microservice Private Cloud 2017 Cisco and/or its affiliates. All rights reserved.

4 Stretching Istio s Service Mesh Across Multiple Clouds Public Cloud Application Service Set policy, traffic routing rules Private Cloud Application Service Istio Service Mesh 2017 Cisco and/or its affiliates. All rights reserved.

5 What is a Service Mesh External Requests Gateway/ Ingress Proxy API API Web UI Proxy Business Logic Proxy API API Billing DB Proxy Accounts DB Proxy Istio s Multicluster enhancement allows cloud boundaries anywhere in above mesh Infrastructure layer for service-to-service communication A mesh of proxies Proxies injected as sidecars Supports numerous protocols (HTTP 1/2, grpc, TCP, UDP) Can inspect API transactions at Layer 7 or layer 3/4. Intelligent routing rules can be applied between endpoints 5

6 Istio Architecture Source:

7 Multicluster Architecture

8 Service and Endpoint Discovery Pilot is configured to watch multiple K8s API servers K8s Clusters KubeAPI Server Istio-Pilot Istio-Mixer KubeAPI Server Istio-CA Controller created in Pilot for each cluster which gathers all service & endpoint data Istio-CA On Prem Private Cloud 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

9 Envoy xds propagation Envoy Discovery Pilot Envoy Micro Service Services() ServiceInstances() Rules Micro Service Kube API Server Service Registry Istio Rules Kube API Server Envoy xds Requests (grpc/rest-json) Envoy xds Responses (grpc/rest-json) Services and Endpoints

10 Creating the Stretched Mesh K8s Clusters Envoy APP POD xds Data & Telemetry Istio-Pilot Istio-Mixer APP Pods Deployed in all Environments Envoy APP POD On Prem Private Cloud Envoy configured with Pilot & Mixer endpoints for xds (Discovery Services) Envoy Proxy sidecar uservice Application Pods 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

11 Deployment Demo

12 Environment Requirements Must have IP reachability between the clusters For Istio control plane interactions between Pilot, Mixer and Citadel and Envoy Sidecars For application pods to reach each other Solution doesn t dictate a certain approach to achieve this reachability but generally a VPN would be needed based on current capabilities. Application relies on Kube-DNS to resolve service naming so special attention is needed during app deployment: Use of headless or selectorless services typically required Could be designated to a special purpose DNS server

13 Istio Control Plane Deployment Istio-Mixer Istio-Pilot Istio-CA Istio-Sidecar-Injector Istio-ingress Istio-CA Istio control plane pods setup only in one Cluster On prem Private Cloud

14 Bookinfo Application Microservice Architecture V1 = No stars V2 = Black stars V3 = Red stars Pods in GCP Pods in on-prem Data center

15 Video of deployment in action 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

16 Video of Mesh Routing 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential

17 Future Improvements

18 1 Future improvements: Pilot to Pilot multi-cloud Zero VPN work Bring your own Service Name Mixer and Istio-CA Multicluster enabled Usability Improvements

19 Q & A

20 References: Initial PR to enable Multicluster: Installation documentation: Multicloud Design Document: Zero VPN design document: Bring Your own Service Name Design Document: 20