ISTIO 1.0 INTRODUCTION & OVERVIEW OpenShift Commons Briefing Brian redbeard Harrington Product Manager, Istio

Transcription

1 ISTIO 1.0 INTRODUCTION & OVERVIEW OpenShift Commons Briefing Brian redbeard Harrington Product Manager, Istio

2 PARTY TIME

3 Istio hits 1.0!!!

4 ONE STEP CLOSER TO BORING* *

5 WHY IS BORING SO EXCITING Testing Upgradeability Incremental deployment

6 THAT S IT?

7 Most of the changes are under the hood

8 Meet Kiali

9

10 NEXT STEPS

11 TESTING TESTING TESTING

12 USER EXPERIENCE

13 OPERATOR BASED DEPLOYMENT

14 OpenShift style multi-tenancy

15 PLAY WITH IT TODAY

16

17 UNDER THE HOOD

18 MICROS ARCHITECTURE HTML Javascript Runtime Runtime Runtime Runtime Runtime Runtime Runtime Runtime Runtime Web Data Access Application Server

19 MICROS ARCHITECTURE DISTRIBUTED HTML Javascript Runtime Runtime Runtime Runtime Runtime Runtime Runtime Runtime Runtime Web Data Access Application Server

20 DISTRIBUTED ARCHITECTURE

21 EIGHT FALLACIES OF DISTRIBUTED COMPUTING The network is reliable Latency is zero Bandwidth is infinite The network is secure Topology doesn't change There is one administrator Transport cost is zero The network is homogeneous Source: Photo: Icon made by Freepik from

22 HOW TO DEAL WITH THE COMPLEXITY? Photo by Clint Adair on Unsplash

23 DEPLOYMENT Container Container Container INFRASTRUCTURE

24 BUILD ONCE, DEPLOY ANYWHERE Physical Virtual source code binary package container image Cloud

25 CONFIGURATION Spring Cloud Config Server Config Config Config INFRASTRUCTURE

26 DISCOVERY Spring Cloud Config Server Netflix Eureka Netflix Ribbon Svc Discovery Svc Discovery Svc Discovery Config Config Config INFRASTRUCTURE

27 DYNAMIC ROUTING Netflix Zuul Server Spring Cloud Config Server Netflix Eureka Netflix Ribbon Routing Routing Routing Svc Discovery Svc Discovery Svc Discovery Config Config Config INFRASTRUCTURE

28 FAULT TOLERANCE Netflix Zuul Server Spring Cloud Config Server Netflix Eureka Netflix Ribbon Circuit Breaker Circuit Breaker Circuit Breaker Routing Routing Routing Svc Discovery Svc Discovery Svc Discovery Config Config Config INFRASTRUCTURE

29 TRACING AND VISIBILITY Netflix Zuul Server Spring Cloud Config Server Tracing Tracing Tracing Circuit Breaker Circuit Breaker Circuit Breaker Routing Routing Routing Svc Discovery Svc Discovery Svc Discovery Config Config Config ZipKin Server Netflix Eureka Netflix Ribbon INFRASTRUCTURE

30 WHAT ABOUT? POLYGLOT APPS EXISTING APPS

31 THERE SHOULD BE A BETTER WAY

32 ADDRESS THE COMPLEXITY IN THE INFRASTRUCTURE

33 AUTOMATING CONTAINER DEPLOYMENT CONTAINER CONTAINER CONTAINER KUBERNETES INFRASTRUCTURE

34 BUILD AND DEPLOY CLOUD-NATIVE APPS WITH RED HAT OPENSHIFT CONTAINER CONTAINER CONTAINER CONTAINER CONTAINER ANY APPLICATION OpenShift Container Platform (Enterprise Kubernetes) Build Automation Discovery Deploy Automation Laptop Config Mgmt Datacenter OpenStack Monitoring Security Log Mgmt CI/CD Pipelines Amazon Web s Microsoft Azure Google Cloud ANY INFRASTRUCTURE

35 MESH A dedicated network for service-to-service communications Photo on Visual Hunt

36 MICROS EVOLUTION Tracing Circuit Breaker Routing Svc Discovery Config Platform Container Platform (+ Mesh) 2018

37 MESH ARCHITECTURE Jaeger Pilot Mixer Auth Applies security, route rules, policies and reports traffic telemetry at the pod level

38 FAULT TOLERANCE

39 CIRCUIT BREAKERS WITHOUT ISTIO A CB B CB coupled to the service code C

40 CIRCUIT BREAKERS WITH ISTIO A B C transparent to the services

41 CIRCUIT BREAKERS WITH ISTIO A B C improved response time with global circuit status

42 TIMEOUTS AND RETRIES WITH ISTIO A B C timeout: 15 sec retry: 5 timeout: 10 sec retry: 5 configure timeouts and retries, transparent to the services

43 RATE LIMITING WITH ISTIO A B C max 100 connections max 500 concurrent reqs limit invocation rates, transparent to the services

44 SECURITY

45 SECURE COMMUNICATION WITHOUT ISTIO A TLS TLS B TLS coupled to the service code TLS C

46 SECURE COMMUNICATION WITH ISTIO A B C TLS TLS mutual TLS authentication, transparent to the services

47 CONTROL ACCESS WITH ISTIO A B C control the service access flow, transparent to the services

48 CHAOS ENGINEERING

49 CHAOS ENGINEERING WITHOUT ISTIO A B C random termination Netflix Spinnaker Netflix Chaos Monkeys

50 CHAOS ENGINEERING WITH ISTIO A B C 10 sec delay in 10% of requests inject delays, transparent to the services

51 CHAOS ENGINEERING WITH ISTIO A B C HTTP 400 in 5% of requests inject protocol-specific errors, transparent to the services

52 DYNAMIC ROUTING

53 DYNAMIC ROUTING WITHOUT ISTIO B:1 A Gateway Netflix Zuul Server B:2 custom code to enable dynamic routing

54 CANARY DEPLOYMENT WITH ISTIO B:v2 boston employee A B:v1 everyone

55 A/B DEPLOYMENT WITH ISTIO B:v2 50% traffic A B:v1 50% traffic

56 DARK LAUNCHES WITH ISTIO B:v2 mirror traffic A B:v1 100% traffic

57 DISTRIBUTED TRACING

58 DISTRIBUTED TRACING WITHOUT ISTIO A B C Spring Sleuth ZipKin Spring Sleuth ZipKin Spring Sleuth ZipKin code to enable dynamic tracing

59 DISTRIBUTED TRACING WITH ISTIO & JAEGER A B C discovers service relationships and process times, transparent to the services A B 210 ms 930 ms C 720 ms

60 TAKEWAY

61 DISTRIBUTED S PLATFORM CONTAINER CONTAINER CONTAINER CONTAINER CONTAINER ANY APPLICATION OpenShift Mesh (Istio + Jaeger + Kiali) OpenShift Container Platform (Enterprise Kubernetes) Laptop Datacenter OpenStack Amazon Web s Microsoft Azure Google Cloud try it at ANY INFRASTRUCTURE

62 THANK YOU plus.google.com/+redhat facebook.com/redhatinc linkedin.com/company/red-hat twitter.com/redhat youtube.com/user/redhatvideos