& the architecture along the way!

Transcription

1 QCon London March 2019 & the architecture along the way! mt165.co.uk

2 Objectives Learn how a packet traverses an Istio//Kubernetes system See what control plane calls are made in that process Build a useful mental model for reasoning about, and debugging Istio

3 Prerequisites Basic networking knowledge Intermediate Kubernetes knowledge An understanding of what Istio is and does

4 Outline Context and Introduction Networking and Containers Pilot and Routing Mixer and Policy Citadel and mtls

5 Context and Introduction

6 Why?

7

8

9 Istio An open platform to connect, secure, control, and observe services.

10 Networking and Containers

11 Ingress Service A

12 Cluster IP Cluster IP Node port *.example.com Load Balancer Ingress Service A

13 Service A

14 SvcA Service A

15 Containers nginx nginx supervisord mnt uts pid user ipc net

16 Kubernetes Pods nginx logger nginx fluentd supervisord mnt uts mnt uts pid user ipc net

17 Kubernetes Pods iptables routes eth0 nginx logger nginx fluentd lo supervisord sockets mnt uts mnt uts pid user ipc net

18 Kubernetes Pods iptables routes eth0 :8080/tcp nginx logger nginx fluentd lo supervisord sockets mnt uts mnt uts pid user ipc net

19 Kubernetes Pods iptables routes eth0 :8080/tcp nginx proxy nginx envoy lo supervisord sockets mnt uts mnt uts pid user ipc net

20 Sidecar Injection iptables routes eth0 lo sockets pid user ipc net

21 Sidecar Injection iptables routes eth0 alpine sysctl -w kernel.core_pattern=... lo sockets pid user ipc net

22 Sidecar Injection iptables routes eth0 istio/proxy_init /usr/local/bin/prepare_proxy.sh -p u 1337 lo sockets pid user ipc net

23 Sidecar Injection iptables routes eth0 nginx istio/proxy nginx envoy lo :15001/tcp sockets mnt uts mnt uts pid user ipc net

24 SvcA Service A

25 Pilot and Routing

26 ?? SvcA? Service A

27 Services $ kubectl get service -o wide service-b NAME TYPE CLUSTER-IP EXTERNAL-IP service-b ClusterIP <none> PORT(S) 80/TCP AGE 90s SELECTOR app=service-b

28 Service DNS exposure $ dig service-b.default.svc.cluster.local. ;; ANSWER SECTION: service-b.default.svc.cluster.local. 5 IN A

29 Pods $ kubectl get pods -o wide grep service-b service-b c-4rk88 1/1 Running service-b c-dc2zv 1/1 Running service-b c-gr75k 1/1 Running m46s 7m46s 7m46s kind-1-control-plane kind-1-control-plane kind-1-control-plane <none> <none> <none>

30 Endpoints $ kubectl get endpoints service-b NAME ENDPOINTS service-b :8080, :8080, :8080 AGE 8m55s

31 Endpoints $ kubectl get endpoints service-b -o yaml... subsets: - addresses: - ip: nodename: kind-1-control-plane targetref: kind: Pod ports: - name: http port: 8080 protocol: TCP

32 Control Plane API Pilot Config to s SvcA Service A

33 k8s consul Pilot Config to s Data plane API SvcA Service A zk Control Plane API

34 Pilot Ingress Routing Traffic Mirroring Traffic Shifting Canary Deployments Circuit Breaking Fault Injection

35 Mixer and Policy

36 Control Plane API Pilot Config to s SvcA Service A Service B

37 Control Plane API Pilot Config to s Mixer Policy checks, Telemetry SvcA SvcB Service A Service B

38 IP 5-tuple (src_addr, src_port, dst_addr, dst_port, proto)

39 IP Router Architecture BGP OSPF ARP CONTROL PLANE Router Information Base DATA PLANE Forwarding Information Base User process Kernel module Interrupt STP

40 IP Router Architecture BGP OSPF ARP STP CONTROL PLANE Router Information Base PILOT DATA PLANE Forwarding Information Base User process MIXER Kernel module Interrupt ENVOY

41 Control Plane API Pilot Config to s REPORT prom ES Mixer Mixer fat client Mixer fat client SvcA Service A RBAC Rate limit CHECK SvcB Service B

42 Mixer Check ACLs / Authorization Rate Limiting Report Logs Metrics Tracing

43 Control Plane API Pilot Config to s Mixer Policy checks, Telemetry SvcA SvcB Service A Service B

44 Control Plane API Pilot Config to s Mixer Policy checks, Telemetry Citadel TLS certs to s SvcA SvcB Service A Service B

45 Control Plane API Pilot Config to s Mixer Policy checks, Telemetry Citadel TLS certs to s SvcA SvcB Service A Service B

46 Control Plane API Pilot Config to s Mixer Citadel TLS certs to s Policy checks, Telemetry SvcA SvcB Ingress Service A Service B Egress

47 Control Plane API etcd API Server Pilot Config to s kubectl Mixer Policy checks, Telemetry Citadel TLS certs to s SvcA SvcB Service A Service B

48 Control Plane API etcd Galley Pilot Config to s kubectl Mixer Policy checks, Telemetry Citadel TLS certs to s SvcA SvcB Service A Service B

49 Outline Context and Introduction Networking and Containers Pilot and Routing Mixer and Policy Citadel and mtls

50 Recap We learned: How a packet traverses an Istio//Kubernetes system What control plane calls are made in that process A useful mental model for reasoning about, and debugging Istio

51 Thanks! QR CODE