Service Mesh with Istio on Kubernetes Dmitry Burlea Software Developer @ FlixCharter
Road to Microservices Monolith (all-in-one)
Road to Microservices Images from http://amazon.com/
Road to Microservices Image from http://amazon.com/
Road to Microservices Monolith (all-in-one) Service A Service C Service B Service D
Self Contained Systems / Micro Frontends Backend Team A Team B Team C Database Frontend https://micro-frontends.org/
Microservices Deployment Service A Service B Service C Service D
Microservices Deployment: Containers
Microservice Architecture Challenges Service A Service B Service A Service B Service C Service D Service C Service D
Microservice Architecture Challenges Image from https://imgflip.com/
Microservice Architecture Challenges Image from https://imgflip.com/
Microservice Architecture Challenges Scaling up & down Resiliency Service Discovery Rolling out & back Security
Container Orchestration Tools Docker Swarm
Kubernetes @ FlixTech Image from http://www.handshakestudios.com/
Kubernetes Open-sourced by Google in 2014 Replication Controller Pod Service Communication Channel Container Container Container Container Pod blueprint Pod Pod Pod
Microservice Architecture Challenges Image from https://imgflip.com/
Microservice Architecture Challenges Image from https://imgflip.com/
Microservice Architecture Challenges Observability Resiliency Traffic Management Metrics Distributed Tracing Dependency Visualization Circuit Breaking Health Checks Fault Injection Policy Enforcement Service Identity & Security
Microservice Architecture Challenges Observability Resiliency Traffic Management Policy Enforcement Service Identity & Security
Frameworks response to the challenge: Netflix OSS example Hystrix -
Service Discovery 10.2.3.4:3333 10.2.3.4:3444 Service A Service A Client Service 10.3.4.5:4444 10.3.4.5:4555 Service B Service B 10.4.5.6:5555 10.4.5.6:7777 Service C Service C
Netflix OSS: Service Discovery @EnableEurekaServer @SpringBootApplication public class EurekaServiceApplication { public static void main(string[] args) { SpringApplication.run(EurekaServiceApplication.class, args); } } @EnableDiscoveryClient @SpringBootApplication @RestController public class EurekaClientApplication { @Autowired private DiscoveryClient discoveryclient; } @RequestMapping("/service-instances/{applicationName}") public List<ServiceInstance> serviceinstancesbyapplicationname( @PathVariable String applicationname) { return this.discoveryclient.getinstances(applicationname); }
Circuit Breaking Service A Client Service Service B Service C
Netflix OSS: Circuit Breaking Hystrix @Service public class BookService { private final RestTemplate resttemplate; public BookService (RestTemplate rest) { this.resttemplate = rest; } @HystrixCommand(fallbackMethod = "reliable") public String readinglist() { URI uri = URI.create("http://localhost:8090/recommended"); } return this.resttemplate.getforobject(uri, String.class); public String reliable() { return "Cloud Native Java (O'Reilly)"; } }
Distributed Tracing Service D Service B Service E error Client Service Service F Service C Service G
Distributed Tracing Service D Service B Service E Client Service Service F Service C Service G
Distributed Tracing http://opentracing.io https://gist.github.com/adriancole/3c4b70925b8f87d7c98e369216b916aa
Distributed Tracing Service D Service B No Trace ID No Span ID Trace ID = X Span ID = A Client Service Service E Service F Service C Service G
Distributed Tracing Trace Data Storage / UI Service D Service B No Trace ID No Span ID Trace ID = X Span ID = A Client Service Service E Service F Service C Service G
Distributed Tracing
Frameworks Support Summary Hystrix Hello, me again Custom Vendor Specific Instrumentation None of them are native networking technologies Not flexible
Frameworks Support Summary
Another programming language Let s maybe implement the new service in Go, Kotlin, Ruby, (insert what is missing)???
New microservice in another programming language https://www.entertainmentearth.com/product/ghostbusters-zuul-110-art-scale-statue/ns35325 https://www.dorksidetoys.com/funko-pop-vinyl-exclusive-ghostbusters-zuul-figur-p/fkgb09017z.htm
Network & Business Logic Network related implementation Business logic implementation Service Service Service Service Service Service Service Service Service
Separate Business Logic from Networking Network related implementation Business logic implementation Service
Service Mesh: Sidecar "A sidecar is a one-wheeled device attached to the side of a motorcycle, scooter, or bicycle, producing a three-wheeled vehicle. @Wikipedia Images from https://github.com/newrelic/sidecar, https://www.pinterest.com
Service Mesh: Sidecar Sidecar proxy Service application Sidecar Service
Service Mesh: Sidecar In 2014, we started an initiative to create a replacement architecture that would scale better. The result has proven extremely successful and has been gradually deployed throughout Google, saving in the process millions of dollars a month in ops costs. Google https://istio.io/blog/2017/mixer-spof-myth.html Sidecar Sidecar Sidecar Service A Service B Service C
Service Mesh: Data Plane Sidecar Sidecar Sidecar Sidecar Sidecar Sidecar Data Plane Service A Service A Sidecar Sidecar Service B Service B Sidecar Sidecar Service C Service C Sidecar Sidecar Service D Service D Service E Service E Service F Service F
Service Mesh: Control Plane Control Plane Sidecar Sidecar Sidecar Sidecar Sidecar Sidecar Data Plane Service A Service A Sidecar Sidecar Service B Service B Sidecar Sidecar Service C Service C Sidecar Sidecar Service D Service D Service E Service E Service F Service F
Data Plane Solutions
Service Mesh Platforms
Istio. How has it started? IBM Amalgam8 project Google Service Control Envoy Proxy @ Lyft https://developer.ibm.com/dwblog/2017/istio/
Istio Service Architecture Pilot Mixer Service Discovery Citadel Envoy Proxy Envoy Proxy Envoy Proxy Kubernetes Pod Service A Service B Service C
Envoy L3 (Network) / L4 (Transport) Proxy L7 (Application) Proxy Implemented in C++ 11 Small memory footprint Battle tested @ Lyft 10 000+ VMs ~ 2 000 000 requests / second
Istio Concepts Traffic Management Discovery & Load Balancing Traffic Splitting Traffic Steering Handling Failures Fault Injections Policies and Telemetry Rate limiting Distributing Tracing Collecting Logs & Metrics Generating Service Graph Security Authentication Policy Mutual TLS Authentication Istio RBAC
Istio: Traffic Management Service A Pod 1 Service Pod A2 Service V1 Pod A3 Service V1 B
Istio: Traffic Splitting Pod 1 Service Pod A2 Service V1 Pod A3 Service V1 B V1 Service A Canary Rollout Pod 4 Service B V2
Istio: Traffic Steering Pod 1 Service Pod A2 Service V1 Pod A3 Service V1 B V1 Service A A/B Testing Pod 4 Service B V2
Istio: Traffic Mirroring (Dark Launch) https://launchdarkly.com/blog/why-leading-companies-dark-launch/
Istio: Traffic Mirroring (Dark Launch) Service B V1 Service A Service B V2
Istio DSL A bit of code
Istio Routing API: Traffic Splitting split-95-5.yml apiversion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: split-95-5 spec: hosts: - service-b http: - route: - destination: host: service-b subset: v1 weight: 95 - route: - destination: host: service-b subset: v2 weight: 5 Service A Pod 1 Service Pod 2 AService Pod 3 V1 AService V1 B V1 Pod 4 Service B V2 istioctl create -f split-95-5.yaml
Istio Routing API: Traffic Steering apiversion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: route-rule-chrome-firefox spec: hosts: - service-b http: - match: - headers: user-agent: regex: *.Chrome.* route: - destination: host: service-b subset: v1 - match: - headers: user-agent: regex: *.Firefox.* route: - destination: host: service-b subset: v2 Service A Pod 1 Service Pod 2 AService Pod 3 V1 AService V1 B V1 Pod 4 Service B V2 istioctl create -f split-browser.yaml
Istio Routing API: Traffic Mirroring apiversion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: route-rule-mirror spec: hosts: - service-b http: - route: - destination: host: service-b subset: v1 mirror: host: service-b subset: v2 Service A Service B V1 Service B V2
Istio Resiliency: Http Timeout apiversion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: timeout-rule spec: hosts: - service-a http: - route: - destination: host: service-a subset: v1 timeout: 5s 00:30 istioctl create -f timeout-rule.yaml
Istio Resiliency: Http Retry apiversion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: retry-rule spec: hosts: - service-a http: - route: - destination: host: service-a subset: v1 retries: attempts: 3 pertrytimeout: 2s istioctl create -f retry-rule.yaml
Istio Fault Injection: Http Delay apiversion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: delay-rule spec: hosts: - service-a http: - fault: delay: fixeddelay: 7s percent: 100 match: - headers: cookie: regex: ^(.*?;)?(user=jason)(;.*)?$ route: - destination: host: service-a subset: v2 istioctl create -f delay-rule.yaml
Distributed Tracing Zipkin Backend Zipkin Adapter Stackdriver Adapter Custom Adapter Custom Backend Mixer Envoy Service A Trace Headers: x-request-id x-b3-traceid x-b3-spanid x-b3-parentspanid x-b3-sampled x-b3-flags x-ot-span-context Envoy Service B Trace Headers: x-request-id x-b3-traceid x-b3-spanid x-b3-parentspanid x-b3-sampled x-b3-flags x-ot-span-context Sidecar Service C
Distributed Tracing $ kubectl apply -f install/kubernetes/addons/zipkin.yaml $ kubectl apply -n istio-system -f https://raw.githubusercontent.com/jaeger tracing/jaeger-kubernetes/master/all-inone/jaeger-all-in-one-template.yml
Service Graph Service Graph Add-On $ kubectl apply -f install/kubernetes/addons/servicegraph.yaml https://istio.io/docs/tasks/telemetry/servicegraph
Security: Citadel Peer: Service-to-service mutual TLS Origin: End-user authentication with JWT apiversion: "authentication.istio.io/v1alpha1" kind: "Policy metadata: name: "example-3 spec: targets: - name: httpbin peers: - mtls: origins: - jwt: issuer: $SVC_ACCOUNT jwksuri: $JWKS principalbinding: USE_ORIGIN https://istio.io/docs/concepts/security/mutual-tls/
Why Service Mesh is a good option? Networking
Decouple Networking from Business Logic Networking Business logic
References Istio Docs and Tutorials: https://istio.io/docs/ Workshops: https://github.com/retroryan/istio-workshop https://github.com/redhat-developer-demos/istio-tutorial https://developers.redhat.com/boo ks/introducing-istio-service-meshmicroservices/
Thank you! Do you have any questions? dmitry.burlea@flixbus.com