Girish Ranganathan

Lee Calcote

Head of Technology Strategy, SolarWinds

Principal Architect, SolarWinds

Using Istio

Lee Calcote

linkedin.com/in/leecalcote

@lcalcote

gingergeek.com

lee@calcotestudios.com

clouds, containers, functions, applications and their management

calcotestudios.com/talks

github.com/leecalcote

R

Thank you to our Teaching Assistant!

@lcalcote

@scottcoulton

Scott Coulton

Show of Hands

What is Istio?

@lcalcote

• Observability

• Resiliency

• Traffic Control

• Security

• Policy Enforcement

istio.io

github.com/istio

@IstioMesh

Observability

is what gets people hooked on service metrics

@lcalcote

Goals

• Metrics without instrumenting apps

• Consistent metrics across fleet

• Trace flow of requests across services

• Portable across metric backend providers

You get a metric!  You get a metric!  Everyone gets a metric!

Traffic Control

control over chaos

@lcalcote

• Traffic splitting
  • L7 tag based routing?
• Traffic steering
  • Look at the contents of a request and route it to a specific set of instances.
• Ingress and egress routing

Resilency

• Systematic fault injection

• Timeouts and Retries with timeout budget

• Circuit breakers and Health checks

• Control connection pool size and request load

content-based traffic steering

visit layer5.io

Lab 1- Deploying Kubernetes

@lcalcote

• Open PWK

• Deploy master node

  • use external DNS

  • save your `kubeadm join` command output

• Install overlay networking

• Add two more nodes to the cluster

layer5.io

Istio Architecture

Istio Architecture

@lcalcote

Touches every packet/request in the system. Responsible for service discovery, health checking, routing, load balancing, authentication, authorization and observability.

Provides policy and configuration for services in the mesh.

Takes a set of isolated stateless sidecar proxies and turns them into a service mesh.

Does not touch any packets/requests in the system.

Pilot

Citadel

Mixer

Istio Architecture

@lcalcote

Lab 2 - Deploying Istio

@lcalcote

1. Installing Istio

2. Setting up `istioctl`

3. Verify install
4. Configuring add-ons

layer5.io

Lab 2.2 - Configuring Mixer Add-ons and Adapters

@lcalcote

layer5.io

SolarWinds Adapter for Istio

®

Open Source Adapters and Add-ons

(servicegraph)

What's Pilot for?

@lcalcote

provides service discovery to sidecars

manages sidecar configuration

Pilot

Citadel

the head of the ship

Mixer

system of record for service mesh

}

provides abstraction from underlying platforms

What's Mixer for?

• Point of integration with infrastructure backends
  • Intermediates between Istio and backends, under operator control
  • Enables platform & environment mobility
• Responsible for policy evaluation and telemetry reporting
  • Provides granular control over operational policies and telemetry
• Has a rich configuration model
  • Intent-based config abstracts most infrastructure concerns

@lcalcote

Pilot

Citadel

Mixer

an attribute-processing and routing machine

operator-focused

1. Precondition checking
2. Quota management
3. Telemetry reporting

What's Citadel for?

@lcalcote

• Verifiable identity
  • Issues certs
  • Certs distributed to service proxies
  • Mounted as a Kubernetes secret
• Secure naming / addressing
• Traffic encryption

Pilot

security at scale

Mixer

security by default

Orchestrate Key & Certificate:

• Generation
• Deployment
• Rotation
• Revocation

Service Proxy Sidecar

A C++ based L4/L7 proxy

Low memory footprint

In production at Lyft

@lcalcote

Capabilities:

• API driven config updates → no reloads
• Zone-aware load balancing w/ failover
• Traffic routing and splitting
• Health checks, circuit breakers, timeouts, retry budgets, fault injection…
• HTTP/2 & gRPC
• Transparent proxying
• Designed for observability

the included battery

Pod

Proxy sidecar

App Container

Lab 3 - Deploying Sample App

@lcalcote

1. Multi-language, multi-service application

2. Manual sidecar injection

3. Verify install

layer5.io

Lab 3 - BookInfo Sample App

Reviews v1

Reviews Pod

@lcalcote

Reviews v2

Reviews v3

Product Pod

Details Container

Details Pod

Ratings Container

Ratings Pod

Product Container

Reviews Service

Lab 3 - BookInfo Sample App

Reviews v1

Reviews Pod

@lcalcote

Reviews v2

Reviews v3

Product Pod

Details Container

Details Pod

Ratings Container

Ratings Pod

Product Container

Nginx sidecar

Nginx sidecar

Nginx sidecar

Nginx sidecar

Nginx sidecar

Reviews Service

Nginx sidecar

Lab 4 - Expose BookInfo via Istio Ingress Gateway

@lcalcote

1. Inspecting the Istio Ingress Gateway
2. Configure Istio Ingress Gateway for Bookinfo
3. Inspect the Istio proxy of the productpage pod
   

layer5.io

Mixer

@lcalcote

Mixer

Foo Pod

Proxy sidecar

Service Foo

Foo Container

an attribute processing engine

Lab 5 - Telemetry

@lcalcote

1. Generate Load on Bookinfo
2. View in monitoring tools
   

layer5.io

Pilot

Citadel

Mixer

Lab 6 - Distributed Tracing

@lcalcote

1. View Traces

layer5.io

Lab 7 - Request Routing and Canary Testing

@lcalcote

1. Configure the default route for all services to V1
2. Content based routing
3. Canary Testing - Traffic Shifting
    

layer5.io

Lab 8 - Fault Injection and Rate-Limiting

@lcalcote

1. Inject a route rule to create a fault using HTTP delay
2. Inject a route rule to create a fault using HTTP abort
3. Verify fault injection

layer5.io

Lab 9 - Mutual TLS & Identity Verification

@lcalcote

1. Verify mTLS
   
2. Understanding SPIFFE

layer5.io

Lab 10 - Circuit Breakig

@lcalcote

1. Deploy a client for the app
   1. With manual sidecar injection:
2. Initial test calls from client to server
3. Time to trip the circuit
   
   

layer5.io

Lee Calcote

Thank you. Questions?

clouds, containers, functions,

and their management

@lcalcote

calcotestudios.com/talks

Girish Ranganathan

distributed systems, operating at-scale, golang

@ingenious_G

layer5.io

We're hiring!

solarwinds.jobs

Extensibility of Istio

@lcalcote

Envoy, Linkerd, Nginx, Conduit

@lcalcote

Swapping Proxies

Why use another service proxy?

Based on your operational expertise and need for battle-tested proxy. You may be looking for caching, WAF or other functionality available in NGINX Plus.

If you're already running Linkerd and want to start adopting Istio control APIs like CheckRequest.

@lcalcote

Conduit not currently designed a general-purpose proxy, but lightweight and focused with extensibility via gRPC plugin.

AppOptics

@lcalcote

• Uses pluggable adapters to extend its functionality
  • Adapters run within the Mixer process
• Adapters are modules that interface to infrastructure backends
  • (logging, metrics, quotas, etc.)
• Multi-interface adapters are possible
  • (e.g. SolarWinds adapter sends logs & metrics)

Mixer Adapters

types: logs, metrics, access control, quota

Papertrail

Prometheus

Grafana

Fluentd

Statsd

Stackdriver

Open Policy Agent

What is a Service Mesh?

a dedicated layer for managing service-to-service communication

@lcalcote

Missing: application lifecycle management, but not by much

Missing: distributed debugging; provide nascent visibility (topology)

@lcalcote

DEV

OPS

Layer 5

where Dev and Ops meet

Problem: too much infrastructure code in services

Why use a Service Mesh?

to avoid...

• Bloated service code

• Duplicating work to make services production-ready

  • load balancing, auto scaling, rate limiting, traffic routing, ...

• Inconsistency across services

  • retry, tls, failover, deadlines, cancellation, etc, for each language, framework

  • silo'ed implementations lead to fragmented, non-uniform policy application and difficult debugging

• Diffusing responsibility of service management

@lcalcote

Help with Modernization

@lcalcote

• Can modernize your IT inventory without:

  • Rewriting your applications

  • Adopting microservices, regular services are fine

  • Adopting new frameworks

  • Moving to the cloud

Address the long-tail of IT services

Get there for free

Microservices

The more, the more merrier?

Benefits

The first few services are relatively easy

Democratization of language and technology choice

Faster delivery, service teams running independently, rolling updates

@lcalcote

Challenges

The next 10 or so may introduce pain

Language and framework-specific libraries

Distributed environments, ephemeral infrastructure, out-moded tooling

Which is why...

 I have a container orchestrator.

@lcalcote

Core

Capabilities

• Cluster Management

  • Host Discovery

  • Host Health Monitoring

• Scheduling

• Orchestrator Updates and Host Maintenance

• Service Discovery

• Networking and Load-Balancing

• Stateful services

• Multi-Tenant, Multi-Region

Additional

Key Capabilities

• Application Health and Performance Monitoring

• Application Deployments

• Application Secrets

@lcalcote

What do we need?

• Observability

• Logging
• Metrics
• Tracing

• Traffic Control

• Resiliency

• Efficiency
• Security

• Policy

@lcalcote