Service Mesh with Istio by Okky Hendriansyah

1. PAGE1
DEVOPS INDONESIA
Solutions Architect, Indonesia, Red Hat
Okky Hendriansyah Tri Firgantoro
Service Mesh with Istio

2. PAGE2
DEVOPS INDONESIA
Agenda
• Background
• Architecture
• Features
• Simple Demo
• Q & A

3. PAGE3
DEVOPS INDONESIA
Monolithic Application
BigMonolithicApp

4. PAGE4
DEVOPS INDONESIA
Microservices Application

5. PAGE5
DEVOPS INDONESIA
Microservices Application

6. PAGE6
DEVOPS INDONESIA
Microservices Application

7. PAGE7
DEVOPS INDONESIA
Microservices Application =~ Distributed Computing

8. PAGE8
DEVOPS INDONESIA
Fallacies of Distributed Computing
1. The network is reliable
2. Latency is zero
3. Bandwidth is infinite
4. The network is secure
5. Topology doesn’t change
6. There is one administrator
7. Transport cost is zero
8. The network is homogeneous
source: https://en.wikipedia.org/wiki/Fallacies_of_distributed_computing

9. PAGE9
DEVOPS INDONESIA
What happens if a microservice failed?

10. PAGE10
DEVOPS INDONESIA
What happens if a microservice failed?

11. PAGE11
DEVOPS INDONESIA
The Solution?

12. PAGE12
DEVOPS INDONESIA
Why Not Traditional Enterprise Service Bus?
source: https://www.ains.com/enterprise-service-bus-esb/

13. PAGE13
DEVOPS INDONESIA
The Solution?
• A service mesh platform originally
developed by Google, IBM, and Lyft on
May 2017
• Built using battle-tested Envoy Proxy
from Lyft
• Just turned v1.0 this August 2018!
• Deploys on Kubernetes and Consul-
based deployment

14. PAGE14
DEVOPS INDONESIA
What is a Service Mesh?
A service mesh is a dedicated infrastructure layer for handling service-to-service
communication. It’s responsible for the reliable delivery of requests through the
complex topology of services that comprise a modern, cloud native application. In
practice, the service mesh is typically implemented as an array of lightweight network
proxies that are deployed alongside application code, without the application
needing to be aware.
source: https://blog.buoyant.io/2017/04/25/whats-a-service-mesh-and-why-do-i-need-one/

15. PAGE15
DEVOPS INDONESIA
What is a Service Mesh?
A configurable infrastructure layer for a microservices application. It makes
communication between service instances flexible, reliable, and fast. The mesh
provides service discovery, load balancing, encryption, authentication and
authorization, support for the circuit breaker pattern, and other capabilities.
source: https://www.nginx.com/blog/what-is-a-service-mesh/

16. PAGE16
DEVOPS INDONESIA
Istio Approach of Service Mesh
• Deploys EnvoyProxy as the default
Istio Proxy as a sidecar container for
each service deployed
• The Istio Proxy sidecars are injected
(automatically or manually)
• No more single point of failure,
since the proxies are distributed
and have cache mechanism
• Istio Proxy obtain rules and
configuration from Istio Pilot

17. PAGE17
DEVOPS INDONESIA
Why Istio Choose EnvoyProxy?
• Originally developed by Lyft
• High performance distributed C++
based proxy
• Understands HTTP, HTTP/2, Kafka,
TCP, gRPC, etc.
• Robust API
• Open source and donated to CNCF

18. PAGE18
DEVOPS INDONESIA
Istio Architecture
● Control Plane
○ Pilot
○ Mixer
○ Citadel
● Data Plane
○ Proxy
● Gateway
○ Ingress
○ Egress
● Addons
○ Prometheus
○ Jaeger
○ ServiceGraph
○ Grafana
source: https://istio.io

19. PAGE19
DEVOPS INDONESIA
Pilot & Proxy Relationship
● Pilot is responsible for
the lifecycle of Proxy
● Rules are defined in the
Pilot
● Pilot hides the platform
complexity from Proxy
● Service discovery and
rules are pushed and
cached from Pilot to
Proxy
source: https://istio.io

20. PAGE20
DEVOPS INDONESIA
Mixer & Proxy Relationship
● Mixer provides policy
control
● Mixer collects
telemetry
source: https://istio.io

21. PAGE21
DEVOPS INDONESIA
Mixer & Proxy Relationship
● Proxy calls Mixer to
check policy before
each request
● Proxy calls Mixer to
report telemetry after
each request
● Proxy and Mixer cached
information to reduce
latency
source: https://istio.io

22. PAGE22
DEVOPS INDONESIA
Traffic Management: Intelligent Routing
Content-based Routing

23. PAGE23
DEVOPS INDONESIA
Traffic Management: Traffic Shifting
Canary Deployment, Blue/Green Deployment, Weight-based Routing

24. PAGE24
DEVOPS INDONESIA
Traffic Management: Ingress & Egress Traffic
Ingress, Service-to-Service, and Egress
By default, outgoing connection outside cluster is denied

25. PAGE25
DEVOPS INDONESIA
Traffic Management: Split Traffic Between Versions
Proxy will forward to specific
version based on routing rules

26. PAGE26
DEVOPS INDONESIA
Other Features (not covered)
• Fault Injection
• Circuit Breaker
• Delays/Timeout
• Retries
• Security (encryption)
• Policy (rate limit, whitelist, blacklist, denial)
• Telemetry
• etc.

27. PAGE27
DEVOPS INDONESIA
Simple Demo: Bookinfo

28. PAGE28
DEVOPS INDONESIA
Simple Demo: Bookinfo

29. PAGE29
DEVOPS INDONESIA
Alone We are smart, together We are brilliant
THANK YOU !
Quote by Steve Anderson