Service Mesh Advanced Use Cases

© OPITZ CONSULTING 2022 / Öffentlich
Service mesh advanced Use Cases 1
Nuremberg, 2022-09-22
Sven Bernhardt , Fabian Hardt
SERVICE MESH ADVANCED USE CASES

SERVICE MESH BASICS
01

MODERN SOFTWARE ARCHITECTURES ARE LOOSLEY COUPLED AND
DISTRIBUTED
¢ Single Deployment unit
¢ Single execution process
¢ Shared database
¢ Local, app-internal communication only
¢ Multiple Deployment units
¢ Exclusive execution process per service
¢ Database per Service (usually)
¢ Remote, inter-service communication
UI
Business
Logic
Persistence
Traditional software architecture Modern software architecture

CONNECTIVITY IS THE BACKBONE OF DIGITAL ORGANIZATIONS
Centralized
STATIC
ON-PREM
MONOLITH
VIRTUAL MACHINES
MANUAL CHANGE PROCESS
Decentralized
DYNAMIC
CLOUD / MULTI-CLOUD
MICROSERVICES / SERVERLESS
CONTAINERS, KUBERNETES
AUTOMATED CI/CD TOOL CHAIN
# Services & APIs
CONTROL AND VISIBILITY

WHAT’S END-TO-END SERVICE CONNECTIVITY?
¢ Between applications
¢ Within applications
¢ At the edge
EDGE
Monolithic back
end service
Microservices
based app
Microservices exposed at edge
for external consumption

RELIABLE CONNECTIVITY IS A MULTIDIMENSIONAL PROBLEM
App App App
App
Edge Cross-App In-App
Monolith Services Microservices Serverless …

INCREASED COMPLEXITY AND CHALLENGES WITH RESPECT TO
DEVELOPMENT CONSISTENCY
Security Security
Logging Logging
Security
Tracing
Metrics Routing
Metrics Tracing
Application
AuthN/Z
Rate-Limiting
Routing
Caching
Organization
Application
AuthN/Z
Versioning
Versioning
Rate-Limiting

WHAT’S A SERVICE MESH?
¢ Efficient implementation of cross-cutting
concerns with respect to service
integration challenges
¢ Everything is a service!
¢ Cloud-native apps deployed to Kubernetes
¢ Non Cloud-native workloads
¢ Should be independent of
¢ Architecture (e.g. Monolithic or µService)
¢ Platform (e.g. VMs, Containers, Kubernetes)
Dedicated infrastructure layer that
makes service-to-service communication
more reliable, secure and observable

WHAT CAN SERVICE MESH HELP YOU WITH?
API Gateway

CONSISTENCE FROM THE EDGE TO THE TARGET SERVICE
¢ External Clients access an organization’s
services through the API Gateway (Single
Point of entry)
¢ API Gateway is integrated in the Mesh
¢ Is just another service
¢ Gateway proxy just handles outbound traffic
¢ Internal traffic routing is handeled by the
Mesh

KUMA MESH
02

KUMA MESH
¢ Initally invented by Kong and donated to CNCF in 2020
¢ Provides a modern distributed Control Plane
¢ Completely Envoy-based Data Plane proxies
¢ Platform agnostic open-source control plane for Service Mesh
¢ Hence Kuma is
¢ Universal
¢ Simple
¢ Scalable
¢ Flexible deployment options
¢ Standalone deployment
¢ Multi-Zone deployment
Source: https://tinyurl.com/xb57bhx5

KUMA STANDALONE ARCHITECTURE

KUMA MULTI-CLUSTER ARCHITECTURE
¢ One zone can be deployed over multiple clusters
¢ All traffic enters cluster over zone ingress
¢ One Remote (Zone) Control Plane in each cluster

KUMA NETWORKING / CNI
¢ Installed as DaemonSet on all Nodes
¢ Injects label on Pods - k8s.v1.cni.cncf.io/networks: kuma-cni
¢ CNI enables Transparent Proxying – redirects all traffic through Data Plane

KUMA NETWORKING / INIT-CONTAINER
¢ Injected to Pod and started individually before Data Plane
¢ Configures iptables / network routing

SERVICE MESH DNS
¢ Local DNS resolution directly in Data Plane (Envoy)
¢ Names are not resolvable in complete cluster, just inside service mesh (Envoy)
¢ Resolves “.mesh“ address to pre-defined service mesh IP address
¢ IP in other zone / cluster is routed over Kuma Zone Ingress

ZONE EGRESS
¢ Special Data Plane instance – like Zone Ingress
¢ All outgoing traffic is routed through this instance
¢ Usage of External Services just possible with deployed Zone Egress in the future

DEMO
03

DEMO: MULTI-CLOUD / MULTI-CLUSTER MESH

ORACLE CONTAINER ENGINE FOR KUBERNETES (OKE)
Based on IaaS Oracle
Compute Cloud Service
Worker Nodes: VM
Master Node:
•Managed and maintained by Oracle
•Not visible for the end user
•Master nodes are free of charge
Auto-scaling capabilities
using Worker-Node Pools
Can be provisioned using
OCI Cloud Console
OCI Cloud Shell
OCI CLI
Terraform (OCI Resource Manager)

CONCLUSION
06

SERVICE MESH BENEFITS
¢ Increased Developers productivity
¢ Self-service network management
¢ Reliable connectivity
¢ Zero-trust security
¢ Service Discovery
¢ Observability

KEY TAKEAWAYS
¢ Service Mesh is essential for modern software architectures to tackle basic service
integration challenges independent of:
¢ Level
¢ Architecture
¢ Platform
¢ Kuma as a mesh implementation provides
¢ Agnostic approach (indepent of architecture or platform)
¢ Modern, flexible architecture supporting hybrid, multi-cloud scenarios
¢ Standalone
¢ Multi-zone
¢ Multi-mesh
¢ Seamless CI / CD integration (GitOps)

Q & A
https://opitzcloud.canto.global/b/H0EMG

Analytics meets Integration – Modern Development mit Data APIs 27
www.opitz-consulting.com
KONTAKT
Sven Bernhardt
Senior Manager Corporate Development
Sven.Bernhardt@opitz-consulting.com
+49 172 2193529
https://www.xing.com/profile/Sven_Bernhardt/
https://www.linkedin.com/in/sven-bernhardt-0570b823/
Fabian Hardt
Solution Architect
Fabian.Hardt@opitz-consulting.com
https://twitter.com/fabian_hardt
https://www.xing.com/profile/Fabian_Hardt
https://www.linkedin.com/in/fabian-hardt-0956b1b1

Service Mesh Advanced Use Cases

More Related Content

Similar to Service Mesh Advanced Use Cases

More from Fabian Hardt

Recently uploaded

Service Mesh Advanced Use Cases