Kubernetes Ingress to Service Mesh (and beyond!)

1. Kubernetes: Ingress to service mesh (and beyond!) Christian Posta Field CTO – Solo.io

2. 2 | Copyright © 2020 @christianposta CHRISTIAN POSTA • Field CTO @ Solo.io • Author of a few books • Contributor to many open-source projects • Architect, blogger, speaker, mentor, leader @christianposta christian@solo.io https://blog.christianposta.com https://slideshare.net/ceposta

4. 4 | Copyright © 2020 01 02 03 04 05 06 Level set Common challenges for application networking Envoy Proxy API Gateway and Service Mesh Bringing it all together Things to watch for in 2020 Approximate flow of talk

10. 10 | Copyright © 2020 Cloud application networking challenges • Edge/DMZ routing • Surgical / fine / per-request routing • A/B rollout • Traffic shaping • Request racing • Internal releases / dark launches • Request shadowing • Fault injection

13. 13 | Copyright © 2020 Q: “What's the biggest technology mistake you ever made?” A: “When I was at IBM, I started a product called Websphere … I thought it needs to be scalable, reliable, have a single point of control ... I tried to build something like a mainframe, a system that was capable of doing anything… I call it the endgame fallacy. It was too complex for people to master. I overdesigned it.” - Donald Ferguson

14. 14 | Copyright © 2020 Cloud application networking challenges • Netflix Hystrix (circuit breaking / bulk heading) • Netflix Zuul (edge router) • Netflix Ribbon (client-side service discovery / load balance) • Netflix Eureka (service discovery registry) • Brave / Zipkin (tracing) • Netflix spectator / atlas (metrics)

15. 15 | Copyright © 2020 Cloud application networking challenges • Require specific language to bring in new services • A single language doesn’t fit for all use cases • How do you patch/upgrade/manage lifecycle? • Need strict control over application library choices • Inconsistent implementations • Incorrect implementations

24. 24 | Copyright © 2020 Envoy implements: • zone aware, least request load balancing • circuit breaking • outlier detection • retries, retry policies • timeout (including budgets) • traffic shadowing • request racing • rate limiting • access logging, statistics collection • Many other features!

26. 26 | Copyright © 2020 Why Envoy? • C++ • Built ground-up for services environment • Large, diverse, vibrant community • Dynamic configuration model • Highly extensible (in C++  we’ll come back to this) • Many out of the box L7 filters (HTTP, HTTP2, grpc, redis, mysql, DynamoDB, thrift, zookeeper, kafka, et. al.) • Incredible trove of telemetry out of the box • Very versatile deployment options (as we’ll see)

32. 32 | Copyright © 2020 The importance of a decentralized, declarative API • Works well with automation • Document-oriented, easy to store in SCM • Decoupled from underlying system • Less complex than general programming languages • Represents ”intent” or “desired state” • Use reconciling controllers to implement desired state • Controllers observe drift and bring into balance

34. 34 | Copyright © 2020 API Gateway pattern “A service that’s the entry point into the microservices- based application … is responsible for request routing, API composition, protocol translation … and edge functions like authentication, authorization, rate limiting, caching, et. al.” https://www.manning.com/books/microservices-patterns See also: https://microservices.io/patterns/apigateway.html

35. 35 | Copyright © 2020 API Gateway pattern • Abstracts backend services, protocols, message shapes, etc • Powerful matching/routing, discovery, transformation, aggregation, protocol translation • Backends for front-ends • A developer-first construct • Intended to be decentralized and change at the pace of your applications • Edge functions including rate-limiting, authentication/authorization, caching, metrics collection

37. 37 | Copyright © 2020 Gloo API Gateway • Unify backend APIs running in Kubernetes, VMs, Physical, FaaS, etc • Decentralized configuration: allow service teams to move fast • Declarative configuration • Provides a control plane for Envoy • Security (Oauth/ODIC, API Key, TLS, SNI, OPA, HMAC, custom) • Kubernetes native / run outside Kube as well • Highly pluggable/extensible • “If you know Kubernetes, you know Gloo”  user quote

38. 38 | Copyright © 2020 API Gateway built on Envoy ENVIRONMENT SECRET CONFIGURATION Data Plane Upstream gRPC-JSON transcoder Rate limiting External AUTH … Control Plane Configure and manage envoy’s plugins Router

45. 45 | Copyright © 2020 Service mesh technologies provide the following: • Service discovery / Load balancing • Secure service-to-service communication • Traffic control / shaping / shifting • Policy / Intention based access control • Traffic metric collection • Service resilience • API / programmable interface

64. 64 | Copyright © 2020 • https://solo.io • https://slack.solo.io • https://gloo.solo.io • https://envoyproxy.io • https://istio.io • https://webassemblyhub.io • https://servicemeshhub.io • https://blog.christianposta.com