Consul: Service Mesh for Microservices

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Service Mesh for Microservices

Armon Dadgar
Founder and CTO
@armon

PROVISION, SECURE AND RUN ANY INFRASTRUCTURE
Nomad Consul
Vault
Vagrant Packer Terraform
Consul Enterprise
Terraform Enter...

Service Mesh for Microservices

A B
C D
Monolith

Monolith
A B
C D

Monolith
A B
C D
Static IP

Monolith
LB
A B
C D
Static IP

Zone FirewallDMZ Firewall
Monolith
A B
C D
Static IP
LB

What Changed?

A B
C D
Monolith

Microservices
A B
C D

Microservices
A B
C D
?

BB
Microservices
A B
C D
?

Microservices
BBA B
C D
LB

Operating in the Cloud + Containers
Dynamic IP Addresses
Higher Failure Rate
Ephemeral Infrastructure
Complex Network Topo...

Service Discovery

Service Registry
Register
BBA B

Service Registry
Discover
BBA B

Service Registry
Connect
BBA B

Service Registry
Connect
BBAttacker B

Service Segmentation

Deﬁning Segmentation
Splitting network into sub-networks
Restricting communication between sub-networks
Virtual LAN, Firew...

Zone FirewallDMZ Firewall
Monolith
A B
C D
Static IP
LB

Microservices
A B
C D

A -> B
C -> D
D -> C
A B
C D

B -> DA -> C
A B
C D

Service Mesh for Microservices
Service Discovery. Connect services with a dynamic registry
Service Conﬁguration. Conﬁgure ...

Consul Usage
Launched in 2014
12K+ GitHub Stars
1M+ Downloads monthly
Customers running 50,000+ agents

Public Users

Service Discovery
Registry of Nodes, Services, Checks
DNS API
HTTP API
Web UI

T E R M I N A L
$ dig redis.service.consul
; <<>> DiG 9.8.3-P1 <<>> redis.service.consul
; (3 servers found)
;; global opt...

T E R M I N A L
$ curl http://localhost:8500/v1/catalog/service/redis
[
{
"ID": "52f73400-a352-80d2-9624-e70cc9996762",
"N...

Service Conﬁguration
Hierarchical Key/Value Store
HTTP API
Long-polling / Edge trigger
Locking

T E R M I N A L
$ consul kv put service/web/enable_foo true
Put successfully!
$ consul kv get service/web/enable_foo
true

Consul Connect

Consul Connect
Service Access Graph
Certiﬁcate Distribution
Application Integration

Service Access Graph
Intentions to Allow/Deny Communication
Source and Destination Service
Scale Independent
Managed with ...

T E R M I N A L
$ consul intention create -deny web '*'
Created: web => * (deny)
$ consul intention create -allow web db
C...

Certiﬁcate Distribution
Transport Layer Security (TLS)
Service Identity
Encryption of all traffic

Certiﬁcate Generation
Automatic Generation & Rotation
ServerClient
Certiﬁcate
Signing Request
Generate
Key Pair
Sign Certi...

Certiﬁcate Format
X.509 Certiﬁcate
SPIFFE Compatible

Certiﬁcate Authority Rotation
Root
Intermediary
Leaf

Certiﬁcate Authority Rotation
Root
Intermediary
Leaf
Root
Intermediary
Leaf

Certiﬁcate Authority Rotation
Root
Intermediary
Leaf
Root
Intermediary Intermediary
Leaf Leaf

Application Integration
Consul Client for Service Graph and Certiﬁcates
Sidecar Proxies
Native Integrations

Sidecar Proxy Integration
No Code Modiﬁcation
Minimal Performance Overhead
Operational Flexibility

Sidecar Proxies
ClientProxy
App
Conﬁgure
Connect
ProxyClient
App
Conﬁgure
Connect

Pluggable Proxies
Client
App
Conﬁgure
Connect
Client
App
Conﬁgure
Connect

${ "service": "web", "connect": { "proxy": { "config": { "upstreams": [{ "destination_name": "redis", "local_bind_port": 12...$

ProxyClient
App
Conﬁgure
Connect localhost:1234
Connect to
upstream redis

T E R M I N A L
$ consul connect proxy
-service web
-upstream postgresql:8181
$ psql -h 127.0.0.1 -p 8181 -U mitchellh m...

Native Integration
Standard TLS
Negligible Performance Overhead
Requires Code Modiﬁcation

// Create a Consul API client
client, _ := api.NewClient(api.DefaultConfig())
// Create an instance representing this serv...

Consul Connect
Service Access Graph. Intentions allow or deny communication of
logical services.
Certiﬁcate Distribution. ...

Consul Architecture

Deployment
Single Binary
Server and Client Agents
3-5 Servers per Datacenter
Multi-Datacenter Support

Consul Servers
Replicated State, Automatic Failover
Service Registry
Service Access Graph
Key/Value Store
Multi-DC Forward...

Consul Clients
Expose HTTP and DNS API
Transparently Forward
Register and Monitor Services
Cache Service Graph
Server(s)
C...

Cluster Awareness
Lightweight Gossip (Serf)
Cluster Membership
Failure Detection Gossip
Server
Client Client

Cluster Membership
Join Requires Any Peer
Server Discovery
Protocol Versioning New Server
Server
Client Client
Server

Failure Detection
Leaving vs Failing
Automatic Reaping
No Heart beating Failed Client
Server
Client Client

Leader
Client
Follower
Replication
RPC
RPCGossip
Datacenter

Leader
Client
Follower
Replication
RPC
RPCGossip
Datacenter
Leader
Client
Follower
Replication
RPC
RPCGossip
Datacenter
RP...

Control Plane vs. Data Plane
Consul as Control Plane
Pluggable Proxies as Data Plane
Conﬁgure
Communicate
Control
Data Data

Data Path
ClientProxy
App
Conﬁgure
Connect
ProxyClient
App
Conﬁgure
Connect

Consul with Containers
Consul Agent per Host
DaemonSet with Kubernetes
Proxy per Container / Pod

Consul Architecture
Batteries Included
Highly Available & Scalable
Pluggable Data Plane

Conclusion

Common Challenges
Infrastructure is means to an ends
Microservices Architecture
Operational Challenges

Patchwork Solutions
Re-invent the wheel
Long Term Maintenance
Minimum Viable vs Maximum Utility

Service Mesh for Microservices
Service Discovery. Connect services with a dynamic registry
Service Conﬁguration. Conﬁgure ...

Consul: Service Mesh for Microservices

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

Share
Email

2024 State of Marketing Report – by... by Marius Sescu 16653 views
Everything You Need To Know About C... by Expeed Software 8524 views
Product Design Trends in 2024 | Tee... by Pixeldarts 3765 views
How Race, Age and Gender Shape Atti... by ThinkNow 2848 views
AI Trends in Creative Operations 20... by marketingartwork 32185 views
Skeleton Culture Code by Skeleton Technolo... 34640 views

Top clipped slide

1 of 78 Ad

1 of 78 Ad