Remember how cool Kubernetes seemed when you first started using it? A simple, easy API for scalable compute in any cloud: just a Deployment and a Service and you’re done! But as you use it more, you learn that this isn’t really enough. A production system needs requests and limits, liveness checks, HPAs, PDBs, PSPs, etc. The same is true for Istio, which can solve a lot of the problems with microservices out of the box, but isn’t magic. When you get beyond playing with bookinfo, more configuration is needed to get the most out of it. In this talk I’ll show you how to: Identify app versions, deploy canaries and run A/B tests Set timeouts Configure retries, with exponential backoff Enforce rate limits Enable circuit breakers Inject faults for testing I’ll also cover a couple of the big security features: Enabling mTLS Using service-to-service access control lists (RBAC)

1. with Isito
Running Resilient
Workloads
Matt Turner
KubeCon, Shanghai China | June 2019 @mt165 | mt165.co.uk

3. Running Resilient Workloads with Istio @mt165
Pop Quiz!

4. Running Resilient Workloads with Istio @mt165
Business Value
● Top Line
● Bottom Line
● Time to Market & Speed of Iteration
● Risk Reduction

5. Running Resilient Workloads with Istio @mt165
Break the Monolith

6. Running Resilient Workloads with Istio @mt165
...don’t just distribute it!

7. Running Resilient Workloads with Istio @mt165
Pod
Pod
Pod
Namespace A
Namespace B
Namespace C
Namespace A
Namespace B
Namespace C

8. Running Resilient Workloads with Istio @mt165

9. Running Resilient Workloads with Istio @mt165

10. Running Resilient Workloads with Istio @mt165

11. Running Resilient Workloads with Istio @mt165

12. Running Resilient Workloads with Istio @mt165

13. Running Resilient Workloads with Istio @mt165
It’s not plain sailing
Production Kubernetes is more than just a Deployment and a Service

14. Running Resilient Workloads with Istio @mt165
Production Kubernetes
● Ingress
● HPA
● Requests and Limits
● Health Checks

15. Running Resilient Workloads with Istio @mt165
Production Kubernetes
● ConfigMaps
● Secrets
● Upgrade Strategies
● Affinities
● Anti-affinities
● PDB
● PSP
● Network Policy
● Pod Presets
● Service Accounts & RBAC
● LimitRanges
● Cluster Autoscaler

16. Running Resilient Workloads with Istio @mt165
“An open platform to connect, secure,
control, and observe services.”

17. Running Resilient Workloads with Istio @mt165
DEMO SETUP

18. Running Resilient Workloads with Istio @mt165
Observability
● Metrics ✔
● Service graph ✔
● Tracing ✔

19. Running Resilient Workloads with Istio @mt165
Layer 7 Traffic Routing
● Workload versioning ✔
● Traffic pinning ✔
● Traffic shifting ✔
● Canaries ✔
● Protocol translation ?
● Traffic mirroring ❌

20. Running Resilient Workloads with Istio @mt165
Layer 7 Traffic Routing
● Workload versioning ✔
● Traffic pinning ✔
● Traffic shifting ✔
● Canaries ✔
● Protocol translation ?
● Traffic mirroring ❌

21. Running Resilient Workloads with Istio @mt165
Layer 7 Traffic Routing
● Workload versioning ✔
● Traffic pinning ✔
● Traffic shifting ✔
● Canaries ✔
● Protocol translation ?
● Traffic mirroring ❌

22. Running Resilient Workloads with Istio @mt165
Layer 7 Traffic Routing
● Workload versioning ✔
● Traffic pinning ✔
● Traffic shifting ✔
● Canaries ✔
● Protocol translation ?
● Traffic mirroring ❌

23. Running Resilient Workloads with Istio @mt165
Layer 7 Traffic Routing
● Workload versioning ✔
● Traffic pinning ✔
● Traffic shifting ✔
● Canaries ✔
● Protocol translation ?
● Traffic mirroring ❌

24. Running Resilient Workloads with Istio @mt165
Layer 7 Traffic Routing
● Workload versioning ✔
● Traffic pinning ✔
● Traffic shifting ✔
● Canaries ✔
● Protocol translation ?
● Traffic mirroring ❌

25. Running Resilient Workloads with Istio @mt165
Resiliency
● Delay injection ?
● Timeouts ✔
● Fault injection ?
● Circuit breakers ?
● Retries ✔
● Rate limits ✔

26. Running Resilient Workloads with Istio @mt165
Resiliency
● Delay injection ?
● Timeouts ✔
● Fault injection ?
● Circuit breakers ?
● Retries ✔
● Rate limits ✔

27. Running Resilient Workloads with Istio @mt165
Resiliency
● Delay injection ?
● Timeouts ✔
● Fault injection ?
● Circuit breakers ?
● Retries ✔
● Rate limits ✔

28. Running Resilient Workloads with Istio @mt165
Resiliency
● Delay injection ?
● Timeouts ✔
● Fault injection ?
● Circuit breakers ?
● Retries ✔
● Rate limits ✔

29. Running Resilient Workloads with Istio @mt165
Resiliency
● Delay injection ?
● Timeouts ✔
● Fault injection ?
● Circuit breakers ?
● Retries ✔
● Rate limits ✔

30. Running Resilient Workloads with Istio @mt165
Resiliency
● Delay injection ?
● Timeouts ✔
● Fault injection ?
● Circuit breakers ?
● Retries ✔
● Rate limits ✔

31. Running Resilient Workloads with Istio @mt165
Security
● Mutual TLS ✔
● Service authentication ✔
● Service authorisation ✔
● Middleware ?

32. Running Resilient Workloads with Istio @mt165
Security
● Mutual TLS ✔
● Service authentication ✔
● Service authorisation ✔
● Middleware ?

33. Running Resilient Workloads with Istio @mt165
Security
● Mutual TLS ✔
● Service authentication ✔
● Service authorisation ✔
● Middleware ?

34. Running Resilient Workloads with Istio @mt165
Security
● Mutual TLS ✔
● Service authentication ✔
● Service authorisation ✔
● Middleware ?

35. Recap
● Settings you should always have
● Settings you sometimes need
● Break-glass options

36. Thanks!
@mt165
Slides
Videos
Demo code
mt165.co.uk