Remember how cool Kubernetes seemed when you first started using it? A simple, easy API for scalable compute in any cloud: just a Deployment and a Service and you’re done! But as you use it more, you learn that this isn’t really enough. A production system needs requests and limits, liveness checks, HPAs, PDBs, PSPs, etc. The same is true for Istio, which can solve a lot of the problems with microservices out of the box, but isn’t magic. When you get beyond playing with bookinfo, more configuration is needed to get the most out of it. In this talk I’ll show you how to: Identify app versions, deploy canaries and run A/B tests Set timeouts Configure retries, with exponential backoff Enforce rate limits Enable circuit breakers Inject faults for testing I’ll also cover a couple of the big security features: Enabling mTLS Using service-to-service access control lists (RBAC)

1. Running resilient workloads with Istio @mt165
Running Resilient
Workloads
OpenInfra Days London | April 2019

2. Running resilient workloads with Istio @mt165
Pop Quiz!

3. Running resilient workloads with Istio @mt165
Why are we talking about this?

4. Running resilient workloads with Istio @mt165
Business Value
● Top Line
● Bottom Line
● Time to Market & Speed of Iteration
● Risk Reduction

5. Running resilient workloads with Istio @mt165
Break the Monolith

6. Running resilient workloads with Istio @mt165
Pod
Pod
Pod
Break the Monolith
Namespace A
Namespace B
Namespace C
Namespace A
Namespace B
Namespace C

7. Running resilient workloads with Istio @mt165
...don’t just distribute it!

8. Running resilient workloads with Istio @mt165
How did we get here?

9. Running resilient workloads with Istio @mt165

10. Running resilient workloads with Istio @mt165

11. Running resilient workloads with Istio @mt165

12. Running resilient workloads with Istio @mt165

13. Running resilient workloads with Istio @mt165

14. Running resilient workloads with Istio @mt165

15. Running resilient workloads with Istio @mt165
Service Meshes

16. Running resilient workloads with Istio @mt165
They work by adding a proxy to every service

17. Running resilient workloads with Istio @mt165
And a control plane

18. Running resilient workloads with Istio @mt165
It’s not plain sailing
Production Kubernetes is more than just a Deployment and a Service

19. Running resilient workloads with Istio @mt165
● Ingress
● HPA
● Requests and Limits
● Health Checks
Production Kubernetes

20. Running resilient workloads with Istio @mt165
Production Kubernetes
● ConfigMaps
● Secrets
● Upgrade Strategies
● Affinities
● Anti-affinities
● PDB
● PSP
● Network Policy
● Pod Presets
● Service Accounts & RBAC
● LimitRanges
● Cluster Autoscaler

21. Running resilient workloads with Istio @mt165
“An open platform to connect, secure,
control, and observe services.”

22. Running resilient workloads with Istio @mt165
ALWAYS

23. Running resilient workloads with Istio @mt165
Observability
Logs
Metrics
Traces
Service Graph
Kiali

24. Running resilient workloads with Istio @mt165
Workload Versioning
and Traffic Pinning

25. Running resilient workloads with Istio @mt165
Canaries

26. Running resilient workloads with Istio @mt165
Traffic Shifting

27. Running resilient workloads with Istio @mt165
Service Authentication

28. Running resilient workloads with Istio @mt165
Mutual TLS

29. Running resilient workloads with Istio @mt165
Service Authorization

30. Running resilient workloads with Istio @mt165
Egress Control

31. Running resilient workloads with Istio @mt165
SOMETIMES

32. Running resilient workloads with Istio @mt165
Delay Injection

33. Running resilient workloads with Istio @mt165
Timeouts

34. Running resilient workloads with Istio @mt165
Retries

35. Running resilient workloads with Istio @mt165
Fault Injection

36. Running resilient workloads with Istio @mt165
Circuit Breakers

37. Running resilient workloads with Istio @mt165
Rate Limits

38. Running resilient workloads with Istio @mt165
Security Middleware

39. Running resilient workloads with Istio @mt165
Protocol Translation

40. Running resilient workloads with Istio @mt165
BREAK-GLASS

41. Running resilient workloads with Istio @mt165
Traffic Mirroring

42. Running resilient workloads with Istio @mt165
Thanks!
@mt165
mt165.co.uk