Cilium + Istio with Gloo Mesh

Cilium and Istio with Gloo Mesh

2 | Copyright © 2020
CHRISTIAN POSTA
VP, Global Field CTO, Solo.io
@christianposta
christian@solo.io
https://blog.christianposta.com
https://slideshare.net/ceposta
Istio in Action (March 2022)
https://www.manning.com/books/istio-in-action
Discount Code: SOLOIO41
Shortlink: mng.bz/06Wl

Idit Levine
Founding API gateway WG-Istio
Christian Posta
Founding community member,
Istio Steering Committee,
author Istio in Action
Lin Sun
Founding Istio project maintainer,
Technical Oversight Committee
(TOC), Steering Committee
Neeraj Poddar
Istio Steering and TOC member.
Co-founded Istio Product
Security Working Group
Yuval Kohavi
Renowned security researcher,
Founding API Gateway WG-Istio,
Contributor Envoy
Ram Vennam
Founding Istio Steering
Committee member
Nick Nellis
First to run Istio in production,
current contributor and maintainer
Solo Istio/Envoy Community Leadership
Founded in 2017 by Idit Levine
Based in Cambridge, MA
with multiple locations around the globe
The industry’s leading Cloud-native Application
Networking company.
Open-Core, “Enterprise” Subscription model
Growing fast
with happy customers
Well Funded
500+%
bookings
growth y/y
98%+
renewal
rate
$171.5M
venture financing
$1 Billion
valuation
Company Overview
Gloo Application Networking Platform
Simplify your application networking with unified control,
reliability, observability, extensibility, and security
Greg Hanson
Founding Istio Maintainer,
Product Security WG Lead,
Istio Release Manager

Manage
APIs
Data
Access
Gloo Gateway
API Gateway
Gloo Mesh
Microservices, Security, Observability
Gloo Network
Kubernetes CNI, Network Policy

Problem

What is application networking?
Challenges
● Service discovery
● Load balancing
● Timeouts
● Retry / Budgets
● Circuit breaking
● Tracing, observability
● Secure transport
● Extension

Previous solutions to these problems

Push enforcement points
down to application

Service Mesh Technologies Provide the
Following
L4 & L7 Observability
Traffic Encryption / L7 Identity
L4 & L7 Policies [Canary, RBAC, ….]

Demo

What you must build to run service mesh in production?
Istio Service Mesh
Security
|
Compliance
FIPS-140
Authentication
Cert-Mgmt
Rate-Limiting
API Gateway
Failover Routing
Global Service
Discovery
Integrate
Observability
Routing
|
Traffic
Mgmt
Topologies | API | UI | Extensibility
Multi-Cluster Multi-Tenant Web Assembly
UI / Higher-level API

https://www.solo.io/products/gloo-mesh/
Enterprise Service Mesh for
multi-cluster, cross-cluster and
hybrid environments based on
upstream Istio

https://www.solo.io/products/gloo-mesh/
Gloo Mesh Enterprise
• Enterprise Istio for single cluster, multi-cluster and multi-platform configuration.
• Focus on ease of us, powerful best practices built in, security, and extensibility.
Installation, upgrade,
takeover and hybrid
lifecycle
Production and long-terms
support (LTS, N-4) with
patches and hotfixes for
validated upstream Istio
Delegate ownership of
configuration and policy
by persona, including:
developers, SREs,
and admins
Discovery services
running across multiple
clusters, clouds, VMs
Operational visibility with a
single pane of glass across
multiple service mesh clusters
Cross-cluster failover and
locality aware routing
Support multiple teams
owning their own resources
across multiple clusters
End to end security across
clusters and meshes for zero
trust networks, integrate with
PKI, CA/RA, etc
Istio
Support
Istio Lifecycle
(2.1)
Global Failover
Routing
Multi
Tenancy
API Gateway Global Service
Discovery
Unified
Observability
Zero-Trust
Security

User Clusters Public cloud
Compliance / DMZ

Consistent API for multi-cluster N/S and E/W Policy

Gloo API Gateway

Team Tenancy (Service Mesh as a Service)
● Tenancy
● Dependency
● More flexible API
● Hierarchy
● Unified NS/EW

Drive everything through GitOps!

Demo

Manage
APIs
Data
Access
Gloo Gateway
API Gateway
Gloo Mesh
Microservices, Security, Observability
Gloo Network
Kubernetes CNI, Network Policy

Kernel-level observability
Security controls
Advanced L3/L4/L7 Network Policy
Container networking / CNI / Overlay built on eBPF!

Cilium: Cloud Networking Overlay

Flexible: Executes custom logic in the Linux kernel.
Safe: BPF code is veriﬁed to not crash/hang kernel.
Fast: JIT-compiled to run at native speed.
Humble origins:
BPF
Berkeley Packet Filter
$ tcpdump -n dst host 192.168.1.1
What is eBPF?

with strong safety guarantees and
native kernel performance
“Function-as-a-Service” for kernel events
Execution Stack in the Kernel
submit_bio submit_bh()
journal_submit_commit_record()
jbd2_journal_commit_transaction()
mb_cache_list()
BPF
Hook
BPF Program Source Code
bpf() syscall
llvm / clang
Verifier +
JIT compiler
What is eBPF?

What about conflicting policy at different layers?
(demo maybe?)

Consistent Networking Policies

Demo

Recap

Cloud Native Stack
ANY KUBERNETES (CLUSTERS) VMs
eBPF
WASM
GLOO NETWORKING | CILIUM
ENVOY PROXY
ISTIO
GLOO MESH GLOO GATEWAY
GLOO PORTAL
EXT.
AUTH
RATE
LIMITING
GRAPHQL
XSLT
(SOAP-REST)
ANY CLOUD

Learn More!!
Free Workshops and
Certifications
● Envoy Proxy
● Istio
● Cilium
● eBPF
● On demand
● Instructor led
● Service mesh
● Modern API gateway
● eBPF
Solo Academy
1 2
https://www.solo.io/events/upcoming
/
https://www.solo.io/solo-academy/

We are hiring!
https://www.solo.io/company/careers/

Solo.io global presence

• https://solo.io
• https://solo.io/blog
• https://slack.solo.io
• https://gloo.solo.io
• https://envoyproxy.io
• https://istio.io
• https://webassemblyhub.io

Cilium + Istio with Gloo Mesh

More Related Content

What's hot

Similar to Cilium + Istio with Gloo Mesh

More from Christian Posta

Recently uploaded

Cilium + Istio with Gloo Mesh