There is a lot of talk now around the term Service Mesh. The hype is high and the promise is real. The problem is that there is not really a good definition of what service mesh really is. In this talk we are going to review the problem service meshes are trying to solve, name the core components that make up a service mesh, and discuss the benefits an organization can receive by implementing this new technology.

4. Back in the days – Client / Server
• Single application per Server
• No app mobility
• Security mapped to IP
• Seldom horizontal scale of an
app
• Few / None Load Balancers

5. Back in the days – Client / Server
• Single application per Server
• No app mobility
• Security mapped to IP
• Seldom horizontal scale of an
app
• Few / None Load Balancers

6. Scale it up

7. 192.168.1.15

8. xxx.xxx.xxx.xxx
Services
Routers
Switches
Firewalls
Networks

9. What if there was no IP?

10. Demystifying Service Mesh
Stephen Wilson
@steve0wilson
Technical Field Engineer at HashiCorp

11. What if there was no IP?
▪ How would services find each other?
▪ How would services be able to securely connect to each to each other?
▪ How can you do traffic shaping based on strategies, updates or
failures?

12. Criteria for answers
▪ Higher Portability
▪ Higher Agility
▪ Lower Operational Management
▪ Lower Security Risk

13. DNS

14. YAML

16. How can services find each other?

17. Web-App Order Processing
“Web-App needs to talk to Order Processing”

18. Web-App Order Processing
xxx.xxx.xxx.153
Load Balancer VIP
xxx.xxx.xxx.163
Load Balancer VIP
DNS Entries
Web-app.internal.mycompany > xxx.xxx.xxx.153
Order-process.internal.mycompany > xxx.xxx.xxx.163

19. Web-App
xxx.xxx.xxx.153
Load Balancer VIP
▪ Ensure request balancing
▪ Handle circuit breaking
▪ Allow traffic to be routed to healthy nodes
▪ Abstract instance IP from service IP

20. Web-App Order Processing
xxx.xxx.xxx.153
Load Balancer VIP
xxx.xxx.xxx.163
Load Balancer VIP
App Team
Network Team

21. Web-App Order Processing
xxx.xxx.xxx.153
Load Balancer VIP
xxx.xxx.xxx.163
Load Balancer VIP
Order-History
App Team Network Team
Deployed
Traffic Pattern Configured
xxx.xxx.xxx.173
Load Balancer VIP

22. Web-App Order Processing
xxx.xxx.xxx.153
Load Balancer VIP
xxx.xxx.xxx.163
Load Balancer VIP
Order-History
App Team Network Team
Deployed
Traffic Pattern Configured
xxx.xxx.xxx.173
Load Balancer VIP

23. Kubernetes
Service discovery
made easy, right?
▪ Service discovery built in
▪ Built in load balancers
▪ Internal Networking

24. Web-App Order Processing
xxx.xxx.xxx.153
Load Balancer VIP
xxx.xxx.xxx.163
Load Balancer VIP
Order-History
App Team Network Team
Deployed
Traffic Pattern Configured
xxx.xxx.xxx.173
Load Balancer VIP
Mobile-Access

25. Web-App Order Processing
Mobile-Access
Federated Link
Order-History
App Team
Deployed
Traffic Pattern Configured
web-app.service.consul order-history.service.consul order-processing.service.consul
mobile-access.service.consul

26. Example
# dig @127.0.0.1 -p 8600 -t SRV web.service.consul
;; ANSWER SECTION:
Web.service.consul. 0 IN SRV 1 1 80 consul-dc1-srv2.node.dc1.consul.
Web.service.consul. 0 IN SRV 1 1 80 consul-dc1-srv1.node.dc1.consul.
Web.service.consul. 0 IN SRV 1 1 80 consul-dc1-srv3.node.dc1.consul.
;; ADDITIONAL SECTION:
consul-dc1-srv2.node.dc1.consul. 0 IN A 192.168.43.102
consul-dc1-srv2.node.dc1.consul. 0 IN TXT "consul-network-segment="
consul-dc1-srv1.node.dc1.consul. 0 IN A 192.168.43.101
consul-dc1-srv1.node.dc1.consul. 0 IN TXT "consul-network-segment="
consul-dc1-srv3.node.dc1.consul. 0 IN A 192.168.43.103
consul-dc1-srv3.node.dc1.consul. 0 IN TXT "consul-network-segment="
Consul Service Discovery

27. How can services securely connect
to each other?

28. Web-App Order-History
?

29. Web-App Order Processing
xxx.xxx.xxx.153
Load Balancer VIP
xxx.xxx.xxx.163
Load Balancer VIP
Order-History
App Team Network Team
Deployed
Traffic Pattern Configured
xxx.xxx.xxx.173
Load Balancer VIP
Mobile-Access
Firewall Team

30. Web-App Order ProcessingOrder-History
Mobile-Access

31. Web-App Order ProcessingOrder-History
Mobile-Access
App Team Cloud Team
Deplyed
Traffic Pattern Configured
Firewall Team
Network Team

32. Microservice Firewalls - ???

33. Web-App
localhost:xxxx
Order-History
localhost:xxxx
xxx.xxx.xxx.xxx:20000 xxx.xxx.xxx.xxx:20000
▪ Intentions
▪ Certificate Management
▪ ACLs

34. CODE EDITOR
services {
name = “web-app"
port = 9090
connect {
sidecar_service {
port = 20000
proxy {
local_service_address = "127.0.0.1"
local_service_port = 9090
upstreams {
destination_name = “order-processing”
local_bind_port = 8003
}

35. Web-App
Order-Data
Cust-Data
Order-Process
Front End
Social
Payment

36. Web-App
Order-Data
Cust-Data
Order-Process
Front End
Social
Payment

37. Web-App
Order-Data
Cust-Data
Order-Process
Mesh Gateway
Front End
Social
Payment
Mesh Gateway

38. CODE EDITOR
Kind = "service-defaults"
Name = "api"
Protocol = "http"
MeshGateway = {
mode = "local"
}
Multi-Datacenter Gateways
Cross cluster / cross cloud service routing

39. CODE EDITOR
Kind = "service-defaults"
Name = "api"
Protocol = "http"
MeshGateway = {
mode = "remote"
}
Multi-Datacenter Gateways
Cross cluster / cross cloud service routing

40. How can you do programmatic
traffic shaping based on strategies,
updates or failures?

41. Web-App Order ProcessingOrder-History
Mobile-Access
App Team Cloud Team
Deplyed
Traffic Pattern Configured
Firewall Team
Network Team

42. Web-App
Order-History
?
/order-history
/customer-data
Cust-Data
Traffic Routing
Route requests based on HTTP parameters

43. Web-App
Order-History
?
/order-history
Order-History
v.1
v.2
Traffic Shifting
Percentage based traffic routing

44. Web-App Order-History
?
/order-history
X
Failover
Gracefully Handle Failure

45. Web-App
Order-Data
Cust-Data
Order-Process
Mesh Gateway
Front End
Social
Payment
Mesh Gateway

46. CODE EDITOR
kind = "service-router"
name = “web-app”
routes = [
{
match {
http {
path_prefix = "/v1"
}
}
destination {
service = "api-v1"
}
}
]

47. CODE EDITOR
kind = "service-resolver"
name = “order-history”
subsets = {
v1 = {
filter = "Service.Meta.version == 1"
}
v2 = {
filter = "Service.Meta.version == 2"
}
}

48. CODE EDITOR
kind = "service-splitter",
name = “order-history"
splits = [
{
weight = 90,
service_subset = "v1"
},
{
weight = 10,
service_subset = "v2"
}
]

49. Consul
Services
Routers
Switches
Firewalls
Networks

50. Web-App Web-App Web-App
Development Testing Production
localhost localhost localhost
App Team
Cloud Team
Firewall Team
Network Team
▪ Environment configuration
▪ Secure Access Controls
▪ Network Optimization

52. Takeaways
▪ To do service mesh right you need to start with the right premise : NO IP
▪ Service discovery is table stakes in this shift. This is a non-negotiable
▪ Have to measure ideas based on Agility, Portability, and Resiliency
▪ Consul is awesome … go check it out

53. Thank You
hello@hashicorp.com
www.hashicorp.com