This document discusses Istio, an open source service mesh that provides traffic management, telemetry and security for microservices applications on Kubernetes. It introduces key Istio concepts like the sidecar proxy Envoy, the control plane components Pilot, Mixer and Citadel, and how they work together to provide service discovery, load balancing, failure recovery, access control and other capabilities across microservices. The presentation concludes with an offer to demonstrate Istio's features in more depth.

1. Introduction to Istio on
Kubernetes
Jonh Wendell
Software Engineer, Red Hat
DevConf.US, Aug 2018

2. 2
Microservices?

3. 3

4. 4
Microservices
Service A Service B Service C

5. 5
Microservices
Service A
(Java)
Service B
(Python)
Service C
(Go)

6. 6
Distributed Systems
●
Deployment
●
Resiliency
●
Networking
●
Security

7. 7
To the rescue

8. 8
●
Deployment platform
●
DNS based service discovery
●
Simple L3/4 load balancing
●
Not so adequate for service-to-service communication

9. 9
Services have to deal with
●
Client Side Load Balancing
●
Fault tolerance – Timeouts and Retries
●
Observability
●
Monitoring & Tracing
●
Circuit Breaking

10. 10
Popular tools
●
Eureka – Service Registry
●
Ribbon – Client side load balancer
●
Hystrix – Circuit Breaker
●
Zipkin – Distributed Tracing

11. 11
“Micro” Services?
Actual Service A
Ribbon
Hystrix
Metrics
Tracer
Microservice A

12. 12
Library approach? What if...
●
You use Spring?
●
Vert.x?
●
Go?
●
Python?
●
Ruby?
●
Perl?
●
I’m kidding, don’t use Perl :)

13. 13
“Micro” Services?
Actual Service A
Library 1
Library 2
Library 3
Library 4
Microservice A
Actual Service B
Library 5
Library 6
Library 7
Library 8
Microservice B

14. 14
Micro Services!
Actual Service A
Microservice A
Actual Service B
Microservice B
Proxy
Common functionality goes here!

15. 15
Meet Envoy
Actual Service A
Microservice A
Actual Service B
Microservice B
Proxy
This is Envoy

16. 16
What is Envoy?
●
service proxy, developed by Lyft
●
written in C++, highly parallel, non-blocking
●
L3/4 network filter
●
out of the box L7 filters
●
HTTP 2, including gRPC
●
baked in service discovery/health checking
●
advanced load balancing
●
stats, metrics, tracing

17. 17
Sidecar model
Actual Service A
Microservice A
Envoy
Actual Service B
Microservice B
Envoy
A kind of deployment in Kubernetes
PodPod

18. 18
Service communication
calls http://serviceB
Actual Service A
Microservice A
Actual Service B
Microservice B
PodPod
Without Envoy

19. 19
Service communication
calls http://serviceB
Actual Service A
Microservice A
Envoy
Actual Service B
Microservice B
Envoy
PodPod
With Envoy

20. 20
Service Mesh
Actual Service 1
Microservice 1
Envoy
Actual Service N
Microservice N
Envoy
Actual Service 2
Microservice 2
Envoy
. . .

21. 21
Configure a fleet of Envoys can be verbose
and error prone without automation.
We need a Control Plane.

22. 22
Meet Istio Service Mesh

23. 23
What is Istio?
●
Control plane for a service mesh
●
Abstracts Envoy concepts and configurations
●
Easy to operate: YAML files a la Kubernetes
●
Kubectl or Istioctl can be used
●
Created by Google, with the help of other companies
●
New project, just reached 1.0

24. 24
Istio Service Mesh
Actual Service 1
Microservice 1
Envoy
Actual Service N
Microservice N
Envoy
Istio Control Plane
Pilot
Configure proxies
Istio Data Plane

25. 25
Istio Service Mesh
Actual Service 1
Microservice 1
Envoy
Actual Service N
Microservice N
Envoy
Istio Control Plane
Pilot
Configure proxies
Istio Data Plane
Service Discovery
Rules (YAML)

26. 26
What pilot can do?
●
Traffic control – enforce route rules & policies
●
Resiliency – circuit breaker, timeouts, retries
Actual Service A
Microservice A
Envoy
Actual Service B
Microservice B
Envoy

27. 27
Istio Service Mesh
Actual Service 1
Microservice 1
Envoy
Actual Service N
Microservice N
Envoy
Pilot Mixer
Check / Report
Adapters:
API Mgt
Prometheus
Tracing...

28. 28
What mixer can do?
●
Quota / API Management
●
Telemetry (Prometheus, ...)
●
Tracing (Jeager, …)
●
Your own integration (pluggable model)

29. 29
Istio Service Mesh
Actual Service 1
Microservice 1
Envoy
Actual Service N
Microservice N
Envoy
Istio Control Plane
Pilot MixerCitadel
Manage TLS certs

30. 30
What citadel can do?
●
Enforce mTLS between services
●
Along with mixer and pilot allows authorization and auditing
Actual Service A
Microservice A
Envoy
Actual Service B
Microservice B
Envoy
Mutual TLS

31. 31
Demo?

32. 32
Thank you
●
https://istio.io
●
https://learn.openshift.com
●
Email: jonh.wendell@redhat.com
●
Twitter: @jwendell