Presented at Istio London, October 2017 Abstract: We will explore the architecture of Istio and Envoy from a packet-eye view, seeing the function and purpose of each component in the system.

1. The Life of a Packet
Through Istio
Matt Turner
@mt165pro
mt165.co.uk
Istio London
October 2017

3. API Serveretcd
istioctl

4. ClusterIP
envoyenvoyenvoyenvoyenvoy
Load Balancer
NodePort
*.skyscanner.net
INGRESS
iptables

7. “Containers”
nginx
net
ipc
user
pid
uts
mnt

8. Kubernetes Pods
nginx
net
ipc
user
pid
uts
mnt
fluentd
pid
uts
mnt

9. Kubernetes Pods
nginx
net
ipc
user
pid
uts
mnt
fluentd
pid
uts
mnt
192.168.0.42
eth0
lo
sockets
iptables
routes

10. Kubernetes Pods
nginx
net
ipc
user
pid
uts
mnt
fluentd
pid
uts
mnt
192.168.0.42
eth0
lo
sockets
iptables
routes
:8080/tcp

11. Kubernetes Pods
nginx
net
ipc
user
pid
uts
mnt
envoy
pid
uts
mnt
192.168.0.42
eth0
lo
sockets
iptables
routes
:8080/tcp

12. Sidecar injection
net
ipc
user
192.168.0.42
eth0
lo
sockets
iptables
routes

13. Sidecar injection
alpine
net
ipc
user
192.168.0.42
eth0
lo
sockets
iptables
routes
sysctl -w kernel.core_pattern=...

14. Sidecar injection
istio/proxy_init
net
ipc
user
192.168.0.42
eth0
lo
sockets
iptables
routes
/usr/local/bin/prepare_proxy.sh -p 15001 -u 1337

15. Kubernetes Pods
nginx
net
ipc
user
pid
uts
mnt
istio/proxy
pid
uts
mnt
192.168.0.42
eth0
lo
sockets
iptables
routes
:15001/tcp

17. ?
?
?

18. $ kubectl get services -o wide | grep httpbin
httpbin NodePort 10.0.0.244 <none> 80:30082/TCP 16m app=httpbin

19. # dig httpbin.default.svc.cluster.local
httpbin.default.svc.cluster.local. 23 IN A 10.0.0.244

20. $ kubectl get pods -o wide | grep httpbin
httpbin-76ddd74666-2m6ds 1/1 Running 0 16m 172.17.0.13 minikube
httpbin-76ddd74666-ls66n 1/1 Running 0 16m 172.17.0.12 minikube
httpbin-76ddd74666-x5ql2 1/1 Running 0 16m 172.17.0.5 minikube

21. Endpoints
$ kubectl get endpoints | grep httpbin
httpbin 172.17.0.12:8000,172.17.0.13:8000,172.17.0.5:8000 21m

22. $ kubectl get endpoints httpbin -o yaml
apiVersion: v1
kind: Endpoints
…
subsets:
- addresses:
- ip: 172.17.0.12
nodeName: minikube
targetRef:
kind: Pod
…
ports:
- name: http
port: 8000
protocol: TCP

23. k8s consul zk

25. IP Router Architecture
Interrupt
Kernel module
User process
DATA PLANE
CONTROL PLANE
OSPF ARPBGP STP
Router
Information
Base
Forwarding
Information
Base

26. IP 5-tuple
(src_addr,
src_port,
dst_addr,
dst_port,
proto)

27. Mixer
Mixer Fat
Client
sysdig datadog

32. ClusterIP
envoyenvoyenvoyenvoyenvoy
EGRESS

33. Questions?

34. Thanks
@mt165pro