Downloaded 13 times
More Related Content
Similar to Kubernetes Istio Miami meetup
Kubernetes Istio Miami meetup
- 1. Lets make amesh of all the things Dustin Humphries App Dev and MW Solutions Architect dhumphri@redhat.com 07/19/2018
- 2. INSERT DESIGNATOR, IFNEEDED SERVICE CATALOG (LANGUAGE RUNTIMES, MIDDLEWARE, DATABASES, ā¦) SELF-SERVICE APPLICATION LIFECYCLE MANAGEMENT (CI / CD) BUILD AUTOMATION DEPLOYMENT AUTOMATION CONTAINER CONTAINERCONTAINER CONTAINER CONTAINER NETWORKING SECURITYSTORAGE REGISTRY LOGS & METRICS CONTAINER ORCHESTRATION & CLUSTER MANAGEMENT (KUBERNETES) RED HAT ENTERPRISE LINUX CONTAINER RUNTIME & PACKAGING (DOCKER) ATOMIC HOST INFRASTRUCTURE AUTOMATION & COCKPIT OpenShift Container Platform - Stack Build, Deploy and Manage Containerized Apps Build RUNTIME SERVICE CATALOG (LANGUAGE RUNTIMES, MIDDLEWARE, DATABASES, ā¦) SELF-SERVICE APPLICATION LIFECYCLE MANAGEMENT (CI / CD) BUILD AUTOMATION DEPLOYMENT AUTOMATION CONTAINER CONTAINERCONTAINER CONTAINER CONTAINER NETWORKING SECURITYSTORAGE REGISTRY LOGS & METRICS CONTAINER ORCHESTRATION & CLUSTER MANAGEMENT (KUBERNETES) ATOMIC HOST / RED HAT ENTERPRISE LINUX OCI CONTAINER RUNTIME & PACKAGING INFRASTRUCTURE AUTOMATION & COCKPIT
- 3. INSERT DESIGNATOR, IFNEEDED3 OPENSHIFT ARCHITECTURE EXISTING AUTOMATION TOOLSETS SCM (GIT) CI/CD SERVICE LAYER ROUTING LAYER PERSISTEN T STORAGE REGISTRY RHEL NODE c RHEL NODE RHEL NODE RHEL NODE RHEL NODE RHEL NODE C C C C C C C CC C RED HAT ENTERPRISE LINUX MASTER API/AUTHENTICATION DATA STORE SCHEDULER HEALTH/SCALING PHYSICAL VIRTUAL PRIVATE PUBLIC HYBRID
- 4. INSERT DESIGNATOR, IFNEEDED4 DISTRIBUTED SERVICES ARCHITECTURES Benefits (when implemented correctly): ā Performance ā Reliability ā Resiliency ā Extensibility ā Availability ā Robustness
- 5. INSERT DESIGNATOR, IFNEEDED5 DISTRIBUTED SERVICES ARCHITECTURES Fallacies of Distributed Computing ā The network is reliable. ā Latency is zero. ā Bandwidth is infinite. ā The network is secure. ā Topology doesn't change. ā There is one administrator. ā Transport cost is zero. ā The network is homogeneous. wikipedia.org/wiki/Fallacies_of_distributed_computing
- 6. INSERT DESIGNATOR, IFNEEDED6 DISTRIBUTED SERVICES ARCHITECTURES Applications must deal with ā Unpredictable failure modes ā End-to-end application correctness ā System degradation ā Topology changes ā Elastic/ephemeral/transient resources A E B C F G D H I Client
- 7. INSERT DESIGNATOR, IFNEEDED7 MICROSERVICES == DISTRIBUTED COMPUTING
- 8. INSERT DESIGNATOR, IFNEEDED8 Example ACME Laptop 128GB SSD, 8GB RAM $323.56 Touchscreen 128GB SSD 8GB RAM Core i3 Windows 10 Add to Cart In-Store Pickup (15 available) Raleigh, Central Ave, Store #1123 Recommendations Pricing Engine Reviews Details/Specifications Location-based availability People who purchased also...
- 9. INSERT DESIGNATOR, IFNEEDED9 Chaining
- 10. INSERT DESIGNATOR, IFNEEDED10 Chaining (Fail) X
- 11. INSERT DESIGNATOR, IFNEEDED11 Chaining (Cascading Fail) XXXX X
- 12. Opportunity ā A/Bon Service Chains Pod Container JVM Service A v1 Pod Container JVM Service A v2 Service Route/ Ingress 50% 50% Service Pod Container JVM Service B v1/v2 Pod Container JVM Service C v1/v2 ? ?
- 13. Opportunity ā FaultInjection Pod Container JVM Service A v1 Pod Container JVM Service A v2 Service Route/ Ingress Service Pod Container JVM Service B v1 Intentionally introduce a 7 second delay to see how customer is impacted Much needed testing scenario!
- 14. Opportunity ā FaultInjection Pod Container JVM Service A v1 Pod Container JVM Service A v2 Service Route/ Ingress Service Pod Container JVM Service B v1 Throttling traffic as Service B is constrained in capacity Rate Limiting Circuit Breaker
- 15. Opportunity ā GranularSecurity Management Pod Container JVM Service A v1 Pod Container JVM Service A v2 Service Route/ Ingress Service Pod Container JVM Service B v1 TLS between microservices Enforce Authn/z in comms Centralized certs mgmt
- 16. Opportunity ā Testingin Production Pod Container JVM Service A v1 Pod Container JVM Service A v2 Service Route/ Ingress Service Pod Container JVM Service B v1 Pod Container JVM Service B v2 When the request is from Tester Jason, route it to Service B version 2
- 17. Opportunity ā Logicalflow Too many microservices, what is my transaction flow?
- 18. Opportunity ā Latencyand Tracing Too many microservices, where is my latency? How do I troubleshoot?
- 19. Opportunity ā MicroservicesMetrics How many http 4xx/5xx errors? Transaction Counts? Bottlenecks? Custom Dashboards?
- 20.
- 21.
- 22.
- 23.
- 24.
- 25.
- 26.
- 27.
- 28. OS JVM Service C Microservices ==Distributed Computing @burrsutter OS JVM Service B OS JVM Service A
- 29. Microservices embedding Capabilities @burrsutter Container JVM ServiceB Discovery Load-balancer Resiliency Metrics Tracing Container JVM Service A Discovery Load-balancer Resiliency Metrics Tracing Container JVM Service C Discovery Load-balancer Resiliency Metrics Tracing
- 30.
- 31.
- 32.
- 33.
- 34. Istio - Sail (Kubernetes- Helmsman or shipās pilot) @burrsutter
- 35. A service meshis a dedicated infrastructure layer for handling service-to- service communication. Itās responsible for the reliable delivery of requests through the complex topology of services that comprise a modern, cloud native application. In practice, the service mesh is typically implemented as an array of lightweight network proxies that are deployed alongside application code, without the application needing to be aware https://buoyant.io/2017/04/25/whats-a-service-mesh-and-why-do-i-need-one/ Service Mesh Defined
- 36.
- 37. Microservices embedding Capabilities @burrsutter Container JVM ServiceB Discovery Load-balancer Resiliency Metrics Tracing Container JVM Service A Discovery Load-balancer Resiliency Metrics Tracing Container JVM Service C Discovery Load-balancer Resiliency Metrics Tracing Before Istio
- 38. Microservices externalizing Capabilities @burrsutter Pod Container JVM ServiceA Sidecar Container Pod Container JVM Service C Sidecar Container Pod Container JVM Service B Sidecar Container After Istio
- 39. Kubernetes, Istio, Envoy @burrsutter Pod Container JVM ServiceA Sidecar Container Pod Container JVM Service C Sidecar Container Pod Container JVM Service B Sidecar Container
- 40. ā¢ Kubernetes forcontrol plane, management of microservices ā¢ Scaling ā¢ OpenShift for making day-2 ops easy ā¢ Builds/deployments ā¢ Software Defined Storage and Networking ā¢ Logging and Metrics ā¢ Service Mesh for Run-time Governance, Policy Enforcement and Traffic shaping ā¢ Use cases listed in a separate page Service Mesh
- 41. Use cases- ServiceMesh ā¢ Policy Enforcement, Run-time Governance ā¢ Intelligent Routing and Load-Balancing ā¢ Request routing amongst multiple service versions ā¢ A/B testing: Request routing based on user or other http headers ā¢ Traffic Shifting: Smarter Canary Releases ā¢ Chaos: Fault Injection/Delays ā Are we resilient, or getting timeouts/errors ā¢ Resilience: Circuit Breakers ā¢ Cluster max connections, max/pending requests, max retries etc ā¢ Rate limiting ā¢ Observability/Ops Visibility ā¢ Metrics and Tracing ā¢ Transaction flow through microservices ā¢ Latency ā¢ Security
- 42. Pod Container JVM Service A Envoy Side-car Pod Container JVM ServiceB Envoy Side-car Pod Container JVM Service C Envoy Side-car HTTP1.1, HTTP2, gRPC, TCP w/TLS HTTP1.1, HTTP2, gRPC, TCP w/TLS HTTP1.1, HTTP2, gRPC, TCP w/TLS Istio Pilot Istio Mixer Istio Auth istioctl, API, config Quota, Telemetry Rate Limiting, ACL CA, SPIFFE @burrsutter Istio Control Plane
- 43. LAB: DETECTING ANDPREVENTING ISSUES IN DISTRIBUTED APPS WITH ISTIO
- 44. GOAL FOR LAB Inthis lab you will learn: ā How to install Istio onto OpenShift Container Platform ā How to deploy apps with sidecar proxies ā How to generate and visualize deep metrics for apps ā How to alter routing dynamically ā How to inject faults for testing ā How to do rate limiting ā How Istio implements circuit breaking and distributed tracing
- 45.
- 46.
- 47.
- 48. RESULT OF LAB Inthis lab you learned: ā How to install Istio onto OpenShift Container Platform ā How to deploy apps with sidecar proxies ā How to generate and visualize deep metrics for apps ā How to alter routing dynamically ā How to inject faults for testing ā How to do rate limiting ā How Istio implements circuit breaking and distributed tracing ā Use cases for service mesh
- 49.
Editor's Notes
- #4Ā Speaker: * This is a high level architecture diagram of the OpenShift 3 platform. On the subsequent slides we will dive down and investigate how these components interact within an OpenShift infrastructure. Discussion: * Set the stage for describing the OpenShift architecture. Transcript: OpenShift has a complex multi-component architecture. This presentation is usable to help prospects understand how the components work together.