Kubernetes provides an API and objects for automating infrastructure components like storage, services, load balancing, and more. Istio implements a service mesh on top of Kubernetes to provide additional features for traffic control, including load balancing, tracing, authentication, and canary testing through an Envoy sidecar proxy. A service mesh separates these networking and traffic concerns from Kubernetes' focus on computing and high availability.

1. Service Meshes with Istio
Randy N. Gupta
SCARATEC IT-Consulting GmbH
Google Developer Expert
gupta@scaratec.com
Twitter: @RandyGupta
www.scaratec.com

2. Why Kubernetes?

3. Kubernetes is
● complicated
● only needed for high availability
● only needed for high traffic
REALLY?

4. Microservice Architecture - Common Definition
Microservice Architecture describes a way of designing software applications as
suites of independently deployable services.
… borrowed by Martin Fowler

5. Microservices Application

6. Let’s create Microservices
… as JAR? On bare metal?

7. Microservice -> Docker Container

8. Where to deploy Docker?

9. Kubernetes

10. Kubernetes is (really)
● an API for an infrastructure
● has objects for infrastructure components
like:
○ storage
○ services
○ load balancers
○ firewalls
○ routing
○ jobs (batch, cron)
○ secrets
… and more
● hides complexity from us
● automates tedious tasks
● language independent
● provides high availability
● is scaleable
● provides monitoring and telemetry
● supports testing
● very good integration with jenkins
… and more

11. Pods are the smallest deployable units of computing that can be created and
managed in Kubernetes.
Kubernetes Pods

12. deployment
● description of a desired state of a set of pods
● a controller takes maintains the state

14. What is istio?

15. istio is an implementation
of a service mesh

16. Simplified separation of concern
● kubernetes focuses on computing and HA
● istio focuses on networking and traffic control

17. Key Features
● load balancing
● tracing (opentracing compatible)
● service-to-service authentication and authorisation
● circuit breaking
● canary testing

18. Demo

20. Rule based routing
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: reviews
…
spec:
hosts:
- reviews
http:
- match:
- headers:
end-user:
exact: jason
route:
- destination:
host: reviews
subset: v2
- route:
- destination:
host: reviews
subset: v1

21. Rule based routing

22. Supported Platforms
● kubernetes
● services deployed with consul or eureka
● other platforms like mesos and cloudfoundry planed

23. Anatomy of istio
our motivation

25. Envoy sidecar
● all traffic is routed via envoy
● replaces ingress controllers
● (mutual) TLS termination
● service is firewalled via IPTABLES
Service Envoy
Pod

26. Pilot
● distributes rules to envoys
● provides an API
● abstracts envoy API

27. Mixer
● primary point of integration with other backends
● processes raw metadata from envoy
● provides request level data to (custom / 3rd party) adapter

28. Citadel
● Certificate Authority for mutual TLS

29. Mesh expansion /
multicluster

30. Mesh expansion / Multicluster
● master / slave (cluster) setup
● one pilot for the whole mesh
● mixer can collect only information from the cluster runs in
● expansion via sidecar e.g. inside a VM

31. Kubernetes is
● complicated -> as complex as the required infrastructure
● only needed for high availability -> nope
● only needed for high traffic -> nope

32. Resources
● kubernetes.io
● istio.io

33. Service Meshes with Istio
Randy N. Gupta
SCARATEC IT-Consulting GmbH
Google Developer Expert
gupta@scaratec.com
Twitter: @RandyGupta
www.scaratec.com
Thank you!!