The life of a packet through Istio
•
6 likes•3,511 views
Video link (paywalled): https://skillsmatter.com/skillscasts/12045-the-life-of-a-packet-in-istio Istio is a service mesh for Kubernetes that offers advanced networking features. It provides intelligent routing, resiliency, and security features, so that service authors don't have to keep re-implementing them. Istio is rapidly taking off and there are great introductory talks everywhere. However in this session, Matt will explore precisely how it does what it does, following one brave little packet in from the internet and back out again. Matt will share with you a great insight into Istio's full power, and you will also learn about its fascinating architecture.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to The life of a packet through Istio
Similar to The life of a packet through Istio (20)
More from Matt Turner
More from Matt Turner (15)
Recently uploaded
Recently uploaded (20)
The life of a packet through Istio
- 1. through Istio The Life of a Packet Matt Turner @mt165pro mt165.co.uk Cloud Native London September 2018
- 2. Outline ● How a packet traverses an Istio / Envoy / Kubernetes system ● What control plane calls are made in that process ● Hopefully a useful mental model for reasoning about, and debugging Istio
- 3. The life of a packet through Istio @mt165pro
- 4. The life of a packet through Istio @mt165pro
- 5. The life of a packet through Istio @mt165pro API Serveretcd istioctl
- 6. The life of a packet through Istio @mt165pro ClusterIP envoyenvoyenvoyenvoyenvoy Load Balancer NodePort *.example.com INGRESS iptables ClusterIP
- 7. The life of a packet through Istio @mt165pro
- 8. The life of a packet through Istio @mt165pro
- 9. The life of a packet through Istio @mt165pro “Containers” nginx net ipc user pid uts mnt supervisord nginx
- 10. The life of a packet through Istio @mt165pro Kubernetes Pods net ipc user uts fluentd pid uts mnt nginx nginx mnt supervisord logger
- 11. The life of a packet through Istio @mt165pro Kubernetes Pods nginx net ipc user fluentd pid uts mnt 192.168.0.42 eth0 lo sockets iptables routes fluentd uts mnt nginx nginx supervisord logger
- 12. The life of a packet through Istio @mt165pro Kubernetes Pods nginx net ipc user uts mnt fluentd pid uts mnt eth0 lo sockets iptables routes :8080/tcp nginx fluentd nginx supervisord logger 192.168.0.42
- 13. The life of a packet through Istio @mt165pro Kubernetes Pods nginx net ipc user uts mnt envoy pid uts mnt eth0 lo sockets iptables routes :8080/tcp nginx nginx 192.168.0.42
- 14. The life of a packet through Istio @mt165pro Sidecar Injection net ipc user eth0 lo sockets iptables routes 192.168.0.42
- 15. The life of a packet through Istio @mt165pro k8s consul zk Data plane API
- 16. The life of a packet through Istio @mt165pro Sidecar Injection alpine net ipc user eth0 lo sockets iptables routes sysctl -w kernel.core_pattern=... 192.168.0.42
- 17. The life of a packet through Istio @mt165pro Sidecar Injection istio/proxy_init net ipc user eth0 lo sockets iptables routes /usr/local/bin/prepare_proxy.sh -p 15001 -u 1337 192.168.0.42
- 18. The life of a packet through Istio @mt165pro Sidecar Injection net ipc user pid uts mnt istio/proxy pid uts mnt eth0 lo sockets iptables routes :15001/tcp nginx envoy nginx 192.168.0.42
- 19. The life of a packet through Istio @mt165pro
- 20. The life of a packet through Istio @mt165pro ? ? ?
- 21. The life of a packet through Istio @mt165pro Services $ kubectl get services -o wide | grep httpbin httpbin NodePort 10.0.0.244 <none> 80:30082/TCP 16m app=httpbin
- 22. The life of a packet through Istio @mt165pro Service DNS exposure # dig httpbin.default.svc.cluster.local httpbin.default.svc.cluster.local. 23 IN A 10.0.0.244
- 23. The life of a packet through Istio @mt165pro Pods $ kubectl get pods -o wide | grep httpbin httpbin-76ddd74666-2m6ds 1/1 Running 0 16m 172.17.0.13 minikube httpbin-76ddd74666-ls66n 1/1 Running 0 16m 172.17.0.12 minikube httpbin-76ddd74666-x5ql2 1/1 Running 0 16m 172.17.0.5 minikube
- 24. The life of a packet through Istio @mt165pro Endpoints $ kubectl get endpoints | grep httpbin httpbin 172.17.0.12:8000,172.17.0.13:8000,172.17.0.5:8000 21m
- 25. The life of a packet through Istio @mt165pro Endpoints $ kubectl get endpoints httpbin -o yaml apiVersion: v1 kind: Endpoints … subsets: - addresses: - ip: 172.17.0.12 nodeName: minikube targetRef: kind: Pod … ports: - name: http port: 8000 protocol: TCP
- 26. The life of a packet through Istio @mt165pro
- 27. The life of a packet through Istio @mt165pro IP 5-tuple (src_addr, src_port, dst_addr, dst_port, proto)
- 28. The life of a packet through Istio @mt165pro IP Router Architecture Interrupt Kernel module User process DATA PLANE CONTROL PLANE OSPF ARPBGP STP Router Information Base Forwarding Information Base
- 29. The life of a packet through Istio @mt165pro IP Router Architecture Interrupt Kernel module User process DATA PLANE CONTROL PLANE OSPF ARPBGP STP Router Information Base Forwarding Information Base PILOT MIXER ENVOY
- 30. The life of a packet through Istio @mt165pro Mixer Mixer Fat Client sysdig datadog REPORT CHECK Custom auth Custom classifier Mixer Fat Client
- 31. The life of a packet through Istio @mt165pro
- 32. The life of a packet through Istio @mt165pro
- 33. The life of a packet through Istio @mt165pro
- 34. The life of a packet through Istio @mt165pro
- 35. The life of a packet through Istio @mt165pro kittenz.com envoyenvoyenvoyenvoyenvoy EGRESS
- 36. Conclusion / Recap ● A packet traverses ○ Cloud ○ Kubernetes ○ Istio Ingress ○ The Pod construct ○ Envoy ○ Application ○ mTLS tunnel ○ Egress ● Pilot pre-programmes Envoys for Service Discovery ● Mixer sits on the hot path for real-time Policy ● Citadel issues certificates for mTLS
- 37. Thanks @mt165pro