What is a Service Mesh and what can it do for your Microservices

What is a Service Mesh?
DevOps Thames Valley, Reading UK | January 2020 @mt165 | mt165.co.uk

Part I: Do You Need a Service Mesh?

Outline
● What are we talking about this?
● How did we get here?
● What is a Service Mesh anyway?
● Demo!
● What can a Service Mesh do?
● Common counter-arguments
● So: Do you need a Service Mesh?

Why are we talking about this?

Business Value
● Top Line
● Bottom Line
● Time to Market & Speed of Iteration
● Risk Reduction

Pod
Pod
Pod
Break the Monolith
Namespace A
Namespace B
Namespace C
Namespace A
Namespace B
Namespace C

...don’t just distribute it!

Do you need a service mesh? @mt165
In-process libraries and frameworks

Must-have primitives
● Service Discovery
● Fault Tolerance
○ Circuit breakers
○ Back pressure
● Observability
○ Logging
○ Metrics
○ Tracing

Declarative Infrastructure

And declarative infrastructure

Assertion: A Service
Mesh is the best of
both

Question: What is a
Service Mesh?

They work by adding a proxy to every service

“A service mesh provides a transparent and language-independent way to
flexibly and easily automate application network functions”
- Google (istio vendor)

“A service mesh provides a transparent and language-independent way to
flexibly and easily automate application network functions”

“A service mesh provides a transparent and language-independent way to flexibly
and easily automate application network functions”

“A service mesh provides a transparent and language-independent way to flexibly
and easily automate application network functions”
Host: users
Host: users
X-testing: true
Host: users
Pod.namespace: staging
users-v1
users-v2
users-mock

Pray to the demo gods...
The old...

Pray to the demo gods...
The old... ...and the new

Service Meshes can
do much more

Declarative Traffic Management
Everyone gets reviews v1 Except Jason

But I have an Edge Proxy!
✅ Ingress proxy
✅ Sidecar model terminates security closer to the app

But I have an API Gateway!
✅ Rate limiting
✅ Access control
✅ JWT validation
❌ OIDC
❌ Bot blocking

But I have a WAF!
✅ CORS header injection
❌ Injection attack prevention

But I have an APM system!
✅ Logs
✅ Metrics
✅ Tracing
✅ Multiple, arbitrary telemetry backends
❌ JVM, .Net CLR insight

But I have an ESB!
✅ Retries etc
✅ Flexible service discovery / late binding
✅ No client/server distinction; better than a middle proxy
❌ Broadcast / pubsub

So: Do you need a
Service Mesh?

Istio has wide backing
Google, IBM, Lyft, RedHat, Cisco, and more

Istio and Linkerd are (quite) easy to install
WIll be managed soon
Go home and try it!

Recap
● Why were we talking about this?
● How did we get here?
● What is a Service Mesh anyway?
● Demo!
● What can a Service Mesh do?
● Common counter-arguments
● So: Do you need a Service Mesh?

Part II: The Life of a Packet Through Istio

Objectives
Learn how a packet traverses an Istio/Envoy/Kubernetes system
See what control plane calls are made in that process
Build a useful mental model for reasoning about, and debugging Istio

Prerequisites
Basic networking knowledge
Intermediate Kubernetes knowledge
An understanding of what Istio is and does

Outline
● Networking and Containers
● Pilot and Routing
● Mixer and Policy
● Citadel and mTLS

“Containers”
nginx
nginx
supervisord
mnt
uts
pid
user
ipc
net

Kubernetes Pods
nginx
nginx
supervisord
mnt
uts
pid
user
ipc
net
logger
fluentd
mnt
uts

Kubernetes Pods
nginx
nginx
supervisord
mnt
uts
pid
user
ipc
net
logger
fluentd
mnt
uts
192.168.0.42
eth0
lo
sockets
iptables
routes

Kubernetes Pods
nginx
nginx
supervisord
mnt
uts
pid
user
ipc
net
logger
fluentd
mnt
uts
192.168.0.42
eth0
lo
sockets
iptables
routes
:8080/tcp

Kubernetes Pods
nginx
nginx
supervisord
mnt
uts
pid
user
ipc
net
proxy
envoy
mnt
uts
192.168.0.42
eth0
lo
sockets
iptables
routes
:8080/tcp

Sidecar Injection
pid
user
ipc
net
192.168.0.42
eth0
lo
sockets
iptables
routes

Sidecar Injection
pid
user
ipc
net
192.168.0.42
eth0
lo
sockets
iptables
routes
docker.io/istio/proxyv2
/istio-iptables -p 15001 -u 1337 ...

Sidecar Injection
nginx
nginx
mnt
uts
pid
user
ipc
net
docker.io/istio/proxyv2
envoy
mnt
uts
192.168.0.42
eth0
lo
sockets
iptables
routes
:15001/tcp

Services
$ kubectl get service -o wide service-b
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
service-b ClusterIP 10.98.84.169 <none> 80/TCP 90s app=service-b

Service DNS exposure
$ dig service-b.default.svc.cluster.local.
;; ANSWER SECTION:
service-b.default.svc.cluster.local. 5 IN A 10.98.84.169

Pods
$ kubectl get pods -o wide | grep service-b
service-b-644856485c-4rk88 1/1 Running 0 7m46s 10.32.0.4 kind-1-control-plane <none>
service-b-644856485c-dc2zv 1/1 Running 0 7m46s 10.32.0.6 kind-1-control-plane <none>
service-b-644856485c-gr75k 1/1 Running 0 7m46s 10.32.0.5 kind-1-control-plane <none>

Endpoints
$ kubectl get endpoints service-b
NAME ENDPOINTS AGE
service-b 10.32.0.4:8080,10.32.0.5:8080,10.32.0.6:8080 8m55s

Endpoints
$ kubectl get endpoints service-b -o yaml
...
subsets:
- addresses:
- ip: 10.32.0.4
nodeName: kind-1-control-plane
targetRef:
kind: Pod
…
ports:
- name: http
port: 8080
protocol: TCP

Envoy
SvcA
Pilot
Control Plane API
Service A
Config to
Envoys

Envoy
SvcA
Pilot
Control Plane API
Service A
Config to
Envoys
k8s consul zk
Data plane API

Pilot
● Ingress Routing
● Traffic Mirroring
● Traffic Shifting
● Canary Deployments
● Circuit Breaking
● Fault Injection

Envoy
SvcA
Pilot
Control Plane API
Service A Service B
Config to
Envoys

Envoy
SvcA
Envoy
SvcB
Pilot Mixer
Control Plane API
Service A Service B
Config to
Envoys
Policy checks,
Telemetry

IP 5-tuple
(src_addr, src_port, dst_addr, dst_port, proto)

IP Router Architecture
Interrupt
Kernel module
User process
DATA PLANE
CONTROL PLANE
OSPF ARPBGP STP
Router
Information
Base
Forwarding
Information
Base

IP Router Architecture
DATA PLANE
CONTROL PLANE
OSPF ARPBGP STP
PILOT
MIXER
ENVOYInterrupt
Kernel module
User process
Router
Information
Base
Forwarding
Information
Base

Envoy
SvcA
Envoy
SvcB
Pilot
Mixer
Control Plane API
Service A Service B
Config to
Envoys
prom ES
REPORT
CHECK
RBAC Rate
limit
Mixer fat client Mixer fat client

Mixer
● Check
○ ACLs / Authorization
○ Rate Limiting
● Report
○ Logs
○ Metrics
○ Tracing

Envoy
SvcA
Envoy
SvcB
Pilot Mixer Citadel
Control Plane API
Service A Service B
Config to
Envoys
TLS certs
to Envoys
Policy checks,
Telemetry

Envoy
SvcA
Envoy
SvcB
Pilot Mixer Citadel
Control Plane API
Service A Service B
Config to
Envoys
TLS certs
to Envoys
Policy checks,
Telemetry
Envoy
Envoy
Envoy
Envoy
Envoy
Envoy
Envoy
Envoy
Ingress Egress

Envoy
SvcA
Envoy
SvcB
Pilot Mixer Citadel
Control Plane API
Service A Service B
Config to
Envoys
TLS certs
to Envoys
Policy checks,
Telemetry
API Serveretcd
kubectl

Envoy
SvcA
Envoy
SvcB
Pilot Mixer Citadel
Control Plane API
Service A Service B
Config to
Envoys
TLS certs
to Envoys
Policy checks,
Telemetry
Galleyetcd
kubectl

Outline
● Context and Introduction
● Networking and Containers
● Pilot and Routing
● Mixer and Policy
● Citadel and mTLS

Recap
We learned:
● How a packet traverses an Istio/Envoy/Kubernetes system
● What control plane calls are made in that process
● A useful mental model for reasoning about, and debugging Istio

What is a Service Mesh and what can it do for your Microservices

More Related Content

What's hot

Similar to What is a Service Mesh and what can it do for your Microservices

More from Matt Turner

Recently uploaded

What is a Service Mesh and what can it do for your Microservices