Connecting Managing Observing and Securing Services QCon SF

Connecting, Managing, Observing, and Securing Services QCon SF - Nov 5, 2018 Zack Butcher

Intro Zack Butcher Core Contributor to Istio Founding Engineer, Tetrate @Zack. Butcher on Twitter

Agenda ● ● The Problem Shape of the Solution A Brief Tour of Service Meshes Dive Into Istio ○ Architecture ○ Use Cases ○ Demo

The Problem IT’s shift to a modern distributed architecture has left enterprises unable to connect, monitor, manage, or secure their services in a consistent way.

The Problem modern distributed architecture container based services deployed into dynamic environments composed via the network

The Problem IT’s shift to a modern distributed architecture has left enterprises unable to connect , monitor, manage, or secure their services in a consistent way.

Connect Get the network out of the application. ● Service Discovery ● Resiliency ○ retry, circuit breaking, timeouts, lame ducking, etc. ● (Client Side) Load Balancing

Monitor Understand what’s actually happening in your deployment. ● Metrics ● Logs ● Tracing

Manage Control where and how requests flow, and which requests are allowed. ● Fine grained traffic control ○ L 7, not L 4! ○ Route by headers, destination or source ID, etc ● Policy on requests ○ Authn/z, rate limiting, arbitrary policy based on L 7 request metadata

Secure Elevate security out of the network. ● (L 7) Workload Identity ○ IP: port is not an identity ○ Reachability != Authorization ● Service-to-Service Authn/z

The Service Mesh The goal of a service mesh is to move this functionality out of the application so application developers don’t need to worry about it. ● Consistency across the fleet ● Centralized control ● Fast to change (update config to affect change, not redeploy)

Istio is a platform to connect, monitor, manage, and secure services consistently.

How Istio Works A call B

How Istio Works 1. Deploy a proxy (Envoy) beside your application (“sidecar deployment”) A Envoy call B Envoy

How Istio Works 2. Deploy Galley to configure the rest of the Istio control plane A B Envoy config Galley

How Istio Works 3. Deploy Pilot to configure the sidecars A B Envoy config Galley config Pilot

How Istio Works 3. Deploy Mixer to get telemetry and enforce policy A Envoy B telemetry policy decisions Galley Pilot Mixer Envoy

How Istio Works 4. Deploy Citadel to assign identities and enable secure communication A B Envoy certs Galley Pilot Mixer Citadel

How Istio Works A Call Envoy Galley Pilot B Envoy Mixer Citadel

How Istio Works Galley A B Envoy Pilot Mixer Citadel

How Istio Works A Envoy Galley Pilot B Call Mixer Envoy Citadel

How Istio Works A B Envoy Policy Galley Pilot Mixer Citadel

How Istio Works Galley A B Envoy Pilot Mixer Citadel

How Istio Works A B Response Envoy Galley Pilot Envoy Mixer Citadel

How Istio Works A B Envoy Telemetry Galley Pilot Mixer Citadel

Architecture HTTP/1. 1, HTTP/2, g. RPC or TCP -- with or without m. TLS Service A proxy Config data to Envoys Pilot: Control plane to configure and push service communication policies. Service B Envoy: Network proxy to intercept communication and apply policies. proxy Mixer: Policy enforcement with a flexible plugin model for providers for a policy. Policy checks, telemetry TLS certs to Envoys Mixer Citadel Control Plane API Galley Citadel: Service-to-service auth[n, z] using mutual TLS, with built-in identity and credential management. Galley: Configuration validation, distribution* *not yet, but upcoming in 1. 1

Demo Cluster A User Traffic Ingress Details Product Page Reviews v 1 Reviews v 2 Ratings Reviews v 3

Demo End State Cluster A Core DNS Cluster B Details User Traffic Ingress Product Page Ingress Reviews v 1 Reviews v 2 Ratings Ingress Reviews v 3

Demo Step 1 Cluster A User Traffic Ingress Core DNS Product Page Reviews v 1, v 2, v 3 Ratings Core DNS Ingress Cluster B Details

Demo Step 2 (Oops!) Cluster A Core DNS Cluster B Details User Traffic Ingress Product Page Ingress Reviews v 1 Reviews v 2 Ratings Reviews v 3

Demo End State Cluster A Core DNS Cluster B Details User Traffic Ingress Product Page Ingress Reviews v 1 Reviews v 2 Ratings Ingress Reviews v 3

Thanks! Istio: ● https: //istio. io ● https: //github. com/istio ● @Istio. Mesh on Twitter Coddiwomple (config gen tool): ● https: //github. com/istio-ecosystem/coddiwomple Istio Core. DNS plugin: ● https: //github. com/istio-ecosystem/istio-coredns-plugin Me: @Zack. Butcher on Twitter