e’ll explore what a service mesh is and what it can do for your microservices. Are the claims of observability, resiliency, and WAF features real? Are they useful during development, production, or both? Using pictures and demos, we’ll find out! This session will also briefly cover how a service mesh works, giving us a mental model with which to explore and evaluate after the talk. Matt will show a simple installation and demo, giving us all the knowledge to go home and try for ourself.

1. What is a Service Mesh?
DevOps Thames Valley, Reading UK | January 2020 @mt165 | mt165.co.uk

2. Part I: Do You Need a Service Mesh?

3. Outline
● What are we talking about this?
● How did we get here?
● What is a Service Mesh anyway?
● Demo!
● What can a Service Mesh do?
● Common counter-arguments
● So: Do you need a Service Mesh?

4. Pop Quiz!

5. Why are we talking about this?

6. Business Value
● Top Line
● Bottom Line
● Time to Market & Speed of Iteration
● Risk Reduction

7. Break the Monolith

8. Pod
Pod
Pod
Break the Monolith
Namespace A
Namespace B
Namespace C
Namespace A
Namespace B
Namespace C

9. ...don’t just distribute it!

10. How did we get here?

17. Do you need a service mesh? @mt165
In-process libraries and frameworks

18. Polyglot environments

19. Polyglot environments

20. Must-have primitives
● Service Discovery
● Fault Tolerance
○ Circuit breakers
○ Back pressure
● Observability
○ Logging
○ Metrics
○ Tracing

21. Do you need a service mesh? @mt165
Declarative Infrastructure

22. Do you need a service mesh? @mt165
And declarative infrastructure

23. Do you need a service mesh? @mt165
And declarative infrastructure

24. Assertion: A Service
Mesh is the best of
both

25. Question: What is a
Service Mesh?

26. They work by adding a proxy to every service

27. And a control plane

28. “A service mesh provides a transparent and language-independent way to
flexibly and easily automate application network functions”
- Google (istio vendor)

29. “A service mesh provides a transparent and language-independent way to
flexibly and easily automate application network functions”

30. “A service mesh provides a transparent and language-independent way to flexibly
and easily automate application network functions”

31. “A service mesh provides a transparent and language-independent way to flexibly
and easily automate application network functions”

32. “A service mesh provides a transparent and language-independent way to flexibly
and easily automate application network functions”

33. “A service mesh provides a transparent and language-independent way to flexibly
and easily automate application network functions”
Host: users
Host: users
X-testing: true
Host: users
Pod.namespace: staging
users-v1
users-v2
users-mock

34. Demo Time!

35. Pray to the demo gods...

36. Pray to the demo gods...
The old...

37. Pray to the demo gods...
The old... ...and the new

38. Service Meshes can
do much more

39. Observability

40. Traffic Management

41. Declarative Traffic Management
Everyone gets reviews v1 Except Jason

42. Security - ACLs

43. Security - mTLS

44. Security - mTLS

45. But!

46. But I have an Edge Proxy!
✅ Ingress proxy
✅ Sidecar model terminates security closer to the app

47. But I have an API Gateway!
✅ Rate limiting
✅ Access control
✅ JWT validation
❌ OIDC
❌ Bot blocking

48. But I have a CDN!
Keep it

49. But I have a WAF!
✅ CORS header injection
❌ Injection attack prevention

50. But I have an APM system!
✅ Logs
✅ Metrics
✅ Tracing
✅ Multiple, arbitrary telemetry backends
❌ JVM, .Net CLR insight

51. But I have an ESB!
✅ Retries etc
✅ Flexible service discovery / late binding
✅ No client/server distinction; better than a middle proxy
❌ Broadcast / pubsub

52. So: Do you need a
Service Mesh?

53. Yes!

54. There are many options

55. Istio has the most momentum

56. Istio has wide backing
Google, IBM, Lyft, RedHat, Cisco, and more

57. Istio and Linkerd are (quite) easy to install
WIll be managed soon
Go home and try it!

58. Recap
● Why were we talking about this?
● How did we get here?
● What is a Service Mesh anyway?
● Demo!
● What can a Service Mesh do?
● Common counter-arguments
● So: Do you need a Service Mesh?

59. 🍺

60. Part II: The Life of a Packet Through Istio

61. Objectives
Learn how a packet traverses an Istio/Envoy/Kubernetes system
See what control plane calls are made in that process
Build a useful mental model for reasoning about, and debugging Istio

62. Prerequisites
Basic networking knowledge
Intermediate Kubernetes knowledge
An understanding of what Istio is and does

63. Outline
● Networking and Containers
● Pilot and Routing
● Mixer and Policy
● Citadel and mTLS

64. Networking and Containers

65. Service AIngress

66. Service A

67. Envoy
SvcA
Service A

68. “Containers”
nginx
nginx
supervisord
mnt
uts
pid
user
ipc
net

69. Kubernetes Pods
nginx
nginx
supervisord
mnt
uts
pid
user
ipc
net
logger
fluentd
mnt
uts

70. Kubernetes Pods
nginx
nginx
supervisord
mnt
uts
pid
user
ipc
net
logger
fluentd
mnt
uts
192.168.0.42
eth0
lo
sockets
iptables
routes

71. Kubernetes Pods
nginx
nginx
supervisord
mnt
uts
pid
user
ipc
net
logger
fluentd
mnt
uts
192.168.0.42
eth0
lo
sockets
iptables
routes
:8080/tcp

72. Kubernetes Pods
nginx
nginx
supervisord
mnt
uts
pid
user
ipc
net
proxy
envoy
mnt
uts
192.168.0.42
eth0
lo
sockets
iptables
routes
:8080/tcp

73. Sidecar Injection
pid
user
ipc
net
192.168.0.42
eth0
lo
sockets
iptables
routes

74. Sidecar Injection
pid
user
ipc
net
192.168.0.42
eth0
lo
sockets
iptables
routes
docker.io/istio/proxyv2
/istio-iptables -p 15001 -u 1337 ...

75. Sidecar Injection
nginx
nginx
mnt
uts
pid
user
ipc
net
docker.io/istio/proxyv2
envoy
mnt
uts
192.168.0.42
eth0
lo
sockets
iptables
routes
:15001/tcp

76. Envoy
SvcA
Service A

77. Pilot and Routing

78. Envoy
SvcA
Service A
?
?
?

79. Services
$ kubectl get service -o wide service-b
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
service-b ClusterIP 10.98.84.169 <none> 80/TCP 90s app=service-b

80. Service DNS exposure
$ dig service-b.default.svc.cluster.local.
;; ANSWER SECTION:
service-b.default.svc.cluster.local. 5 IN A 10.98.84.169

81. Pods
$ kubectl get pods -o wide | grep service-b
service-b-644856485c-4rk88 1/1 Running 0 7m46s 10.32.0.4 kind-1-control-plane <none>
service-b-644856485c-dc2zv 1/1 Running 0 7m46s 10.32.0.6 kind-1-control-plane <none>
service-b-644856485c-gr75k 1/1 Running 0 7m46s 10.32.0.5 kind-1-control-plane <none>

82. Endpoints
$ kubectl get endpoints service-b
NAME ENDPOINTS AGE
service-b 10.32.0.4:8080,10.32.0.5:8080,10.32.0.6:8080 8m55s

83. Endpoints
$ kubectl get endpoints service-b -o yaml
...
subsets:
- addresses:
- ip: 10.32.0.4
nodeName: kind-1-control-plane
targetRef:
kind: Pod
…
ports:
- name: http
port: 8080
protocol: TCP

84. Envoy
SvcA
Pilot
Control Plane API
Service A
Config to
Envoys

85. Envoy
SvcA
Pilot
Control Plane API
Service A
Config to
Envoys
k8s consul zk
Data plane API

86. Pilot
● Ingress Routing
● Traffic Mirroring
● Traffic Shifting
● Canary Deployments
● Circuit Breaking
● Fault Injection

87. Mixer and Policy

88. Envoy
SvcA
Pilot
Control Plane API
Service A Service B
Config to
Envoys

89. Envoy
SvcA
Envoy
SvcB
Pilot Mixer
Control Plane API
Service A Service B
Config to
Envoys
Policy checks,
Telemetry

90. IP 5-tuple
(src_addr, src_port, dst_addr, dst_port, proto)

91. IP Router Architecture
Interrupt
Kernel module
User process
DATA PLANE
CONTROL PLANE
OSPF ARPBGP STP
Router
Information
Base
Forwarding
Information
Base

92. IP Router Architecture
DATA PLANE
CONTROL PLANE
OSPF ARPBGP STP
PILOT
MIXER
ENVOYInterrupt
Kernel module
User process
Router
Information
Base
Forwarding
Information
Base

93. Envoy
SvcA
Envoy
SvcB
Pilot
Mixer
Control Plane API
Service A Service B
Config to
Envoys
prom ES
REPORT
CHECK
RBAC Rate
limit
Mixer fat client Mixer fat client

94. Mixer
● Check
○ ACLs / Authorization
○ Rate Limiting
● Report
○ Logs
○ Metrics
○ Tracing

95. Envoy
SvcA
Envoy
SvcB
Pilot Mixer
Control Plane API
Service A Service B
Config to
Envoys
Policy checks,
Telemetry

96. Envoy
SvcA
Envoy
SvcB
Pilot Mixer Citadel
Control Plane API
Service A Service B
Config to
Envoys
TLS certs
to Envoys
Policy checks,
Telemetry

97. Envoy
SvcA
Envoy
SvcB
Pilot Mixer Citadel
Control Plane API
Service A Service B
Config to
Envoys
TLS certs
to Envoys
Policy checks,
Telemetry

98. Envoy
SvcA
Envoy
SvcB
Pilot Mixer Citadel
Control Plane API
Service A Service B
Config to
Envoys
TLS certs
to Envoys
Policy checks,
Telemetry
Envoy
Envoy
Envoy
Envoy
Envoy
Envoy
Envoy
Envoy
Ingress Egress

99. Envoy
SvcA
Envoy
SvcB
Pilot Mixer Citadel
Control Plane API
Service A Service B
Config to
Envoys
TLS certs
to Envoys
Policy checks,
Telemetry
API Serveretcd
kubectl

100. Envoy
SvcA
Envoy
SvcB
Pilot Mixer Citadel
Control Plane API
Service A Service B
Config to
Envoys
TLS certs
to Envoys
Policy checks,
Telemetry
Galleyetcd
kubectl

101. Outline
● Context and Introduction
● Networking and Containers
● Pilot and Routing
● Mixer and Policy
● Citadel and mTLS

102. Recap
We learned:
● How a packet traverses an Istio/Envoy/Kubernetes system
● What control plane calls are made in that process
● A useful mental model for reasoning about, and debugging Istio

103. Thanks!
@mt165
mt165.co.uk