Microservices With Istio Service Mesh

Microservices With
Service Mesh

Hello!
I am Natanael Fonseca
Solution Architect at Everis.
You can find me at: @natanaelfonseca
2

Session Agenda
- Microservices Patterns;
- Spring Cloud;
- What is a Service Mesh?
- What is ISTIO?
- Before and After;
3
- Traffic Control;
- Service Resilience;
- Chaos Testing;
- Observability;
- Security.

Microservices Patterns
▷ Netflix Hystrix (Circuit Breaking)
▷ Netflix Zuul (Edge Routing)
▷ Netflix Ribbon ( Client-Side Service Discovery )
▷ Netflix Eureka (Service Discovery Registry)
▷ Brave / Zipkin (Tracing)
▷ Netflix Spectator / Atlas (Metrics)
4

Spring Cloud Projects
▷ Spring Cloud Config;
▷ Spring Cloud Netflix;
▷ Spring Cloud Bus;
▷ Spring Cloud Foundry;
▷ Spring Cloud Open Service Broker;
▷ Spring Cloud Cluster;
▷ Spring Cloud Consul;
▷ And others…..
5
https://spring.io/projects/spring-cloud

Spring Cloud Netflix
▷ Service Discovery;
▷ Circuit Breaker;
▷ Declarative REST Client with Feign;
▷ Client Side Load Balancer with Ribbon;
▷ Router and Filter with Zuul.
6

“A service mesh is the connective tissue between your
services that adds additional capabilities like traffic
control, service discovery, load balancing, resilience,
observability, security, and so on…
8
What is a service mesh?

“Developed by a collaboration between Google, IBM, and
Lyft, Istio is an open-source service mesh that lets you
connect, monitor, and secure microservices deployed on-
premise, in the cloud, or with orchestration platforms like
Kubernetes and Mesos.
9
What is ISTIO?

What are the biggest changes
10
Before and After

Microservices with regular
containers.
11

Two areas to aim complete solution
13
Control and Data Plane

Data Plane
Comprises the primary Istio sidecar:
▷ Envoy
14

Envoy
A layer 7 load-balancer takes routing decision based on
IPs, TCP or UDP ports or any information it can get
from the application protocol (mainly HTTP). The layer
7 load-balancer acts as a proxy, which means it
maintains two TCP connections: one with the client
and one with the server.
15

Sidecar Pattern
16
https://docs.microsoft.com/en-us/azure/architecture/patterns/sidecar

Control Plane
Comprises three primary Istio services:
▷ Pilot
▷ Mixer
▷ Citadel
18

Pilot
Provides capabilities like service discovery as well as
support for VirtualService. The VirtualService is what
gives you fine-grained request distribution, retries,
timeouts, etc
19

Mixer
With Mixer, you can create policies, apply rate-limiting
rules, and even capture custom metrics. Mixer has a
pluggable backend architecture that is rapidly evolving
with new plug-ins and partners that are extending
Mixer’s default capabilities in many new and interesting
ways.
20

Citadel
Formerly known as Istio CA or Auth, is responsible for
certificate signing, certificate issuance, and
revocation/rotation. Istio issues X.509 certificates to
all your microservices, allowing for mutual Transport
Layer Security (mTLS) between those services,
encrypting all their traffic transparently.
21

Examine Istio patterns including smarter canaries and
dark launches
22
Traffic Control

“With a canary deployment, you deploy a new version
of your code to production but allow only a subset of
traffic to reach it
23
Canary Deployment

Destination Rule and Virtual Service
24
In this case, 100% of traffic for the recommendation service will always go to pods matching the
label version v1.

Canary Release for API V2
25
We’re sending 90% of the traffic to v1 and
10% of the traffic to v2 with this VirtualService

Header Based
26
This rule uses a request header–based matching
clause that will match only if the request
includes “Safari” as part of the user-agent header

Dark Launch
27
Istio allows you to duplicate or mirror traffic to a
new version of your application and see how it
behaves compared to the live application pod

Egress Gateway
28
Controlling all outbound traffic with rules.

Service resiliency
How Istio provides load balancing, circuit breaking, and
pool ejection
29

Load Balancing
30
ROUND_ROBIN
This algorithm evenly distributes the load, in order,
across the endpoints in the load-balancing pool.
RANDOM
This evenly distributes the load across the endpoints in
the load-balancing pool but without any order.
LEAST_CONN
This algorithm picks two random hosts from the load-
balancing pool and determines which host has fewer
outstanding requests (of the two) and sends to that
endpoint. This is an implementation of weighted least
request load balancing.

Timeout
31
Calls to services over a network can result in lots
of unpredictable behavior, but the worst behavior
is latency. Did the service fail? Is it just slow? Is it
not even available? Unbounded latency means
any of those things could have happened

Retry
32
With Istio’s retry capability, you can make a few
more attempts before having to truly deal with
the error, potentially falling back to default logic.
To forward the request to another instance just in case you get an open circuit
breaker or pool ejection

Circuit Breaker
33
Istio puts more of the resilience implementation into
the infrastructure so that you can focus more of your
valuable time and energy on code that differentiates
your business from the ever-growing competitive
field.
To create circuit breaker functionality for our services,
we use an Istio DestinationRule
To avoid multiple concurrent requests to an instance

Pool Ejection
34
If the request is forwarded to a certain instance
and it fails (e.g., returns a 50x error code), Istio
will eject this instance from the pool for a
certain sleep window. In our example, the sleep
window is configured to be 15s.
To remove failing instances from the pool of responding instances

Chaos testing
Turbulent conditions through fault injection
35

“Chaos Engineering is the discipline of experimenting
on a distributed system in order to build confidence
in the system’s capability to withstand turbulent
conditions in production
36
Principles of Chaos Engineering
http://principlesofchaos.org/?lang=ENcontent

HTTP Errors
37
We use the combination of Istio’s DestinationRule and VirtualService to
inject a percentage of faults—in this case, returning the HTTP 503 error
code 50% of the time.
Injecting errors via Istio instead of using Java code

Delays
38
The following manifest injects 7
seconds of delay into 50% of the
responses from the
recommendation service
The most insidious of possible distributed computing faults is not a “dead”
service but a service that is responding slowly

Observability
Tracing and metrics
39

Tracing
40
Jaeger implements OpenTracing, a vendor-neutral tracing API. Jaeger was originally open sourced by the
Uber Technologies team and is a distributed tracing system specifically focused on microservices
architecture.

Metrics
41
Istio will gather telemetry data across the service mesh by leveraging Prometheus and
Grafana to get started with this important capability

Service Graph
42
Istio has provided the out-of-the-box basic Servicegraph visualization
since its earliest days

Security
Istio’s security capabilities, such as mTLS, RBAC, and
policy enforcement
43

Mutual Transport Layer Security
44
Enabling mTLS in Istio uses the combination of Policy and DestinationRule objects
(mTLS)

Access Control with Mixer Policy
45
Istio’s Mixer Policy service allows you to construct a series of rules that ensure the various
microservices that make up your application follow an approved invocation path
For example:
• customer is not allowed to call recommendation;
• preference is not allowed to call customer;
• recommendation is not allowed to call customer;
• recommendation is not allowed to call preference.

Role-Based Access Control (RBAC)
46
Istio includes a Role-Based Access Control (RBAC) authorization feature
that can be used to further constrain which services (e.g., customer,
preference, recommendation) are accessible by particular users.
Where mode can be:
OFF: Istio authorization is disabled.
ON: Istio authorization is enabled for all services in the mesh.
ON_WITH_INCLUSION: Enabled only for services and namespaces
specified in the inclusion field.
ON_WITH_EXCLUSION: Enabled for all services in the mesh except the
services and namespaces specified in the exclusion field.

Role-Based Access Control (RBAC)
47
Istio’s RBAC uses a deny-by-default strategy, meaning that nothing is permitted until you explicitly
define an access-control policy to grant access to any service. To reopen the customer endpoint
to end-user traffic, create a ServiceRole and a ServiceRoleBinding

JWT
48
Istio has support for user authentication and authorization via JWT (JSON Web Token)Istio has
support for user authentication and authorization via JWT (JSON Web Token)

Thanks!
Any questions?
You can find me at:
@natanaelfonseca
natanael.vaz@gmail.com
49

Microservices With Istio Service Mesh

More Related Content

What's hot

What's hot (20)

Similar to Microservices With Istio Service Mesh

Similar to Microservices With Istio Service Mesh (20)

More from Natanael Fonseca

More from Natanael Fonseca (19)

Recently uploaded

Recently uploaded (20)

Microservices With Istio Service Mesh