1. Connecting, Managing, Observing, and Securing Services
QCon SF - Nov 5, 2018
Zack Butcher

2. Intro Zack Butcher Core Contributor to Istio
Founding Engineer, Tetrate
@ZackButcher on Twitter

3. Agenda The Problem Shape of the Solution
A Brief Tour of Service Meshes
Dive Into Istio
Architecture
Use Cases
Demo

4. The Problem
IT’s shift to a modern distributed architecture has left enterprises unable to connect, monitor, manage, or secure their services in a consistent way.

5. The Problem modern distributed architecture
container based services deployed into dynamic environments
composed via the network

6. The Problem
IT’s shift to a modern distributed architecture has left enterprises unable to connect, monitor, manage, or secure their services in a consistent way.

7. Connect Get the network out of the application. Service Discovery
Resiliency
retry, circuit breaking, timeouts, lame ducking, etc.
(Client Side) Load Balancing

8. Monitor Understand what’s actually happening in your deployment.
Metrics
Logs
Tracing

9. Manage
Control where and how requests flow, and which requests are allowed.
Fine grained traffic control
L7, not L4!
Route by headers, destination or source ID, etc
Policy on requests
Authn/z, rate limiting, arbitrary policy based on L7 request metadata

10. Secure Elevate security out of the network. (L7) Workload Identity
IP:port is not an identity
Reachability != Authorization
Service-to-Service Authn/z

11. The Service Mesh
The goal of a service mesh is to move this functionality out of the application so application developers don’t need to worry about it.
Consistency across the fleet
Centralized control
Fast to change (update config to affect change, not redeploy)

12. Istio
Istio is a platform to connect, monitor, manage, and secure services consistently.

13. How Istio Works A B
call

14. How Istio Works
1. Deploy a proxy (Envoy) beside your application (“sidecar deployment”)
Envoy A
Envoy B
call

15. 2. Deploy Galley to configure the rest of the Istio control plane
How Istio Works
2. Deploy Galley to configure the rest of the Istio control plane
Envoy A
Envoy B
config
Galley

16. 3. Deploy Pilot to configure the sidecars
How Istio Works
3. Deploy Pilot to configure the sidecars
Envoy A
Envoy B
config
Galley
config
Pilot

17. 3. Deploy Mixer to get telemetry and enforce policy
How Istio Works
3. Deploy Mixer to get telemetry and enforce policy
Envoy A
Envoy B
telemetry
policy decisions
Galley
Pilot
Mixer

18. 4. Deploy Citadel to assign identities and enable secure communication
How Istio Works
4. Deploy Citadel to assign identities and enable secure communication
Envoy A
Envoy B
certs
Galley
Pilot
Mixer
Citadel

19. How Istio Works
Envoy A
Call
Envoy B
Galley
Pilot
Mixer
Citadel

20. How Istio Works
Envoy A
Envoy B
Galley
Pilot
Mixer
Citadel

21. How Istio Works
Envoy A
Envoy B
Call
Galley
Pilot
Mixer
Citadel

22. How Istio Works
Envoy A
Envoy B
Policy
Galley
Pilot
Mixer
Citadel

23. How Istio Works
Envoy A
Envoy B
Galley
Pilot
Mixer
Citadel

24. How Istio Works
Envoy A
Envoy B
Response
Galley
Pilot
Mixer
Citadel

25. How Istio Works
Envoy A
Envoy B
Telemetry
Galley
Pilot
Mixer
Citadel

26. Architecture Control Plane API Mixer Pilot Citadel Galley
Service A
Service B
proxy
HTTP/1.1, HTTP/2, gRPC or TCP -- with or without mTLS
Pilot
Citadel
Config data to Envoys
TLS certs to Envoys
Policy checks, telemetry
Galley
Pilot: Control plane to configure and push service communication policies.
Envoy: Network proxy to intercept communication and apply policies.
Mixer: Policy enforcement with a flexible plugin model for providers for a policy.
Citadel: Service-to-service auth[n,z] using mutual TLS, with built-in identity and credential management.
Galley: Configuration validation, distribution*
*not yet, but upcoming in 1.1

27. Demo Cluster A Details Reviews v1 User Traffic Product Page Ingress
Ratings
Reviews v3

28. Demo End State Cluster A Cluster B Details User Traffic Ingress
CoreDNS
CoreDNS
Details
User Traffic
Ingress
Product Page
Ingress
Reviews v1
Reviews v2
Ratings
Ingress
Reviews v3

29. Demo Step 1 Cluster A Cluster B User Traffic Ingress Product Page
CoreDNS
CoreDNS
User Traffic
Ingress
Product Page
Ingress
Details
Reviews v1, v2, v3
Ratings

30. Demo Step 2 (Oops!) Cluster A Cluster B Details User Traffic Ingress
CoreDNS
CoreDNS
Details
User Traffic
Ingress
Product Page
Ingress
Reviews v1
Reviews v2
Ratings
Reviews v3

31. Demo End State Cluster A Cluster B Details User Traffic Ingress
CoreDNS
CoreDNS
Details
User Traffic
Ingress
Product Page
Ingress
Reviews v1
Reviews v2
Ratings
Ingress
Reviews v3

32. Thanks! Istio: https://istio.io https://github.com/istio
@IstioMesh on Twitter
Coddiwomple (config gen tool):
Istio CoreDNS plugin:
on Twitter