Individual microservices are relatively easy to develop, but managing a distributed system composed of microservices is never a simple task. Kubernetes helps, but it falls short of providing everything such a system needs. This is where the Istio Service Mesh comes in. Running microservices in production, you'll soon realize you want things like traffic splitting, automatic connection retries, timeouts and failovers, secure communication and authentication between your services, distributed metrics, tracing and logging. By introducing Istio into your architecture, you get all of that and more. And you get most of it without changing your code at all. In this talk, you'll see a demonstration of Istio in action and learn about the tricks that make its magic possible.

1. Istio Service MeshThe magic between your microservices
Marko Lukša, Red Hat

2. Marko Lukša
● Software engineer at Red Hat
● 20+ years
● Currently working on:
○ Istio
○ Kubernetes
○ OpenShift
● Author of Kubernetes in Action
○ www.manning.com/books/kubernetes-in-action
○ FREE chapters 2-5: Exploring Kubernetes
■ www.manning.com/books/exploring-kubernetes

3. About you? Show of hands
● Develop Microservices?
● Heard of Istio?
● Using Istio?
● Using Kubernetes?

4. INTRO

6. Microservices: The fairy tale
● Smaller, simpler units
● Easier to develop
● Different languages
● Re-use existing components
● Independent development cycles
● Independent release cycles
● Independent scaling
● ...

7. Microservices: The reality
*hacker icon source: https://www.freeiconspng.com/img/37219
*hourglass icon by Freepik from www.flaticon.com
*monitoring icon by Francesco Daffini from www.onlinewebfonts.com
User
v2v1

8. IstioConnect, secure, control, and observe services.

9. Istio is an open-source service mesh

10. A service mesh is
decentralized application networking infrastructure
that connects your (micro)services

11. Istio is in-between your microservices
User
v2v1
● No libraries to import
● No* code changes required
● Completely transparent to
the application
● Sounds impossible?

12. HOW?

13. *
* Optional

14. Sidecar container pattern
sidecar noun /ˈsaɪd.kɑːr/
a small, low vehicle attached to the side of a motorcycle
for carrying passengers.
sidecar container
a container that augments and improves the main
application container, often without the main application’s
knowledge.
Pod
Service
(Your code)
Sidecar
Istio Proxy

15. Pod B
Service B
Istio Proxy
Communication through Istio Proxy
Pod A
Service A
Istio Proxy

16. Istio Control PlanePilot Mixer CitadelGalley
Istio Service Mesh architecture
Service A Service B Service C
Istio Proxy Istio Proxy Istio Proxy
HTTP/1.1
HTTP/2
gRPC
TCP
HTTP/1.1
HTTP/2
gRPC
TCP
mTLS mTLS

17. What kind of MAGIC does this enable?

18. Istio enables OBSERVABILITY

19. Istio Control Plane
Monitoring with Istio
Pod
Service A
Istio Proxy
Pod
Service B
Istio Proxy

20. Monitoring

21. Distributed Tracing

22. Distributed Tracing
Pod
Service A
Istio Proxy
Pod
Service B
Istio Proxy
Istio Control Plane
Pod
Service C
Istio Proxy
Pod
Service D
Istio Proxy
??
?
?
? ?
?
?

23. Distributed Tracing With Jaeger

24. Visualizing Microservices
$ kubectl get pods
NAME READY STATUS RESTARTS AGE
details-v1-54b6b58d9c-lk78s 2/2 Running 0 7h
productpage-v1-69b749ff4c-xj2tl 2/2 Running 0 7h
ratings-v1-7ffc85d9bf-pk8jt 2/2 Running 0 7h
reviews-v1-fcd7cc7b6-5hmbl 2/2 Running 0 7h
reviews-v2-655cc678db-td98q 2/2 Running 0 7h
reviews-v3-645d59bdfd-ckphz 2/2 Running 0 7h

25. Visualizing Microservices with Kiali

26. Istio doesn't just enable us
to OBSERVE traffic.
It also allows us to SHAPE it!

27. Service myservice
Traffic management
Client
v1
v1
v1
v2
v2
GET http://myservice
20%
20%
20%
20%
20%
kind: Service
metadata:
name: myservice
spec:
ports:
- ...
selector:
app: myservice

28. Service myservice
Traffic management
Client
v1
v1
v1
v2
v2
GET http://myservice
20%
20%
20%
20%
20%
kind: DestinationRule
metadata:
name: myservice
spec:
host: myservice.myns.svc.cluster.local
subsets:
- name: v1
labels:
version: v1
- name: v2
labels:
version: v2
Subsetv2Subsetv1

29. Service myservice
Subsetv2Subsetv1
Traffic management
Client
v1
v1
v1
v2
v2
90%
10%
kind: VirtualService
spec:
hosts: ["myservice.myns.s.c.l"]
http:
- route:
- weight: 90
destination:
host: myservice
subset: v1
- weight: 10
destination:
host: myservice
subset: v2
GET http://myservice

30. Service myservice
Subsetv2-betaSubsetv1
Canary deployment
Client
v1
v1
v1
v2-beta
v2-beta
http:
- match:
- headers:
Opt-in:
exact: beta
route:
- destination:
host: myservice
subset: v2-beta
- route:
- destination:
host: myservice
subset: v1
regular
users
GET http://myservice HTTP/1.1
HTTP header
opt-in: beta
GET http://myservice HTTP/1.1
user-agent: Mozilla/5.0...
opt-in: beta

31. Service myservice
Subsetv1
Dark launch
Client
v1
v1
v1
Subsetv2-alpha
v2-alpha
v2-alpha
kind: VirtualService
spec:
hosts:
- myservice
http:
- route:
- destination:
host: myservice
subset: v1
mirror:
host: myservice
subset: v2-alpha
GET http://myservice

32. Istio also SECURES
inter-service communication!

33. Man-in-the-middle
attack

34. Encryption & authentication with Mutual TLS
Pod
Service A
Istio Proxy
Pod
Service B
Istio Proxy
mTLS
kind: DestinationRule
metadata:
name: service-b
spec:
host: service-b
trafficPolicy:
tls:
mode: ISTIO_MUTUAL
...

35. Authorization with Istio RBAC
Service A Service B
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRole
metadata:
name: service-b-viewer
spec:
rules:
- services:
- service-b.ns.svc.cluster.local
methods:
- GET
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRoleBinding
metadata:
name: bind-ratings
spec:
subjects:
- user: cluster.local/ns/default/sa/service-a
roleRef:
kind: ServiceRole
name: service-b-viewer
Service C

36. Istio also adds FAULT TOLERANCE,
RETRIES and RATE LIMITING!

37. Connection timeouts & retries
Pod
Service A
Istio Proxy
Pod
Service B
Istio Proxy
kind: VirtualService
metadata:
name: service-b
spec:
hosts:
- service-b
http:
- route:
- destination:
host: service-b
subset: v1
timeout: 10s
retries:
attempts: 5
perTryTimeout: 2s
Timeout: 10s
Retry: 5x

38. Rate limiting
Pod
Service A
Istio Proxy
Pod
Service B
Istio Proxy
kind: DestinationRule
metadata:
name: service-b
spec:
host: service-b
trafficPolicy:
connectionPool:
tcp:
maxConnections: 200
http:
http2MaxRequests: 500
Max 200
connections
Max 500
requests

39. Circuit breaker (Outlier detection)
Pod
Service A
Istio Proxy
Pod
Service B
Istio Proxy
kind: DestinationRule
metadata:
name: service-b
spec:
host: service-b
trafficPolicy:
...
outlierDetection:
consecutiveErrors: 3
interval: 5m
baseEjectionTime: 10m
If 3 errors in
5 minutes:
eject for 10
minutes

40. ...and even helps with TESTING
by injecting FAULTS or DELAYS!

41. Chaos Engineering: Inserting a delay
Pod
Service A
Istio Proxy
Pod
Service B
Istio Proxy
kind: VirtualService
metadata:
name: service-b
spec:
hosts:
- service-b
http:
- route:
- destination:
host: service-b
subset: v1
fault:
delay:
percent: 50
fixedDelay: 3s
Insert 3
second
delay
in 50%
of requests

42. Chaos Engineering: Inserting a fault
Pod
Service A
Istio Proxy
Pod
Service B
Istio Proxy
kind: VirtualService
metadata:
name: service-b
spec:
hosts:
- service-b
http:
- route:
- destination:
host: service-b
subset: v1
fault:
abort:
percent: 10
httpStatus: 500
HTTP 500
in 10%
of requests

43. Services are completely
unaware of all this!

44. And more...
● Configurable load balancing
○ Consistent hash LB (e.g. cookie-based / sticky session)
○ Least connected, Round robin, Random
● Connection pools
● Prevent accessing external services
● HTTP redirects, URL rewrites, Injecting HTTP headers
● Growing support for well-known protocols
○ Not just HTTP-aware
○ MySQL, Postgres, Kafka, ...

45. DEMO

46. OpenShift Service Mesh
● Red Hat's distribution of Istio
○ Jaeger distributed tracing
○ Kiali for visualizing services
○ Prometheus for monitoring
○ Grafana for visualizing monitoring data
○ Istio operator - automatic install and management of Istio
● Maistra
○ Upstream, open-source project
○ OpenShift Service Mesh is based on Maistra
○ https://github.com/Maistra

47. THANK YOU!
marko.luksa (gmail) twitter.com/markoluksa medium.com/@marko.luksa