Professional Documents
Culture Documents
127.0.0.1:5500/#54 1 / 58
1/58
2019/4/4 Istio Service Mesh Introduction
whoami
Kyohei Mizumoto(@kyohmizu)
C# Software Engineer
Interests
Docker/Kubernetes
Go
Security
127.0.0.1:5500/#54 2 / 58
2/58
2019/4/4 Istio Service Mesh Introduction
Required
Basic knowledge of Kubernetes
Targets
People who:
127.0.0.1:5500/#54 3 / 58
3/58
2019/4/4 Istio Service Mesh Introduction
Contents
1. What is Service Mesh?
2. What is Istio?
4. Traffic Management
127.0.0.1:5500/#54 4 / 58
4/58
2019/4/4 Istio Service Mesh Introduction
127.0.0.1:5500/#54 5 / 58
5/58
2019/4/4 Istio Service Mesh Introduction
Microservices?
Loosely coupled
Independently deployable
127.0.0.1:5500/#54 6 / 58
6/58
2019/4/4 Istio Service Mesh Introduction
Service Mesh?
Describe the network of microservices that make up
applications and the interactions between them
Service Discovery
Load Balancing
Failure Recovery
127.0.0.1:5500/#54 7 / 58
7/58
2019/4/4 Istio Service Mesh Introduction
Service Mesh?
More complex operational requirements
A/B Testing
Canary Rollouts
Rate Limiting
Access Control
End-to-end Authentication
127.0.0.1:5500/#54 8 / 58
8/58
2019/4/4 Istio Service Mesh Introduction
What is Istio?
127.0.0.1:5500/#54 9 / 58
9/58
2019/4/4 Istio Service Mesh Introduction
Istio
Open source independent service
mesh
127.0.0.1:5500/#54 10 / 58
10/58
2019/4/4 Istio Service Mesh Introduction
Istio
Connect, secure, control, and observe services
127.0.0.1:5500/#54 11 / 58
11/58
2019/4/4 Istio Service Mesh Introduction
Architecture
127.0.0.1:5500/#54 12 / 58
12/58
2019/4/4 Istio Service Mesh Introduction
Architecture
Data plane
Envoy
Control plane
Mixer
Pilot
Citadel
Galley
127.0.0.1:5500/#54 13 / 58
13/58
2019/4/4 Istio Service Mesh Introduction
Envoy
A high-performance proxy developed in C++
127.0.0.1:5500/#54 14 / 58
14/58
2019/4/4 Istio Service Mesh Introduction
Envoy
Features
Load Balancing
TLS Termination
127.0.0.1:5500/#54 15 / 58
15/58
2019/4/4 Istio Service Mesh Introduction
Envoy
Circuit Breakers
Health Checks
Fault Injection
Rich Metrics
127.0.0.1:5500/#54 16 / 58
16/58
2019/4/4 Istio Service Mesh Introduction
Mixer
Responsible for providing policy controls and telemetry
collection
127.0.0.1:5500/#54 17 / 58
17/58
2019/4/4 Istio Service Mesh Introduction
Mixer
127.0.0.1:5500/#54 18 / 58
18/58
2019/4/4 Istio Service Mesh Introduction
Pilot
Provides service discovery for:
Envoy sidecars
Resiliency
(e.g. Timeouts, Retries, Circuit Breakers)
127.0.0.1:5500/#54 19 / 58
19/58
2019/4/4 Istio Service Mesh Introduction
Pilot
127.0.0.1:5500/#54 20 / 58
20/58
2019/4/4 Istio Service Mesh Introduction
Citadel
Strong service-to-service/end-user authentication with
built-in identity and credential management
Galley
Istio’s configuration validation, ingestion, processing and
distribution component
127.0.0.1:5500/#54 21 / 58
21/58
2019/4/4 Istio Service Mesh Introduction
127.0.0.1:5500/#54 22 / 58
22/58
2019/4/4 Istio Service Mesh Introduction
Set IAM
Set the default compute service account to include:
127.0.0.1:5500/#54 23 / 58
23/58
2019/4/4 Istio Service Mesh Introduction
Set IAM
127.0.0.1:5500/#54 24 / 58
24/58
2019/4/4 Istio Service Mesh Introduction
Create a Cluster
Need 4 nodes
127.0.0.1:5500/#54 25 / 58
25/58
2019/4/4 Istio Service Mesh Introduction
Istio Resources
$ kubectl get svc -n istio-system
or
127.0.0.1:5500/#54 26 / 58
26/58
2019/4/4 Istio Service Mesh Introduction
Install Istio
1. Go to the Istio release page to download the
installation file
$ export PATH=$PWD/bin:$PATH
127.0.0.1:5500/#54 27 / 58
27/58
2019/4/4 Istio Service Mesh Introduction
Sample Application
127.0.0.1:5500/#54 28 / 58
28/58
2019/4/4 Istio Service Mesh Introduction
Bookinfo
Reviews-v1
Requests Reviews-v2
Product
page
Ratings
Reviews-v3
Ruby
Details
127.0.0.1:5500/#54 29 / 58
29/58
2019/4/4 Istio Service Mesh Introduction
Bookinfo
4 separate microservices:
Productpage
Details
Reviews
Ratings
127.0.0.1:5500/#54 30 / 58
30/58
2019/4/4 Istio Service Mesh Introduction
Bookinfo
3 versions of the Reviews microservice:
Version v1
doesn’t call the ratings service
Version v2
calls the ratings service, and displays black stars
Version v3
calls the ratings service, and displays red stars
127.0.0.1:5500/#54 31 / 58
31/58
2019/4/4 Istio Service Mesh Introduction
Deploy
Enable automatic sidecar injection:
$ kubectl apply -f \
samples/bookinfo/platform/kube/bookinfo.yaml
127.0.0.1:5500/#54 32 / 58
32/58
2019/4/4 Istio Service Mesh Introduction
Resources
Confirm all services and pods are running:
127.0.0.1:5500/#54 33 / 58
33/58
2019/4/4 Istio Service Mesh Introduction
127.0.0.1:5500/#54 34 / 58
34/58
2019/4/4 Istio Service Mesh Introduction
127.0.0.1:5500/#54 35 / 58
35/58
2019/4/4 Istio Service Mesh Introduction
Httpbin
HTTP testing service that can be used for experimenting
with all kinds of Istio features
127.0.0.1:5500/#54 36 / 58
36/58
2019/4/4 Istio Service Mesh Introduction
Set variables
Set the ingress IP and ports:
127.0.0.1:5500/#54 37 / 58
37/58
2019/4/4 Istio Service Mesh Introduction
127.0.0.1:5500/#54 38 / 58
38/58
2019/4/4 Istio Service Mesh Introduction
Configure routes
kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: httpbin
spec:
hosts:
- "*"
gateways:
- httpbin-gateway
http:
- match:
- uri:
prefix: /headers
route:
- destination:
port:
number: 8000
host: httpbin
EOF
127.0.0.1:5500/#54 39 / 58
39/58
2019/4/4 Istio Service Mesh Introduction
Virtual Service
Contains the route rules that Allows traffic for path
/headers
$ export GATEWAY_URL=$INGRESS_HOST:$INGRESS_PORT
$ $ curl -I http://$GATEWAY_URL/headers
HTTP/1.1 200 OK
...
$ $ curl -I http://$GATEWAY_URL/status
HTTP/1.1 404 Not Found
...
127.0.0.1:5500/#54 40 / 58
40/58
2019/4/4 Istio Service Mesh Introduction
127.0.0.1:5500/#54 41 / 58
41/58
2019/4/4 Istio Service Mesh Introduction
red stars
black stars
no stars
127.0.0.1:5500/#54 42 / 58
42/58
2019/4/4 Istio Service Mesh Introduction
$ kubectl apply -f \
samples/bookinfo/networking/destination-rule-all.yaml
127.0.0.1:5500/#54 43 / 58
43/58
2019/4/4 Istio Service Mesh Introduction
Traffic Management
127.0.0.1:5500/#54 44 / 58
44/58
2019/4/4 Istio Service Mesh Introduction
Request routing
Introduces the concept of a service version:
127.0.0.1:5500/#54 45 / 58
45/58
2019/4/4 Istio Service Mesh Introduction
Request routing
127.0.0.1:5500/#54 46 / 58
46/58
2019/4/4 Istio Service Mesh Introduction
Request routing
Route to v1:
$ kubectl apply -f \
samples/bookinfo/networking/virtual-service-all-v1.yaml
127.0.0.1:5500/#54 47 / 58
47/58
2019/4/4 Istio Service Mesh Introduction
Round robin
Random
127.0.0.1:5500/#54 48 / 58
48/58
2019/4/4 Istio Service Mesh Introduction
127.0.0.1:5500/#54 49 / 58
49/58
2019/4/4 Istio Service Mesh Introduction
$ kubectl apply -f \
samples/bookinfo/networking/virtual-service-reviews-50-v3.yaml
$ kubectl apply -f \
samples/bookinfo/networking/virtual-service-reviews-test-v2.yaml
127.0.0.1:5500/#54 50 / 58
50/58
2019/4/4 Istio Service Mesh Introduction
Handling failures
Timeouts
Fault injection
Test the end-to-end failure recovery capability
2 types of faults
Canary rollout
Introduce a new version of a service by first testing it
using a small percentage of user traffic.
127.0.0.1:5500/#54 53 / 58
53/58
2019/4/4 Istio Service Mesh Introduction
Canary rollout
With Istio:
127.0.0.1:5500/#54 54 / 58
54/58
2019/4/4 Istio Service Mesh Introduction
Books
127.0.0.1:5500/#54 55 / 58
55/58
2019/4/4 Istio Service Mesh Introduction
Links
Microservice Architecture
https://microservices.io/index.html
Istio.io
https://istio.io/
Istioサービスメッシュ⼊⾨
https://www.slideshare.net/yokawasa/istio-114360124
127.0.0.1:5500/#54 56 / 58
56/58
2019/4/4 Istio Service Mesh Introduction
Links
Installing Istio on GKE
https://cloud.google.com/istio/docs/istio-on-gke/installing
Bookinfo Application
https://istio.io/docs/examples/bookinfo/
127.0.0.1:5500/#54 57 / 58
57/58
2019/4/4 Istio Service Mesh Introduction
Thank You!
127.0.0.1:5500/#54 58 / 58
58/58