Cloud Native Computing Foundation EnvoyCon 2018 (Seattle), 16 Jan 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Lightning Talk: Extending Envoy with Go - Thomas Graf, Covalent

Description

Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io

Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects

Lightning Talk: Extending Envoy with Go - Thomas Graf, Covalent

Envoy has become a popular proxy in the cloud native landscape thanks to its robustness, stability, efficiency and community. What if we could extend Envoy filters and parsers using Go. This talk introduces the new Go based extension framework for Envoy that allows to extend Envoy with customized filters, logic and protocol parsers written in Go without requiring to understand the entire C++ codebase. We will walk through how everyone in the community can write a Go extension to Envoy to add additional protocol parsers or filtering logic and discuss how this allows to implement a fully distributed servicemesh.

A

All right, I think we're ready to get started after lunch break I think everybody enjoy lunch. My name is Thomas. Groff I am from the cilium project and I'm here to talk about extending envoy with go. Who am I. I have a kernel development background. Why do I speak about go different story in the back in about in the past, I've, mostly focused on networking, security and BPF, and then founded a Sicilian project, and we found this nice integration possibilities with envoy and gold. The NGO extensions is one part I'm going to talk about today.

A

First of all, what is psyllium solemn is a networking and security solution that also does Q Boneta services. We have deep envoy integration, so we're doing security on kind of l3, l4, networking level. What services can talk to each other and then we need to do all seven of our security API where security, that's. Where we go to envoy, we we use the power of BPF, which is this very exciting technology. That's happening inside of the Linux kernel and hence my kernel background to actually accelerate.

A

For example, envoy, we use BPF to provide a new kind of a new wave of networking. That's very exciting, we're using VPS to provide transparent, SSL visibility. We'll talk a little bit about that. The way we enter it if Envoy is first of all the acceleration part, that's called kernel internal, but then we have a BPF metadata filter. We have a network, filter and I have an HTTP filter. The network security.

A

That's not really a Envoy specific, but we have an identities, an entity based network security model we our DNS server, so we can actually filter on DNS requests and so on. What we focus on today is to go extensions, one more basics, very simple: we have like services talk to each other or edge talking to service service, talking to edge you put envoy in and then to simplify traumatic salon.

A

War looks something like this: you have a filter chain that is filtering and then the actual proxy functionality, where do go, extensions fit in they run on top, so they hook into the filter chain and allow a filter to call into the go extension. Do something with data and return a verdict?

A

What is the motivation for all of this secret plot to get Matt and embrace golang right? We're we're going really far like we're already implementing C++ exceptions.

A

We will support, go plus, plus, if you don't know about what I'm talking about follow Matt on Twitter, you will be entertained. What is the real motivation, though, making making envoy data we're right? Let's look at the types of service communication we have. You have kind of edge to service. Envoy list is very very well already. It's mostly. Actually it's about SSL termination. We have service to service communication still mostly HTTP.

A

Some share PC, there's things like mutual TLS on what is really well, but what about services accessing data resources, databases, storage as three Kafka Cassandra, memcache, T, readies, Kafka and so on? We want to make envoy perfect for that as well. This is where go extensions fit in we'll learn about that, and also the ssl visibility, because that data is typically encrypted and you cannot typically change your applications to just do clear text to AWS s3, for example, design printables. This is pretty boring.

A

They need to be clean and simple: they need to be safe and flexible. This may be more important right. So if a goal extension crashes, it should not bring down envoy with it.

A

The extension should be loadable at runtime, so we don't actually want to restart envoy when we load a go extensions and we want to preserve the good performance metrics in semantics, that envoy house so native execution speed. That's why we picked go to actually compare compiled into a native language, but also to have zero copy data exchange between the go extensions and envoy.

A

How does this all work? So this is where cilium comes in. You run your stack. You basically run cilium as the so called CNR there. We can also run in different modes, but if you're running kubernetes, you would choose solium as you're saying I plug in, we will run an agent. You will then tell the cilium agent why our a C or D or REST API, hey I, actually want to like plug in a go extension. You will say it should apply for this particular service.

A

You can specify this by a service label or Paul label or IP address some selector that we can kind of identify for what connections should tico extensions run. Serling will then go on and actually start envoy if it's not already run running and then configure a listener that listens on a port and that listener will have the information to actually invoke that go extension as part of the filter. It will then load a shared library which contains to go extension right at this point. Oh no.

A

It's already hooked into the go extension and for every for every data connection that the listener handles. The data will go to the go extension and the go. Extensions can parse that data and return a verdict. The kind of the connection is not yet flowing through envoy, so the last step is actually to configure and redirect that will redirect all connections through envoy, so the Coe extensions can actually see the data.

A

This is how how actually one thing that I missed here is that there is a key value portion in the CR D kind of just key value that is passed into the go extension. So why does cieaura REST API can basically configure your go extensions to, for example, and that a policy like this. This is how we do Cassandra. We have already used this ko extension framework to implement a memcache, D and Cassandra parser. This is how you would configure it right.

A

You would say ad for for any any service that matches AB Cassandra on port 1942. Redirect is to the Cassandra echo extensions and, by the way, pass in the following key, no key value table which then specifies this policy that says you can only do a select on my table and all order Cassandra calls would be rejected. So this is one example. You could use this for anything you like it is not it's not limited to policy at all.

A

This is how the API looks like it's very basic, so the go extension gets the data as to connection sees it and to go extension can then basically return the verdict. First of all, it can say: hey I need more data. I cannot parse the entire headers yet need more data. You can pass on data like n number of bytes, you can say I actually want to send something back to the original sender. You can inject bytes into both into both directions, or you can say, hey something went wrong. There is a parse error.

A

Please terminate the connection, so it allows us to control our own voice proxy behavior. In the future. We can add additional API calls or additional API bordick to actually influence. For example, the low balancing behavior of on what I talked about this acceleration. This is where, like the BPF PARP, plays a big role. So if you typically plug-in on boil on kind of using an IP tables redirect, for example, if you're running issue or something like this, it kind of looks like this.

A

So a lot all of the connections go through the stack down or done really on to Ethernet level over the loopback and back up into Envoy and then back out. This is using TCP, which was written for a lossy environment, but if you're running the proxy on the same, no that's the service station dot, really no reason to do TCP, which is why, if you run cilium using a reason enough currently we'll get something like this. We will detect that hey your service is talking to the sidecar locally.

A

We will simply copy the data from one socket to the other, and you get performance increased like this. You basically get UNIX domain sockets speed for TCP sockets without having to repoint your application to a UNIX domain socket or to one Y or to use some. Some other means to talk to envoy I will not go into all of the details. Overall, it's about three to four X faster for persistent HTTP connections. It's also faster, even if you point your apps directly to envoy like one twenty, seven or one.

A

The last piece that we need for the data visibility as I mentioned, is like visibility into SSL, like if, typically you talk outside of your cluster, it's usually SSL encrypted and you would not have the data visibility right, so TLS would happen. Inside of the service, we have transparent, SSL visibility using K TLS, which is Colonel TLS.

A

What we do is we defer the encryption from inside the service where the SSL library is running to after in the kernel right, so that the handshake to negotiate the keys that still all happening in the SSL library, but then the actual encryption is happening later. The reason why was this was done as Facebook and others have done this to more efficiently, provide video streams over ssl. By doing this in the kernel, it's about 3/4, 3/4 percent faster. That's the original motivation. Why to do this?

A

We're using this to basically provide envoy visibility into data, even if the application is encrypting the data. This is not 100% transparent. It's like 95, the SSL library running in the application has to basically say yes, I support. Katie Ellis, open SSL already supports this, but the library can say: hey, I, don't want to do this, so we cannot force the application to do this, but the application by default, if it's using an open, SSL library, will do this.

A

We have a flexible proxy model. You can run us in kind of the sidecar mode where the Envoy is running in the service, but we also have a model where we run one envoy per node, and then we transparent the redirect connections into envoy kind of a shared proxy model. This is interesting if you're running a lot of services on us on a particular node, you don't actually have to spin up many many Envoy instances, plus you don't have to modify any of your apps. This mode also obviously works for non containerized workloads. Very well.

A

To summarize this, like oh I, don't have to talk much about, let's definitely of its effectively more interesting, effective or efficient l7r else for 12:7 proxy. We have go extensions which run on top of Envoy I reload at runtime configured by a C or D or REST API they're injected by our cilium.

A

What we can also upstream this, of course, which I think will be interesting, and then we have syllable which, on its foundational level, provides networking and integrates into Envoy to do l7 policy on like service to service and also service to data, and we have integrate interesting honor integration, unlike acceleration side and into the and SSL visibility side of things with that I think I'm just about in time.

A

Thanks a lot everybody why we will have envoy stickers so like envoy goal and essentially stickers, walk up to me for to get the stickers I'm, not sure whether we have time for questions at all.

A

Okay, all right, there was a question over there. I think yep.

A

Quite like, quite frankly, I, don't know how to write. Lou I know how to write. Go notice that the real reason is there's a lot of existing protocol parses in golang, which makes it very interesting, like it literally, took us less than a week to write Kassandra support, memcache the support group. Just about to add my sequel. There's lots of existing code out there, which makes that choice an obvious one for us but like this is not limited to go along at all. We could also do the same from the world.

A

A

So the performance penalty right now injecting a go extensions, is about 10%, but I. Think we can. We can lower that even down right, so I think right now. What we measure is about 10% performs overhead. Most of that is, is how go does see. Go it actually does quite some expensive operations. When you switch context, I think we can lower that even more right. Now it's about 10%.