Cloud Native Computing Foundation KubeCon + CloudNativeCon China 2019 (Shanghai), 5 Jul 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Intro: Network Service Mesh (NSM) - Frederick Kautz, Doc.ai & Nikolay Nikolaev, VMware

Description

Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io

Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects

Intro: Network Service Mesh (NSM) - Frederick Kautz, Doc.ai & Nikolay Nikolaev, VMware

Network Service Mesh (NSM) is a novel approach solving L2/L3 network use cases in Kubernetes that are tricky to address with the existing Kubernetes Network Model. Inspired by Istio, Network Service Mesh maps the concept of a service mesh to L2/L3 payloads. Network Service Mesh enables a variety of types of Use Cases such as: * Connecting Pods to: -VPN Gateways -Non-Kubernetes virtual bridge domains -The *right* physical NIC or SR-IOV VF for their needs -Multiple-interfaces * Cloud-native NFV use cases Network Service Mesh controls the L2/L3 data planes to deliver these types of use cases. Network Service Mesh enables users to express the context of their network needs in a Cloud Native manner, rather than manually stringing together disjoint interfaces, IPAM, and subnets. Finally, we discuss how audience members can get involved and help drive the direction and development of NSM.

https://sched.co/OB2V

A

Welcome to the network service mesh introduction- I am my name- is Nicola Enquirer I work as an open source technology lead in the open source technology center at VMware.

A

The session was announced with to present us. Frederick outs didn't manage to make it so I'm going to do it on my own. We are both maintainer signatories mesh, also I'm, going to do the introduction today on my own, you see how this works.

A

Ok, so what we are going to discuss today is some of the tools that we have around networking and the cloud native networking, and we will try to discuss and demonstrate I mean in terms of how how network service mates works, how we are trying to solve these problems, but we see metal surface mesh is a very, very core technology. That is the way that we perceive it so whatever we are going to give as an example. Here, it's not the only application of this technology in this approach.

A

So please come to me, I'll be around to date more and if you get specific use case that you you are finding like challenges implemented it in a coordinated way, come and talk to me talk to us, the community. We have a couple of friends here, also in China.

A

Yeah but ok, let's see what the journey is so today we are going to, as I said, share some thoughts about the cognitive networking. We are going to look at how kubernetes networking API does. This is there's a good example.

A

We also, usually someone has seen our talks. We usually do this story type of story that we discuss usually help our friends, Sarah and her problems today, we're going to show another for our one of our friends, which is Marsha and her multiplication problems. We are going to also show how networks of this mesh works at a higher level and, of course, in the end, the couple of links and I hope that we have time for Q&A also.

A

So this is the cloud native definition is defined by CN CF. You probably show it so it today, Dan show it at his keynote. It's pretty long, there's no point in to reading the whole bit but yeah, it's very well written. So please go and check it if you haven't done so already, but we have outlined a couple of points that we think are very important for the networking done in a coordinated way, so immutable infrastructure gathered. Everyone aspires to that end. Note that this is important.

A

Loosely coupled system, like decoupling, all the components that are implementing your functionality in a coordinated way and minimal foil and mitosis in an important thing. No I really would like to do more than one date. They should so, let's say with minimal pollinate working. So what that would mean.

A

Essentially, people don't really want to think about all the details of networking. I mean you just want your good in connection. Then people would not really want you think about subnets route. I mean you're, not requesting a specific subject.

A

You want to consume some form of networking, that's on the conceptual and and that's why we would like to call these network services, and this is a famous technology, but we would like to think that although the requirements for connectivity or the aspects of connectivity are packaged in a single term called network service, so all your security or balancing cutting whatever you need you just pack, it isn't a network service and then, when you want to consume it, you want to refer to it by name. You just want. Okay, I want my secure, Internet connectivity.

A

This is a typical example that we give in our totes and one of our core examples in the project. But essentially imagine if you want to run your application in a cloud public cloud and you want to connect to your office. You want to consume some more form of network service that you get you the proper, secure access to your corporate Internet. So there are other examples given here, but we can continue to find this now how how kubernetes is going through this?

A

How Burnett is networking is applying this concept so essentially from conceptual point of view. You basically get your layer, 2 connectivity out of the box, want the POTUS deployed and created you get your your layer, 2 connectivity. We can do security with network policies, load balancing is there for those services and between the endpoints and what one would really notice. We start looking a little bit causal is that mostly most of these concepts are about inter cluster like hold the networking that goes inside.

A

A single cluster Beck has been challenges about this people are trying to overcome. But if you look at the plain networking that kubernetes describes today, it's about the internal intercostal communication activity, if you want to consume it, as we said it's just there once you get your pop connected, we have everything there and network policies and services. Are we easy to consuming to implement.

A

When talked about who's coupling this, this is something that's very familiar to all the application developers. When we start talking about micro services, it's essentially a way to abstract, oh you're, building blocks to some API abstractions, and then you can kind of build build like from these small blocks. You can do more complex functionalities and design patterns. It's very flexible way to actually implement complex functionalities.

A

But if you look at it, historical networking has been very strongly coupled to the to the infrastructure, and we what we typically see that your networking is coupled to your cluster, to a data center using a public cloud, PC, etc, and you don't really care very much Randall IT and flexibility to the way that people would really like to do it at some point, you could start doing more advanced things.

A

How this works with kubernetes networking? Yes, in general, you are your decouple from the specific implementation through the CNI, which is contaminated interface, container networking interface and on the other hand, it is also strongly coupled because usually get one CNI plugin per cluster. You can do multiple C&I. There are ways, but it's not really obvious a consistent and easy to do it.

A

What you, you would also see that there is a single H which is typical for for the entire cluster or even for multiple clusters like if you ever in the data center using virtual machines, then you can very easily end up with a single H of your multiple clusters chain and the granularity is not is not a very fine here. I mean like you, either get your networking call, you don't get it. You cannot tweet for particular workloads.

A

From the immutable point, material infrastructure point of view, essentially your option on really high level, so you cannot really change anything, particularly from the point of view of the networking functional data and actually there are abstracted into the kubernetes and CNI api's. So your possibility cannot request any specific networking capabilities from from the infrastructure and you cannot change that easy of nice I checked here twice.

A

So, let's look at our example and the story that Marshall has to tell us so um March is trying to implement an application that yes, some multi cloud and highway 12 transports. What that means is that essentially she wants to.

A

She has workloads that are running. Possibly you know public cloud in a private kubernetes deployment, maybe some legacy virtual machines, and here we have some bare metal deployment cycles on or they could be some huge database running here already. You know data center and you don't want to mess with it. So she wants all these things connected. Now. If you look from the point of view of networking, you will find that each of these domains have their own ideas about how they do networking.

A

So the public will have their own private Siana implementations, your own premises, kubernetes deployment. You probably have some some of the publicly available co-op limitations for private citizen, z9 connotations. Virtual machines have their virtual networking and, of course, your bare metal physical networks. The usual way that you interconnect this is on network to network.

A

Direct connections, which is not very fine, great no I, mean the the usual way that we do this. Is you just draw a line? If you want to call it like this from one network to the other, and then you assume that both networks are connected, and then you have to put some filtering and additional work just to be able to isolate particular workloads and pots, and there's no actually very Oh way for Marsha being adjust the developer to to do this.

A

On her own I mean she, she gets to work with all the things that I evolved in setting up all these complex networking, but in the end, what she really wants to do is to be able to connect her workloads Holly, so should see what wants to be able to declare and say: okay, my workload button on the public cloud wants to to connect on my workload at Simone, private cloud and virtual machine bare-metal, etc, etc, and that's one of the things that we are trying to solve it network service mesh. So it comes.

A

We have this concept of virtual wires or some kind of abstraction of connections that actually will help her in this situation, to essentially request a network service that we will implement this point-to-point connectivity for her. Of course, under the hood they still be. You know all the all the networking inter inter cloud intercom networking going on, but the network service being something that can be requested straight from the pot level, actually will help her very easily to implement her distributed application.

A

Contacts that we set already, essentially, we have this Marshall sub connectivity, Network service that she can request, and she she can do that from the MIMO pop up point of view. Whatever we do with networks of this mission, I have an example later to explain how this works is. Essentially, what she has to do is to just rotate her deployment manifest with this. This special label, where she essentially requests a specific network service and then network service mesh, takes over actually provides all the connectivity from there.

A

Of course, someone has to implement the network service before it's not working just magically out of the box from the loose coupling yeah. We already said that, essentially you don't you don't bind to your inter, inter domain connectivity, you bind to to my decouple from from there and you you have just your connectivity between your world codes and from the immutable immutable infrastructure point of view. Essentially the way to enable network service meshes though we have helm charts or you just install and ascend there. It works on top of kubernetes. It doesn't change.

A

Any aspects of covalency doesn't use any special special version of kubernetes; it doesn't change, the CNI doesn't interfere with it. We think that CNI does his job great for the way it was designed. We don't want to mess with it. I know that there are some approaches. People are trying to implement some various form of tweets, ionized, etc.

A

To solve some of these problems, our approach is to kind of amend to that, to provide some extended capabilities based on our concept that we do the network service mesh and, of course, it works with any CNI and to prove that it works with any CNI. We are having our CI and continuous deployment.

A

Rc sed pipeline continuously running kono on a couple of public clouds, also virtual machines, bare metals and also used kinds, don't know if you're familiar with kind, like it's a very nice project to put on your tests against the central us kubernetes unit. Okay, so with that I I can move on to how this thing works, and before we talk about how this thing works, how anything works.

A

I would like to talk you through a little bit to our definition of for tax, for the NS, a Miss, so any same is treating network service definition of GPC API and distributed control, planning or shared state, so starting from the last four distributed control plane this kind of resembles the product kubernetes case with its cubelet.

A

So there are kind of local agents that are same, it's separated from each other, it's kind of distributed. They work on on their own. This is what we do again. We call these Network service managers. We run them as daemon sets.

A

Then the GPC API is essentially an abstracted way to describe, publish and consume network services, and then we have the definition of network service where we actually say that the network service is not a single entity, it's essentially a composition of multiple functions and endpoints that are kind of bound together to a single network service description. This picture, of course, all these concepts and all these theories we have implemented in our gift.

A

Every poem it's a kubernetes based implementation, but the overall edge of the project is, is done in a way that we are the component. Specifics are isolated in a separate module that can be replaced. So today we don't use much of uber natus, except for its center of storage like HCD, and to use multiple scheduling our thoughts about natural, doing network service mesh, but other that we are not tightly bound to kubernetes all in theory. It should be.

A

It should be easy to actually out all these other aspects of virtual machines bare metal- and there are some interesting work going on discussions around these things.

A

Also, today we reuse as a kind of basic packets passing or as we call it forwarding component holding plane. We use VPP, which is FDI yo, the new foundation project, but there is a word going on around implementing a pure kernel, only based implementation, which will not depend on VP, and it's not that we don't like the VP. It's just that we want to do to be able to demonstrate how the underlying forwarding plane is independent from an SM. We are not bound to any specific implementation.

A

We want to have something that is bare metal for chemical baseline, that we can just run each and everywhere, without really realign connector part cone components, so a couple of slides to show how how these things work in more details. So if you have your kubernetes cluster with let's say here, we have three worker nodes. The first thing that we do is so we apply our custom dissolve definitions.

A

We define three essential, secure this network service, manger registry network service, endpoint registry and network services registry, not obvious for the services, so once we deploy with helm, for example, once we deploy network service mesh in the same, it essentially deploys diaper service managers, which are the mandatory components we also deploy alongside it. The forwarding plane, which in this case is we DP, but it's completely orthogonal, it can be deployed in another by other means.

A

What's important here is that essentially network service managers gets registered to the center registry, so they are very well defined, which Metro service manager on which work or not it runs. Then the next thing is to essentially deploy the network service, which is I, will show it later. I have a slight switch base. Some llamo file descriptor else tells us how the network services composed out of the endpoints, then, when we deploy the endpoints, which also get registered in the central registry. This is for the red service.

A

You do the same for the bull service, you network service and then, when the client comes and want to consume that service or direct client there it. It will essentially communicate to its to its local network service manger. This local network service manager is going to consult the central registry about what the service is. What this network service is, what endpoints are implementing it, etc, etc.

A

There's a selection process going on based on labor matching and then both petrol service managers that are involved in these processes are going to establish a point-to-point connection, and that's maybe one of the crucial thing that we should mention here that, with with network service mesh, we don't do broadcast domain remains virtual switches or things like that.

A

It's only point-to-point connectivity between box and, on the other hand, this network service endpoint, maybe would like to also chain the term that was used in service chaining, but we would like to call it compost here, but you can connect to the other network service endpoint that actually implements the full network service as a whole. So in this case this network services is composed out of two endpoints and, as you can see here, the first endpoint here essentially is getting two new interfaces at runtime.

A

This is one thing that network service mesh actually uses as a tool to achieve its goals. We support multiple interfaces for ports and they can be requested and disposed at runtime. You don't have to restart your services to to do any fancy things that just are there the moment that you request the service. You just get your interface injected, then you can start consuming it same of course goes for the blue service. The client can come and you can consumer to service wanting, but I don't know this.

A

It's seen very clearly, but here on the bottom, we essentially have labels on the service request. So once connection request goes out of the pot, you can have labels alongside it. Like you can say, I want to consume service version two and then it should be able Metro service. My should be able to get you the proper service label to it. The proper way cause there's some rate for matching involved here in the picture.

A

How the network is consumption happens. So if you give your your application container and you want to run it- you know network service mesh enabled, but essentially, as we showed before, all you have to do is to use our own mutations format and then there is pink, which is an SM admission controller.

A

It processes this deployment at deployment time it up creation time and it figures out what the services it's essentially injects in it container there, and this in each container takes care to actually inject the interface for your and to ensure couldn't connectivity and consumption of the network service. Now this is one one way that, but someone can do things. We have more advanced ways. We have an SDK that actually we can incorporate in your application straight and actively request and major services and connection that your application, but this is the easiest way.

A

If you just want to consume something: that's it's out of the box, you don't even have to change your application.

A

This is some example on on the network service manifest. So this is how we essentially visit the descriptor of natural service manifest. So the first thing that we have, we have our custom resolve defined of kind network service. Then we have the service name, which in this case is secure, Internet connectivity or it could be marshals up connectivity, we're talking about Marshalls application here then, of course, we have the payload type, which in this case is IP network service mesh is pretty much payload agnostic.

A

So if you have seen our site or some of our slides, who call the number we are claiming that we can do layer, 2 and layer, 3 connectivity.

A

There's nothing really bound, there's noting a motive bound or hard-coded in the picture and the design principles that we have, that is binding, cost or any particular workload.

A

So one of the use cases of this just before me here they were discussing queue, flow and queue flow, is essentially a way to intensifying kubernetes way, but on top of the kubernetes infrastructure, but they are limited to whatever the kubernetes networking is giving them to essentially use TCP to communicate between the nodes.

A

Now, that's good, but if someone of you knows tensorflow, there's also improved performance performance improve on based on using our DMA, which is a really fast way to communicate between the nodes, and one of the things that we were discussing with some of the members of the community is how we can essentially enable cube flow. For example, we poke our DMA mean between the the notes, so essentially, in that case, the service there would be payload would be our DMA or other more something else.

A

Whatever is needed there so to continue here with the you know, it was mesh the descriptor. We have label matching for selecting the endpoints. This is essentially a much on the label that comes from the clients request, so in this case the label mark Doug. The driver. Much refers to a Pecos firewall, but it could be, they could be multiple label that could be versions, etc. Whatever people people need, and then we have a simple routing and then there's again they were marching for selecting the endpoint.

A

Essentially, each of the endpoints are labeling themselves saying: okay, I am implementing worst one implementing a firewall on lamenting a gateway.

A

So, given all this, this is essentially the basic rule for finding the way to the mentioned. Finding the way how to wire and to connecting so within this mesh- and the last thing that we have here on the slide is a wild card or essentially, if you don't specify labels, you can just use a wild card matching for default connectivity, routing.

A

This is more or less what I have to share with you, so we have our network, our side, network service, mesh, Delta Y. We have our github page. We are CNC, f, sandbox project, since April you're actively participating put some of the initiatives there. One of them is a little related to telcos. This is another one of the aspects of network service mesh. There's some interest around this. How telcos can be enabled to do cognitive networking?

A

If you want to connect with this on our side, you have the communities of page. We have a slack channel in CN, CF slack. We have a couple of calls during the week we have mailing lists. It's all listed there and so I think that we have some time for questions. Yeah, bleep weed okay, but if you want to find me later, unfortunately, as I said, the other maintainer that was supposed to be here couldn't make it so I'm.

A

The only one representative here on the project I'll be late at our booth between 2:00 and 4:00 p.m. today and tomorrow and the CNC app answer bar near the end of the event. But a video and someone wants to chop and discussed some of their specific problems are began and that's all from me.

A

This, what we have some time for questions, maybe yeah widow or questions.

B

Hi Nikola great proposal here: I haven't the questions yet the first wise I mean in the security in the service case and as as you, papa so yeah and and and it's crime to connect and maybe client to me. Never I work service and the point and the Soviets any point of view, connect to VP and get away in a pointer and can be and connect to the service to the Mito service and the point of the example for v5 were published in print yeah.

A

B

We connect to a service, mercenaries missiles.

A

Yes, yes, so there's nothing in the architecture that actually prevents you from doing that. It's up to the endpoint to be able to accommodate more incoming connections and how it you can know them now it depends on the application. So, if you want to give the best scaling application, you can probably put some limits on the incoming connections and say: oh okay, I cannot accept more than five connections or my CNF form for my endpoint or you can just let it run as as much as possible to accept each and every request.

A

That's best not in binding in the architecture. Here to tell you, you should run only one interface or five or ten over.

B

Okay, here I mean icing and is okay for a technology but I I, guess and it's hard to manage that the circle and never reserves and emprender was anger and in the know, service panda is that is instead and and we have to excuse and maybe turn lower service or more never service is harder and no connection. Yeah.

A

Yeah, so we have that's, probably one of things that that is worth mentioning, condition to talk to that we have pretty pretty complex out of healing functionality implemented some stupid. That needs to be clean, but it works pretty well.

A

So, essentially, what we have today is that at any point in time, because we are essentially managing the connections- and we know what type of functional design point is implementing if the end point dies, we can essentially rewire you to another end point that that implements the same function and I mean, of course, if you, if the end point is stateful, then it's up to you to have mean to to the implementation of network service on the end point to have the replication of the state between the neighboring end points.

A

But if it's stateless then like, if it's just I, don't know passive packet filter that just drops packets or some ACO rules, you can just be rewired and your service will just continue to work without any okay there's going to be some small beach. While we identify the end points and why we rewire, but still you can change okay,.

B

Another question yes, and why we used an image container for an immersive scan to connect, no service I mean. Can we use another and another function? For example, we use a controller. Yes, we we adjust there and watched and labels of the and unique you know. Nevertheless, current label, yeah, I, guess yeah. She wanted to connect whom there was service and I just and to connect to, and no spike in and put.

A

A controller by.

B

Any container widely used, that was the advantage, and this one advantage that I.

A

Guess I thought this was more or less inspired by the way that other guys are doing.

A

Projects in the domain are doing more things like I'm sure you know how the service missions like is to and link early they're using, not in your container but citecar proxy sitting there. What you're, saying actually makes makes a lot of sense. I will be I'll, be I mean it would be nice if you can chop later about it. But, yes, it makes sense. Whatever.

B

A

Ask me the way that we did it is we essentially have an SDK. So what we? What we did is we just created a client package it as a sidecar con container and found that this works a little way with an admission control. But yes, of course we can, we can go without it. We should gather Mista.

B

Is a high high speeds and for the nervousness trying to connect you know so the service or the internet, but in containment.

A

B

A

Really get the question, but you can we.

B

Can thank you. Thank you.