►
From YouTube: Deep Dive: Network Service Mesh (NSM) - Nikolay Nikolaev, VMware & Frederick Kautz, Doc.ai
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Deep Dive: Network Service Mesh (NSM) - Nikolay Nikolaev, VMware & Frederick Kautz, Doc.ai
Network Service Mesh (NSM) is a young and ambitious project, offering solutions to many current problems around Cloud-Native Networking Connectivity in the L2/L3 layers. In this talk, we walk the audience through the process of solving practical problems with NSM using three scenarios:
Enabling an existing service-based solution to run on top of NSM with no code changes
Building a Network Service with the existing tools, with minimum coding
Using composition to build complex Network Services out of a collection of simple ones
The focus is on explaining the principles and offering practical advice on how to design for and integrate with NSM. Some source code and YAML manifest excerpts may be shown to illustrate the ideas.
Finally, a quick demo of a pre-implemented example will be show a link to all examples and materials will be shared for further exploration by the audience.
https://sched.co/NxZi
A
B
A
B
We're
going
to
show
a
little
bit
of
llamó
files
on
the
screen.
I
hope
that
they're
going
to
be
seen
good
and
slight
reduction
of
our
goal
code
that
that
you
can
use
to
enable
network
service
match
for
your
applications.
We
try
to
make
it
not
look
that
scary,
so
we're
going
to
go
through
and
fetch
your
own
right.
A
So
so
so
what
is
so
network
service
smash?
So
we
start
off
with
like
what
is
the
network
service,
so
in
network
service
mesh,
we
have
three
core
concepts:
we
have
something
that
wants
to
connect
to
a
network
service.
We
have
something
that
provides
the
network
service
and
we
have
something
that
the
we
have.
The
connection
between
between
the
two,
so
a
network
service
is
anything
that
you
want
to
connect
to
that
provides
that
provides
a
service
for
you.
We
specifically
look
at
layer,
2
and
layer
3
services.
A
So
if
you're
looking
for
an
l4
or
l
7,
then
kindly
ask
you
to
take
a
look
at
sirs
that
the
application
service
message
message,
such
as
sto
link
or
D
and
so
on.
What
we're
focusing
on
specifically
is
is
l2
and
l3.
So
if
you
have
a
internet
or
an
IP
payload,
you
want
to
pass
then
this
is
the
this
is
place
to
do
it.
Although.
A
A
You
can
do
through
G
RPC,
and
so
this
means
that
if
you
want
to
hook
in
something
like
we're
starting
with
kubernetes,
but
if
you
want
to
hook
an
openstack
you
want
to
hook
in
a
physical
system,
then
you
use
the
G
RPC
api's
and
you
can
then
connect
things
that
are
not
part
of
kubernetes.
The
system
is
also
distributed,
so
there
is
no
centralized
control
plane.
In
this
scenario.
It's
it's
purely
it's
purely
distributed.
We
do
have
some
patterns
that
we
kit
that
we
recommend.
A
If
you
have
to
do
something
with
some
centralized
information,
you
can
centralize
that
to
a
to
a
specific
system
perform
the
work
you
need
to
do,
but
inherently
it
is
a
conservative
system
at
heart
and
we
also
provide
a
concrete
kubernetes
based
implementation.
So
this
implementation
is
a
we're
calling
it
a
moment
our
reference
implementation.
It
is,
it
does
not
touch
your
kubernetes
networking,
it
is
orthogonal
to
CNI,
so
we
also
leverage
at
CD
as
the
central
stare
shared
storage,
so
we
actually
create
CRTs
and
we
store
information
about
where
the
network
services
live.
A
So,
let's
start
with
what
network
service
mesh
shows,
so
we
start
off
with
in
in
the
in
the
system.
We
have
a
network
service
manager
so-
and
this
is
where
this
is
a
demon
that
stores
that
that
is
actually
doing
the
actual
facilitation
of
the
connections
themselves
and
we
store
the
pointers
to
each
of
those
with
the
within
the
kubernetes
registry
itself.
So
we
know
where
each
manager
lives.
We
have
a
registry
of
network
services,
so
this
is
where
so,
you
create
your
network
service
in
a
pod.
A
They
then
get
stored
in
the
location
of
those
gifts,
or
rather
not
the
location
with
the
definition
of
those
gifts
are
in
the
registry.
So
this
includes
information
like
what
payload
is
it
is.
It
is
like
an
IP
or
as
Ethernet
or
MPLS
or
so
on,
and
we
and
we
also
have
the
endpoints,
which
are
the
things
that
actually
provide
those
services.
A
So
it's
very
it's
very
similar
to
kubernetes,
where
you
might
have
a
service
that
provides
a
NAT
web
application,
and
then
you
have
a
set
of
n
points
that
actually
provide
you
the
real
thing.
So
we
have
the
same
thing.
We
have
another
service
that
provides
you
with
a
description
of
what
the
service
is
and
we
have
endpoints
that
provide
you
with
the
actual
connectivity,
and
so
once
we
have
connections
where
you
see
I
can
know
where
service
client
itself,
through
with
some
context,
so
we
show
off
with
a
label
on
the
bottom
left.
A
A
So
if
you
want
to
submit-
or
you
want
the
bridge
domain
virtual
means,
like
think
of
it,
like
a
switch,
then
those
are
network
services,
so
you
are
connecting
to
a
network
service
to
to
a
subnet,
so
in
so
what
this
ends
up,
looking
like,
if
you're
trying
to
define,
if
you're,
trying
to
define
a
service.
So
let's
sort
of
one
of
the
examples
that
we've
shown
in
the
past
was
the
concept
of
like
how
do
you
connect
to
a
VPN?
So
if
you
think
it
would
it
takes
to
connect
to
a
VPN?
A
You
want
to
have
a
pod
to
connect
to
a
to-
let's
say,
corporate,
to
secure
corporate
internet
so
that
pod,
the
the
operator
may
decide.
Ok,
we're
going
this
pod
must
go
through
a
firewall.
Let's
go
through
an
intrusion.
Detection
system
goes
through
a
VPN,
client
and
Gateway,
and
so
on.
So
this
entire
list
of
things
this
entire
chain
is
specified
by
by
the
operator.
So,
as
the
consumer
of
this
VPN,
you
shouldn't
have
to
care
about.
Any
of
that
you
should
not
care
about.
Is
this?
A
This
thing
have
a
firewall,
because
your
operator
is
taking
care
of
that.
For
you
all
you
care
about
is
I
can
connect
to
this
thing
in
just
so
it
works,
and
so
so
this
is
so.
This
is
one
of
the
areas
that
we
have
where,
if
you
see
we
have
on
the
we
have
a
source
selector.
So
so
this
actually
specifies
two
two
end
points
that
we're
looking
at.
So
one
of
them
is
if
a
default
match
so
you're.
When
you
connect
in
with
it
there's
the
default
match
is
as
empty.
A
We
have
a
route
to
the
destination,
the
destination
says
app
firewall.
So
that's
actually
the
the
bottom
one
they
actually
come
around,
so
I
can
point
it
out
so
yeah.
So
you
can
see
the
destination
right
here:
match:
route
firewall
and
then
the
firewall
when
firewall
connects
to
the
network
service
so
did
scum.
These
are
all
composable.
So
when
the
firewall
connects
in
and
says,
I
want
to
connect
to
secure
Internet
connectivity.
Then
this
is
at
the
sources
firewall.
A
The
destination
is
then
VPN
gateway,
so
you
can
create
arbitrary
chains
of
your
network
services
and
in
this
way,
so
so
as
an
operator,
your
your
defining
declarative,
because
in
a
declarative
way,
what
your
system
is
things
to
note
about
this
as
well.
There's
no
'wipeys
listed
here,
there's
there's
a
payload
payload
is
set
to
IP,
but
we're
not
we're
not
putting
any
MAC
addresses
or
not,
who
are
not
storing
anything
about
the
runtime
on
the
scenario
that
I'll
get
freezing
they're
still
little
IP
addresses
there.
A
So
what
this
ends
up,
looking
like
in
for
our
particular
system,
if
you're
the,
if
you're
the
user,
who
wants
to
connect
so
notice,
this
one,
is
a
deployment
and
has
a
it,
has
a
pod
spec
inside
of
it.
So
this
was
just
running
alpine
and
in
the
metadata
we
added
in
the
an
annotation
in
that
annotation
is
ns,
then
we're
service,
submission
of
I/o
and
the
name
of
the
service
that
you
want
that
service.
You
could
be
secure.
A
Internet
connectivity
like
this
as
we
had
before
the
label
allows
you
to
provide
additional
context
additional
information.
Our
recommendation
is,
if
you
want
to
add
in
a
label
the
label
should
be
something
that
is
at
a
high
level.
That's
declarative
level
shoe.
You
should
not
be
yeah
peel
an
ID
or
you
should
not
be
adding
in
specific
the
excellent
data
or
that
kind
of
stuff.
So
let.
A
At
a
lower
level,
at
the
operational
side,
and
so
if
you
include
the
sanitation,
then
we
have
an
admission
controller
and
what
this
admission
controller
does?
Is
it
inject
San
in
ink
container
into
your
into
your
pod,
and
that
any
container
will
then
use
the
SDK
that
Nikolay
is
going
to
show
in
order
to
make
the
connection,
something
that
something
that
we're
able
to
do
as
well?
Is
that
this
is
for,
like
a
standard
legacy,
say
like
say
it's
a
standard
application.
A
If
you
want
to
hook
in
something
that
has
more
intelligence,
more
complexity
at
the
network
layer,
you
could
also
use
the
SDK
directly.
You
don't
have
to
bring
in
the
in
in
container
while
the
application
is
running.
You
can
ask
for
things.
So,
if
you
want
to
say,
I
want
to
open
up
a
firewall
open
up
a
connection
to
my
secure
banking
information
or
and
start
or
find
my
financial
network
and
start
to
make
some
operations.
A
So
the
way
that
so
the
way
that
this
works,
I've
compressed,
I
compress
this
a
little
bit
I'll
from
the
operational
side,
is
in
the
client
when
you
make
a
connection,
so
these
black
lines
are
all
G
RPC.
So
we
make
the
connection
request
down
and
in
this
connection
requests
we
say
we
would
like
secure
Internet
connectivity
or
that's
and
I've
gets
resolved
to
VPN
gateway
pod,
and
so
we
say
request
connection
so
we're
never.
A
A
So
these
are
Colonel
bypass
mechanisms,
ways
to
get
to
your
data
plane
very,
very
quickly
without
occurring
the
cost
of
the
colonel,
and
so
so,
if
your
pods
is
more
intelligent,
you
could
say:
I
support
my
FB
host
user,
currently
interface
in
that
preference
and
that
all
gets
wrapped
into
the
request
and
gets
in
up
to
the
to
the
NSA
manager.
The
innocent
manager
will
take
that
particular
request
for
the
network
service
and
forward
it
on
to
the
pod.
That's
providing
the
service
and
that
pod
can
make
a
decision.
A
A
So
this
is
for
the
single
node
example
of
the
multi
node
example
is
similar.
So
multimode
is
an
example.
We
have
a
request
connection
with
that
local
mechanism,
as
we
have
before
it'll
it'll
connect
to
the
to
the
CRD
or
to
the
kubernetes
api
server
to
work
out
where,
like
which
network
service
manager
do
I
need
to
connect
to
in
in
order
to
gain
access
to
that
system.
So
once
it
once
it
knows,
of
its
an
assent
manager
to
it'll
then
send
that
request
over
to
the
msn
manager.
A
To
now
this
additional
request,
number
step
number
three
has
some
additional
information.
It
added
it.
So
this
information
is
about
the
remote.
What
remote
mechanisms
that
this
data
plane
down
here
supports,
so
you
might
even
have
two
different
data
planes
from
two
different
groups,
so
this
data
plan
might
say:
I
support,
VX,
LAN
and
GRE
and
we'll
send
that
in
the
request,
connection
step.
Four,
that's
that
information
gets
stripped
out,
but
it's
still
stored
off
to
the
side
and
the
requests
like
before
get
sent
to
the
VPN
gateway,
so
that
back
half
is
the
same.
A
When
it
accepts
we
create
an
injecting
interface
on
the
right
side.
We
then
create
the
tunnel
with
the
data
plane.
We
create
that
we
create
the
tunnel
on
the
on
the
right
side
and
the
data
planes
will
then
so
now
that
we
now
we
have
the
the
tunnel
created
at
least
we
now
have
some
more
information
that
we
can
then
pass
back.
So
maybe
the
data
plane
selected,
we
we
decided
to
go
with
VX
lab
with
these
parameters.
So
now
we
can
have
your
your
tunnel,
so
that
gets
encoded
into
reply.
A
So
when
they
reply
returns,
an
assent
manager
now
has
all
the
information
it
needs
in
order
to
make
that
connection,
so
the
interface
gets
injected.
In
with
the
mechanism
requested,
then
the
side
of
the
tunnel
gets
created
using
the
information
that
came
from
the
reply
and
once
the
tunnel
is
established,
we
respond
that
the
connection
is
ready
and
then
now
you
have
a
full
working
connection.
So
we
use
this
pattern
over
and
over
and
over
again
just
to
in
order
to
create
and
connect
the
network
services.
Before
we
move.
A
The
other
thing
that
the
other
advantage
that
we
have
is
that
when
we,
when
we
establish
connection
we're
not
part
of
the
lifecycle
of
kubernetes
other
than
the
pod,
can
make
requests
it's
part
of
a
pod
for
this
example.
So
when
you
start
CNI
CNI
starts
before
the
filesystem
is
established
and
I
notice
times.
We
are
talking
about
file
systems
here
in
a
networking
duct.
But
what
happens
with
the
is
is,
if
you
wanted
to
add
in
shared
memory,
so
you
want
to
do
kernel
bypass.
A
You
have
to
be
able
to
mount
an
inode
somewhere
in
your
file
system,
so
you
can
then
access
it.
Since
you
have
no
file
system
when
C&I
is
running,
you
don't
have
anywhere
to
put
it,
you
do
have
access
to
a
network
name
space,
so
you
can
inject
kernel
interfaces,
but
you
cannot
and
you
cannot
easily
inject
a
shared
memory
interface
into
into
the
system
so
because
of
that
limitation
that
required
us
to
to
provide
a
alternative
path
in
order
to
establish
those,
and
so
that's
a
good
question
sure.
A
So
so
kubernetes
never
policy
is
not
something
that
we're
providing
in
us.
So
we're
orthogonal
to
kubernetes
networking
you
can
have
policy,
but
your
policy
would
get
encoded
into
the
network
service
or
you
provide
a
policy
through
an
every
service.
So,
like
you
can
have
a
firewall
and
a
firewall
could
implement
your
policy
for
you,
but
we're
not
reading
directly
off
of
kubernetes
policy,
because
it's
it's
an
it's
an
orthogonal
network
to
it.
I
saw
one
in
the
back,
though,
here.
B
A
Kind
of
permissions
I'm
privileged,
so
the
the
injection
occurs
with
in
coordination
with
the
network
service
manager
in
the
in
the
data
plane,
which
have
a
little
bit
more.
The
data
plane
doesn't
have
permissions
if
ever
I
call
anymore,
so
we
actually
managed
to
get
rid
of
that.
So
so
we
delegate
we
the
when
we
make
a
request
from
this
and
it
container
there's
no
permissions.
It
gets
injected
in
through
something
that
the
user
does
not
have
control
over
other
than
the
ability
to
make
a
request
for
a
connection
sure.
A
So
so,
in
terms
of
see
the
CNI
part,
so
we
we
go
to
great
lengths
to
not
interfere
with
the
CNI,
so
we've
Kerber
Nettie's
networking
is
very
well
done.
We
don't
want
to
mess
with
that
simultaneously,
anything
that
it's
it's
up
there.
There
is
some
part
of
the
application
in
terms
of
how
you
set
up
the
routes
and
so
on
and
those
routes
like
independent
if
you're
a
VPN
gateway,
you
provide
those
routes
and
those
would
get
injected
in
and
then
those
would
then
head
off.
So
as
an
operator
you
do
need
to
be.
A
You
do
need
to
be
slightly
concerned
with
some
of
this
stuff,
but
it's
not
it's
a
lot
easier
than
than
the
current
state,
because
the
current
state
is,
you
said,
is
you
may
end
up
setting
route
school
bully
at
a
high
level,
and
in
this
scenario
we
can
negotiate
that
and
if
and
we
could
set
up
a
policy
that
says
if
the
routes,
conflict
or
there's
some
conviction,
here's
how
you
resolve
it
or
here's
our
failed
connection
or
our
so
on.
So
as
an
operator
it,
it
should
make
your
life
so
easier.
A
Okay,
so
so
this
is
a
little
bit
of
an
interesting
area
when
you
so
in
terms
of
scaling
out
so
first,
the
actual
innocent
managers
themselves
are
point-to-point
system.
So
each
of
these
connections
is
is
point-to-point,
so
are
you
thinking
like
VX
land,
where
you
might
run
out
of
like
us,
like
parameters
or
so
on?
Are
you
just
thinking
about
management
zone.
A
So
well,
the
gateway
pod
is
a
service,
and
in
this
scenario,
and
so
in
this,
in
terms
of
in
terms
of
scale
out,
we
can
scale
out
the
number
of
pots
that
you
have
so
like
the
instead
of
having
a
single
gateway,
you
can
have
multiple
gateways
or
so
have
a
single
firewall.
You
can
have
multiple
firewalls
and
when
you
do
the
connect
and
then
we
can
based
upon
some
mechanism,
we
commend
and
select
one
on
your
behalf
and
connect
you
to
it.
A
Well,
the
good
news
is
the
tunnels
are
cheap.
So
what's
what's
more
expenses,
if
you
try
to
set
up
like
if
you,
if
you
try
to
set
up
it's
a
V
switch
or
something
like
running
at
altar
of
each
switch,
these
switches
are
very
expensive,
they're
very
computationally,
expensive
in
this
scenario,
we're
just
doing
very
simple
point-to-point
connections
and
point
point
connections
scale
out
very
well,
like
the
entire
Internet's
beds,
built
on
point
point
connections.
So
from
a
scalability
perspective,
this
entire
system
is
distributed.
A
We're
able,
if
you
get
too
old,
to
a
hyper
scale
scenario
where
you
don't
want
to
list
out.
Where
is
every
Edison
where's
every
gateway
pod
when
you
get
to
a
high
will
to
a
hyper
scale.
We
haven't
implemented
this
yet,
but
you
could
go
and
do
something
like
summarization
or
something
similar.
So
that
way
you
say
here's
one
particular
system.
Then
you
let
the
backend
system
resolve
which
is
very
similar
to
how
DNS
works
today.
So
what'd
you
hit
DNS
will
give
you
back
an
end
point.
A
A
A
It's
it's
it's.
This
is.
This
is
more
on
the
persistent
side,
so
it's
not
like
you're,
making
a
connection
making
a
packet
closing
connection.
So
you
establish
connection.
Then
you
now
have.
This
is
an
l2
like
an
l2
l3
connection,
now
I'm
not
not
like
an
l4
or
L
7
l7
connection,
so
once
you've
established
it
like
it
might
be
a
connection
to
your
gateway
pod
and
then
you
just
spend
everything
over
it.
So
I
want.
A
B
B
B
One
way
to
actually
do
to
consume
network
services
with
within
NSF
is
implementing
the
so-called
smart
client.
So
whatever
Fred
showed
a
couple
of
slides
ago
with
the
admission
control
is
like
injecting
the
in
container.
This
gives
you
some
flexibility
to
use
your
to
actually
enable
anything
for
your
existing
applications.
But
if
you
want
to
do
something
because
smarter
you
want
to
be
able
to
control
your
connections
to
the
to
the
N
to
the
N
network
services,
you
should
use
the
SDK,
and
this
is
how
it
looks
like
so.
B
Essentially,
there
are
three
three
four
actually
cost.
So
the
first
thing
is
you
create
a
new
client.
Then
you
call
the
connect
method
with
a
couple
of
arguments:
the
interface
name
that
is
actually
going
to
to
be
injected
in
your
in
your
pot
where
the
application
is
running.
The
next
argument
is
the
type
of
the
mechanism.
So
currently
we
here
shown
Curnow,
but
you
can
use
the
other
mechanism
that
we
do
support
it's
a
retro,
TV
host
user
mif
and
whatever
appears
in
the
future,
and
then
we
have
some
small
description
just
for
logging
purposes.
B
Saying
things
like.
Ok,
your
primary
interface
got
connected
then,
as
a
result
of
disco,
you
essentially
get
a
connection
structure,
so
this
is
a
dumper
in
our
jogger
where
actually,
you
can
see
because
remember
all
these
calls
within
the
SDK
actually
are
hiding
our
G
OPC
communication,
so
we
have
yeri
enabled
all
over
the
NSM
infrastructure.
So
when
you
look
at
the
messages,
this
is
essentially
what
you
get
as
a
result
of
this
call.
So
you
have
all
the
information.
In
this
specific
case,
we
have
requested
the
services
IP
enabled.
B
So
that's
why
the
endpoint,
the
network
service
essentially
apply
it
with
other
IP
addresses
around
psyche,
neighbors
fifteen.
All
the
data
is
filled
in
the
context.
So
getting
this.
So
what
you
see
here
is
we
have
a
source
IP
and
the
destination
IP,
so
the
source
ID,
the
sole
we
didn't
ever
sell
this
mesh.
We
we
call
the
source,
the
the
requester
of
the
other.
So
in
this,
in
this
case
it
would
be
the
client.
B
So
this
means
that
your
local
address
that
you
get
is
1061
one
and
the
remote
address
of
the
point-to-point
connection
is
1061.
This
is
just
for
information.
Reason
for
information
reasons,
I
mean
you
don't
have
to
do
anything.
You
just
can
use
this
information
to
implement
your
functionality.
The
interface
is
injected
in
your
pot
and
all
right.
This'll
set
all
the
routes
and
set
everything
is
in
place.
Our
tables
are
updated
and
cetera,
so
this
is
all
done
to
the
sdk.
So
when
you
get
this
this
information,
you
can
actually
run
your
actual
code.
B
You
can
do
your.
You
can
consume
your
service,
you
know
where
the
other
entities
and
then
in
the
end
you
can
close
the
connection.
You
can
open
it
again
if
you,
if
you
need
and
when
you're
done
you
just
call
client
destroy
which
is
in
the
bottom.
I
didn't
highlight
it.
So
this
way
you
you
have
a
dynamic
control
in
the
Tran
time
of
injecting
interface
is
actually
within
your
pot.
So
you
request
an
interface.
You
request
a
network
service
as
a
result,
you
get
this
interface
in
injected.
For
you,
the
service.
Is
there.
B
B
Clients
are
fun,
but
I
guess
that
a
lot
of
people
will
be
interested
to
know
how
how
how
you
implement
in
a
network
service
endpoint.
So
here
is
an
example
with
where
we
have
a
network
service
which
is
composed
of
two
endpoints
and
one
client
that
the
two
endpoints
are
party
to
and
poetry
and
the
client
ransom
port
one.
So,
let's
quickly
look
at
how
this
works
so
essentially,
client
requests
a
connection
to
the
network
service.
B
It
gets
the
connection
to
the
first
pot
within
the
network
service,
the
PERT
endpoint,
which
would
be
running
to
and
then
on
its
own.
The
network
service
points
in
pot
to
request
the
connection
to
the
network
service
endpoint
in
poetry.
This
is
this
is
how
one
option
that
you
can
implement
network
service.
B
You
can
do
this
with
static
connections
like
at
the
moment
that
the
two
endpoints
are
deployed.
They
connect
to
each
other
and
just
wait
for
connections
whatever
we
are
showing
here
is
just
a
dynamic
mesh
establishment
upon
request,
so
imagine
that
your
endpoints
are
just
sitting
there
being
deployed
sitting
there
waiting
for
connections
when
the
client
once
the
client
comes
and
depending
on
their
request,
they
can
dynamically
establish
the
mesh.
B
So
you
don't
have
a
static,
static
connections
over
established
all
the
time,
but
this
is
one
option:
I
mean
you
can
do
whatever
whatever
works
for
you.
So
essentially,
if
you
zoom
in
a
little
bit
in
the
network
service
endpoint
in
pot
to
what
what
it
has
to
implement
is
it
has
to
handle
the
request
from
port
one
and
then
generate
request
to
poetry.
B
Now,
let's
see
how
this
works
in
the
code,
oh,
this
thing
looks
probably
slightly
more
complicated,
but
it's
really
not
so
the
orange
highlights
are
showing
the
cost
to
the
SDK
which
are
related
to
the
implementation
of
the
endpoint.
So
you
first
have
to
create.
We
have
this
notion
of
composites,
so
the
composite
is
a
essentially
a
chain
of
structures
which
implement
callback
like
interface,
these
structures,
we
call
composable.
So
these
are
the
highlighted,
calls.
So
the
first
thing
that
you
do
is
you
create
your
composite.
B
Then
yuo
create
a
new
network
service,
main
point
where
you
pass
your
composite
as
a
as
a
point
out
there,
and
then
you
start
the
end
point
as
you
can
imagine.
The
start
function
is
just
blocking
it
sitting
there
waiting
for
connections,
click
happen
and
passing
the
other
incoming
requests
to
the
to
the
composite.
Now
what
what
actually
the
composite
looks
here?
B
So
we
have
stack
of
functions
so,
on
the
top
we
have
the
monitoring
function,
which
essentially
just
wait
for
other
incoming
connections
and
then
updates
our
monitoring
mechanisms
with
the
creation
and
remove
of
new
connections.
This
is
this
issue,
so
for
observability
for
monitoring,
you
can
imagine
things,
then
we
change
this
to
an
ACL,
which
is
for
those
that
you
don't
know.
It's
access,
control
list,
it's
a
simple
form
of
packet
filtering.
B
We
change
this
to
a
function
called
cross
connect
as
you,
as
we
saw
on
the
previous
side,
what
to
essentially
sits
in
the
middle
between
the
client
in
the
end,
poetry.
So
what
it
has
to
do.
Is
it
just
has
to
connect
the
two
interfaces
that
it
has?
So
that's
what
we
do
with
a
cross
connect.
Then
we
have
an
network
service
client,
which
is
essentially
the
layer
that
generates
the
request
to
port
3.
Those
also
did
this
kind
of
generates
the
request
for
the
next
endpoint
and
at
the
bottom
we
have
a
simple.
B
This
is
layer
that
just
creates
a
fuse
structure
that
we
need.
Actually,
this
is
the
structure
that
we
shot
in
the
client
that
has
all
the
IPS
and
the
whole
deck
the
context
in
stock.
Now,
if
we
zoom
in
a
little
bit
in
the
requests
in
the
notice
request,
but
in
the
composable,
this
is
what
we.
This
is
what
we
have
so
the
request
callback.
Essentially
you
when
get
the
request,
you
can
use
it
or
manipulate
it,
and
then
you
call
them
the
next
guy
in
the
chain.
B
So
if
much
time
with
the
SDK,
we
currently
have
a
couple
of
ratified
composable.
So,
as
we
said,
the
one
of
them
is
the
client.
Then
we
have
the
connection.
We
have
IP
address
management
and
monitoring
a
little
bit
about
IP
address
management.
It
essentially
is
a
layer
that
is
pre-configured
with
a
subnet
and
then
it
splits
it
into
smaller,
slash
30
chains
for
ipv4.
It
all
support,
ipv6
and
kind
of
distributes
IPs
for
all
the
incoming
connections
for
all
the
point-to-point
connections.
This,
of
course,
is
optional.
B
B
We,
this
I
mean
explained
like
this
thing's,
probably
look
a
bit
scale
and
probably
not
really
clear,
but
we
have,
in
our
network
service
mesh
examples
repo
on
github.
We
have
a
couple
of
examples:
we
have
simple
I,
simply
responder,
which
is
just
a
couple
of
containers
sending
pings
to
each
other,
because
the
same
thing
implemented
with
my
elf
interfaces,
based
on
VPP
running
as
a
CNF.
We
have
the
my
interceptor,
which
it
is
going
to
show
in
two
minutes.
B
A
B
A
To
finish
this
up
yeah,
so
so
to
finish
this
up,
one
of
the
things
that
we
did
recently
is
we
added
in
all
the
way
support,
and
so
one
of
the
reasons
we
did
this
is
envoy
is
layer,
4
or
7.
So
it's
probably
more
about
how
do
you
connect
to
an
envoy
system,
and
so
historically,
when
you
run
envoy
like
a
misty
or
so
on,
you
get
a
bunch
of
sidecars
and
then
that
that
exists,
and
you
run
them
alongside
with
that.
A
So
what
we're
looking
at
is
well
what
if
that
envoy
was
something
that
was
part
of
your
was
part
of
your
infrastructure
itself
and
you
connect
it
to
envoy
and
rather
than
setting
up
an
envoy
with
with
each
instance,
and
so
with
this
we
we
created
a
simple
envoy
configuration
so
this
one
in
our
example.
So
this
this
is
actually
not
repository,
so
you
actually
get
it
into
run
it
and
and
see
it
connect
to
envoy
with
the
Envoy
echo.
A
So
when
you
open
up
a
tcp/ip
connection
with
it,
it'll
then
respond
back
with
anything
that
you
that
your
right
to
it
and
the
way
that
this
ends
up
looking
in
the
destination
is
that
the
default
matches
matches
is
empty.
So
it's
a
wild
card
and
then
the
destination
in
this
scenario
is
the
is
the
is
the
we
see
we
there's
a
slight
tie,
but
we
put
into
the
next
maybe
saccade
way
in
there,
and
so
it
works
in
the
same
way
and
it
establishes
the
in
the
container
gets
you.
A
Access
to
the
on
Vuli
envoy
doesn't
odd
way,
does
not
support
the
shared
memory
interface
at
this
time.
So
one
things
that
we
do
is
we've
used
the
IP
tables
out
of
out
of
envoy
in
order
to
reconfigure
the
the
in
order
to
redirect
everything
to
the
to
the
port
and
so
I.
Don't
think
we
have
time
to
show
it
at
the
at
the
MoMA
yeah.
B
A
So
so
we're
gonna
be
meeting
today
at
2:30
as
well.
So
if
you
have
any
questions
on
this
I
come
come
over
and
ask
us
the
three
of
us
should
all
be
there.
Nikolai's
Ben
also
talked
about
it
at
his
at
his
booth,
on
Thursday,
from
10:30
to
12:30.
So
yet
could
come
feel
free
to
talk
with
any
of
us
afterwards.
So
if
you
have
any
questions
on
it
or
wanting
clarifications
or
so
on,
we'll
be
happy
to
to
talk
to
you
about
it.
Thank
you.