►
From YouTube: Istio on Knative Lessons Learned: How Istio is Fit for Serverless Platform - Ying Chun Guo
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Istio on Knative Lessons Learned: How Istio is Fit for Serverless Platform - Ying Chun Guo & Iris Ding, IBM
Serverless is the emerging technology to support microservices. Istio is a popular service mesh platform. How Istio is fit for a serverless platform? It's a question that developers and users of both serverless and Istio shall look at. Knative, a Kubernetes native serverless platform, relies on Istio to provide routing, logging, tracing and metrics support for its serverless platform. In this session, we will discover how Istio is leveraged in Knative, analyze and showcase the advantages and disadvantages that Istio brings to Knative. Finally, we will summarize the lessons learned when utilizing Istio on serverless platform.
https://sched.co/MPeL
A
Mean
I'm
I'm
in
trouble.
I
have
an
English
name
Daisy.
This
is
iris.
We
are
from
IBM
China
in
the
office.
Iris
is
sitting
close
to
me.
We
have
different
focus
area.
Iris
is
focusing
service
mesh.
She
has
a
lot
of
contributions
to
e
still
I'm,
focusing
in
service
and
I
have
contributions
to
Canadian
up
until
OPA
whisk
one
day
when
we
talk
about,
we
think
that
post
or
lists
and
the
service
mesh
become
essential.
A
2008
youth
development,
so
I
said:
let's,
let's
do
a
study,
how
it
still
plays
our
service
platform.
That's
the
origin
of
this
speech
proposal.
So
today
we
will
talk
about
our
service
and
make
energy,
so
it's
mesh
and
is
tube
and
we
will
talk
about
the
benefit
of
each
tio
brings
to
Canadia
and
the
costs,
and
last
there
will
be
a
summary.
A
So
as
the
technology,
girls
and
the
abstraction
unit
of
infrastructure
becomes
smaller
from
pair
metal
to
water
machine
and
then
container
and
the
latest,
there
is
a
function
as
a
service
in
function
as
a
service
developers
only
taking
take
care
of
the
business
logic
development
without
without
thinking
about
the
local
infrastructure.
That
is
thoroughness.
A
There
are
many
properties.
There
are
some
properties
of
service
service,
for
example,
they
are
stateless,
event-driven
and
short-lived.
Also
in
ISO
Service
are
feminist
platform.
It
can
be
scaled
up
and
also
scale
down
to
zero.
If
it's
not
used
anymore,
that,
if
we
can
reduce
the
cost
and
also
serverless,
brings
new
improves
a
developer
experiments,
it
can
help
developer
to
focus
on
the
logic,
business
logic,
development
which
can
which
can
faster
time-to-market.
A
So
unless
think
about,
if
you
want
to
make
your
own
service
platform,
what
can
you
do
and
we
have
a
kubernetes
as
a
mature
container
extrusion
platform
on
top
of
coronaries
and
we
can
set
up
open
cell
service
product?
Actually,
there
are
many
choices
of
open
source
server
list
platform
among
them
clean
a
view
is
become
becoming
hotter
and
hotter.
So,
in
this
presentation
we
will
use.
Canady
is
a
service
platform
to
study
to
look
at.
A
So
what
is
Canadian
Canadian
with
some
is
an
Adu
service
platform
based
on
kubernetes,
let's
think
about
what
we
should
do
is
we
want
to
make
kubernetes
alizé,
cornet
Ascan,
deploy
and
manage
conveners.
It
can
scale
containers
on
demand,
actually
kubernetes
already
have
disabilities.
So
what
is
left
him
first?
If
the
is
a
capability
to
bring
south
code
to
a
service,
it
means
to
read
wrap
up
your
source
code
into
a
container
image.
A
Second
is
a
eventing
platform,
and
the
third
one
is
the
most
important
one
is
to
scale
from
zero.
We
all
know
that
kubernetes
can
scroll
from
one,
and
now
we
need
to
scale
up
from
zero.
All
this
missing
components
will
be
filled
by
by
Canadian,
so
Canadian
have
all
three
in
major
compulsory
their
components
that
is
a
building
or
which
can
wrap
up
your
package,
a
South
code
package
into
a
container
image
and
the
third
way
is
serving
Oh
which
provide
the
ability
to
scale
up
based
on
command
and
the
scale
up
from
zero.
A
The
third
way
is
the
event
he
platform
and
among
them,
Canadian
serving
is
most
relevant
to
this
topic,
so
today,
I
will
focus
on
Canadian
serving
so
unless
messing
about
what
we
have
now
now
we
have
kubernetes
which
can
deploy
and
manage
containers.
We
have
cannotyou,
which
can
scale
up
your
service
from
0
to
infinity
and
amount
on
top
of
canadian
kubernetes.
There
are
a
lot
of
services
running
on
them,
scale
up
and
down
start
and
shutdown.
So
all
these
can
be
recorded
regard
as
micro
service.
So
this
also
is
you
I.
A
Do
user
satisfied
with
always
the
service
and
capability
other
enough?
Of
course?
Not!
No,
so
users
want
more.
They
want
to
easily
find
the
service
by
a
hostname.
They
want
to
control
the
traffic
if
they
want
to
do
the
blue-green
deployment
and
they
want
secure,
Secret
Service
access
and
they
want
tell
me
trees,
for
example,
logging
monitoring
and
treating
all
these
in
the
scope
of
service
mesh,
so
I
will
pass
over
to
Ares.
B
B
Well,
yeah,
okay,
so
what's
also
is
meshed.
So
from
my
understanding,
a
service
man
actually
provide
network
for
your
macro
services,
so
it
can
help
your
connecting
observing
a
silcoon
and
controlling
your
Mac
services.
So
there
are
two
key
features:
are
of
our
coupons
for
service
service
match
the
first
one
is
transparent,
so
transparent
means
your
doesn't
need
to
modify
your
business
business
logic
when
you
want
to
move
to
a
service
match.
So
the
second
one
is
language
independent.
So
it
means
you
can
select
your
language.
It's
be
sitting
on
your
situation.
B
B
Okay,
so
now
there
are
multiple
service
mesh
implementations,
so
among
them
I
think
each
tier
is
a
very
popular
one.
So
each
tier
is
an
open
service
match
platform,
so
it
means
each
tier
is
an
open
source
project.
So
it
has
a
very
active
community
which,
backed
by
some
big
companies,
so
using
used
here,
you
can
connect,
observe,
secure
and
control
your
micro
services.
B
So
this
actually
is
a
picture
from
the
ECR
website.
So
you
can
see
it
explains
in
detail.
What
does
it
mean
for
the
for
the
four
parts?
The
first
one
is
connect,
so
it
means
it
can
trip
to
the
traffic
routine
for
your
services.
It
can
help.
You
discover
your
services
automatically.
It
also
can
inject
some,
for
example,
the
photo
tolerance
to
make
your
macro
services
more
resonant.
The
other
one
is
observe.
B
So
after
you
move
your
micro
services
into
service,
you
can
gather
more
metrics
logging
and
treating
data
from
the
Romulus
ID
card,
because
all
the
traffic's,
whether
you
are
whether
inbound
or
outbound,
had
been
measured.
So
the
third
way
is
secure,
so
Newton
East
here
you
can
very
easily
turn
on
the
mutual
ties
between
your
micro-services
and
the
last
part
is
the
policy
enforcement.
So,
for
example,
if
you
want
to
do
some
real
image
are
white
black
lists
for
your
macro
services.
So
it'll
you
just
need
to
define
some
policy
rule.
B
You
can
easily
get
the
benefits.
So
this
picture
I
want
to
show
is
a
history
of
architecture.
So
from
beginning
there
are
two
services
and
they
want
to
communicate
with
each
other.
So
before
that
we
will,
after
you
move
to
the
service
the
history
of
service
match.
It
will
help
you
inject
and
sidecar
into
your
user
container
part.
So
you
need
to
know
the
sidecar
videos
as
well
so
now
opens
Wednesday
is
one
to
communicate
with
the
other
one.
B
It
actually
will
go
first
into
the
annual
proxy
and
then
go
to
the
other
pause
and
work
about
privacy,
so
this
pad
is
also
what
is
called
the
data
plan
for
each
tier.
So
besides
is
you
know
the
n-word?
If
you
it's,
actually
you
can
think
something
very
damning.
He
doesn't
know
what
to
do.
How
I
can
find
where
the
other
services,
so
you
need
somebody
to
control
them
this
also
the
where
the
easier
control
plane
coming
into
place.
So
you
can
see
there
are
several
components
which
comes
into
the
control
plan.
B
The
first
one
is
galley,
so
you
can
see.
Actually
galley
will
monitor
the
results,
changes
in
the
humanities,
API
server
and
generate
related
information
and
push
it
to
other
control
plant
components
so,
for
example,
the
pilot
and
the
mixer
so
using
the
mesh
configuration
protocol.
So
after
pilot
forget
all
this
information,
it
will
generate
something
and
well
who
will
understand
and
push
each
other
out
and
well
sidecar.
B
So
the
sympathia
is
the
one
who
is
responsible
for
the
security
part
who
will
help
you
generate
the
certificate
and
help
to
rotate
your
substitute
imitated
to
make
sure
it
not
expired
and
the
mix-up
had.
Actually,
there
are
two
components:
the
policy
and
telemetry.
So
policy
will
do
the
pre
check
and
the
telemetry
will
do
the
report
so
it'll
be
reported.
The
telemetry
data,
including
matrix
logging
and
the
tracing.
So
now
you
have
the
service
managed
how
you
interact
with
them.
B
So
there
are
two
options:
the
first
one
is
Cuba
CTO,
the
other
one
is
the
East
EO
command-line
utility,
it's
easier
ztl,
so
you
just
ran
command
line
and
it
will
communicate
with
your
kubernetes
api
server
and
it
will
deliver
your
configuration
rules.
Two
years
of
is
match.
So
besides
they
also
a
side.
High
injector
is
I
listed
in
in
this
left
bottom
part,
so
this
part
actually
will
help.
You
intercept
your
incoming
deployment,
Yama
file
and
intercept
it
to
inject
the
side,
so
you
generate
all
the
incoming
workload.
B
For
example,
if
you
have
labeled
the
namespace,
so
it
will
automatically
inject
a
sidecar
for
you.
So
this
is
a
whole
attempt
to
return
them.
There
are
interested
way
and
the
egress
conveyed
this
is
this
two
component
has
defended
the
master
boundary,
so
our
your
inbound
traffic,
we
are
going
to
the
ingress
gateway
and
the,
if
possible,
if
needed,
you
can
enable
egress
gateway,
so
it
will
control
all
your
outbound
traffic.
So
that's
the
architecture.
So
let
me
head
over
to
Daisy.
A
Yes,
Thank
You,
iris,
so
I
mean
after
iris
introduced.
We
all
know
that
you
can
connect
control,
secure
and
observer
micro-services,
so
we
have.
If
we
use
dollies
to
Uncle
ain't
you,
what
benefit
can
is
to
bring
to
continue.
Let's
take
a
look
at
the
traffic
routine,
our
telemetry
and
the
security
before
I
go
into
the
details.
I
must
talking
a
little
about
about
the
Kennedy
basic
concept.
Just
to
make
sure
you
can
understand
my
following
introduction.
So
incra
need
you.
A
There
is
a
concept
as
name
night
service,
so
service
is
the
results
to
manage
your
life,
the
life
cycle
of
your
apps
on
server
list,
meaning
it
includes
several
concepts,
such
as
configuration
or
revision
and
root.
A
configuration
is
to
manage
the
history
of
your
app,
and
it
includes
some,
for
example,
the
environment
configuration
something
like
that.
Well,
configuration
is
created,
a
revision
will
be
created
if
the
configuration
is
updated,
a
new
revision
will
be
created,
so
you
can
really.
A
You
can
regard
revision
as
a
snapshot
of
your
app,
including
on
a
configure
under
an
image
so
I'm,
Aaron,
service
and
razor
and
the
point
the
root
is
used
to
map
the
end
point
to
the
exact
pot
which
can
serve
this
traffic.
So
the
root
is
used
to
manage
the
traffic
you
can
you
can
map
all
the
traffic
to
a
end
point
to
the
latest
revision.
A
You
also
can
configure
rules
to
a
new
to
manager
and
some
of
the
traffic
to
revision,
to
new
revision
to
all
the
revision,
for
example,
here
in
the
picture
and
I
showed
that
there
is
a
revision,
there
is
a
series
there.
There
is
a
90%
of
the
trash
is
sending
to
revision.
Two
and
ten
percent
of
the
traffic
is
sending
to
revision.
Three
using
this,
you
can
do
a
slower
upgrade
of
your
service.
A
A
So
in
infinite
you,
when
you
create
our
route,
actually
easier,
virtual
service
will
be
created.
Here
you
can
see
that
a
virtual
service
is
created.
It
will
route
all
the
traffic
to
this
hostname
to
the
latest
revision
and
the
destination
is
defined
and-
and
this
is
a
company-
this
is
a
complex
situation.
If
you
want
to
sorry,
if
you
want
to
define
rules,
what,
if
you
want
to
define
rules?
A
Sorry
so
here
you
can
see
that
all
the
traffic
to
the
hostname
are
routed
to
two
revisions
and
you
define
two
destinations
and
the
algorithm
are
weight
so
that
the
virtual
service
will
manage
the
traffic
next.
Okay,
then,
let's
take
a
look
at
a
telemetry,
actually
other.
Of
course
there
should
be
many
options
for
you
to
set
up
the
login
monetary
and
treating
of
a
sort
of
Canadian,
but
in
Canadian
it
offered
a
default
installation
of
telemetry.
A
It
used
ruin,
be
like
elasticsearch
and
a
Cabana
to
manage
logging.
It
use
promises
to
manage
monitoring
and
the
news
they
became
too
many
to
manage
the
tracing,
so
continued
itself
send
send
those
traffic's
a
standard,
those
metrics
to
to
send
the
logging
money
trip,
metrics
and
the
trees
to
to
keeping
our
promises
and
Deb
king,
and
if
you
have
the
said,
Kerry
injected
you
have
you
have
my
to
manage
the
input
and
output
of
your
traffic.
A
Then
you
can
get
more
detailed
metrics
that
make
make
your
that
can
help
you
to
look
at
the
detailed
information
of
your
service.
So,
let's
talk
about
security.
Actually
our
community
who
depends
on
is
to
a
lot
of
security.
So
with
the
side
carry
injected
and
you
are
able
to
turn
on
the
mutual
TRS,
then
all
the
traffic
between
your
service
to
service
are
secured.
If
you,
if
you
install,
is
to
with
the
secret
discovery
service,
you
are
able
to
turn
on
the
gateway
TRS
after
that.
A
A
So
to
now
we
let's.
Let's
do
a
simple
recap
to
look
at
the
summary
as
to
look
at
the
benefit
that
we
still
bring
to
us.
Only
East
you
as
a
service
mesh
platform.
It
can
it
take
care
of
all
the
service
mesh
concerns
such
as
the
traffic
control,
secure
your
service
success
and
the
tell
me
trees.
It
makes
Kimmage
you
workers
on
the
server
list,
focus
on
the
concerns
that
service
shall
be
shall
shall
to
implement
to
solve.
A
B
Yes,
Daisy
said
also
also
easier,
can
provide
a
lot
of
our
benefits
to
your,
but
anything
doesn't
come
free,
so
you
must
play
some
cost
for
your
for
this
choice.
So
actually,
when
you
want
to
install
sto
together
with
connected
with,
there
are
multiple
options,
so
you
can
select
which
one
it
is
suitable
for
you.
So
we
have
just
least
four
options
here
and
as
I
said,
and
there
are
modern,
there
are
multiple,
so
you
can
because
Easter
installation
is
very
customizable.
B
You
can
customize
but
way
today
we
only
studied
these
four
options,
so
the
first
one
is
fully
steel,
so
it
means
we
will
install
all
your
components
together
in
your
into
Clinton
Hill
and
the
way
we
are
using
sidecar
using
the
unit
container
to
inject
the
sidecar.
So
you
can
say
if
you
using
this
option,
the
code
start-up
time
is
really
long.
You
can
see
from
the
chart,
for
every
user
can
use
apart.
They
are
actually
at
least
four
containers
there.
B
The
first
one
is
easterly
need,
so
this
container
is
responsible
to
join
your
IP
table
shell
script,
to
redirect
out
all
traffic
to
the
own
website
card.
The
second
one
is
the
easier
proxy,
so
it's
the
mo
of
sidecar,
so
the
third
one
is
the
start-up
queue
proxies.
This
is
a
container
provided
by
Canadian,
the
and
last
it's
the
turn
for
the
user
container.
So
you
can
see
it
takes
the
really
long
and
the
other
part
is,
if
you
have
the
policy,
enabled
least
here.
B
You
can
see
that
the
bottom
part
is
a
typical
request
and
response
flow
for
for
request.
You
can
see
edit
axilla
as
well.
You
can
see
the
Rick
requires
the
coming
from
the
east,
your
ingress
gateway,
and
then
it
will
go
to
the
mixer
to
do
the
policy
three
check
to
make
sure
this
track
should
I
be
allowed.
Then
it
will
go
into
the
hello
world.
B
Is
the
user
container
after
the
call
and
before
the
response
return
back
the
there
is
another
additional
mixer
call,
it
will
report
back
the
check
result
to
make
some
cash
in
the
mixer
pad,
so
there
are
two
additional
span
in
your
work.
Also,
you
can
see
it
takes
about
three
million
seconds
to
finish
the
car,
so
if
you
using
display
alcohol,
so
you
can
enjoy
also
with
magic
abilities,
the
control,
the
security,
the
observability,
the
traffic
control,
all
this
it
there,
but
you
need
to
pay
some
cost.
There
are
the
cold
start
up.