Cloud Native Computing Foundation KubeCon + CloudNativeCon Europe 2019 (Barcelona), 24 May 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Cross-Cluster Calls Made Easy with Istio 1.1 - Matt Turner, Tetrate

Description

Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io

Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects

Cross-Cluster Calls Made Easy with Istio 1.1 - Matt Turner, Tetrate

Despite the now-common practice of spinning up multiple clusters across multiple regions, cross-cluster communication between the services running in them is still a huge issue. We rarely bother, or when we do, it’s hard-coded at the application level. Holes are punched in our ingress. Traffic traverses the open internet with hand-crafted addresses, no observability, and one-way TLS. Istio already helps communication within a cluster: adding layer 7 routing, automatic security and more. The new version 1.1 can now do that between clusters. This talk will guide you through using Istio’s latest features to easily setup secure, resilient, cross-cluster communication. Matt will talk through the required config before showing a demo of an app seamlessly spanning Kubernetes clusters. The full config will be made available so you can head straight home and give it a go on your own systems!

https://sched.co/MPfb

A

Thanks for coming to the closing keynote.

A

Particular Craig I have I have energy. We all have energy for like a deep dive into SEO. This is not going to be a grand ideas, talk by working how we can survive to the beer. There have actually been a bunch of great talks on this year so far this conference, so I'm not gonna, go through that content. Again, this is an STI 101. Also 30 minutes isn't very long, so I'll I'll go into the details on this cross.

A

Cluster calls made easier if I'm quite honest with this you're 1.1, certainly easier than they were before so we'll have a look at that. I am Matt Turner I'm from London in the UK I'm, with native wave we're a consultancy that helps people move to the cloud have become cloud native and modernize their IT organizations so I'm around in a pretty sure.

A

If you want to talk about that, but now I'm going to talk about its do so I will cover a quick recap of how networking works within a cluster like really quick but I, know we're all tired will then look at ways that you might be able to make calls between clusters will see how East EO can get involved with that and help as a service mesh.

A

We then look at the new features in STR 1.1, which makes that marginally easier than it was before, and I will then attempt to demonstrate it, but that does involve like manage GK clusters in multiple regions around the world and conference Wi-Fi. So I've got it recorded though so it can't. It can't go wrong because I've hedged it.

A

So, like really click quickly, remember when we had computers- and they look like this- this is the windows 95, my computer logo. They genuinely did look like that. They were fine. You could play dost games on the right you could place if to, and everything was good. But if you wanted them to talk to each other, you had to write a switch and then they were on a network.

A

Now our computers aren't computers, they're containers, the isolation is done by software, not an air gap and they're inside another computer, which is great, but how do they talk to each other? Well, you have to switch. This is a virtual switch just like the isolation mechanisms for these containers of software. This switch is implemented in software, but now we have two computers. We got scale.

A

We got users, it's very web 2.0 scales great because it pays for your avocados on toast, but the problem is this container has to be a talk to this container and it's only got a switch and, of course, realistically your estates, probably larger than this right Google- has more than these two computers kubernetes will support ten thousand or so so. How do we get them talking to each other? We had a switch, and this effectively I mean there's details, but this effectively is a kubernetes overlay network all right, so we can.

A

We can zoom out a bit and we can say that this pink box here, it's what's called the overlay Network, so only part on any node- can talk to any other part on any other node through this overlay network, and that's that's great because this is kubernetes. Job right is to run these containers on on multiple machines at the end of the day, and if it's going to do that, you need some basic functionality in place. So we can remove some of these layers of abstraction right. The network, the overlay network, kind of works.

A

If you're studying that place of rolling your own cuba Nettie's, then why? But you know you have to install flannel or calico or whatever, but we can remove that. We can assume it just kind of works and in fact we can zoom out a bit more because we don't care where the computers are right, because this is kubernetes. This is the cloud. So we have these containers running in this ambient compute and we have an overlay network. It's a layer, 3 network right, an IP network and they can all talk to each other.

A

Then along came the service mesh, we love so meshes, so we can put a sidecar. We can put an HTTP proxy alongside our container. This is obviously envoi and then the gray box is is the kubernetes pod, boundary I, guess technically the network namespace part of the implementation of a pod, but this is sort of network isolation and then no container talks directly to another container. They all parts they all talk through this proxy, which adds a bunch of value. So this is a mesh of services with their properties.

A

So if we zoom out again, we find that the context this lives in is a kubernetes cluster right, Str, Wars or something like that will run outside of Cuba Nettie's. But the most common deployment strategy is within a cluster. So we have this kind of grey amorphous blob of compute ability, compute power, some pods run in it. You know they all show this overlay network, there's pink overlay, Network and there's a kubernetes control plane up there.

A

So we as users, can interact with that and tell the control plane to do things in this cluster and actually, if the pods are aware, the pods are able to call that API as well and they can affect their own environment if they have permissions or whatever.

A

So the service message we saw before the subtle changes is the addition of that little sailboat, the mesh of services we had before have proxies. They do stuff, that's great, but manually manually, configuring them kind of takes us back to the 90s. So a full-service mesh lancing, like sto, comes along with the control plane which much like the kubernetes control plane gives us a nice API that we can talk to, or we can declaratively say well. I would like my proxies to be set up like this.

A

I would like them to be doing this for me, and the sto box of tricks takes care of working out what the Envoy configuration files looked like and propagated them out to do that, so that was I was iste ió in three minutes: I hope that was okay for everybody.

A

We still got some energy so now, but now we zoom out again right now we don't just have our two computers me and my friend playing command & Conquer over IP X we've got multiple clusters made of multiple computers around the world, and maybe we want one pot to be able to talk to another. So how do we do these inter cluster calls? There's a bunch of ways you could do this.

A

You can do this first and foremost, with the traditional layer, 3 network, right with with IP I mean I, won't bore you with the details, but it's it's hard and it's annoying and it's suboptimal, and it basically involves VPN in these two overlay networks together and dealing with routing and dealing with. You know: IP clashes and dealing with IPAM and all that kind of stuff, and it's really not great, because anybody's ever set up a VPN every anybody who's ever used a VPN.

A

Those VPNs aren't great, but we have the service mesh right so in in the in these pink boxes. We have this service mesh with this proxy being a smarter network providing all these features and all these power. So so maybe we can use that you see where I'm going. Maybe we can use that to do inter cluster calls. What we can, but you have to you- have to know how to configure it, which I'll show you today and you have to know how to use it right as well.

A

So maybe this sort of you know naive approach to doing this. These diagrams are beautiful. Are they naive approach to doing this would be to say? Well, we've got this big. We've got this big Network right. We've got the service machine Network, it's a layer, seven network, it's a super smart network, but we want this big measure of services. So, let's just let's just wait, my money being networked right.

A

Let's make one big service mesh, so you see, we've got one control plane in any any pod that wants to you know only sidecar that wants to get configuration from this control plane ends up going up to to the one sailboat that's hosted in one of these clusters. This isn't great. This isn't a great way of doing things.

A

This has actually got all the problems at the sort of previous approach because because if the service mesh isn't actually a network right for the packets to move around, you have to have this overlay, so you need one shared layer, 3 network here, so you have all the problems that you had before and then you have additional problems as well in that you've got one control plane and it might be on the other side of the planet, to some of the proxies that want config.

A

So you have real problems with preferred performance and resiliency and scalability security, blast zones and all that kind of stuff. So this I think this works. Just like VPN in the networks together would work or just like issuing a carrier pigeon from one to the other, would work but I, don't think it's I, don't think it's the right way to do it, so we can use two meshes. We can have these multiple, Listia and I think this is much better. So, just like their underlying clusters are isolated. They're kubernetes control planes aren't shared.

A

You know they don't share anything. We have like a data plane, we have these control planes and then there's, you know not shown it's the sort of the management plane right, which is you or more realistically, your CD system. That's telling kubernetes to deploy applications in these in these two clusters, but the clusters themselves, their control planes, are completely isolated.

A

So if we do this, then it's exactly the same for the for the sto side of things as well and for the first time I'm, showing this big purple box, which is the the ISTE o ingress gateway. So all the traffic that wants to go from sort of kosta a across the cluster B can just hit that that ingress gateway.

A

You know one well known IP, one sort of ingress point that you can whitelist or something- and we don't have to expose every pot in in that second mesh to the internet, because everything can ingress through the ingress gateway.

A

We can, even with a little bit more config, actually set it up so that everything comes out of the first cluster through the egress gateway, again more defense-in-depth, more opportunities for whitelisting and all that kind of stuff. So we can get to this kind of configuration with two service messages on two clusters and I think this is a pretty pretty optimal way of doing things.

A

I just wanted to check everybody's awake just wanted to check. We all noticed that sto is a word. It means sale, it has a plural which is STR I'm, going to use that because I used it before and somebody call me on it and I was like nice in the dictionary. So there we go so multiple Listia. If there's one takeaway before you fall asleep many sto, so we're not talking about inter-cluster calls anymore. We're talking about intermesh calls.

A

You know, I think it's best not to have any kind of sheds layer, 3 network or any kind of shared layer, 7 network, so we're not just calling between the clusters were actually calling between the meshes so in very broad strokes. The things we need to make this work are, we need service discovery, a pod in one mesh, these to be able to discover where the pod is in.

A

You know, which other meshes our pod is in, because we want to share nothing and we actually need a way to move the traffic around which, of course, is not trivial, so quick, recap I'm sure on sto, trebly notices off by heart. These these resources are confusing at all. We recap on the sort of networking resources of sto, so we've got the gateway object, which basically says please listen on. This port basically means please open this door to the outside world.

A

Gateway resources to use the right term. The Yama file right is not to be confused with a a gateway which is a deploy. A kubernetes deployment like a bank of envoys. Actually implementing that thing, so the purple box from before is the ingress gateway. That's a kubernetes deployment of several Envoy pods, the egress gateway, is also cuba. Nettie's deployment of several Envoy pods. Those can be addressed as sto ingress gateway, a misty, Oh, egress gateway.

A

Those are their names, their their deployment names and then there's another special mesh, a special gateway, sorry called mesh, which refers to all of the sidecar envoy's. So those are the names of like gateways with a capital G, if you like physical Gateway's, and then the Gateway resource goes and configures those that you target it you're, almost always at the ingress gateway. Admittedly- and you say, I want to open this port to the outside world gateways have a TLS mode right, because there they're opening a port they're listening for traffic.

A

They need to know what to do about SSL, so they have a few TLS modes. You can put them in the first. One is none that doesn't do any TLS. The second one is simple, so this just kind of standard web serving this would be here's a certificate. Please present that's TLS certificate right so that something can do can establish a one-way TLS connection with me: that's usually used for actually sort of serving web sites or whatever right so yeah. That would normally be a certificate that you've gone and domain verified or Evie door.

A

Something- and you put you put it in a secret and it's like a a pet certificate for your domain for sort of standard TLS. You can also put these things in mutual TLS mode, where they're expecting to do a mutual TLS exchange with something on the other end.

A

That also has certificates- and this is how pod to pod communications work because remember, there's that that mesh of all the side cars see that gateway of all the side- cars, so you can say, hey sidecar gateway, called mesh when you open the port to talk to other pods you're expecting to do mutual tear, that's with them. There's in another couple of modes, one is pass through, which means don't terminate the TLS and pass it through so that routes on an SLI header.

A

If everybody is familiar with that from TLS right, there's a there's, an unencrypted header at this thing, as soon as you take a I P packet and you encrypt it you've been with their TLS. You've then lost all the information. You can't read the header right. You can't read the addresses trying to go to so you wrap on another unencrypted thing, which is called the server name, identification header, and it's it's basically another copy.

A

The host header incest, where this thing should go if you're going to pass the TLS through and not terminate it and then there's the auto pass-through which is magic and new and we'll come onto it later, service entries basically say what names exist. So, when I get a packet to route, you know, I mean it's going to have a host header, giving a name do I. Do I recognize that name. Do I accept that that exists, and you know what what should I do with it.

A

Virtual services saying: ok when I've gone a name that I recognize how do I route to the back ends. So I look at the path, I, look at haters, I, look at the port number, which said of pods, do I actually send it to and then a destination root which is like when I've actually chosen a back-end, but I'm actually chosen like an IP to send it to how do I talk to that thing? Do I inject faults, do I retry.

A

Do I do Mitchell TLS, you know is the Gateway on the other end in mutual TLS modes, and it should I be talking to it like that. If anybody knows nginx, then Gateway is kind of the server block right, open the port virtual services, like the location Bach, did this path based routing destination rule is like the upstreams.

A

You know pick from this actual set of pods and here's their like their preference order, they're waiting and then I guess, service entry is this kind of a DNS server you you look at to turn those upstream names into IPs.

A

So now we're all this do experts. We will realize that it's always been possible to do this in this multi cluster. Networking these into mesh calls kind of the hard way right, so it's GL 1.0 and back. You could do it, but you had to set a lot of stuff up manually. You had to really kind of crop those resources and you have to set all of this stuff up. You needed at least three. You know it's do it's very powerful and very flexible.

A

So it's always been, though, if you kind of knew how to cook it, but you needed at least three resources. So on the calling size you needed a service entry, okay. So one point I pointed out now we're using the name food on global when this cluster wants to call foo on the other side right so over here, phooeys has its kubernetes in dots names.

A

Three dots default, dot, service, dot, cluster dot, local I got a little bit wrong, but on the left-hand sides we want to address that as food or global like we don't want it to look like a local service. I think this is an opinion. This is this is my opinion and I guess. The opinion of the people I work with this on is that it shouldn't look like a local service and you should be differentiating you should. If you're going to call literally around the world, you should probably be opting into that.

A

There should probably be a good reason that you know maybe I've got a database of users. All of my users- and you know I- can have a I- can have a shard in each region. I said I can have a copy in each region that they can sync data at an application layer right if I'm calling the users database in another region, it's presumably because each region only holds its own users and I'm doing some special operation there's some special region. Why I want to talk to to that?

A

So the idea is that- and you know, you're going to get a different experience, calling this right, sto can-do resiliency for you. It can do retries, but even a best-case in a hop it's going to be hundreds of milliseconds rather than sort of hundreds of microseconds. So we think you should really want to opt into this, hence the the special form of name global. So the first thing we do is we make a service entry in this mesh saying why food or global is a name that exists.

A

We then use a gateway to punch, open, whatever port, on the sto ingress gateway on the other side, and then we attach a virtual service to that to say right when things hit this port number in this ingress gateway. I know that you know food or global is actually going to go to foo in the default namespace.

A

So it's always been possible, but it was a little bit complicated to set up like this, and this this isn't really very good anyway, so you need at least these three per service per cluster, so that's very quickly becomes a competent or an explosion. This doesn't set up empty LS. You need a lot of extra around for that. This doesn't route through the egress gateway that can be done, but it's more resources and you have to expose for every service that you want reachable in the cluster.

A

You have to punch open a port on the ingress gateway and it has to be the same. If foo is listening on 90-80, you have to open 90 80 here, because there's no way it's complicated, but there's really no way to sort of force. Everything down to 443 to go across the internet and then back to the port that it should be on internally. So there's a few there's a it was it worked and there's a proof of concept, but there was a bunch of problems with it. I guess! Well, I got this picture up.

A

The only other thing to explain is its service discovery, so we're adding this service entry to say food or global exists. But if there's a you know on this side there will be a service entry for food default, and that's because this do talks to kubernetes it's one of its service discovery plugins right, it says I, know I'm running in a kubernetes cluster. Obviously you want to ever talk to all the kubernetes services, so sto will automatically make you a service entry for every kubernetes service that already be a food default service center.

A

In here anything that is still handles. Actually a lot of people don't realize how to be matched against the service entry, so they're all there for all the kubernetes ones. What we're doing is saying I'm going to tell you about a new name, because there is no fool on this side. You know, kubernetes doesn't know about it, so it's do doesn't know about it and we're keeping this state completely separate I mean another approach. I didn't talk about for doing this.

A

There is to kind of try to sync data between those two control planes, but again you've just built yourself a distributed assistance problem right and again, I really think you should be opting in to calling services across the world like this, and it shouldn't be available to all of them, so we especially go and make that name exists anyway. This this was how you did it. It was just a little bit complicated.

A

Another trip to dictionary corner the word: Cody wonpil, I'm, British I assure you. This exists, it's kind of Shakespearean Aeschylus's or the middle english. That is an urban dictionary. Screenshot I swear. It was in the OED like to swear. It was in the real dictionary when I looked it up, but I can't find it now. Maybe it's got too old.

A

It's it's expired, but the word Cody wonpil exists and it means to go on a real stride to really walk purposely towards somewhere that you don't really know um the reason I'm taking it to dictionary corner is that Cody wampa was the name that Zach and I tetra used to make a little program called Cody wonpil the basically it's some really simple go. It's got 13 github stars, maintainer here 13.

A

What this does is it you give it a higher level description of all the services that you want to expose globally. You give it a high level description to the clusters and it also generates clusters, time services times 3 resources actually times 5. To give you a few more features, so it generates reams, a breeze of yam, all that you can pipe into your clusters. So this automated the hard way right and that worked in like no point 8 onwards or something but enter its tier 1 point 1. This is now first-class ish.

A

There is more support than there used to be I'll. Go through it quite quickly because I'm running a little bit out of time. We love ya Moll. So sto, when you install this, it was a very flexible, powerful platform the helm chart, for it is huge, like absolutely massive.

A

It does take of the values, dot, yeah, more files and there's a few samples if you download the STL repo there's a few sample values the annual files to configure its do for common use cases, one of which is this new sort of 1.1 based multi cluster thing, and this is the whole values Dom will file for that. So we'll go through it bit by bit to explain what it's doing.

A

It's basically reconfiguring some stuff at install time and then we go in and we only have to add one resource now in order to make multi cluster stuff work and it's a lot more simple. So the first thing to talk about is service. Discovery and I won't really go into this because I'm running out of time. But if you think about it, when you try to make a request for say, I want to go to my back-end global, because it's in another cluster the, for example, the golang HTTP librarian- produces something like this right.

A

It does a get for the path where HTTP 1.1 and it takes that name and it uses it as the host header and that's great because that's what is your routes on right? It's Joe, you put a packet on the wire. It's intercepted by the proxy SEO doesn't care what IP address is aiming for like it just doesn't.

A

It doesn't give a just throws it away, everything's done at layer, seven based on this host header or based on the table name, if you're routing the my sequel protocol, or something like that, but it's done on some application level idea of what resource you want like aka, Fielding's thesis. The problem with this is that almost any actual library that you defer T to do network calls, including the go one.

A

The first thing it's going to do with the URL like that is look my back-end or global up in DNS, because it needs to know the IP to connect to right- and this is pointless because as I say, you can name it at any IP. Ip tables is just going to extract it. You know just go, intercept it straight away and look at this host header, so it'll take that name and it'll put it in the host header, but it also wants to look it up in DNS.

A

That's not going to work because there is no such named or global. What does that mean? It's not a it's, not a TTL! It's not that fqdn that you can buy, and it's it's just not. How is geo name service? It's not how pure minetti's name services.

A

So there is a solution to this. Every pod looks to the kubernetes dns server right to do name resolution. So if this is foo and there's a service called bar, it can look at bar it'll get the right answer. Each cluster only obviously because they're isolated each cluster only gives you the names in its own on its own side.

A

What we do here is we turn on sto core DNS, which means that sto also deploy deploys the DNS server or DNS server, and that thing does resolve dock global right. It just resolves it to to anything because it doesn't matter right.

A

It resolves it to like one 2700, 169 I, think because I wrote it, but all we have to do is steady on so now sto has a call DNS server and then all we need to do is tell the kubernetes one to defer to the sta one to say: okay, if you see doc low wall, it's a stop domain go ask: it's go and sta will say: yeah doctor low, well, yeah, they exist one 27001, so you get an address and that resolution doesn't fail.

A

Next is we turn on the egress gateway, the left-hand purple box, so we can route everything through it and then we say we're basically set an environment variable in all the pods saying yes, if you're going to go to the internet, then you want to go through the egress gateway and that lets us. Do this sort of point-to-point, the best best class most offensive MPLS stuff, and it does some some mangling we'll see later.

A

We then just turn on multi cluster. We just we just set it to true. This does a few things I could have to look at the speaker notes for this. It basically, as a destination rule that says any traffic aiming for a dot global address should be using MPLS, because this teo doesn't know what these things are. It doesn't know they're inside the it doesn't know they have an invoice with them. So estion wants to know whether things are inside or outside the mesh.

A

Well, that actually means is, can I expect to find an EM boy next to the thing I'm talking to, and can I therefore do like MPLS negotiation, so we basically say yes, if the address is not global, consider it on the mesh do MPLS negotiation with it.

A

The second thing it does is: it puts the ingress gateway into that magical. New TLS mode called also pass through. This is a fantastic hack and what it does is- and it tells the egress gateway to play this game as well so remember before we had to have a virtual service on the other side to say. Well, when this packet comes in aiming for food or glow you, actually you need to send it to like food or bar in the bar namespace.

A

What this basically does is it takes all of the information you need to do routing on the far end it takes that virtual service and it encodes it into the sni header. So it writes a proprietary like delimited string of. Let me get this right service name, dot, subset as in sto, subset, dot, port stuffs it in the sni header and sends it out of the egress gateway towards the ingress gateway. Basically, this is like the internet. It's built right. You are basically each at each point.

A

You know how to get to the next hop right, the IP, the internetworking protocol, it's about how to get to the next hop at layer two and that's exactly what this does basically encodes. It knows how to get to that ingress gateway, because we tell it where it is and then ending code. The information in his on the far end in the S&I header and sends it with it it's a fantastic hack who works very well and then on the ingress, great race ID.

A

It takes that host, which is obviously gonna, be the form, food or global and rewrite it to food default service, cost it on local. That was a fun afternoon reading the source code. The one last thing we need to do is we want to do empty LS because it's great think about how to you're less works. If I'm talking to another part in this cluster, we both present certificates, we're not going to trust each other unless they're signed by the same route. The problem we have here is sto citadel, like each one. These aren't globally.

A

You know Verisign RSA certificates, they're just self signed by each do when it starts up. That's absolutely fine, but the trust domain therefore, is within each cluster. So that's not going to work. What we have to do is say right when you start up, don't self sign a certificate, just leave that field blank, and then we, as the user as the management plane, have our own routes. We sign to intermediate certs that we provide this year with those. So each is each history or control plane has its own cert. To use to sign.

A

Psych asserts, but they have the same root of trust so that let's empty, let's work without further ado I'm going to try and do a demo um I tried to be smart at this demo, I try to write we've seen too much book info. This is an STL 1.1, so I tried to write my own micro service, that's auto-scale, auto-scaling and self, and stateless and polyglot, and is of course, global yeah. It's it's hello world. So it's really immersed because it's the only language you ever need look at this. We have a try.

A

Monad, we have types. We have first-class tuples. Look at all these language features go, doesn't have it's great um we're effectively listening on on 8080 and requesting. So this is the greeter. This is the thing that says hello. He needs to know who to say hello to and then so it's really questing name a default. Go global. Those two unwrapped there or me saying: hey rust. Thanks for all of the safety features, you've got I'm going to buy them in the bin. The other side of it is written in bash.

A

Really the only two languages you need. This is a fully compliant HTTP 1.1 server and it has minimal dependencies, so I think I. Think I've want DevOps bingo with that anyway, I've got a game of thrones joined it. It's done now. Isn't it it's done. um It's my Game of Thrones joke I, won't even defend it, because these are neighbors. Alright, oh we've gone too far. Let's try it on the wrong screen.

A

Okay, so I've got two G key clusters. I brought them up already, because that can be quite slow. That's really small! Isn't it.

A

All right, there's two they're in different regions, you're at West, two and three years of ones, I think just down the road, and once in Stockholm we've got a shell into each one. Each one has a different context: I promise did I install this. Do.

A

No, okay, so right we've got the clusters up. This is all scripted. The first thing to do is to install those root certificates, I'm, actually really cheating and using exactly the same certificate for the root on both sides. But it's it's fine that works. It's not the best security stance, but it totally works because they'll trust each other. So we installed the root certificate first and then we install this do which sticks in all of its er DS.

A

And then we have to wait for the CR these two to calcify, and then we can actually go on and uninstall the rest of STI I wanted to show you this, because I wanted to show the circle in first, but this actually means we have to sort of drum our farmers for a while, while there we go fruit, III see IDs, and we can do the next thing. So we'll do that on the next cluster as well same root, certificate.

A

A

Cool rody next, so the next thing we need to do is we need to get kubernetes. So we've installed its do with that. Multi match Matthews file. It's it's changed a few things, including getting this teo to deploy this magic call dns server that actually just defers to a little plugin that I wrote like six months ago. This is global. Yes, we need to tell kubernetes dns to use it. This is cube, one point thirteen, but because it's gku, it's still cube dns. It's not Cordy Onis! Don't ask me why.

A

So we have to delegate that Global's. You know dog global stopped domain. We have to delegate it to cube DNS, which means basically writing in.

A

This is really hard to do a.

A

Really simple config map right that says: if it's not global, you're going to go to the IP address of this, do dns and I. We literally template that with bash I'll do the same on the other side. If it's come up, Oh, sometimes sometimes that install there's non-deterministic just pretend everything works. I thought I had enough weights in I thought: I had enough weights in the right place, but there we go. This do.

A

To play cute ass, yes, good!

A

This is really hard. Next, okay, we're gonna go into hello, world hello, world world. This is cost of one. So this is gonna, get my little greeter out, but it says hello: you saw it, it's beautiful memory, say Frost, so yeah cheers man, she has passed Matt and we get the we get there. No, no!

A

We don't have a cube. Config I've got this recorded. It can't fail. I will get the recording out.

A

But why are you China? Where do you think that we can list my being stupid? Oh.

A

Don't don't rewrite your demo at the last minute? Fine, okay, let's deploy the greeter somewhere, we can find a config file. Yes, oh yes,.

A

Yeah there we go right. Yes, thanks haha small victories at this hour. I try to get the IP at the ingress, but the ingress controller really isn't working so we'll have to port forward to it. I applied it to this cluster three hours four minutes ago and it still doesn't have an IP address, so I guess they're out of GL bees in that region.

A

Okay, on the other side cluster two we would apply the name of service. The name of service is some bash. That returns the word mat and then I've got a bunch of demos. In here, okay, we will get.

A

What we're doing here is getting there ingress gateway address from cluster two. So this is cluster ones context, but it needs to know where the next hop is. It needs to know where the ingress gateway of cluster two is so we just stick that in an environment variable.

A

We can make that service entry for the neighbor, so this is cluster one with the greeter. It wants to call the neighbor to get the word mat, so we can make that service entry and we're going through a yeah mall and we're taking cluster two gateway Jess and we're replacing it with the real thing.

A

So the service century doesn't say alive, it says well, yeah. The thing is mesh internal ie. You can expect to find a proxy next to it, even though it's not in this mesh, this is the port is listening on. It's got an address literally, can be anything you just need to get the packets on the wire.

A

If you say 127, they're not going to accidentally hit anything else, so we just give it a random loopback range address and then so that's the address it resolves to and the format's a little bit confusing for them with the actual place it's going to. Is it's the next stop, which is this ingress address, and then everything this now does work in one point, one everything is multiplexed across everything goes across the internet or 15 443, and that can be any point.

A

You want to punch there any firewalls or whatever, and then it gets because that magic, S&I header, contains the point number it ends up in the right place. On the other side, I am nearly done. This now should just work, although I'm first gonna have to find a damn thing.

A

Cool when I was stupid, it's gonna be here.

A

Cuz I just can't remember what it's this is, what we religious, but which is what we're really gonna do and we can curl.

A

So this remember localhost:8080 is actually port forward into the padang cluster one cluster, one with that service centuries gonna call cluster hello comes from the greeter, matt comes from the neighbor, and that is across cluster calls made easier with this year. 1.1 I'm at a time. I could go change the config mapping cluster to and then it returns a different name, but that config much to take like 30 seconds to synchronize and I. Don't want to keep anybody from there beer, but there you go, it works and what we did.

A

We did some sto configuration, but we that's all install time. There is a values fire ready to go for you to do that. I know. I just spent most of my time explaining how it works, because this is cube Gong, you then really need just need to deploy it. You need to change your application to use a dot global style name to opt in to those calls, and then you add the one service entry that says right in this cluster. It is acceptable to call this service in another cluster.

A

That's the ingress gateway, IP, the other cluster and it kind of works and, as I say, doing prot. You know proper architecture, a separate clusters, separate layer, 3, Network, separate service meshes. Keep your isolation. Tell one how to talk to the other, it's very nearly first class. Now it's all I've got. Thank you very much.