►
From YouTube: gRPC For Microservices: Service-mesh and Observability - Sanjay Pujare & Wenbo Zhu, Google
Description
Don’t miss out! Join us at our upcoming hybrid event: KubeCon + CloudNativeCon North America 2022 from October 24-28 in Detroit (and online!). Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
gRPC For Microservices: Service-mesh and Observability - Sanjay Pujare & Wenbo Zhu, Google
gRPC is a popular and the de facto framework for connecting services. gRPC is language and platform independent. It was initially created by Google, as the next version of “Stubby” where “Stubby” was used to connect Google’s large number of microservices. gRPC recently has added many features for the proxyless service mesh. These features enable gRPC based microservices to do traffic management (which includes service discovery, routing and load balancing), and security without the use of proxies or without rewriting any code to make use of these features. gRPC also offers built-in observability support such as logging, metrics and tracing for microservices. One can try these features out in Google Cloud where the gRPC observability plugins seamlessly integrate with Google Cloud’s Operations Suite to give you dashboards for logs, metrics and traces.
A
A
A
One
of
the
numbers
I
heard
mentioned
is
something
like
order
of
10
to
the
power
of
10
about
10
billion
rpcs
per
second
one
of
the
improvements
of
grpc
over
stubby
is
use
of
http
2
and
the
benefits
we
get
are
binary.
Framing
multiplexing
streaming
and
h-back
compression
for
headers
I'll.
Also
talk
about
protocol
buffers
in
a
later
slide.
Protocol
buffer
is
also
known
as
protobuf,
and
that's
the
term
I'll
use
in
the
arrest
of
this
presentation.
A
A
A
A
Most
of
these
things
follow
from
what
I
have
discussed
so
far.
Now,
just
a
couple
of
things
I
would
like
to
add:
grpc
is
not
only
used
for
unary
rpcs,
a
unity.
Rpc
is
where
you
send
a
single
request
and
get
a
response,
but
it
is
also
used
for
the
streaming
paradigm,
where
you
do
client
streaming
or
server
streaming
or
bi-directional
streaming
rpcs.
A
A
Another
thing
that
I
would
like
to
talk
about
is
extensibility
and
customizability
are
using
what
we
call
interceptors.
These
interceptors
are
present
both
on
the
client
and
the
server
side.
Using
an
interceptor,
a
client
or
server
can
intercept
rpcs
to
decorate
the
calls
or
it
can
perform
some
cross-cutting
functionality,
such
as
authentication
or
authorization
or
logging.
A
A
A
One
advantage
of
microservice
architecture
is
the
ability
to
scale
various
infrastructure.
Resources
such
as
vms
clusters
or
networks
are
added
as
the
application
scaling
requirements
go
up
and
the
rpcs
have
to
be
routed
or
load
balanced
or
secured
as
part
of
that
scaling
up.
So
how
can
all
this
be
automated
or
managed?
A
A
The
control
plane
maintains
and
manages
policies
for
traffic
management
and
security.
These
policies
are
enforced
or
implemented
by
data
frame
entities
called
proxies.
Now
this
is
the
proxy
mode
in
this
picture.
Grpc
traffic
flows
through
these
proxies
and
the
proxies
are
responsible
for
routing
the
traffic
and
enforcing
security
based
on
policies
from
the
control
plane.
A
The
grpc
application
is
not
aware
of
their
presence
and
communicates
as
if
the
proxies
are
not
present.
The
proxy
is
also
used
for
http
and
other
application
level.
Traffic
such
as
redis
or
sequel,
but
with
grpc.
We
can
do
away
with
the
proxies
if
we
implemented
the
same
functionality
in
the
grpc
layer.
A
A
The
infrastructure
resources
used
are
as
follows:
a
gk
cluster
version
1.20
with
three
e2
standard
16
nodes.
These
nodes
have
16
cpus
and
64
gigabyte
memory.
Each
this
experiment
uses
the
fortio,
client
and
server
apps
in
the
application
container,
which
has
1.5
virtual
cpu
and
1000
megabytes
memory
allocated
to
it.
A
Then
we
also
have
the
sidecar
container
for
the
istio
agent
and
the
on
y
proxy,
which
has
one
virtual
cpu
and
512
megabytes
memory
allocated
to
it.
The
experiment
included
both
the
with
and
without
mtls
enabled
modes
and
with
and
without
the
unripe
proxy,
now
a
little
bit
about
the
sidecar
container.
If
this
is
proximalis
mode,
why
is
there
a
cycle
container
note
that
we
did
the
experiment
to
measure
the
performance
for
both
the
cases
now
in
case
of
rock
service?
A
A
A
Even
if
we
still
require
an
sql
agent,
the
agent
uses
less
than
0.1
percent
of
the
full
vcbo
and
only
25
megabytes
of
memory,
which
is
less
than
half
of
what
envoy
requires
note
that
these
metrics
don't
include
the
additional
resource
usage
by
grpc
in
the
application
container,
but
this
serves
to
demonstrate
the
resource
usage
impact
of
the
issue
agent.
When
running
in
this
mode.
A
I
think
I
had
mentioned
xps
before
so.
Let
me
expand
on
that.
A
little
bit.
Xps
is
a
protocol
for
control
plane
to
talk
to
the
data
plane
entities.
That's
why
it's
called
a
data
plane.
Api
xts
now
xps,
where
x
stands
for
some
data
print
entity
like
x
in
algebra
and
ds,
is
discovery
service,
for
example,
cvs
for
discovery
of
clusters,
rds
for
routes
lds
for
listeners
and
so
on.
A
A
A
So
this
is
the
place
where
routing
and
traffic
policies
are
enforced.
Rds
further
points
to
cvs,
cds
has
constructed
information.
A
cluster
is
a
set
of
backends
that
are
part
of
the
same
infrastructure
such
as
the
same
geography
or
the
same
network
and
the
all
the
backends
in
the
cluster
share.
The
same
security
configuration
such
as
certificates
and
keys.
A
A
A
A
We
need
security,
that's
well
integrated
with
things
like
routing
road,
balancing
and
service
discovery.
For
example,
each
endpoint
needs
to
be
able
to
evaluate
its
peer
certificate
and
identity
using
the
control
plane
provided.
Information
security
also
includes
authorization
where
a
server
authorizes
a
client
before
accepting
the
rpcs.
A
A
A
We
get
authentication
encryption
and
something
called
server.
Authorization
with
mpls
server
authorization
is
somewhat
like
the
host
name
check
in
http
tls,
then
as
part
of
security.
We
also
have
a
regular
authorization
or
client
authorization
implemented
on
the
server
side,
where
a
user
can
use
authorization
policies,
also
known
as
rbac
to
authorize
rpcs
based
on
various
things,
including
client
identities,.
A
A
There
is
something
called
a
server
credential
on
the
server
side
which
instructs
grpc
to
use.
Xts
supplied
security,
configuration
on
the
server
side,
and
I
wonder
what
the
insecure
channel
credentials
used
inside
create
is
doing,
and
this
is
a
fallback
credential,
and
what
is
that
I'll?
Come
to
that
in
a
bit
now
that
xts
channel
conventional
is
note
that
the
xts
channel
credential
is
a
way
for
a
caller
to
obtain
the
use
of
xds
security
conflict.
A
A
I
have
also
included
another
coupon
presentation
last
year
that
focused
on
security
in
proxima
service
flash
both
of
these
talk
about
using
the
proxima
grpc
service
mesh
in
google
cloud
using
google
service
mesh
products.
I
have
also
included
an
sql
block
that
talks
about
proximal
service
mesh
in
istio.
A
A
A
A
A
A
The
grpc
observability
product
runs
in
google
cloud
platform
on
the
producer
side,
it
has
plugins
for
logging,
metrics
and
traces
on
the
producer
side.
You
also
include
the
required
exporters
in
the
application,
namely
the
stackdriver
exporters
configured,
to
send
data
to
the
google
cloud.
Ops
backend
the
product
also
has
an
admin
console
to
enable
or
otherwise
administer
the
feature,
and
then
we
have
consumer
dashboards
that
provide
some
popular
canned
views
or
allow
you
to
configure
or
customize
the
views
with
customizable
queries.
A
A
A
Let's
look
at
the
java
code
snippet
for
an
actual
example
in
your
main
application
class.
There
is
a
main
method.
You
call
gcp
observability.grpc
init
to
start
observability.
In
this
case
we
are
using
try
with
resources.
So
when
the
try
block
exits,
close
is
also
is
automatically
called
the
whole
application
execution
is
inside
the
try
block.
A
A
We
also
allow
the
user
to
provide
additional
custom
tags
that
could
be
used
to
provide
additional
identification
information
such
as
the
app
id
or
the
data
center,
and
so
on.
This
is
a
screenshot
of
the
consumer
dashboard.
As
you
can
see,
we
automatically
provide
suggested
queries
based
on
the
suggested
date
from
the
based
on
the
ingested
data
and
clicking
on
a
suggested.
Query
will
generate
that
dashboard,
for
example,
log
records
of
grpcs
that
had
errors.
A
A
You
can
filter
by
specific
workloads
such
as
the
vm
name
or
vm
instances
or
by
location
or
custom
tags,
so
that
wraps
up
the
whole
presentation.
Before
closing,
I
would
like
those
of
you
who
are
interested
to
know
more
about
anything
I
mentioned
here
or,
if
you
just
want
to
meet
the
grpc
maintainers,
you
can
go
to
grpc
dot,
io
slash,
meet
to
submit
a
form
and
to
get
started.