Cloud Native Computing Foundation Kubernetes on Edge Day EU 2022, 19 May 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Lightning Talk: Connecting Klusters on the Edge with Deep Dive into Cilium Cluste... Raymond de Jong

Description

Lightning Talk: Connecting Klusters on the Edge with Deep Dive into Cilium Cluster Mesh - Raymond de Jong, Isovalent

Edge computing can require connecting hundreds of clusters across disparate locations and infrastructures. Without a networking solution to manage this scale and complexity, you will just have a bunch of computers talking to themselves rather than each other and your customers. Cilium is the next generation, eBPF powered open-source Cloud Native Networking solution, providing security, observability, scalability, and superior performance. Cilium has joined the CNCF as incubating project. In this session, you’ll learn how you can leverage Cilium Cluster Mesh for providing connectivity for load-balancing, observability, and security between nodes across multiple clusters, enabling simple, high-performance cross-cluster connectivity at the edge. We’ll explore how Cluster Mesh allows endpoints in connected clusters to communicate while providing full security policy enforcement. The audience will walk away with an appreciation for how eBPF can help solve their networking challenges at the edge.

A

Good morning, everyone, buenos dias. I hope everyone has a great time um today. I do a first lightning talk about connecting kubernetes clusters on the edge using psyllium cluster mesh and the agenda for today, starting with an introduction about psyllium and ebpf to understand how it works and how psyllium uses it to publish services across clusters or to have identity based security across clusters using cluster mesh.

A

And then I want to do an overview and deep dive on cluster mesh use cases and I'll talk a little bit about how. For example, customers can be used on the edge to support edge workloads in a design or topology which extends clusters across multiple kubernetes clusters.

A

My name is raymond dion, I'm a solution architect working at isovalent, the company behind psyllium.

A

So, let's start with ebpf. What's ebpf, it stands for extended berkeley packet filter that doesn't tell you a lot what it basically is. It provides technology software for having a base, sandbox virtual machine to run custom code in your kernel based on events without actually updating or changing the kernel. What it means is that if you have a recent enough kernel, you can leverage evpf to do a number of things based on events.

A

So, like I said, ebpf runs custom code in the kernel based on events, so it has user space in a kernel space. So when an event, for example, a packet arises, it arrives at the network interface, an ebp pro ebpf program can be triggered on that event and do custom code or logic with it.

A

So it runs ebpf programs on events and today we're talking about networking. So what that means is that every time a process connects or tcp retransmit happens or a packet leaves or arrives at the network, interface psyllium with ebpf can do things with it and inspect that traffic to provide rich observability or to provide services across clusters.

A

Now psyllium is obviously software for providing connectivity across kubernetes clusters and it provides security, connectivity, services and observability for your container workloads and it uses ebpf technology under the hood and it abstracts ppf for you as an engineer interacting with the kubernetes cluster. So you don't have to know ebpf or program ebpf. It just leverages ebpf under the hood to provide network connectivity or rich observability.

A

So a number of things we are currently doing with cerium and especially cluster mesh, so we provide network policies, identity, aware network policies across clusters, so we can see identity from other clusters and secure that kind of workloads based on their metadata, so their labels providing services and load balancing and in terms of cluster mesh. That means that we can provide services across clusters, bandwidth management flow policy, logging and operation operational and security metrics.

A

So also we use hubble as a component which talks to the zillion agent to inspect and show traffic leaving and arriving your workloads.

A

So in terms of cluster mesh, you can use psyllium for availability, security and manageability use cases.

A

First of all, you can run services across your kubernetes clusters, so you can connect on-prem or in the cloud or a hybrid kind of combination of clusters using psilium cluster mesh, and you can have global services defined, which are may basically make a surface and their endpoints available across clusters.

A

But you can also do centralized services kind of topologies, which I will show a bit later and while you're doing so, you can also enforce security using serium network policies. So, like I said, each set of unique labels from a port creates an identity, a unique identity and using psyllium. You can create cellular network policies or cluster network policies to enforce that security across your clusters and then finally manageability using hubble. We can provide visibility for the workloads across your clusters, so you can inspect traffic across your cluster.

A

So, for example, when a given port in a given cluster reach another endpoint in another cluster, you can inspect the traffic and how the ui understands where it comes from and which identity it has.

A

So, let's talk about let's dive a bit deeper on customers use cases so first use case is obviously the high availability use case where you have one or when you have two or more clusters connected with cilium cluster mesh.

A

How it works is that in each cluster you will create a namespace and you create a surface, and then you annotate a service with a global and cmio global surface to enable it to be available across clusters and what happens using ebpf is that obviously psyllium understands endpoints in each cluster and it will advertise those endpoints across clusters. So in each cluster you will see endpoints from both clusters being available.

A

That means that, for example, if you have pods in some kind of cluster, which has a mis-configuration or being redeployed or there's something wrong with that, actually the service can fail over connectivity to the other cluster.

A

Another use case is shared services, which means that you're basically want to abstract centrally configured servers in a given cluster and, have you know smaller clusters across, uh for example, on the edge.

A

So what this means is that you most likely have things like dns or logging, or some kind of storage, where you need to find, configure and store the state of your workloads in a shared services cluster, and you don't necessarily want those to manage them in your edge clusters in other clusters, because you want to be flexible in the life cycle of those clusters or you want to keep those clusters as small and as agile as possible.

A

So what you can do, then, is just you just expose that surface in the front-end clusters and then have a shared service in a single shared service cluster. So each front end in this example will connect, for example, to a vault service in their own cluster and get redirected and connected to the shared services cluster, and this also works very well for providing segmentation, for example, between tenants or separation between security levels. So, for example, if you're high secure you don't want to expose necessarily in that cluster that given a services workload.

A

And then, finally, a very useful use case, I believe for x. Classes is splitting services, and this is about creating stateless versus stateful clusters, so obviously on edge and some kubernetes other topologies as well is stateless clusters, creates the option to have more flexible workloads on the front end, also better, performing because you're not storing state. On that front end, you want low latency, quick response, but if you need to store or consult data stores in another cluster, you can create a stateful cluster, expose that service across your front-end clusters and make that connectivity available.

A

That also makes it easier to life cycle, your front-end edge clusters and just maintain a single stateful cluster, which obviously needs more configuration and care in terms of making that available.

A

So if you want to know more about psyllium cluster mesh, I recommend to go to cilium.io and learn and there's a lot of documentation on the psyllium io website to get started with cluster mesh. It has a lot of examples to create a a a surface, a global surface and to show how it will fell over across a cluster.

A

What's also coming is that we're close to releasing a feature that you can have an affinity. So, for example, you want only the local endpoints to respond when it's available and when the local endpoints are not available, it will fill over to another cluster or the option to only expose remote endpoints which make sure that once when a front end is hitting a surface, it will get redirected to another cluster and have the workloads running there.

A

This also gives a lot of flexibility if you do some kind of maintenance in a specific cluster to have that surface redirecting traffic to another cluster.

A

There are also weekly, interactive, psyllium introduction and live q and a's with thomas graf, our celium co-creator, and we have also installed this. If you get started with cilium, where some of us is walking you through installing psilium on a kind they set up, for example,.

A

That's what I had for today. We also have slack github websites and obviously twitter, to follow and to know more about psyllium. If you have specific questions about psyllium cluster mesh, I will be outside and please ask me: I'm happy to help. We also have a psyllium boof in the in the expo starting tomorrow, so myself and other contributors of psyllium will be there to answer any questions.

A

um Thank you for spending time with me and there will be another tech talk right after this. So thank you very much.