Cloud Native Computing Foundation ServiceMeshCon EU 2021, 14 May 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Virtual Machines and Service Mesh in the Enterprise: 5 Things You Need to Know - Petr McAllister

Description

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Virtual Machines and Service Mesh in the Enterprise: 5 Things You Need to Know - Petr McAllister, Tetrate

With VM onboarding moving to beta in Istio 1.9, integrating non-Kubernetes workloads into the mesh is undoubtedly within reach for leading-edge service mesh practitioners. But, the full story is not so simple for enterprises looking to bring their traditional apps into the service mesh fold. What if your VMs and K8s clusters are in different clouds? What if there's a load balancer between them? If your cloud provider only provides a fully-qualified domain name for K8s API endpoints, how do you preserve the certificates? In this talk, we'll cover the top five issues we see enterprises face as they move their non-K8s workloads into the mesh and how they're being solved at the top service mesh shops we work with.

A

Welcome everyone welcome to today's sessions. A session about virtual machines and service mesh um service mesh in enterprise uh feed will provide you much more than five things uh you need to know, but we hope you can pick up five things that are important for your environment and your implementation of service mesh and your application and take them and implement on in your architecture.

A

My name is peter mcallister. I work for cpr8. If you don't know, iterate is a leader in a service mesh space. We provide a platform to run your service, mesh and multi-cluster uh enterprise environment.

A

In this session we will cover first how our vm are joining service mesh, what concepts we use, what architectures we see in our enterprise environments and how we arrest them and at the end we also want to go through the demo to see how vm is onboarded and how application vm works after it's on board.

A

So let's spend a little bit of time just discussing our basic concepts before actual experience.

A

So everyone starts with the question: why why would we add vm to a service measure and hopefully, if you're, in this session, you already understand benefits of service mesh? I will touch on them a little bit later, um but in general, mostly people who is asking this question. They already know why they need service measure, so why you need vm in the service mesh. It's the next question and answer to it is mostly because you may have some traditional application in monolithic.

A

Form factor- and you want to put it microservices, but it's work that cannot be done in one day. It requires multiple uh months or maybe even years to migrate. Whole applications so and microservices idea is to start small and extend so you start with future research running and kubernetes ports and the rest of your applications served by vm, or you may have some services that run in kubernetes space and the same time in vms, so for load, balancing and failover and other reasons. You may have two different form factors running the same application.

A

For service mesh advantage, of course, you can just run these two instances independently and use load balancers. But question comes what if I want to benefit for from service mesh concepts and, first of all, of course, security. So encryption of the traffic, you don't need any extra vpn solutions to tunnel your traffic between ports and vms.

A

You also can identify requests if they're coming from a valid source and respond to them only if they validated you can also get different rules around your traffic patterns that is important and finally, for your troubleshooting and analyze an analysis of your performance. You also need to have one single picture of our application. Doesn't matter if it runs in microservices or vm up form factor how we look at it in terms of technologies.

A

So we trying to look at vm as it's another port, meaning you have a vm that runs application and it runs proxy and traffic. All traffic comes to proxy and application and proxy are only communicate using glue back address so application in theory shouldn't be exposed to the external world.

A

It's a security requirement and there's a newspaper actually written by one of my different colleagues and together with other members of a community that covers these concepts of securing application behind proxy and, if you think of port, you never reach application directly. You always go through proxy if our application is onboarded to service measure.

A

At the same time, even if we treat it as a port, we can't completely treat it as a pod, because, technically on next level, uh you cannot run vm inside of kubernetes. You run it on a separate piece of infrastructure.

A

So in play comes all things you wouldn't worry about in one kubernetes cluster, such things as a network and firewalling and routing additional to it. You think about the application.

A

Running in the same name space, so you cannot say: oh, my vm is completely independent. I can have it to be a member of multiple namespaces namespaces, it's very interesting concept in kubernetes and it limits uh and specifies rules around your workload.

A

If you get in conflict between these workload specifications from different namespaces, it causes bigger problems that you want to avoid at all possible cost.

A

Additionally, in terms of detecting where application traffic is going or what application traffic belongs to, it also needs to have namespace attribute or namespace label.

A

Moving along so what we think in real life, it's a multiple uh different combinations and architecture. So, okay, your vm, we discussed already around some different um in in different um what form right. So it's not part of your kubernetes cluster, but what effects behind firewall?

A

What, if it's behind the load, balancer and you're, addressing vm using ip address? But what? If it's, behind aws and an aws load? Balancer, they don't provide you end point ap. They just publish fqdm.

A

So now you have a qdm different than fqdn of your application running on vm and question is how you're going to authenticate it, because certificate of vm doesn't match uh fqdn of aws.

A

So what if you want to run multiple applications on vm? How proxy will uh find out traffic belongs to application number one or number two? How we collect metrics around this data? How we provide security around these applications that we want to keep separately?

A

So all these different scenarios- and they come in very, very different, shapes there's, no single answer. How would you add vm to your service mesh? It depends how your service meshes build, how your vms are hosted. What is the connection between them? But whatever scenario will look back to my previous comment?

A

Vm has to belong to name, space and computer matrix. It cannot be shared between different name spaces.

A

So question comes okay. What I need to do uh to onboard vm, so you have to create three objects: object number one is for quote entry and if you're not familiar workload, entry provides you description of vm, so ip address of vm label of vm and all other stuff workload. Entry is object that we actually use to bootstrap vm. So data from this object, together with certificates together with a bigger mesh config, gets transferred to vm vm gets bootstrapped and that connects back uh to eq id and gets authorized there.

A

So then certificate exchange happens and vm becomes part of your service mission.

A

You need two more objects here: one is sidecar, so one in the middle and sidecar basically defines uh your application and your sidecar communicate right. So what ports are they listening to reports they sending traffic to how they talk to each other on what black addresses?

A

What namespaces can call with instance, visual code, both namespaces visual code, can reach out. So all these different things are specified in sitecar and last thing you need to create. You need to create service entry and service entry uh tells kubernetes ports where they can find your vm or workload endpoint. So it basically has pointer. It has a service name, and it has point back to your code, site, car and service entry can be replaced, uh modify changed at any moment and all these changes immediately applied or almost instantly applied to your kubernetes infrastructure.

A

This workload entry a little bit different, as I mentioned in the beginning, all data. It's part of a data set that getting transferred to vm for bootstrap. So if you change your workload, entry, the most common case, you're, adding additional labels or you're changing ip address of your vm, you need to take this file and put it on vm and reboot, strap it so workload. Entry changes are really costly. Comparing to other two so last thing before gemma. I want to cover.

A

I want to cover uh how vm and port communicate to each other, and we totally rely here on mesh network configuration machine work, configuration uh specifies networks for your ports and your vms and you can have gateway attached to these ports and vms, or you may have no gateway attached to it, and you can see basically all four combinations here. So if there is no uh gateway attached to vm or kubernetes port network communication going direct. So your uh workload calls is your proxy.

A

Is your proxy calls uh destination, actual easter proxy and reaches destination workload if you have gateway defined for vm? What happens here? Kubernetes um kubernetes for code reach out to a gateway and then gateway childs to vm and opposite side if um gateway is defined for uh kubernetes cluster vm reaches out gateway and then uh gateway roads, traffic to destination, kubernetes ports, and, of course, if we have gateway defined on both ends, we're going to throw two gateways.

A

It's important to understand. Just for your traffic pattern, traffic troubleshooting, I know in some use cases. Are we really really looking at decreasing, decreasing latency, so having extra hopes differently may be concerned for our performance? So I just wanted to mention it, so you uh have better idea, you understand how it works in a bigger picture.

A

So let's move to the demo, so first uh just quick coverage, what we will do in edm and how it's set up. So if you worked with easter before you know, one of the applications that heavily used is booking form, so booking for application is already set up, and I already have vms that runs ratings and details on the same vm.

A

We will look at the end, how it works for the pre-established vm, but most important thing. We want to show you how to import uvm, so we already pre-created service entry inside car in kubernetes, so we will not really uh change or touch them. So what we will do here, we will create a workload entry for new vms that also already pre-provisioned, meaning it's instance created on gcp.

A

uh In my case it can be a ws, it can be anything- and I have five addresses of usb am and also inside of the docker is installed.

A

We can today we can run hto proxy on vm as a docker container and that's binary for this specific gema we use container, but really it's up to your decision as a customer, what you prefer container or binary uh during demo, we will create workload entry. As I mentioned, we use tctl titrate service bridge utility to bootstrap vm.

A

uh We will use ssh direct connection to bootstrap it, but you have also option to do offloading so export your configuration and import it on your vm transfer to your vm and upload there.

A

We will show how proxy is installed and configured and run. We will confirm that rating application response ratings application response to your request and also confirm connection back from vm to product page or show vmware in a tsb iterator with bridge ui interface and have a quick click on existing vm. That runs already two different services ratings and details, and, let's start demo. So here you have you see a usb usb interface.

A

So right now we have uh booking for application with all services. Running here is ratings that runs as a kubernetes I service and it's v1.

A

So what we're going to do we're going to add another service that it's going to be v2, but first, let's look what we have for it in this cluster, so we have four called entry and we have two side: cars. One is the full sidecar and one created for vms, so also I pre-created for code entry. uh You can see multiple labels here and also ip address that we're confirming on our right window, ip address of vm, external address and also internal.

A

So we need to internal address, so vm uses it because it's not aware of its uh internet address and also we specify a external address twice, because we're going to use it for uh bootstrapping2 and now you're running command to uh sorry. Let's apply this for code entry, so it's successfully applied next thing we will do is to confirm it. It's applied yeah, seven seconds since it's created and as I record as I said, we have already it's four vms that are already running and running details and writing similar.

A

That's called details list two services running on it so connecting to vm. You can see that if we run docker command, there is no containers currently running switch back to kubernetes cluster and basically around.

A

Command to bootstrap vm, so it takes over quote entry and it transfers all files to vm and it starts for option, and you can see now we have proxy running here for five seconds.

A

And that's successful: you can see analog files, it's successful successfully connected back to kubernetes cluster and running already in a ready mod. Let's start ratings.

A

Rating started okay, so we have now proxy in ratings containers running on vm, and if you look there's a number of requests coming from my traffic generator, uh let's confirm that: that's not pre-recorded, okay, so there's new requests coming from a traffic generator. We get 200 successful response.

A

If you look at looks for ratings, we also can see. Ratings container receives multiple, multiple requests and responses to them. So because right now, tos is not enabled. I should be able to query proxy directly from my machine instead of kubernetes port yeah, and you can see I'm getting successful response here.

A

A

So now let's try to call back so what we will do. We will just scroll from our vm back to product page and product pages. Like comments container uh circumvention support and we got successful response here.

A

So last thing we want to show is a different vm that already runs two services details and reviews. I believe.

A

So it's called ratings, but I think it's detailed something which we will see in a second.

A

So we're connected to this vm and, let's see yeah, so I have oh it's another version of ratings. Actually I'm running here, so I have visual proxy in two application containers listening on different ports and now, when I look here I can see. I have rpm added to my map and I have version two version. 2 is vm that I added and it's successfully shown in this.

A

Diagram, so we can see the traffic is going there and getting responses and we can get all additional metrics.

A

That's all I wanted to share today. Thank you very much for your attention. So I would like to thank um service mesh project for uh platform, creating platform for us to make difference in this uh space service. Meshcon.

A

Definitely for accepting this proposal and letting us to meet you you for your attention, and hopefully you will be both to bring something back home and discuss and, of course, our customers to trade customers for the great feedback that allowed us to make this product.

A

uh This functionality better understand different use cases, different scenarios, a life scenario that hopefully a lot of you, can apply um gitaray team for tremendous efforts on getting all of it, implemented and available for our customers.

A

And finally, I just want to uh say uh thank you to whole big tutorial team for focus and.

A

Consideration, hopefully, you've got five things that you need to find out in your environment before implementing vms, and we will be more than happy to talk to you of different use cases you have as enterprise, maybe something that we didn't cover so far and multiple customers or you personally, would benefit from. Thank you.