Cloud Native Computing Foundation ServiceMeshCon EU 2021, 14 May 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Service Mesh Extensibility Explained - Lin Sun, Solo.io

Description

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Service Mesh Extensibility Explained - Lin Sun, Solo.io

You love service mesh but may have found out you need to extend your service mesh, whether you want to enhance the sidecar proxy or the gateways or the mesh control plane or plugin in your certificate authority or external authorization system. We’ll explore various user cases and extension points a service mesh could provide to users, using Istio service mesh as an example. This is meant to be an intermediate-level talk for audiences who understand the basics of service mesh and would like to further leverage service mesh to the next level.

A

Have you ever wondered how to expand your service mesh for your specific business needs? Perhaps you need to add external authorization or advanced rate limiting, or maybe you want to add customer logic in your data paths to perform dynamic, routing or policy enforcement?

A

I would like to talk about service mesh extensibility patterns to help you with service mesh hi. My name is linsa. I am the director of open source with solo.io.

A

I have been a long time contributor to the istio project, I'm a maintainer and currently also serve the technical oversight committee of this.

A

Year so before we get to service, there's service mesh extensibility, let's talk about what is the service match as part of the journey to cloud native organizations, face many challenges with managed microservices such as connecting securing and observing these microservices?

A

Why? Because microservices comes with a lot of challenges with one monolithic to many many many services. These services needs to connect to each other. You need to understand what, if the network has stayed there, how do you do retry and timeout?

A

Can you defend your arrows and how do you observe what really goes on within these microservices so that you can tell which team may have a problem and also, how do you actually secure the communication on mommy's micro services so that your security team would actually be happy with the microservice framework you have so service mesh in the nutshell, is really to help you with this problems so that you don't have to handle.

A

How do you connect to other services? How do you secure other services? How do you send the telometry data?

A

How do you observe your services in your application container, and the service line should provide the proxy for you that you can run alongside with your application container and also, most importantly, the servicemen provide uh api to allow you to declare intention on how you want to configure these proxy and then the service mesh would automatically configure these proxy for you, so that the proxy would follow your intention, but in the language that the proxy can understand in istio the api you interact as a user is the issue api, which is a much higher level abstraction on top of the onward configuration, and the issue of all plan would essentially turn that customer resource you provided following is your api contract into the proxy configuration of envoy which easily create tens and thousands of code of only configuration with just a few micro services?

A

So there's strong reason, you don't want to do that. Configuration yourself. You rather leverage your service mesh control plan to program the cycle for you. So today we're going to talk about what. If the default control, plane and data plane doesn't fit your business needs, and you want to extend that so let's talk about the data plane, extensibility first, so at the bottom of the layer we have two application and these applications are as part of our data plane. As you can see, one app one needs to talk to app2.

A

Essentially, the proxy is the main in the middle to mediate. The traffic right each application container has its own proxy as a sidecar running within the same pod namespace using kubernetes as an example. um So you might be wondering how does that happen right? So how does traffic always goes in and out of the proxy, so within istio we have something called emit container that set up the ip table rules for the part so that it probably can fit how the traffic are intercepted and redirected on that pod.

A

In fact, the first customization point we're going to talk about is the unique container in the is2 project itself.

A

We support um using any container to config vip tables as the default configuration, but some of the organization may find out it's really against their security rules to have like net admin privileges to deploy applications into the mac, because the any container needs to configure networking ip table, so it needs the net admin privilege.

A

So in those case, we provide on something called seo: cni plugin, so the organization could use issue cmi plugin to config the ip tables. It runs as a daemon set on your kubernetes worker notes, and it would allow the the demons that you can say the pods as they are added to the mesh. It can fix the acting table rules. What the ending container in those case does instead of programmably configured, it's simply just validates the ip table.

A

Rules are good and then finishes the initialization work so that the proxy and the application container can take effect.

A

The second um extension points is really the proxy image, so the proxy image with in istio you can plug in your own image. So that's one way to extend the second way to extend. Is you change the proxy config which we provide a config map that dictates how you want the default configuration template to be, and you could certainly customize that too?

A

You may want to customize a pilot agent or you may want to add some libraries onto the proxy image or you may want to trim down the proxy image to provide your own image to do that before you convince the upstream or maybe upstream, doesn't have an interest, because it's on your own private scenario, the third customization we're going to talk about is envoy future.

A

So angry future, it essentially allows you to customize the proxy configuration at envoy level to the language that envoy can understand. It's a very detailed api that you have to understand exactly you know what onward configuration looks like and how you want to patch it. So, for example, some of the common scenario we see over customer do is uh maybe enable access log for the products move this a little bit, so the first one we commonly see is using rather to be able to provide customizations.

A

So the reason wasm is really interesting. Here is because it's running in the native speed and it's very easy to test. You can use um a standalone, isolated, vm to test your proxy and your proxy extension. It can do dynamic updates without hour restart.

A

It really eliminates the need to recompile and maintain your own build of alloy, because you could use ryzen to simply build your extension on top of it, and what I like most about wasm is really be able to store the weather, moving plugins in whatever assembly hub and be able to consume other people's plugins, so think about hub. How many of you use docker hub, I'm sure it's a lot right be able to reuse other people's work.

A

It's fantastic, so wasm really enables you to be able to easily catalog and share their work and reuse work from other people. So these are the four extensions. The fifth extension points um is in this diagram. One thing we haven't discussed is the ingress gateway right or egress gateway.

A

So typically, um you would have a ingress gateway that mediated traffic coming into the mesh and the the ingress gateway. You can also customize that using any of these customers logically mentioned so you could have any container. Even though most of these you don't need a unique containable ingress gateway. You could customize the proxy image you could also customize.

A

um You could also customize the uh gateway using ongoing filter. You could also use a web assembly module to customize um the gateway, so the gateway is really um different from the cycle proxy because it doesn't do automatically injection on demand. So you have that proxy configuration already up front and then you can just go to the kubernetes yaml file to customize the gateway configuration.

A

So let's call that the fix by reusing some of these same techniques but those but apply on the gateway. So we talked about the data playing extension points. Let's talk about the control, plane, extension ports, um typically on the control plane side. This one common extension points is build the abstraction over the service measure api, for example. It's your car salesforce was mentioning they build the abstraction using helm.

A

So that is one way to build abstraction.

A

Ebay also mentioned they have their own abstraction, using their own customer resource and solo. We also build uh abstraction. This are our glue api and that api.

A

Is it's a role-based api so that you can focus on rows? um So that's one type of extension on the control plane side, the other type of extension is in the control plane. You can say I don't want my control plane to serve as a ca.

A

Instead, I want to plug my own ca, so you could um certainly do that with your own ca, so that your own ca would sign and or some all the keys and certificates for all the workloads in the mesh.

A

So these are the two common um control plane extension points: let's go ahead and see a demo, um um so this is my kubernetes environment running my on my laptop cluster one as you can see, so I have a kind cluster and in my cluster I have a bunch of stuff installed. I have issue installed. First of all, um I have the book info. In start, the only thing with looking for is, I didn't install version three, so I have review version one or two.

A

I also have a simple example called istio in action uh in the insta in action namespace. uh It's the web api example uh and the recommendation and the history and also the sleeve, so a lot of the interesting stuff you can see. You know these um apps are already in the mesh with the two slash two. That means uh it has icon next to it. So what I'm going to do is I'm going to walk you through each of the configuration we talked about right.

A

So let's change the web api, for example. Let's check out its configuration, so we talked about the first configuration extension point: is the elite container right? So this is the unique container used by the by istio. As you can see, it can fix a bunch of ip table rules and it captures the incoming traffic and outgoing traffic and all that configuration is done. Then the proxy takes place.

A

In the the application container, so one thing interesting on the proxy is, you can see you know the image is highly customizable um the bunch. A bunch of other configuration are also customizable and what's interesting in this scenario, is we actually enable configuration uh called hold application until true? So essentially this says, you know, you don't start the application, and here the proxy is ready- and this is important, because some of the application is right here. Some of the application really requires um maybe get out of the network, or maybe just for security purpose.

A

They don't want the application, do any job before the proxy reaches running okay. So we talked about one and two: let's talk about this, uh the third one, which is using onward filter right. What we're going to do is apply an onboard filter called um web api logging audit.

A

So I'll show you what that looks like um so essentially what this does is. It says: hey I'm modifying this, because I want to apply it to the sidecar of the web api and I want to change my login format. To add these configurations.

A

An interesting configuration I would say here is like the search um and also like the the x forward four, the response, so that's not print out by default. So let's apply this and generate some traffic to it.

A

So we're going to do is uh we're going to generate some traffic from the issue in action um from the sleep pod in the sleep container. So if you look at the sleep sleep part in the sleep name space, you can see it's one slash one. So in this case, if you look at the logs, it would not have anything interesting.

A

So you can see because the search is like blank because we're not doing any search, because the sleep part doesn't have sidecut.

A

So that's trying to generate the traffic from the sleep container within the issue in action, and you can see this time. We actually have two slash two in there. So let's try to look at the locks and you can see in this time the locks print out like interesting data right, the search information we ask to print the uri. It's all printed out for you. So this you can use this technique to check. You know if the traffic is indeed mutual tis and what other certs and the uri are using through the two microservice communication.

A

The fourth approach we're going to show is using web assembly. Let me bring my thing over, so I have a filter here called my filter and in this filter um there is a you written your assembly, language and in this filter. The only thing I changed is um on the response. Header side. I want to add hello world through this filter web assembly filter and let's build that so build um the filter and also push the filter to my registry um in web assembly hub.

A

So you can see I'm running the wires and build commands and then I'm trying to build it, and then I'm also trying to uh push it to the hub and you can see it push through the hub successfully and then, let's quickly validate that in the heart.

A

So this is over what assembly had it's quickly validated in a hat logging.

A

Okay, so you can see um my filter, which is the was a module I just added 30 seconds ago. Okay, so we have our advisor module in the web assembly hub. Let's go ahead and use it on the review version. One.

A

Through our workload selectors, I can specify this is only for review version one.

A

Let's take a look at the on way, filter generated.

A

As you can see, review version one rasm, so the corresponding onboard filter is generated for me automatically.

A

Let's check how the future works. So what I'm going to do now is from product page to call the reviews and notice. We have version 1 and version 2 of review on the local cluster, so you're going to see.

A

Sometimes I hate the hello world, sometimes not so now you can see what we have done is we build a wasm plugin and we push the plugin to the hub and then through the wasm deployment configuration we brought that into our cluster and then have it applied to the review version, one service.

A

So what I'm going to do is, as you can see, this is my cluster two on the right side and at the bottom is my management cluster. So cluster two is pretty much same as cluster one. The main difference is, um it doesn't show it doesn't have uh reviews for version one and version two just to simple show: traffic routing.

A

I ship theme and if you look at the bottom cluster, which is the management cluster that I installed it has um it has the management layer so essentially um that I can deploy my abstracted api, which is the robust glue api we talked about.

A

So what I'm going to do is I'm going to exit out of the management layer now.

A

What I want to do is I want to apply the virtual destination crd, which is the abstraction crd uh we built on top of the seo resources, and you can see this says, I'm creating a reviews.global to represent all the review services across different clusters, and the other thing I just created is traffic policy. So traffic policy, allow me to say you know, shift to the fare over um and if local fails go ahead, shift the traffic to the virtual destination that we just defined, which is go to global okay.

A

So now I'm going to go to the cluster ones to see.

A

Okay, now I'm visiting the booking for um the customized ingress gateway. As you can see right now, you know it's run rubbing between the clusters, um because you know I have both one two. Three in place.

A

But now, if I go here and shut down my reviews, uh one and two in the first cluster, let's see if, uh if istio can handle that automatically, so um let's go here and now guess what I'm expecting to only see version three because version, one and version two are done in the in the first cluster. Okay, let's check out the configuration for this because you might be wondering what's the magic right like two resources, uh traffic policy and also the virtual destination, and now you have a complicated, an interesting thing or scenario already played.

A

So what we're going to do is looking at the ui um to help you understand. What's really going on. One thing I like the ui is because it allows you to to look at the debug configuration of the istio. So if you go here, you can actually see this is cluster 1 and cluster 2. You can see actually how many virtual servers and service entry that's actually behind this thing, including our envoy filter.

A

So we talk about onward filter like in this case we actually have an only filter that applies to the gateway to handle the intra gateway of our multi-cluster and to handle the smi port one five, four four three to say: you know for the traffic that costs for class, one that global change to cluster.local, so that the traffic can be forwarded from the gateway to the local service. So this really shows you, um the power of building abstraction and your user doesn't have to create a lot of virtual service service entry and destination rule.

A

Let's wrap it up. As you can see, service mesh extensibility are super powerful. We went through different ways to extend the data plan which can be applied to the cycle proxy and also be applied to the gateways. We also went to building abstraction layer on top of the service mesh api and also plugging your own ca for your service mesh.

A

We would like to have you share us your extensibility stories and see if any of these extension patterns would fit your requirements.

A

Thank you very much. I would love to hear any questions you guys have.