Cloud Native Computing Foundation ServiceMeshCon EU 2021, 14 May 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Multi-Cluster Service Mesh With Istio - Zhonghu Xu, Huawei

Description

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Multi-Cluster Service Mesh With Istio - Zhonghu Xu, Huawei

In order to achieve high availability and scalability, more and more users are going to deploy applications across multiple clusters. Even these clusters are distributed in different regions, how could services discovery and communicate with each other become a big challenge for users. In this talk, Zhonghu will show you how Istio can handle this tricky issue for us. First, he will talk about the different kinds of multi-cluster models and what are the best scenarios they can address. Then, Zhonghu will illustrate the design philosophy of how Istio discovers services across clusters and how Istio simplifies service management. And at last, Zhonghu will conclude some points that can be improved in the future.

A

Hello all right, my name is today: I will introduce you multi-cluster service mesh with these two before we get started. Let me first introduce myself, I'm enthusiastic and works on research source software since 2017.

A

I have joined the sql committee since 2018 and the focus on networking since then, and now I used to call methanol and one of the top contributors, I'm also a school student committee member as the author of our native search mesh is too the best selling service match book in china.

A

Let's see today's agenda, there are four parts that I will introduce today. The first part is use case of multicast.

A

In this part, I will show you why we need multi-cluster and the second part is the challenge of multi-cluster, and there are several challenges here. I will show you. The third part is different multi-class patterns.

A

This part is the most important part of today's topic. The last part I will introduce you future evolution of multi-cluster in history.

A

Let's see the first part, why do we need multicast?

A

Multicluster is a subjective strategy for deploying an application on or across multiple kubernetes clusters, with the goal of improving availability, isolation and scalability multi-cluster can be important to ensure computer planes with different and conflicting regulations, as individual clusters can be adopted to comply with geographic or certification, specific regulations, the speed and safety of software delivered can also be increased within individual development teams, deploying applications to isolated clusters and selectively, exposing which services are available for testing and release the first part. The first point is availability, multi-clusters can spin across multi-regions or even multi-vendors.

A

Users can rapidly replicate applications in each cluster. Thus, even when one cluster is totally down, the traffic can fail over to a healthy, remote cluster and it has no influence on the system availability.

A

The second one is performance for internet users. They can access the servers nearest to them and the latency is the smallest, strong isolation, guarantees simplicity, key operational processes such as cluster and application of greece. Moreover, isolation can reduce the blaster radius of a cluster outage organizations with a strong tendency. Isolation requirements convert each tenant to their individual cluster scalability.

A

One kubernetes cluster can take charge of 5000 nodes at the most, which is not enough for 100 100 kilo, 100 000 replicas application, so it's not enough for their application level, so they need multi-clusters.

A

The last one is the cost. A multi-class strategy strategy in enables your organization to shift workloads between different communities, vendors, to take advantage of new capabilities and pricing offered by different vendors.

A

Okay, let's see the second part, the challenges for multicast.

A

There are four points I listed here. The first one is service, discover discovery for native kubernetes. There is no way to do service discovery for remote clusters.

A

We have to make use of external service registries like people, for example, on the picture on the right picture. The cluster one clients can not discovery, discover the class services from the other clusters and the second one is the dns dns reserve reserve.

A

The remote service domains are resolvable in local cluster because in native kubernetes the kubernetes is responsible for dns reserve, but here it has no information of the other clusters service and any points.

A

So for our service survives across much clusters, it is resolvable. The service is hard to access, because the kinetics improvement service accessed by our iv walls, which only handles local cluster service and voice.

A

The third one is load balancer policy, the load balancing is run rubbing for kubernetes av testing and the canary release are hard to implement employment.

A

The fourth one is a lack of security. It is very dangerous to talk with each other with plain text. It's best especially sorry, especially through.

A

Especially through the public network, okay, let's see the next part. What is sq uh from the is your official document website. We can say the water is joyous before we start that part. Let's show kubernetes kubernetes is a platform for medication deployment and operation and also provides some capability on service discovery and load balance. However, its q is totally service or oriented and is very good supplement for managers in service management.

A

It is very friendly to both developers and operators from the slide here. It still provides four major function. The first one is connect. It intelligently controls the flow of traffic and api calls between services.

A

So with it, we can do some more advanced traffic management, like uh blue, green, current deployment, a red black development and a clan radius release penalty release. The second part is secure.

A

It sql provides the automatically chairs with each each api call. So by default, the service to service traffic is encrypted with qrs.

A

And the third party is the control with the issue of authorization policy, authentication policy. It still can control the policy. The fourth part is, I think, is the most important one. It provides the over the ability, such as access, log monitoring and also assets uh also distributed transit.

A

Let's say multi-class match before we get started in production with multi-cluster surface match. We should consider the following three questions:.

A

Compared with multi-clusters, which provides a blackboard service, boarding, single machine is aware of all the clusters.

A

Services and can do more advanced localizing like location, aware, routing and failover. So the first quick question. The answer is: where should the two choose single mesh?

A

The second question is single network or different networks. It still uses a simplified definition of network to refer to workload, instances that have direct reachability, for example, by default all workload instances in a single cluster on the same network.

A

Many production systems require multiple networks or thumbnails for isolation, and higher availability is about spring expanding a service mesh over a variety of network topologies.

A

So the second answer for the second question is depends on the production environment. We have the third one is single or multiple control plans.

A

Single plane is easier. While multi replicated control planes in each cluster may provide more availabilities. We can depend on our real.

A

A

Okay, let's see the next part dns result before 1.1.8.

A

Let's see the picture 1.8, the dns result is via the kubernetes and the sql codens for services for native communities, services, which is resolved by the audience and for the remote cluster services, which is resolved by a separate plugin. It's your code. Yes, the audience is a is an upstream dance for the.

A

Audience uh in native kubernetes it still use the virtual ip returned by the dns lookup to load balance across the list of active endpoints for the requested services, taking into account any configured routing rules, it still uses other community services or endpoints or is to service entry to configure its internal mapping of hostname to workload. Ip address.

A

To ensure that dns lookup success, you must deploy a connected service to each cluster that consumes that service. This includes that, regardless of where the record request origin is, you will pass dns lookup and will be handed to issue for proper routing. This can also be achieved with sql service entry rather than communicating service.

A

However, a service entry doesn't confirm, configure the kubernetes dns server. This means that dns will be configured either manually or with automatic, automated tooling, such as sql code, ds, plugin,.

A

Let's see the dns resolve after after release, 1.8.

A

After being 1.8 released, dns proxy is introduced not only for multi clusters, but also for virtual machines, the as a result. Previous. Obviously, we need an additional components: sql code. Yes, it is not very friendly. It requires service interest created seo is extends a new kind of x, guest nds and yes, the full name is named. This limitable discovery service to facilitate the dns reserve.

A

Nds is used by the dns proxy to fetch the answer name tables from sql control plan, and then it builds dns, lookup, cable to service mds results from reload from local application service. The name table contains awesome services across clusters for community service. The address is class type e for the other service entry defined service. The address is author allocated.

A

This address is a kind of clustering address.

A

Okay, let's see the picture. This is a works workflow of the dns reserve.

A

Firstly, the the dns requester is forwarded to the dns processing. The drs proceed returns a dns response. If it caches the dns name table, otherwise it will afford the dns request to the kubernetes and then maybe the audience can follow the dns request to external upstream, yes, single network, let's say single network for single network.

A

All cluster rest resides in a same network and outputs from past. One can touch to pause from class 2 directly. Such no gateway is needed and the close-class communication will not increase latest. In most cases, this is not common. This is the pros.

A

Proof is low. Latency for easter eggs to traffic as a gateway is not needed. The cons, one is the complexity, need an additional tool to build flight and network. Second, one is security.

A

It is not secure, as all the workloads are using a single network. The third one is no operation for the service. Iqr3 ranges that means that the cluster, the class 1 and the cluster 2 cannot have overlapping service id address or port iplan for the ipl address.

A

Different networks, so the mesh kinds brings seven different networks. Each cluster resides in a network product can not talk directly to the other ports in another cluster. This provides better isolation. Each cluster is independent, independent undergrowth class service access must through uh easter western giveaway.

A

So the challenge is is a cross-cluster service communication. Actually it requires users to gather it and it works in tis or pass through mode. So, let's see the pros and cons.

A

Yeah, this is good for scaling of network addresses. The concepts is the load balancing across multi-cluster, as well as a single.

A

A

But different network get away.

A

The first one is the stabilizer horizon: is it s? Endpoints from different network cannot be accessed directly masked through a gateway and the gateway is accessible from other networks. So it is hard.

A

It is issue d who has to convert the endpoint address to gateway address, gui works in alt, password mode and with sni cluster network filter, applied on the listener, invoice listings on the same port and follows different for different service to service course by the sni it brings with this. It requires the closed cluster communication must be ts encrypted.

A

The sni cluster network filter works by setting the upstream cluster name through the sci field, passed from the tis.

A

Handshake, let's see the single network primary remote model.

A

From the picture we can say that this is the class 1 and class. Two classes and class to rest are the two clusters, but they are in the same network, so service a can talk to service b across clusters and from the picture we can say that there is only one control plane resides in cluster west.

A

So this is the primary remote, but the service discovery is done by the sqd is to the list to watching the services and points from all the clusters within the meshes the configure discovery. It is also the sqd who is to watches custom resource like photo service designation rules from private primary from only primary cluster.

A

Now this is how the single network primary remote pattern works. This is a single network, multi-primary model in this model. The eco control plan is deployed into every cluster.

A

A

Okay, the service discovery is like looks like the same as the single network is 2d in each cluster discharges service endpoints from all the clusters.

A

Further configure discovery is to see in each cluster's list, which is local or the local cluster customer resource. Like virtual service, that is usual.

A

Sidecast, that means a local cluster sidecast can only can connect to the local institute, and the local cluster study is responsible for pushing x gas to the side class.

A

This pattern provides more availability in the resilience because one cluster, when one cluster fails or when one cluster, when single control, plane fields, the other clusters can work as well.

A

Let's see the gateway for the different networks ahead, yeah, how can eastern discover recovery discovers the east west gateway and is requested to do also to do auto split, rising eds? This is by the name. Space labels, the name space labels, topology dot, sql dot, io network tells is to the local cluster is in network one and the service labels topology dot, institute, dot, io slash network tells xqd the service in is network.

A

The the service is network is resized residing in network one.

A

It is the east western gateway service, so we can get the service ingress ip or external ib address to get the east west gateway address for network one and such the ucld can convert the endpoints for network one with the gateway address.

A

So what can be improved.

A

Yeah multi-cluster is looks very well for, and it is already can be used in production, but there are several companies we have to face too. The first one is better load balancing across cluster from the right side picture. We can see that green cluster wine service want to talk to class 2 services at the easter easter white western gallery as a tcp proxy.

A

Actually it is a tis proxy and the sessions decay between the client service and the server space is not every article because the easter egg getaway works on around rubbing load balancing policy.

A

So there is no setting session sticky between source and desktops, and this is easier in github. We can see more details there. The second one is the holiday service does not work well.

A

That means when we want to access a healthy service to like it's the right picture. If we want to access from the class to one to a remote headlight service that is deployed in class, two, it is not possible now, because that's the hiding service instance dns result resulted to the portal called address, as the cluster type is using the original desktop.

A

So the if we access the port ip address from the local cluster cost one here, the traffic is blind text and it cannot be processed proxied by the green.

A

The third one is the cluster client must send ts, rightly so, if we want to make the healthy service works. Firstly, we should make the easter west gateway worker for plant text, not only for trs encrypt traffic.

A

The last one is a network or class to aware load balancing because for multi multi networks, multi-cluster model, the traffic is funded by the east west gateway, so in order to reduce so this increase is the service to service licensing, because the trafficker is through an additional piece to us to get away hope.

A

So we should increase, improve the performance by enable bias, supporting network or cluster aware localities. So with network aware messaging, the traffic from local cluster will forward it to the lower class services. Firstly, and then when, when the local cluster service is filled down, the traffic will fail over to the remote cluster or remote network clusters.

A

Okay, thank you. This is all the all today's topic. Thank you. Everyone. Thank you for your time. Bye.