Istio Community, 13 Mar 2023

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Istio Community Meetup February 2023

Description

NSM + Istio across cluster communication

This demo shows how the default Istio booking example can be converted into an interdomain example via NSM. We'll run the demo on AWS and GKE clusters.

A

A

Cluster integration, before uh we would discuss it, we will start with what is NSM so in Assam is hybrid multi-cloud, AP service mesh. That makes complex networking simple and the same adapts traditional service mesh ideas to solve layer, free payloads and the Sam looks at Network as a service, and the Sam also runs everywhere on any clouds or virtual machine setups, or something special like Barry metal for, for example, equonex metal clusters and also an Assam support, different data planes um and also IO repeat it, but this uh my uh the representation.

A

So in the sum it's uh just service mesh like uh the history, the main difference between an assignment list or that an assign works on layer, 3 and layer 4 of OSI model. It means that in most cases your client and then point has a virtual Network and client Hampton Point endpoint have a network interface to communicate with each other, um also major thing that NSM doesn't use gateways or layer 7 proxies in traditional sense, so we are using only Network and network interfaces.

A

Entity and NSM is a network network service mesh and yes, in most cases, you will operate this network interfaces when you're using MSM foreign.

A

Also in presentation you can find all currently supported data planes. I will not explain each top topic because it will took many time and also, let's look at the basic and SM scenario. Just for your understanding. What is an assume here?

A

um We can see that the simple picture, so in most cases we have client client wants some network service and client always ask for network service network service mesh. It requests it with wider PC services and, as a result, client gets a virtual wire is concrete and point that implements network service. So uh in NSM we have two major abstraction. The first one is networks wise. It's something like interface in programming and also we have the second major entities network service, Mission Point.

A

It's like implementation of the programming interface in programming, so um I think that's it this uh an installment Raw, and we can continue talk about our motivation for this integration. So we want to run Easter over an SM Network.

A

We want to achieve Easter cross cluster communication without additional layer, 7 proxies or something like Ingress or other additional.

A

Additional workloads that currently are using in service measures also, we wanted to allow istia to interact with and the same clusters, and we also want uh to don't modify source code for NSM and for Eastern.

A

So now, let's talk about example from the rail board for this use case. That I'll show you so, for example, uh in some moments we need we might need to migrate the old monolith system with some old monalis style Services into kubernetes, and we also want to use istio as a service mesh for our all migrated services from the monalis.

A

But when we started to migrate our monalis in kubernetes, we realized that some Services impossible to move from for some reason, probably some something is super, hard-coded or and so on, and now we need to make a new services in kubernetes work with old services from the monoliths, uh and we also want to use Easter for the system.

A

So, um and the solution here for case could be is using an assignment is to integration. So, for example, we have something like that. We have some Barry metal uh server. We have some Cloud. We have another barometer server where, where we have some Docker application, that is exposed- and we also have something like virtual machine- and we also have kubernetes cluster with Easter workloads so and our, and we want to make communication with all workloads uh and uh to achieve it, we can use.

A

um Oh and attribute we can use NSM, so um we can just deploy network service mesh for all our environments and.

A

As you know, NSM is working everywhere, so um it actually it's possible to run it in all our environment and.

A

And when we use NSM on this environment, we also could use one feature from an SM that we call that we named like a scale from zero. It allows to create workload pod, it's something like mirror from the overcloud from the environment. So, for example, as you can see for barometer one you have workload free and when we use NSM and after scale feature, it will create our Cloud free agent for kubernetes cluster.

A

And also major things that workload free agent is actually handled by Network sales mesh and it also handled by Easter. So it just have two annotations.

A

So, um let's about let's a bit talk about what is proxy itself I mean this Agents from this scheme. So um agent is a is like just a pot that has Easter annotation because, as you can see, workout 3 is running in the question where we have store system, so I still will handle.

A

This proxian will append histoproxy sidecar, and it also is using uh Network series mesh endpoint, it's just a container with supplication.

A

um Here you can see um proxy that that we named like layer 7 proxy, but actually it just proxies traffic from an SM interface to Easter Sidecar.

A

uh So um layer 7 means here that we proxy traffic from an SM to istio layer, 7 proxy.

A

um So uh small conclusion about proxy proxy is just a mirror of the original were called proxy uses. Installable proxy is an assignment Point based on NSM, SDK uh and proxy doesn't modify an assignment with your source code.

A

And it's also the proxy itself doesn't use layer, 7, proxy and Link, but as I said, it proxies traffic to the to the histoproxy that that actually is uh layer. 7 application.

A

And also the super major knot that the proxy has superb performance, because it's working on layer, free and layer 4..

A

Let's look at data pass architecture for use case. That I show here. I mean this scheme, so um here for for workload will be for workload. That pass looks like that. We have uh what we have in the same interface in the workload that is located in outside of the historical cluster.

A

It's connected with layer, 7 proxy that has Easter that has that has an NSM interface like NSM endpoint and all traffic from this interface is approximate to the Easter side car without any code modifications for Eastern.

A

So uh now, let's look at demo from for this scenario. Currently I prepared prepared press it up. Let's look at this a bit in details.

A

Foreign cluster, it's actually is real working, Google Cloud cluster. It has at this moment it has only only an SM uh service mesh on the board and also it has spire, because.

A

We are currently we are using expire for for authorization and for security reason. Also, as you know, Easter is also supports. Subspires, so I guess you, you already know about Spyro and let's look at the second question. uh Orange terminal is for AWS.

A

Here we have a real working AWS cluster, and here we already have a few things. So, first of all, we have aspire second. Secondly, we have an SM system and finally, we have Easter is the application install service mesh and also we have deployed here.

A

We deployed here Easter example, just from Quick demo, I mean example this uh about booking.

A

Let's and now, let's look at the example from AWS cluster. So for that we can just do portfolio forward or product page.

A

From AWS cluster.

A

Okay, port forwarding is working now, let's verify it.

A

Oh I, as you can see, port forward is working, but here you will see is just basic uh booking for sample from the history. Repository uh here is no changes. Currently we don't see anything here. I just show you that example is working.

A

So now, let's return to the Google cluster, and here, as you can see, we also have deployed product page. As you know, this example is uh shows how how is what? How is working services in kubernetes and this store and all content here is dynamic and it it's. uh It is loading from different services. For example, reviews are loading from reviews. Serious ratings are loading from rating service and so on. So let's return to the Google Cloud.

A

Here we have product page that actually- and this question uh have not any ratings and it haven't any details and review services um and it shouldn't work actually because it haven't access to the resources.

A

um But uh here product page is also is a client for NSM, and an SM is already the work for connection this product page this uh AWS cluster. Let's just describe product page Bots,.

A

I want to just show that product page is just is just simple booking for product page without modifications, and also this bot has an SM annotation. You can see it here here. We can see that uh this bot is a client for a network service mesh, and it wants to be connected with after scale is to approxy endpoint, it's actually bought from AWS cluster.

A

It's um give me a second it's the spots as you can see. It's just bought with one container. This container is just a network service measuring point, so we don't have history here and also you can see here in the same domain. My cluster tool, it's just a domain name for AWS cluster and also you can see here kernel.

A

It's a type of interface that will be created for this product page will set its and also you can see here. Query parameters like instant one and a product page understand one means name of network interface.

A

So um now, let's just uh perform forward to this spot, let's stop or forward from AWS and let's start port forward from Google Cloud cluster, so um put forward to start it I'm refreshing the page and as you can see, we have the same results for this.

A

A

For this product page all content is loading and to verify that we actually have access to the second cluster. We actually can do something like the speed, dump and check our network, but for for quick demo, we can just delete something from the AWS question. For example, we can remove reviews uh service from the OS cluster.

A

And to refine that the change will be applied for the product page from Google Cloud, so I am deleting.

A

Why, from the average cluster I'm I'm deleting reviews for this version free uh as as I know it's uh when, when reviews version, 3 answers UI show is like red stars, so science I have deleted reviews version. 3 will not see red stars here. Let's check it, I will do a few refreshes and, as you can see, we have only we have responses only from reviews version, one and version two so looks like our integration is working. So now, let's try to delete uh evios version.

A

Tool to verify it so now we will not see stars when we'll refresh the page and as you can see, we don't see stars only fresh, so also um I won't try to do some think.

A

It's actually not the part of demo, but I think it could be useful for you to understand what is going on. So um here we can. We can delete, for example, rating service from the AWS clusters, cluster, okay,.

A

And when we believe it, we will see errors on our product page. As you can see, something happened and we've done. We don't see any details.

A

Oh sorry, we don't see any ratings, no, because we have deleted it and now uh we'll reapply rating service, but for Google Cloud. So this moment we don't have it. Let's pick it.

A

Yes, as you can see, we just have only product page for Google, Cloud, okay, let's just.

A

And before we apply it, let's just quick look into these spots into this deployment um here, as you can see, it's just a ratings service writings deployment, but it has an SM annotation. It means that when we apply it, an SM will append any same side cards for this uh four pots for this deployment.

A

So and also you can see here the same annotation as we saw for product page from Google Cloud. So actually, this annotation is is needed to be connected with AWS question.

A

A

Let's apply it.

A

Also also one another thing: we need to apply it for Google, for Google clouds.

A

Okay and we apply it as you can see, ratings deployment has been created. Let's check it, as you can see here, writing server started doing it and when you'll be needed for this, for this bot for this AWS cluster will be. Oh, it's already created. As you can see, we have proxy ratings service for AWS cluster, but uh it's just a mirror. Just a lightweight NSM blocks here.

A

So, let's check is it started? Yes, you, as you can see it's started, and now we can verify it so now, I'm.

A

Oh, but for now we will not see any results because we need to report forwards. They will put forward for Google cluster product page and, as you can see,.

A

As you can see, oh probably I'm not sure but looks like it's. We don't see any updates.

A

Oh give me a moment to verify it. We can Port forwards um product page from the AWS question.

A

I'm just forget what looks like it's. uh It's actually review looks like it's working, but let me verify it. You can delete product page and check that we don't see any reviews.

A

Or I mean any oh sorry, we have applied ratings version, one for for question one. It means that you can delete.

A

And let's um writings wedding from typo in your Cube cuddle, Commander oops, sorry, you can delete.

A

Oh looks like it's correct: it's looking correct to me: okay, let's just delete uh ratings and verify that we will not see ratings on product page.

A

The ratings has been deleted and we need to put forward again.

A

And it looks the same to me, probably some something: okay,.

A

I think we can play with it. So give me a moment we can I I I'll show another another use case for this. I need to get.

A

I need to get uh booking info example.

A

Oh, we can uh in online lot do something interesting. We can get uh reviews version free from original example of Mr and we can try to.

A

Make it like, in the same point.

A

Yes, for this, we need to restore our.

A

Our annotation.

A

And let's try to apply it.

B

A

Looking correct to me, I just added some SM annotation for reviews service; okay, let's try to apply it for Google Cloud being.

A

B

A

Have something wrong.

A

Okay, it looks like I see the problem: let's try to apply it. Okay, all right reveals version, 3 has been applied and I'm not sure. Will it work but uh they're a nice demo for your.

A

Okay, um for this moment, I don't see I, don't see that it's, it has been applied by some reason. It's not already.

A

Okay, let's look at this deployment.

A

Okay, by some reason, it's not available.

A

Create a copy for the page that I will just replace container is Easter application, so.

B

It may help to Simply go on to explaining sort of like the underlying quicker demos, rather than continuing to try and beat on it, live.

A

Yes, uh I agreed. um Is that, but give me one last try to apply it.

A

I think it should work.

A

Okay, let's replace reviews.

A

A

A

Let's just replace it, and now we can try to apply it directly, like reports I'm, actually not sure why deployment hasn't started. I think it's probably related to my Google Cloud.

A

Okay, I I have I, have just applied uh reviews like airport. Let's look view it work.

A

And I also don't see it I think. Probably something is wrong with.

A

With some my Google Cloud, so it just didn't apply anything by some reason.

A

All are I see it's. It's also looks like a deployment and by some reason this deployment is not started.

B

Yeah, it may make sense to come back to sort of refocusing on the the point of the demo and then maybe taking some questions.

A

Yes, I I think uh we can skip this part, so I I just wanted to show educational extreme part of using it, but unfortunately we get some problems, so it's Google Cloud. Yes, we can return to the presentation.

A

Oh uh before before we move to the presentation, let's Let Me Show and some interfaces for product page just want to show you how an assignments work.

A

So here I am in.

A

A product page.

A

And here we have, we can see that we have an SM interface and, as you can see, we have a virtual Network here and also this example. The part with product page worked with this interface.

A

It's just a start point of our virtual wire, and here we can also see at end point for virtual wear and point here is a proxy product page.

A

So and we can just exec it.

A

Yes, and as you can see uh here for endpoint, we also have network service mesh interface, which in clients Network to verify it. You can use pink and pink chrome endpoint, we can ping a clients and from client we can bring in points.

A

B

I think we're running in the last 15 minutes or so the call would it make sense to sort of summarize what we've seen in terms of the demo and the point of it and so forth, and then take questions.

A

Yep I think we can just summarize all what yeah so so um now, let's talk about pros and cons of this integration and this extension extension case.

A

um It's uh here Easter worked uh in liking, a single cluster scenarios uh for for this demo, Easter salt. That all communication is uh uh is uh is, though, under a single posture, but actually worked in multi-cluster scenario.

A

The second rows that we did not use, ingresses, aggressors external services to achieve all services from Easter cluster and also and also istioch last year, has communicated with NSM cluster without any changes for this solution. We also have currently bonds that, as you saw for all workloads, uh we could we are creating uh proxy ports and it's not it's not free and it takes resources.

A

But uh in future we are planning to simplify this solution and we want to use Virtual layer free feature from an SM that will solve the problem with resources and communication with clusters will look like on this picture.

A

Also in the presentation you can find all the links and you can run all all demos on your laptop for this. You need just to copy paste comments from the example and repeat it, and also you can find more information about extension, use case that I shall.

A

um So mostly that's it from me.