►
Description
Service Mesh is becoming a key component in the Cloud Native world. It allows teams to connect, secure and observe complex microservices environments built on containers and container orchestration tools. But most Service Mesh tools are also very complex and require a lot of engineering overhead to deploy and maintain. In this talk, we will explore the considerations you have to take into account before you commit to a Service Mesh-based stack. I had the opportunity to help customers design around Istio (one of the most famous Mesh tools) and learned a lot through the years. This talk is a distilled experience of the learnings I had.
About speaker:
Abdelfettah Sghiouar, Cloud Developer Advocate @Google
Bio: Senior Cloud Developer Advocate @Google. Focused on GKE/Kubernetes, Anthos, Service Mesh and Serverless.
A
This
is
my
first
time,
I'm
speaking
in
this
forum,
and
so
please
forgive
or
please
pardon
me.
If
I
made
any
mistake
or
you
know
I
did
do
anything
wrong,
which
is
not
I
I'm
not
supposed
to
do
with
that.
I
will.
I
will
share
my
screen.
Let
me
show
my
skin.
I
hope
my
screen
is
visible.
So
a
little
bit
of
intro
about
myself
that
my
name
is
modit.
I
am
working
in
publisher
sapient
from
last
five
years.
A
I
worked
on
cloud
technologies
and
passionate
about
cloud
native
technologies,
kubernetes
networking
and
these
kind
all
kind
of
latest
technologies.
I
started
to
work
on
stu
around
few
months
back
like
three
months
back
where,
when
I
was,
I
was
supposed
to
implement
calorie
deployment
for
one
of
my
clients
and
that's
where
my
sto
journey
has
started.
I
am
not
an
sto
expert
and
I'm
I'm
learning
a
bit
and
that's
where
you
know
during
this
journey.
A
I
have
done
few
of
the
certifications
from
solo,
dot,
io
and
tetrad,
and
that's
where
then,
on
the
occasion
of
five
years
of
history,
when
you
know
we
were,
there
was
a
campaign
going
on
that.
What
is
the
idea
if
someone
has
to
float
some
idea?
I
floated
that
I
want
to
work
or
I
want
to
showcase
a
poc
or
a
demo
where
I
want
to
do
a
local
primary
remote
install
on
two
laptops
right.
A
A
But
you
know
what
it
takes
from
my
from
my
learning
perspective
that
if
I
do,
if
I
consider
two
laptops,
as
as
you
know,
one
cluster
on
one
laptop
and
another
kubernetes
cluster
on
another
laptop
and
I
and
I
try
to
do
primary
remote
on
those
basically
so
so
what
I?
What
I
did
basically
is:
I
have
a
home
network.
A
I
have
two
two
laptops
both
are
both
are
mac
and,
and
they
are
running
behind
the
same
network
both
are
connected
to
wi-fi.
They
both
are
running
kind
cluster
on
plus
on
mac
one
or
you
can't.
You
can
call
it
cluster
one.
I
am
running
a
kind
cluster
one
and
on
map
to
cluster
two,
I'm
running
a
kind
construct.
Two
on
one
of
the
on
one
of
the
mac.
I
I
set
up.
A
I
modified
the
queue
config
so
that
I
can
reach
the
kind
cluster
of
both
the
turning
on
both
the
mac
from
from
one
system.
I
I
did
this
configuration
on
both
the
system,
basically
as
part
of
the
primary
remote
setup.
What
I
am,
what
I
am
doing
is
I
will
be
running
stod
and
the
main
story
and
the
main
component
on
on
one
of
the
primary
cluster,
and
there
will
be
one
remote
cluster
and
my
primary
cluster.
A
The
stod
for
this
should
be
able
to
communicate
with
the
api
server
of
my
remote
cluster
as
well,
and
my
services,
both
the
services
should
be
disk.
The
discovery
should
should
happen
for
both
the
services
from
both
the
api
servers,
so
so
this
is
what
I
was
supposed
to
achieve
for
setting
up
the
kind
conference.
What
I
did
is
on
both
the
map.
A
I
use
this
kind
config
where
I
just
change
the
name:
cluster
2
for
cluster
2
and
cluster
1
for
for
the
another
cluster,
and
to
so
that
the
api
server
can
be
accessible
on
the
on
the
underpinnable
ip
or
on
the
ip,
which
is
the
coming
from
the
my
home
router
dhcp.
There.
I
use
the
api
server
address
as
my
mac
ethernet
address,
so
that
I
can,
by
both
the
cube
api
servers,
are
accessible
over
the
lab
right.
So
my
both
the
servers
are
accessible
over
the
lan.
A
So
if
I
do
a
cube
ctx,
my
both
the
both
the
contacts
are
visible
and
I-
and
what
I
can
do
is
if
I
see
that
both
the
nodes,
both
the
customer
control
plane
nodes,
are
visible
from
the
same
node
that
if
I
do
a
kind
cluster
one,
the
kind
cluster
one
control
plane
and
the
worker
node
are
visible.
If
I
do
a
context
for
the
cluster
2,
then
accordingly,
cluster
2
control,
plane
and
the
worker
nodes
are
visible
right.
A
A
Install
this
is
what
the
primary
remote
install
architecture
or
the
should
should
look
like
right
and
I
have
tried
to
be.
I
have
tried
to
bring
my
both
the
laptops
pretty
much
in
the
same
thing
where
I
am
having
the
same
home
network
and
this
cluster
one
is
my
first
laptop
and
the
cluster
two
is
my
second
laptop
right,
so
so
this
is
what
I
was
trying
to
achieve.
A
So
one
of
the
thing
which
I
so
for
this
demo,
as
I
told
that
I
have
tried
to
use
current
cluster,
but
before
that
I
have,
I
was
also
trying
to
use
a
mini
cube
on
that
many
of
you
mini
q
for
this
poc,
but
on
mini
cube.
I
was
facing
few
of
the
issues
that,
because
mini
cube
it
you
know
it
uses
the.
I
need
to
have
a
bridge
network
so
that
it,
the
communication,
can
happen
right.
A
But
somehow
I
was
with
both
the
vms,
the
the
mini
cube
vms.
I
was
not
able
to
ping
them.
Obviously,
there
were
some
networking
issues
which
I
faced
during
my
poc,
so
for
those
I
I
reach
out
to
the
mini
cube
community.
Also,
if,
if
I,
if
I
show
you
these
couple
of
issues
I
have
raised,
I
have
raised
with
the
community
that
I
am
trying
to
establish
connectivity
between
two
locally
created
mini
cube
clusters
on
two
laptop
but
yeah.
A
Right,
it
is
a
it
is
a
good
tool,
but
again
it
it
was
also.
I
was
also
facing
issues
with
the
while
setting
this
up.
I've
also
raised
this
with
the
community,
but
yeah,
because
it
takes
some
time
so
yeah
it
is
still
in
in
pending.
It
is
still
being
in
progress
or
being
discussed
at
the
community
level
right
now.
Coming
from
sorry
now
going
back
to
from
my
poc
perspective,
what
I
have
done
is
I
have
followed.
A
I
followed
the
documentation
for
the
istio
multi
cluster,
install
with
the
the
first
thing
I
started
within
plug-in
and
see
a
certificate
wherein,
if
we
want
to
have
a
if
we
want
to
have
a
multi-cluster
install,
we
need
to
have
a
root
ca
certificate
with
cluster
one
and
crystal
two,
so
I
was
able
to.
I
was
able
to
follow
the
instructions
which
are
which
are
there
in
this
in
this
documentation,
and
the
documentation
was
pretty
straight
forward
with
this.
A
I
I
want
to
start
with
the
second
thing
where
I
I
I
try
to
do
a
primary
and
remote
install
and
exactly
where
I
am
currently
step.
So
what
I've
done
is
I've
used
a
metal
led
because
I
am
using
the
kite
cluster.
I
have
used
metal
lb
to
use
the
external
ip
for
the
load
balancer
services
and
which
is
running
fine
in
in
my
both
the
clusters.
A
A
Similarly,
if
I,
if
I
go
into
the
cluster
too,
I
can
see
that
my
ingress
gateway
have
an
external
ip
right,
so
to
go
with
the
process.
What
we
have
to
do
is,
firstly,
we
have
to
configure
cluster
one
as
as
primary,
primarily
so
so
what
I've
done
is
using.
I
have
used
the
sd
operator
approach
to
install
to
do
the
installation
on
the
cluster
one.
A
So
if
we
go
on
to
the
onto
the
cluster
one
then
and
is
installed
start
the
installation,
then,
on
the
cluster
one
itself,
I
am
able
to
install
the
sda
core
steel
gateways
and
the
ingress
gateway.
Then,
after
that,
I
I
need
to
install
the
east
to
west
gateway,
which
I
have
I
have
just
shown,
so
I
was
also
able
to
install
the
ingress
gateway
and
the
successfully
without
any
issues.
A
A
Now
my
problem
starts
with
when
I,
when
I
configure
cluster
2
as
remote.
So
as
soon
as
I
as
I
kick
off,
the
installation
of
the
cluster
2
right,
my
stu
component
stu,
core
and
s2d
component
gets
installed,
but
I
am
not
able
to
install
the
ingress
gateway
it
is.
It
is
not
getting
installed
on
cluster
two
right
and
that's
where
you
know,
I'm
I'm
currently
stuck
with
it
right.
A
So
so
my
is
my
ingress
gateway
on
the
cluster.
2
is
not
able
to
talk
to
basically
east
this
gateway
and-
and
that's
where
I'm
currently
stuck
with
my
with
my
poc,
basically
all
right.
So
this
is
this
is
what
currently
I
I'm
further
working
on,
and
probably
I
was
and
that's
where
I
was
stuck
earlier
as
well
on
this.
That's
where
I
I
tried
to
use
some
mariner
as
well,
but
it
is
also
giving
the
same
issue
right
so
so
is.
B
A
Two
yeah,
I
I
tried
to
add
root
right
because
I
tried
to
add
by
default
root
for
this
cluster
to
this
cluster,
but
that
that
rooting
thing
was
also
not
working.
Actually,
I
tried
that
root,
but
if
there
is
any
specific
thing
which
you
can
suggest,
then
I
can
try
now
or
I
can
try
later
as
well,
because
I
tried
that
using
the
simple
route
add
command
to
you
know
to
route
that
traffic
through
the
interface
for
that
subnet.
A
Yeah
but
but
yeah
that
was
that
was
also
not
working
and-
and
that
was
my
idea
that
you
know
I
want
to
try
this
poc
on
my
home
network,
because
probably
I
may
not
face
these
kind
of
issues
when
I'm
working
on
cloud
or
something
or
maybe
you
know,
I
don't
have
much
idea
about
networking.
Maybe
I
you
know
from
that
perspective
also,
I
want
to
you
know,
go
through
this
journey,
so
that's
where
I'm
still,
you
know
looking
for
to
fix
this
issue.
Well,
basically,.
B
Yeah
yeah,
I
I
see
that
makes
sense,
I'm
not
quite
sure
about
the
about
the
container,
the
the
ingress
gateway
container,
whether
it
has
some
network
debugging
tool
or
not,
but
it
might
worse.
Yeah
connect
to
the
container,
execute
the
shell
and
then
check
the
yeah.
What
the
ip
commands
can
show
us,
or
something
like
that.
A
B
A
A
B
B
A
B
I
see
I
I'm
not
really
familiar
with
kind
to
be
honest,
so
so
the
thing
is,
it
creates
docker
networks,
docker
bridges
inside
them
and
from
one
docker
bridge
on
one
computer.
You
want
to
reach
the
other
docker
bridge
in
the
other
computer
right,
yeah
yeah
exactly
and
both
the
bridges
are
in
the
same
network.
Uh-Huh.
B
A
B
B
Please,
yes,
so
so
the
thing
is,
you
have
two
identical
networks
and
if
you
have
a
container
that
wants
to
connect
to
another
container
that
has
an
ip
address
in
that
range
and
you
send
the
packet
to
the
bridge,
the
bridge
will
think
that
okay,
this
other
container,
is
inside
my
network.
So
I
guess
I
just
yeah
yeah
put
the
network
like
a
there
to
switch
or
something
like
that,
and
I
I
I
guess,
that's
the
root
of
the
problem.
B
A
B
A
B
B
B
A
A
A
So
this
is
what
I
have
today
to
show,
probably
once
I'm
I'm
done
with
this.
Probably
I
will
let
the
let
the
community
know
I
will
probably
upload
a.
I
will
probably
upload
a
complete
recording
on
share
with
community
on
youtube
or
will
will
share
on
my
link
but
yeah.
This
is
where
I
am
currently
stuck.
I'm
I'm
trying
hard
to
to
get
it
fixed
and
probably
I
think,
as
as
you
all
mentioned,
like
probably,
we
are
missing
something
on
the
routing
part,
so
yeah.
C
A
Sorry,
I
I
I
don't
know
about
it,
but
I
know
that
you
know
if,
if,
if
your
micro
services
are
running
on
different
servers,
then
there
are
observable
observability
things
which
comes
with
the
istio,
which
can
helps
you
in
in
monitoring
and
monitoring
and
even
tracing
off
of
your
micro
services
on
different
servers.
So
what
yeah?
What
what
you
does
be
precisely
so
yeah
yeah?
I
will
try
to
answer
that
question
with
my
limited
knowledge.
A
You
can
run
some
kind
of
testing
or
a
load
or
for
few
days,
and
if
that
service
is
behaving
good,
then
you
can
pass
your
100
traffic
to
the
new
micro
service
or
you
can
roll
back
that
that's
the
first
use
case.
The
second
thing
is
in
normally
in
microservices
scenarios.
What
happens
is
there
are
few
use
cases
like
circuit,
breaking
timeout
fault
injection,
which
are
which
are
helpful
from
resiliency
of
micro
services
perspective
right
now
in
in
old
days.
What
happens
is
the
all
these
features?
Like
short
circuiting
circuit,
breaking
timeout?
A
A
Okay,
so
developer
does
not
have
to
worry
about
how
how
he
will
implement
circuit
breaking
fault
injection
and
this,
and
that,
with
the
with
the
business
logic
of
the
application,
he
just
have
to
care
about
the
business
logic
of
what
he's
writing
in
the
microservice
and
the
rest
of
the
things
are
taken
care
by
the
stu.
So
these
are
the
two
varied
use
cases
I
have
worked
on
with
stu.
Of
course,
there
are
others,
many
but
yeah.
I
have
worked
on
these
two.
A
What
is
circuit
breaking
so
basically
circuit
breaking
is,
is
what
happens?
Is
you
you
have
your
your
micro
services
are
running
right,
and
so
what
are
circuit
breakers
right
that
sometimes,
if
there
are
overloading
of
you
know
there
are
loads
on
services
right.
So
your
your
and
your
connections,
the
users
are
trying
to
get
to
the
microservices
right.
Then,
in
that
sense,
what
happens
you
want
to
respond
to
the
normal
accordingly
right?
In
that
sense,
you
want
to
pass
on
some
message
or
say
that
timeout
or
the
service
is
not
available.
A
A
Yeah
not,
I
don't
think
that
if
you
go
to
the
traffic
management
task-
and
I
think
this
is
the
circuit
breaking
yeah
like
second
building-
allow
you
to
write
applications
that
limit
the
impact
of
failures,
latency
spikes
and
other
undesirable
effect
of
network
particularities
right.
So
sometimes
what
is
happening
then
it
is
overloaded
or
too
many
requests
are
coming.
Then
you
know
how
you
want
to
you
know.
A
How
you
want
to
you
know,
control
the
connection
with
the
minimize
the
impact
of
that
failure
and
how
the
connection
is
happening.
This
is
what
circuit
breaking
is
so,
and
there
are
a
couple
of
other
things
like
fault
injection
circuit
breaking,
so
these
are
all
resiliency
features
which
are
related
to
visibility
of
microservice.