►
From YouTube: Istio Environments Meeting 2021-09-15
Description
Istio Environments Meeting 2021-09-15
A
A
I
was
planning
to
do
to
discuss
this
this
subject.
The
short
version
is
that,
well,
as
you
know,
we
right
now,
it
still
depends
heavily
on
on
on
limitating
web
hook
and
injection
and
that
works
well.
It
has
a
lot
of
benefits,
but
it
is
specific
to
kubernetes
and
it
is
a
pretty
complicated
template
that
that
you
know
it's
it's
hard
to
maintain
and,
and
we
have
what
kind
of
problems
with
with
it.
The
document
I'm
presenting
is
based
on
some
work.
A
I
I
did
to
attempt
to
use
to
support
hto
on
docker
container
plain
docker
container,
in
particular
in
google
server
cloud
run
and,
as
you
know,
in
vms
and
in
other
environments,
since
we
don't
have
mutating
webhook,
we
need
to
do
something
else.
We
need
we
and
and
the
solution
we
have
for
vm,
it's
relatively
complicated
and
and
doesn't
work
very
well
in
docker,
because
it
relies
on
saving
some
files
and
obviously
on
docker.
A
You
don't
have
any
any
storage
typically,
so
we
have
to
do
something
slightly
different
and
and
while
doing
this
this
those
changes,
it
becomes
obvious
that
that
they
benefit
regular
kubernetes
as
well.
So
the
goal
here
is
to
support.
Obviously,
first
goal
is
to
support
running
histo
in
in
non-kubernetes
environment
orientating
web,
which
is
not
available.
A
A
You
cannot
use
those
crds,
but
you
still
want
to
participate
in
selection,
and
this
is
probably
not
very
common,
but
it's
identical
with
the
docker
environment,
where
you
have
a
docker
container
environment,
nothing
else
available,
and
if
we
can
support
docker,
we
can
also
support
those
use
cases.
I
mean
for
overlappings,
where
you
don't
touch
anything
with
cluster
admin
and
proxies
grpc,
which
we
also
starting
to
support
in
history.
Where
again,
there
is
nothing
to
inject
because
they
are
not
using
a
proxy.
A
A
Please
read,
leave
comments
again.
There
are
other
use
cases
that
are
possible,
there's
just
an
example
for
what
I
think
it's,
it's
probably
the
most
useful
mode
for
this
injection
less,
but
we
can
discuss
for
regular
clusters
where
we
have
injection
where
we
want
to
continue
to
use
injection
this
proposal
is,
is,
is
basically
reducing
the
injection
template
to
basically
five
lines
about
around
five
lines.
A
A
A
Mutating
weapon
does
the
three
things
it's
adding
the
employee
and
pirate
agent,
because
you
need
obviously
the
mesh.
It
adds
a
bunch
of
environment
variables
that
change
from
version
to
version.
It
adds
volume
mounts
including
the
token
and
it
with
any
container.
It
makes
sure
that
you
know
the
ip
tables
are
set
up.
I
mean
the
ultimate
result
of
this
injection
is
that
evitable
setup
and
the
sidecar
is
connected
to
the
control
plane.
A
The
solution
for
for
for
non-kubernetes
environment
is
basically
to
like,
like
on
vms.
We
just
add
pilot
agent
with
on
changes
that
are
proposing
this
document
as
well
as
same
way.
We
are
going
to
set
the
docker
image
and
the
set
has
the
same
same
same
same
same.
It
takes
care
of
the
first
step
which
lightens
the
binaries.
A
I
have
it
working
with
instio,
1,
9
and
110,
because
it
really
this
yo
d
doesn't
care
that
that
some
workloads
happen
to
want
to
configure
themselves
in
a
different
way
and
yeah.
Let
me
let
me
go
to
to
explain
the
actual
implementation,
because
the
real
real
trick
here
is
to
start
with
a
config
map
that
is
using
the
system
authenticated
permissions.
That's
really
the
key
of
this
document
that
that's
you
know
what
made
this
happen.
A
And
that's
pretty
much
the
the
everything
that
is
required
here.
There
is
some
discussion
about
having
this
mesh
environment
file,
which
is
again
an
opaque
file.
It's
not,
we
are
not.
We
don't
want
to
repeat
the
mistakes
of
proxy
configuring,
other
things
where
we
we
have
a
strict
specification.
It's
just
some
blobs
that
that
is
guaranteed
to
be
repeats
on
the
url
may
change.
When,
when
upgrade,
when
exhibitions
are
upgraded,
may
be
refreshed,
but
in
the
end
all
it
needs
to
do
is
to
make
sure
the
mesh
is
configured.
A
A
A
A
To
some
extent
in
there
is
a
project
that
is,
it's
actually
using
accessing
api
server
directly
with
http
request,
because
with
with
yes,
we
have
a
there's,
a
big
library
and
has
dependencies
and
has
all
kind
of
of
issues
with
with
throttling
other
things.
But
all
we
need
to
do
is
make
an
http
request
to
get
a
blob
with
a
job
token,
so
we
don't
really
need
the
entire
aps
server
and
it's
not
necessary
that
api
server
is
needed.
A
B
A
It
has
a
public
set
exactly
same
thing
with
api
server.
I
mean
we
have
the
the
the
the
it's
not
the
public
server
it
has.
We
have
the
key
basically,
and
if
you
use
external
history
or
other
things
again,
you
you
may
not
even
know
the
address
of
the
study
in
the
first
place,
maybe
not
because
you
didn't
it's
your
system,
because
if
you
are
running
in
a
cluster
you
don't
have
your
system.
Then
then.
B
What
are
you
going
to
do
well
yeah,
but
you
still
need
the
url
of
the
bucket,
so
you
still
need
like
you
need
the
url
of
something.
So
why
not
just
give
it
e2d?
I
don't
know
I'm
a
bit.
I
am
very,
very
hesitant
to
doing
this
on
kubernetes
itself,
I
mean
I
get
like
in
a
docker
environment,
it's
useful
and
even
in
a
vm
environment.
It
may
be
like
there's
cases
where
some
people
may
want
to
do
things
today,
where
they
run.
B
A
Your
concern,
the
community,
is
the
last
one
that
I'm
planning
to
so
the
plan
is
to
to
support
all
others,
support
kubernetes,
where
you
don't
have
stod,
because
that's.
I
think
we
agree
that
it's
a
valid
use
case,
or
hopefully
it's
it's
about
use
case.
But
if
you
have
a
sturdy,
just
use
injection
and-
and
you
don't
have
to
use
this
still
it-
we
can
get
it
from
history
if
we
find
a
way
to
to
connect
with
you
and
what
you're
describing,
but
we
still
want
to
simplify
the
template.
A
C
B
A
Again,
this
is
minimal
config,
it's
it's
the
address
and
and
the
certificate
that
would
certificate
and
instead
of
having
injecting
those
things,
we
just
get
them
from
kubernetes
because
that's
already
taken
care
by
the
cubelet.
So
that's
that's
really
simpler
and
same
with
same
effect,
and
if
we
find
out
the
api
server
doesn't
work
then,
and
latency
is
not
not
impacted
by
this.
Because
again
we
make
the
same.
B
I
don't
know
about
that.
I
think
it
has
more
efficient
watches
it
can
cache
across
like
it's
not
like.
If
you
have
100
proxies
it's
opening
up,
100
watches
on
the
config
map
right,
it's
opening
one
and
we're
using
it.
I
hope
I
assume
there's
no
work
involved.
There
is
no
much
importance
in
this
answer.
It's
just
the
pure
gets
on.
They
can.
D
Yeah,
so
so
I
think
the
the
other
use
case
of
this
apart
from
sort
of
having
common
path
for
starting
everything
is
yes,
it
is
forcing
us
to
simplify
the
injection
template,
or
at
least
hiding
it
right.
It's
not
it's
not
simplifying
it,
and
it's
also
useful,
I
think,
in
sort
of
in
place
upgrades,
because
one
of
the
reasons
why
we
just
can't
start
a
new
version
of
proxy
is
because
the
template
can
change.
D
A
D
Right
so
so,
as
long
as
you
have
the
new
bits
available,
the
new
bits
of
the
proxy
available,
wherever
it
wants
to
start,
everything
else
is
obtained
from
this
sort
of
the
known,
endpoint
and
yeah,
and
so
so
I
think,
I'm
still
not
very
clear
on,
though
how
does
this
interact
with
the
indirection
that
we
get
through
revisions
and
web
books?
So
I
thought.
C
A
A
A
For
docker
again
you
don't
have
revisions
in
cluster,
you
don't
have
rotating
web
hook,
you
don't
select
them
to
tag
or
anything.
You
have
just
this
file
and
the
idea
is
that
this
file
will
list
not
one
address
but
multiple
addresses
of
history,
including
for
each
revision
and
each
so
so.
Basically,
there
is
a
controller
that
is,
you
know,
looking
at
the
cluster
file
finding.
What
is
your
data
installed
and
creates
these
opaque
file?
A
My
recommended
configuration
is
to
have
typically
external,
I
mean,
have
a
number
of
water
regions
here,
zone
istio,
external
study
clusters
restore
the
configurations,
and
then
you
can
have
as
many
workload
clusters
where
you
just
have
workloads
and
you
get
a
list
of
revisions
and
idea
addresses
of
different
studies,
and
you
pick
one
based
on
whatever
you
choose.
I
mean
that
you
know
you
have
access
to
your
configuration.
You
can
choose
to
to
to
select
the
camera.
You
are
better
if
it
doesn't
work,
you
fall
back
with
the
other.
A
A
Okay,
let
me
get
a
bit
into
small.
You
know
fancier
iptable,
again,
there's
a
discussion
about
ap
table
in
this
mode.
Actually,
let
me
go
first
with
the
golden
image,
because
that's
that's
where
it
starts
so
normally
in
history,
we
in
in
kubernetes
we
have
a
report
running
for
your
book
info
and
we
add
the
second
container
that
is
running
this
joint
is
your
pilot,
agent
and
and
and
envoy
for
docker
and
and
vms.
Really.
A
I'm
calling
it
golden
image
because
have
everything
inside
that's
typically
maintained
by
the
mesh
admins
and
someone
who
provides
provides
space
in
each,
including
the
reference
operating
system
that
is
using
the
enterprise
or
whatever.
So
this
golden
image
is
deployed
in
any
docker
environment
can
also
be
deployed
in
in
kubernetes
environment
as
an
image.
A
So
it
will
be
your
application
for
your
with
mesh
included
and
you
can
deploy
it
anywhere
if
you
deploy
it
in
as
a
regular
user
in
a
regular
cluster
with
no
injection,
it
will
know
how
to
find
the
the
mesh
environment-
and
you
know,
connect
the
mission
to
everything
that
you
are
doing.
The
only
thing
that
is
a
bit
special
is
that
you
need
to
have
id
table
permissions
or
you
need
to
have
the
cli.
A
So
one
of
the
two
must
exist
or
we
fall
back
to
whitebox
history
which
still
works
so
so
it
will
basically
works.
It
works
everywhere.
Basically,
and
the
other
point
I
included
in
this
document,
which
is
a
bit
more,
you
know
kind
of
far
future.
Unless
someone
is
volunteering
to
use
a
writer
code,
we
can
also
inject
docker
images
directly.
So
there
is
a
program
called
code
that
is
basically
building
a
go
binary
and
then
it's
patching
it's
adding
a
layer
to
the
manifest
without
actually
using
docker
itself.
A
It's
just
uploading
a
target
z
as
a
layer,
and
then
it's
doing
a
small
patch
as
a
docker
file
manager.
We
can
actually
do
the
same
thing.
I
mean
take
any
docker
container
image,
we
run
a
command
and
it
automatically
becomes
a
mesh
enabled
docker
image.
Assuming
it
has.
You
know
it's
based
on
libc,
whatever
employee
needs,
yeah,
that's
kind
of
the
the
gist
of
of
of
this
proposal
that
what
kind
of
details
and
possible
extensions.
E
A
A
A
A
Assuming
you
are
willing
to
you
are
willing
to
maintain
an
image
or
to
patch
an
image
to
have,
but
but
again,
if
you
are,
if
you
are
you're
a
developer
and
you
run
both,
that
is
a
non-compared
lattice
environment,
you
probably
will
patch
the
image
for
for
the
nonpartisan
environment
and
then
why
not
use
it
for
competitors
as
well,
because
you
are
testing
it.
One
thing
I
forgot
to
mention
cicd
everything
that
I
described
here.
A
You
know
works
in
any
kubernetes,
any
docker
environment,
including
github
actions,
for
example,
or
any
other
google
cloud
builder.
It's
you
know
it's
a.
They
know
how
to
build
a
docker
image.
You
can
run
the
docker
image.
The
docker
image
can
download
the
mesh
environment
can
connect
to
xbs
can
have
mtls
certificate.
It
can
do
pretty
much
everything,
so
you
can
test
your
image
in
the
cicd
system
with
full.
You
know
access
control,
whatever
you
know
measure
you
are
using
and
then
you
can
deploy
it.
A
D
A
No,
I've
got
to
say
technically
one
of
the
things
that
I
I
did
part
of
this
prototyping
is
to
try
to
minimize
the
number
of
round
trips
to
api
server,
because,
as
john
said,
you
know,
api
server
is
a
delicate,
delicate
server,
so
and,
and
it
impacts
the
startup
time.
So
it
is
possible.
You
know
the
bootstrap
discovery.
It's
you
know
going
to
xds
server
gets
bootstrap,
save
bootstrap,
starts
and
void,
connects
again
to
api
server
to
go
to
xds
server.
A
We
can
put
the
bootstrap
in
this
mesh
environment,
which
is
completely
opaque
file,
and
then
you
save
around
it.
That's
the
only
thought
I
gave
to
this
problem
in
this
implementation
and
and
and
again
since
it's
a
single
round
tripod
startup.
That
needs
to
happen
anyway.
You
save
a
bit
to
100
milliseconds
in
the
startup
time.
A
The
the
launcher,
because
this
reliance
on
some
binaries
that
is
now
is
coordinating
with
this
thing.
The
launcher.
Could
you
know
check
the
mesh
environment?
Has
pilot
version
change,
download
pilot
agent
download?
You
know
which
knows
the
bootstrap
template
download
the
m4a
and
launch
them
again.
So
it's
not
really.
A
A
A
A
A
I
do
not
plan
to
make
any
changes
to
east
yo
itself
at
this
moment,
because
almost
everything
is
in
this
binary
that
is
completely
agnostically
to
istio,
and
these
two
versions,
I'm
planning
to
put
it
in
you-
know,
ecosystem
initially
get
feedback,
see
how
it
works,
and
only
after
that
we
discuss,
if
we
should
add
it
to
the
main
three.
The
benefit
is
that,
since
it's
agnostic
to
version,
people
can
try
it
and
and
start
using
it
with
your
1
10
11.
E
A
In
in
recent
history
I
mean
we
had
a
number
of
acquiring
compatible
changes,
but
yeast
your
master
today
works
with
control,
plane.
1.9,
assuming
I
mean,
if
you
solve
the
problem
of
injection
template,
which
is
different.
If
you
just
take
the
energy
and
why
it
doesn't
it's
really
agnostic
to
to
to
almost
agnostic
to
the
version
of
the
control
plane
in
the
last
few
versions,
and
we
can
we
can
make
it
a
bit
more
strict
in
testing.
A
I'm
not
saying
that
it's
infinite,
I
mean
any
version
with
any
version,
but
you
know
one
nine
one,
ten
one
eleven
one
twelve
are
all
more
or
less
compatible
and
don't
forget
we
are
trying
to
add
proximate
grpc,
which
is
completely
different
repository
differently
and
proximate.
Grpc
works
not
only
with
any
version
of
eto,
but
it's
also
working
with
other
xds
servers.
E
A
I
should
I
should
mention
for
for
any
docker
environment.
So
if
you're,
if
you're,
not
an
exclusive
kubernetes
shop,
you
build
a
docker
image.
You
have
a
ci
cd
that
is
building
docker
images
and
and
the
requirements
for
for
such
environments
is
that
periodically
weekly
or
whatever
you
are
doing
is
a
build.
You
pick
up
any
fixes
from
the
operating
system
from
libraries
from
any
other
binaries.
You
are
using
it
in
in
in
your
golden
image,
including
envoy
and
pilot
agent,
so
so
so
part
of
the
ci
cd
system.
A
That
is
building
the
golden
image
and
it's
not
specific
to
east
europe
or
avoid
that
it's
a
bug
enough
where
you
need
to
pick
it
up.
You
can't
believe
c
can
believable
business
open
ssl.
It
can
be
anything
else
in
the
image
we
are
just
not
having
a
different
process
for
security
fixes
in
a
void
versus
security,
open
ssr.
A
I
should
make
it
more
clear
in
the
document
that,
with
golden
images,
responsibility
of
the
mesh
administrator
for
every
week
to
to
build
a
new
image
and
pick
any
security
and
critical
bug
fixes
for
anything,
including
operating
system
and
and
the
same
same
as
vms
today,
right
so
some
of
the
vms.
Today
we
have
the
same
requirement.
If
you
are
operating
on
vm,
you
need
to
do
update
whatever
to
install
the
new
range,
but
it's
not
very
clear
to
users.
That
is
a
responsibility
and
they
need
to
be
sure
to
patch
their.
A
E
Right,
which
is
why
I
also
agree
what
john
mentioned
earlier.
It
sounds
like
you
know.
The
existing
cycle
injector
model
would
be
continue
to
be
the
best
for
kubernetes
environment.
When
you
know
when
the
mutating
web
hooks
are
allowed-
and
this
will
be
a
nice
alternative
for
other
environments
or
when
they
can't
use
mutating
weapons.
A
I
I
mean,
if
you
are,
I
agree
with
you
if
it's
exclusive
kubernetes,
if
it's
not
exclusive
kubernetes,
if
you
have
at
least
one
docker
or
clcd
system-
and
you
need
to
maintain
a
tool
and
a
golden
image,
then
probably
you
are
better
off
using
the
golden
image
and
not
using
the
injector
at
all,
because
you
will,
you
know
test
this
image
control
the
rollout
of
this
image.
You
are
not.
You
know,
you
are
using
the
same
process
for
any
security
fix
and
you
don't
have
a
split.
A
E
A
I
I
I
I
tested
extensively
in
in
in
in
docker
on
my
vm
I
tested
on
on
cloud
builder
and
and
guitar
action.
So
I
think
it's
working
fine
in
some
some
documentary
environments,
the
problems
you
don't
have
official
net
capability,
net
admin
capabilities
and
that's
where
the
fallback
to
whitebox
comes
into
picture
and
I
submitted
some
patches
to
improve
a
bit
the
white
box
and
it
works
pretty
nice.
Now
I
mean
if
you,
if
you're
in
http
or
connect,
you
change
your
code
to
localhost
it's
it's!
It's
really!
Nice.
A
That's
great
again,
I'm
just
saying
you
know
it's
prototype
and
proposal.
Don't
just
expect
this
to
work
tomorrow,
but
if
we
agree
on
this
direction,
I
think
we
can
make
pretty
fast
progress
because
there
are
not
a
lot
of
big
changes.
Really,
this
proposal
is
just
you
know:
it's
like
small.
You
know
taking
the
environment
variables
from
from
injection
template
and
putting
them
in
a
config
map,
and
then
few
adjustments.
A
A
A
A
A
A
E
B
Yeah,
I
think
the
the
only
case
where
you,
where
you
absolutely
need
this,
I
mean
unless
you
want
to
do
everything
manually,
of
course,
that
this
is
doing
is,
if
you
have
basically
a
service
where
you
just
throw
a
container
at
it,
and
it
runs
it
there's
a
lot
of
these,
like
you
know,
cloud
build
as
an
example
cloud
run
or
if
I
know
my
non-google
services,
aws
lambda,
maybe
they
have
a
container
one
as
well.
I
think
every
time
you.
B
B
B
This
could
still
be
used
to
make
it
simpler
like
in
some
cases
it
may
be
simpler
to
do
the
current
setup
where
you
run
easter
cuddle
and
you
pre-compute
this
and
then
stick
it
on
the
vm
in
some
it's
simpler
to
do
it
dynamically,
probably
most
dynamically,
to
be
honest,
but
it's
not
necessarily
required
in
those
cases
like
you
can
still
do.
Docker
on
vms
today,.
A
Yeah,
the
the
real
real
issue
here
is:
if
you
have
a
hybrid
environment,
where
you
have
you,
you
have
both
vms
docker
services,
container
services,
vms
and
whatever
you
just
build.
One
called
an
image
with
your
application,
which
is
this
proposal,
and
then
you
stick
it
you
throw
it
everywhere.
You
don't
have
to
do
things
slightly
different.
For
the
end,
I
mean
it
is
possible
to
do
a
lot
of
different
things
like
this.
You
can
have
all
the
ejection
or
vms.
E
Okay,
yeah,
that
makes
sense
so
today
I
we
don't
necessarily
we
they
are
work
around
that.
I
guess
I
forgot.
There
is
workaround,
I
guess
you
could
run
docker
host
network
or
you
could
potentially
with
the
ip
flag
you
mentioned,
so
you
don't
necessarily
have
to
use
this,
but
it's
nice.
If
you
run
your
services
on
different
environments,
which
provides
you
the
same
image,
whether
you're
running
on
docker,
around
vm,
directly
or
running
in
cube.
A
Yep
and
another
nice
thing,
if
you're
not
using
the
workarounds,
is
that
you
can
run
as
many
as
you
want,
because
with
the
current
workaround,
it's
a
bit
more
difficult.
If
you
have
a
if
you're
running
a
host,
you
can
have
only
one,
and
so
it's
a
bit
more
inflexible.
If
you,
if
you
use
the
work
around
them
than
the
golden
image.
A
The
upgrade
scenario
is
the
controller,
make
sure
that
the
blob
contains
everything
necessary
for
the
protections
installed
in
the
system,
so
you
have
pst
110,
111,
112
and
some
external
stod.
The
controller
will
populate
this
blob
with,
with
whatever
is
necessary
for
all
of
them
by
patching
and
and
an
important
thing
that
we
discussed
is
ability
to
if
the
configmap
is
flat,
it's
very
easy
to
patch
it
from
from
multiple
controllers,
and
each
version
can
maintain
its
own
variables
with
with
patching
without
touching
the
other
ones.
A
At
least
that's
how
we
implemented
it.
So
far,
now
the
upgrade
experiences,
the
user
picks.
Whatever
version
of
this
you're
saying
the
current
pressure
issue
in
the
weekly
build
of
the
golden
image
and
that
is
deployed-
and
that
will
pick
the
blob
which
will
have
hopefully
everything
that
is
necessary
inside.
A
A
But
I
think
it's
important
to
to
have
this
fallback
because
it
increases
reliability,
because
if
the
canary
is
bad
and
if
you
try
to
deploy
112
1
15
and
it
has
a
problem-
it's
very
useful
for
the
board
to
be
able
to
say
hey.
I
cannot
connect
with
dslr.
I
cannot
get
certificate.
Okay,
let's
track
the
other,
the
previous
environment,
and
and
not
fail.