solo.io Gloo Platform, 1 May 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Incremental Multi-Cluster Adoption Using a Service Mesh and API Gateway

Description

Gloo Platform integrates API gateway, API management, and Istio service mesh into a unified application networking platform that scales across multiple clusters. In this video, we will explore a common incremental adoption pattern, transitioning from a single cluster to multiple clusters across regions or clouds to achieve high availability and improve performance.

A

Hello., my name is ram vennam., I'm a field engineer here at solo, and today I want to talk to you about how you can.

A

Incrementally adopt a global multi-cluster architecture using the gloo platform.. Let's.

A

Get started. so first we'll start with just a single cluster,. So let's say that this box.

A

Represents my single cluster, and let's have a couple of workloads.

A

On here., these are your kubernetes deployment, services,, so I'll just.

A

Say a1 and then a2, and I also have some legacy applications running as vms,. So you.

A

Know I'll write, vm1, and then I also have some lambda functions,. So I'll do lambdas.

A

Okay, so now, let's start sending traffic to my.

A

Various workloads, and that's where gloo gateway comes in., gloo, gateway...,.

A

Is a full-fledged api gateway solution that runs natively in your kubernetes cluster,? So it's.

A

Responsible for handling traffic that is coming into your cluster., so here's traffic, that's coming.

A

In and gloo gateway comes with things like an external authentication server,, a rate limit server...

A

It can also act as a as a graphql, server, etc. but for the purpose of this video we'll.

A

Use gloo gateway to route that traffic to workloads that are running in the cluster.

A

And they can do you know, host based, routing,, path-based routing, do all kinds of manipulations.

A

Etc. to get to wherever it needs to go, and then gloo gateway can also.

A

Route to external services such as vms, or...or, lambda, functions.

A

To manage... to control this gloo gateway there, you need a control plane and a.

A

Management, plane and gloo gateway comes with an otel collector to collect all your.

A

Telemetry data. it comes with an agent which is responsible for communicating.

A

With the control plane, therefore, complete communicating with the data plane, which.

A

Is envoy that is running as your gloo gateway, and then it comes with this management server.

A

Next, let's add another cluster, right so again, I'll draw another box to represent my second cluster...

A

And this cluster can have the same workloads that I have deployed on the first cluster.

A

For h-a or d-a purposes or d-r purposes, or it could have new workloads that you might want.

A

To introduce for canary purposes,, so let's just say I have a2 again replicated across both.

A

Clusters and then I have new workloads as well, which I'll represent with a3.

A

Gloo gateway can be used to send traffic to both the local cluster, as well as.

A

Remote clusters,, so traffic to remote clusters would flow through gloo gateway.

A

And then, through to a2 workloads in a separate cluster through what we call an east-west gateway...

A

So I'll just write, east-west gateway., this east-west gateway is managed by the gloo agent,.

A

And this agent is the exact same thing as this agent, and both of these agents will communicate.

A

To the management plane that is running in the first cluster. so now I can send.

A

Traffic from gloo gateway to workloads that are duplicated across both clusters and I can send.

A

Traffic to any new workloads on the second cluster. in the future,, this secondary cluster.

A

Can also turn into an active primary cluster.. In that case, you would deploy another gloo gateway...

A

Here's gloo gateway again. and again this one will come with the same exot server raid limit server.

A

Etc. and now traffic can come to both clusters, cluster 1 and cluster 2, and route to the local.

A

Clusters as well as route to the remote services, again, by leveraging the same east-west gateway.,.

A

This might be a good point to introduce mesh. with the service mesh. You have specific granular.

A

Control over exactly what service can talk to what other service, so when a1 wants to.

A

Talk to a2,, we can make sure that this traffic is fully encrypted with mtls,. We can create.

A

The right authorization policies to make sure that a1 can talk to a2 and also.

A

Now you have multi-cluster capabilities given to every one of your workloads,, so meaning if.

A

A1 wants to talk to a2, but a2 is let's say: a2 crashed or is no longer available in that.

A

Server, it's not healthy, a1 can automatically talk to a2 sitting in a completely separate.

A

Cluster, again,, going through the east-west gateway, and this failover from one cluster.

A

To another is automatically handled using the gloo platform.. Another thing you can do is a1 can.

A

Also talk to a3 in this cluster again going through this east-west gateway to get to it.

A

As you start adding more clusters now,, let's say you have 3, 5, 10, 100.... You now are at a point where.

A

You can start thinking about moving the management plane to its own dedicated cluster, right.. So, let's.

A

Say now you have another cluster... think of this as an internal cluster that is dedicated to.

A

Just the management point,, so we're going to move this management plane out of cluster one.

A

And run it in a separate cluster.. What this gives us is... gives you a central point to manage all of.

A

Your service mesh,, all of your north-south and east-west traffic communication policies from.

A

A central place,, so as as an operator, you apply your your gloo routing, policies, security policies.

A

Etc. to the management plane and the management plane knows where all your workloads are, and it.

A

Knows where all your gateways are and it's able to program all of those by talking to the agent.

A

There is also otel collectors, like I mentioned in every cluster.

A

And that otel collector can gather all the metrics, send it back to the.

A

Management plane, the management plane also comes with the ui so that you can.

A

Use the built-in dashboard or connect it up with your own existing observability stacks.

A

Another next good, incremental step to take from here is to have dedicated gateway, tiers,.

A

So that looks like a separate, dedicated cluster.

A

Whose sole purpose is to act as the ingress cluster,, so in this case you would deploy.

A

Gloo gateway in this cluster and all of your external traffic now comes to gloo gateway...

A

So I'll use this color..., all traffic now comes to gloo gateway,, and then you no longer need a gloo.

A

Gateway per cluster,, so you can get rid of these there's no external traffic coming, in no external.

A

Traffic coming in, and now gloo gateway can route to your destinations, regardless of where they are.

A

This means that you can now give every line of business within your organization, their.

A

Own kubernetes, cluster, and, depending on how the traffic looks like you know whether you're doing.

A

Path-Based, routing or host-based routing, can route to the right destination automatically. as.

A

Workloads move from one cluster to another,, because the management plane knows where those workloads.

A

Are living, it can program the gloo gateway automatically to route this to the correct.

A

Destination, no matter where that exists., this architecture is very scalable, because.

A

You can add more and more clusters and you can add workloads to those clusters without.

A

Impacting every other cluster and you can also deploy one of these instances per region.

A

You can leverage... because all of the components are modular,, you can leverage..., you can reuse components.

A

As necessary, and only deploy the components that are required per cluster., a single management plane.

A

Can control multiple clusters..., multiple workload clusters, as well as multiple gateway, clusters.

A

I hope you found this video useful.. If you have any questions, feel free to reach out.

A

To me at ram.vennam@solo.io, or you can reach out to us using our contact page. thank you.