►
From YouTube: Gloo Cilium and Istio Seamlessly Together
Description
Cilium provides powerful networking and security policies at l3/l4, Istio provides zero trust for applications with defense in depth, traffic control and resiliency. What does it mean by gloo-ing Cilium and Istio together? Can we take the best of both worlds? In this hoot livestream, Eitan and Scott will join Lin to share some perspectives to gloo Cilium and Istio seamlessly together.
#cilium #istio #gloo
00:04 welcome + speakers intro
2:08 service mesh, graphQL, eBPF news
5:30 general discussion around Cilium, network identity & multi clusters
14:50 Gloo cilium and Istio together, why and how to make it simpler?
28:20 Live DEMO + answer live questions
42:27 wrap up
To learn more about us, please visit https://www.solo.io, we are hiring! https://www.solo.io/company/careers/
Questions? https://solo-io.slack.com
Code Samples: https://github.com/solo-io/hoot
Suggest a topic to cover here: https://github.com/solo-io/hoot/issues/
A
Hello
welcome
to
hoot
episode,
27
glucillium
and
istio
73
together.
Network
policies
are
highly
recommended,
along
with
the
l7
security
policies
based
on
seo's
security,
best
practice
documentation.
These
resources,
unfortunately,
are
different
learnings
for
a
user.
How
can
we
really
make
this
easy
for
our
user
today
we're
going
to
discuss
some
of
the
thoughts
from
the
solo
team
are
how
to
glue
slim
and
istio
together.
I
am
your
host
and
I'm
so
looking
forward
to
learn
this
topic
with
anton
and
scott
together.
B
C
Hey
everybody
thanks
lynn,
I'm
scott
weiss.
I
am
architect
in
the
office
of
the
cto.
I've
been
in
solo
for
four
and
a
half
years.
I've
also
worked
on
pretty
much
everything
and
the
architecture
for
our
core
products
and
integrations
things
like
that
kind
of
not
always
as
down
and
dirty
as
eitan.
But
then
I
learned
it
from
him
and
the
the
cycle
is
complete.
A
A
A
The
fact
is
that
a
lot
of
the
people
filling
out
the
survey
are
actually
running
kubernetes
in
very,
very
small
scale,
like
65
of
the
audience,
is
running
in
two
to
five
clusters,
so
I
would
take
the
result
with
a
grain
of
such
because
of
that
factor.
One
thing
I
would
see
really
interesting
about
the
survey
is
79
of
the
audience
are
using
mutual
ti's,
which
is
the
top
feature.
A
People
want
out
of
service
match
which
is
consistent
from
what
we
have
hearing
from
our
customers,
as
solo
matt,
klein
introduced
envoy
gateway
to
as
a
implementation
of
the
kubernetes
gateway
api.
Unfortunately,
when
I
go
to
the
repo
I
haven't
really
seen
much
code
out
there.
I
think
it's
mainly
just
the
documentation
of
the
moment.
A
A
Ice
surveillance
has
allowed
tetragong
as
a
new
open
source,
ebpf
based
security
and
observability
and
runtime
enforcement.
So
that's
an
exciting
project
brought
by
our
friends
at
mainland
last,
not
the
least.
We
also
find
out
apollo
graphql
launches
its
super
graph
based
on
federation
v2,
so
I
couldn't
find
out
a
ui
for
this,
but
this
sounds
something
pretty
interesting
to
federate
the
graphs
and
allow
single
pane
of
glass
for
their
user.
A
One
last
thing
before
we
get
to
the
episode
is:
thank
you
so
much
max.
You
have
helped
us
publish
the
steps
for
episode.
25.
I've
also
run
through
the
steps
so
yeah.
I've
actually
got
spell
integration
with
the
latest
issue
1.14
to
be
released
this
week
with
spell
to
do
the
attestation
of
the
past
identity,
so
very
cool
if
you
are
interested
to
running
the
staff,
that
is
the
news
for
this
week.
C
C
It
leverages
the
ebpf,
the
berkeley
packet
filter
technology,
using
some
kernel
code
to
more
efficiently
handle
packets,
do
filtering
and
observability,
and
it's
become
quite
a
popular
cni
for
use
in
kubernetes.
It's
got
uses
such
as
enforcing
policy
at
the
l3
l4
level,
that's
on
tcp
ip,
as
well
as
connecting
nodes
together.
So
when
you're
running
multiple
kubernetes
nodes
for
them
to
actually
communicate
with
each
other.
You
need
a
some
kind
of
overlay
network
to
allow
that
to
happen.
Something
provides
that
functionality.
A
B
So
psyllium
knows
it
keeps
track
of
all
of
the
ips
for
all
of
the
pods
in
the
cluster
and
for
something
like
their
multi-cluster
offering,
which
is
the
cluster
mesh.
They
keep
track
of
ips
in
the
other
clusters
when
they're
bridged,
but
it
keeps
track
of
all
the
of
all
the
pod
ips
and
it
can
do
it
can
make
policy
decisions
based
on
those
ips
right
so
based
on.
B
If
you
have
a
specific
pod
trying
to
talk
to
you
know
a
source
pod
and
a
destination
pod,
depending
on
the
labels
and
other
other
metadata
psyllium
can
make
a
decision.
Should
I
allow
this
packet
to
go
through.
Should
I
not
allow
this
to
go
through
so
essentially
it
exists
right
because
psyllium
is
already
there.
It's
already
allocating
these.
These
ips
and
everything
it
has,
and
it
has
deep
knowledge
and
it
actually
does
those
policy
decisions
from
within
the
kernel
using
ebpf.
So.
A
B
A
lot
of
the
networking
that
that
happens
today
actually
consists
of
many
hops,
so,
whether
that
be
through
you
know,
global
load,
balancers
or
through
you
know,
istio
gateways
or
conflict
gateways,
or
you
know,
whatever
gateway
you're,
using
that
ships
with
your
cloud
or
whatever.
It
is,
there's
so
many
hops
that
you
have
to
create.
You
have
to
ensure
that
the
network
identity
is
exists
at
every
layer
and.
A
B
C
C
C
A
That
that
makes
sense
yeah.
Certainly
I
I
can
imagine
the
user
definitely
appreciate
that
portability
factor
right
to
be
able
to
specify
a
label
to
identify
a
part
just
purely
using
ip
address.
So
you
talk
about
multiple
clusters,
even
multiple
cloud
a10.
So
how
does
network
based
identity
work
with
multi-cluster?
A
B
B
Directly
with
with
each
other,
because
again
for
network
identity
to
function,
you
really
need
to
have
just
a
single
hop.
You
know
this
can
talk
to
this
this
source,
ip,
this
destination
ip.
I
can
verify
right,
so
that's
great
and
to
be
so,
if
you
already
have
a
a
a
flat
network
since-
and
you
are
all-
you
only
have
a
flat
network,
then
this
you
know
a
flat
network
style
of
security
might
be
acceptable,
but
there
are
also
potential
issues
with
the
way
this
is
implemented
in
in
psyllium.
B
A
Yeah
definitely-
and
I
know
our
flat
network
is
a
challenging
in
many
of
the
cloud
provider
environment.
In
fact,
that's
exactly
why
in
istio
multi-cluster
we
always
have
a
multi-network
model,
because
we
know
most
of
the
users
out.
There
are
actually
running
a
non-flat
network
yeah.
So
scott
I'd
like
to
ask
your
thoughts
pick
your
brain
on
how
psyllium
and
istio
can
potentially
be
integrated
together.
Why
would
someone
wants
to
maybe
just
use
psyllium,
or
maybe
someone
just
wants
to
use
istio,
or
maybe
somebody
wants
to
use
both
together
right?
C
So
it's
a
really
good,
really
good
question.
When
we
started
with
glue
mesh,
we
started
with
istio
istio's
enforcement
and
policy,
for
the
most
part
happens
on
the
l7
level.
There
are
policies
that
could
apply
to
the
l4
level,
but
that
happens
over
tls.
There
is
no
the
l3
and
the
ip
level.
Control
of
things
is
not
in
istio's
domain,
so
even
to
connect
the
actual
pods,
the
workloads
in
kubernetes
to
istio
require
some
iptables
rules
which
is
actually
going
on
inside
of
their
this.
C
The
init
process
that
bootstraps
the
service
mesh
a
cni
like
psyllium
obviates
that
need
you
actually
will
not
need
to
use
ip
tables
for
that.
Psyllium
can
take
over
that
process,
as
well
as
a
number
of
other
processes
which
can
both
be
seen
as
an
additive
to
istio
a
replacement
in
some
cases
or
an
alternative.
So
in
the
main
case,
sorry,
so
sorry
about
that
hold
on
one
second,
maybe
it's
on
you
want
to
pick
it
up
for
me.
B
B
You
have
this
network
identity
issue
when
you
start
to
scale
into
multiple
clusters
with
psyllium
and
so
istio
from
the
ground
up
is
built
to
do
l7
identity
using
the
service
account,
it
uses
cryptographically,
verifiable
identity
with
with
mtls,
which
means
that
you
can
use
it
across
your
workloads
in
any
data
center,
any
cloud
any
cluster
and
actually
there's
a
question
inside
that
I
just
want
to
briefly
mention:
is
there
a
hard
limit
to
the
number
of
pods?
Yes?
Technically?
Will
you
ever
hit
it?
B
No,
it
is
absolutely
massive.
So
it's
not
so
much
that
the
limit
of
network
identity
has
to
do
with
there
being
a
limit
to
the
number
of
pods.
It's
it's
more,
so
that
those
pods
are
not
necessarily
the
pods
and
the
connections
are
not
necessarily
cryptographically
verifiable
for
all
those
connections.
C
Thanks
eitan
yeah,
so
so,
basically,
what
it
comes
down
to
is
that
the
level
of
awareness
and
knowledge
that
istio
has
of
the
system
is
higher.
Basically,
we
know
more
content
of
the
type
of
communication.
That's
going
on.
We
know
information
about
the
protocol.
If
it's
http,
we
know
things
like
host
names
that
are
being
used.
We
know
paths
and
and
http
methods
that
are
being
used.
C
It
gives
us
more
ability
to
be
granular,
but
it
also
requires
us
to
run
components
that
can
actually
parse
the
http
messages
where
the
policy
enforcement
happens
at
a
much
faster
rate
and
it's
on
a
on
a
lower
level
of
the
system.
So
we
don't
even
need
to
parse
that
information.
The
downside
is
that
it's
not
as
as
granular
it
doesn't
give
us
as
much
flexibility
so
from
a
high
level
in
a
in
a
very
short
sentence.
C
Psyllium
and
istio
can
both
make
each
other
better,
depending
on
what
you're
looking
for
as
a
user,
you
may
just
want
one
or
both
and
and
yeah.
That's
that's
we're
looking
to
enhance
the
experience
for
both
types
of
users,
all
three
types
of
users
who
want
to
use
just
one
or
who
would
like
to
use
both.
C
B
B
Right,
you
don't
have
that
that
you
cannot
verify
where
the
traffic
has
been,
where
it's
coming
from
right.
So
what
the
way
that
we
at
solo
see
it
is
that
there
should
always
be
two
methods
of
enforcement,
so
for
any
hop
within
a
kubernetes
cluster
or
from
you
know,
ec2
workload
whatever
it
is
for
any
single
hop
within
those
spaces.
We
do
believe
that
psyllium
and
l3
policy
are
incredibly
important
to
make
sure
that
the
connection
is
secure.
B
Additionally.
Additionally,
we
believe
that,
when
you're
going
within
those
hops
or
between
different
clusters,
when
you're
making
many
hops
at
the
same
time
right,
you
need
to
be
able
to
make
sure
that
point
a
in
that
chain
is
allowed
to
talk
to
point
z
right
because
it
could
have
gone
through
many
hops.
And
so
yes,
you
need
to
ensure
the
single
hops,
but
you
also
need
to
ensure
the
journey
and
that's
what
the
the
the
crypt,
the
l7
identifiable
policy
allows
for
you
to
get
and
that's
why
we
think
that
they're
so
powerful
together.
A
Okay,
so
let's
say:
if
I'm
a
user,
I'm
convinced.
Okay,
I
want
both
right
because,
like
you
said
defense
in
depth
right
not
only
at
layer,
three
and
four,
I
also
want
layer
seven.
So
what
is
glue
mesh
doing
to
make
it
easy
for
me,
so
that
I-
because
I
could
do
that
manually
right,
I
could
deploy
network
policy
for
psyllium
or
some
other
cni.
If
I'm
not
running
saline
and
I
could
deploy
it's
your
authentication
authorization
policy,
I
assume
I
could
potentially
do
that
in
a
manual
way.
A
C
B
Yeah
definitely-
and
you
know
just
just
to
add
to
what
scott
was
saying-
you
know-
we,
the
the
single
glean
of
single
glean
of
past
single
pane
of
glass
approach
that
we
take
with
glue
mesh.
We
feel
that
that
applies
here
100,
because
when
you're,
when
you're,
trying
to
lock
down
service
to
service
communication
right,
it
shouldn't
just
be
one
or
the
other
right.
If
you,
if
you
as
a
if
a
user,
is
running
right,
just
psyllium,
then
glute
then
glue
mesh
can
just
do
that
right.
It
can
create
the
l3
policy.
B
B
A
A
You
just
hit
one
of
the
questions
I
was
thinking
so
sounds
like
I
can
potentially
using
psyllium
without
istio
right
so
depends
on
so
glumash
can
automatically
discovery.
Well,
I
have
selim,
or
some
other
cni
glue
match,
can
also
automatically
discover
it.
Whether
I
have
issue
installed
and
so
based
on
the
automatically
discovery
results.
A
B
Indeed,
yeah
and
that's
the
kind
of
thing
that
we
take
on
right,
because
we
as
as
you
as
we've,
been
talking
about
this
whole
time
right.
We
think
that
psyllium
is
an
incredible
product
for
many
many
reasons.
But
the
reality
is
that
other
things
exist,
and
so
you
know
other
cni's
exist,
and
so
we
we
take
on
that
responsibility,
yeah
and
the
other
thing
that
I
just
wanted
wanted
to
mention
or
scott.
If
you
want
to
talk
about
the
multi-tenancy
that.
A
A
A
So
yeah
I
mean
we
at
the
service
smash
con
right
christian,
give
a
really
good
talk
about
how
to
do
multi-tenancy
with
service
mesh.
He
also
introduced
the
concept
of
workspace
and
how
workspace
can
help
onboarding
team.
So
can
you
talk
about
in
the
context
of
ceiling?
What
does
this
mean
for
our
user
using
workspaces
and
doing
multi-tenancy
within
service
mesh.
C
A
lot
of
these
things
can
be
automated
for
the
user
when
they
set
up
their
tenancy
system
in
glue
mesh.
So
one
thing,
I'm
not
sure
that
we've
we've
made
clear
is
that
a
lot
of
this
configuration
happens
automatically
so
just
by
having
glue
mesh
in
your
system.
Just
by
setting
up
your
workspaces
and
registering
them
with
glue
mesh
blue
mesh
is
able
to
automatically
apply
policy
to
increase
the
security
of
your
cluster,
and
then
we
expose
options
for
making
those
more
granular
for
more
advanced
users.
A
A
B
Let's
share
this
screen
alrighty,
so
I
hope
everyone
can
see
my
terminal
that
I've
that
I've
got
here
and
so
before
I
get
started,
I
sort
of
want
to
explain
what's
running
and
you
know
what
what
exactly
the
thing
that
we're
demoing
today
is.
So
you
know
we've
been
mentioning
that
glumesh
can
power
the
network
policy
as
well.
B
You
know
the
l3
policy,
as
well
as
the
l7
policy,
for
your
applications
across
multiple
clusters,
and
so
we're
going
to
show
a
bit
of
a
demo
of
that
right
now,
so
we're
going
to
get
we're
going
to
get
into
the
policy
we're
going
to
get
into
the
ammo
so
before
I
do
that
again,
I'm
just
gonna
give
an
outline
of
what's
running
in
these
terminal
windows,
so
in
this
left
terminal
window
over
here.
This
is
our
management
plane.
So
this
is
the
this
is
our
glue
mesh
management.
A
B
So
those
that's
what's
running
in
cluster
one
we've
got
the
product
page
ratings
and
two
revisions
of
reviews
and
then
in
this
downward
window.
This
is
our
cluster
two.
We
are
also
running
psyllium
and
istio,
but
we
have-
and
we
have
the
rest
of
the
book
info
application,
so
that
would
be
reviews
v3
and
ratings
v1.
A
B
A
B
But
in
this
particular
demo
there
won't
be
any
multi-cluster
traffic,
but
they
are
not.
There
is
no
flat
network
here.
They
are,
they
are
connected
via
the
istio
ingress
gateway.
Okay,
so
I
deleted
that.
So
let's
go
ahead
and
just
test
out
our
traffic
to
make
sure
that
our
pods
are
able
to
hit
one
another.
So
the
first
thing
I'm
going
to
do
is
I'm
going
to
exec
into
our
product
page.
B
B
Awesome
connect
all
right,
everything's
working
okay.
So
now
what
I'm
going
to
go,
go
ahead
and
do
is
create
our
access
policy.
What
our
access
policy
is
going
to
do
is
it's
going
to
say:
only
the
product
page
is
allowed
to
talk
to
ratings
and
we're
going
to
see
under
the
hood.
What
glue
mesh
goes
ahead
and
creates
to
do
this
defense
and
depth
that
that
we've
been
mentioning,
so
I'm
going
to
go
ahead
and
apply
our
access
policy
and
then
we're
just
going
to
take
a
look
at
it
here.
B
Alrighty,
so
let's
take
a
look
at
this,
so
what
do
we
got
here?
Well,
we've
got
applied
to
destinations
so
we're
applying
to
the
ratings
destination
on
port
9080
that
only
okay
and
we're
selecting
a
service
account
here.
Only
the
product
page
is
allowed
to
talk
to
the
rating
service
and
it's
been
accepted
by
the
glue
mesh
management
plan
awesome.
So
now.
A
B
B
B
B
A
B
B
I
know
that
you
know
this,
this
label,
it's
actually
interesting.
These
labels
are
not
actually
present
on
the
pod,
so
I
could
go
ahead
and
check
the
pod
and
those
wouldn't
be
there.
So
psyllium
knows
that
I,
as
a
user,
might
want
to
select
things
given
other
primitives
that
the
network
policy
doesn't
allow
right,
which
is
amazing,
which
is
really
great
right.
So
I
can
go
ahead
and
select.
B
B
We
remember
our
product
page
should
have
access
boom.
There
you
go
so
let's
go
ahead
and
in
our
second
cluster,
try
that
same
call.
Oh
it's
hanging.
That's
not
good
wait!
That
is
good
because
that's
what
we
wanted
to
happen
so
what's
happening
on
our
second
cluster.
Is
that
we're
trying
to
curl
ratings
from
the
reviews
app,
but
the
reviews
app
doesn't
have
access.
A
Because
the
product
page
doesn't
run
on
this
cluster,
so
the
network
policy
is
different,
so
it
actually,
so
I
think,
there's
a
couple
of
things
interesting.
So,
first
of
all,
you
deploy
this
policy
access
policy
on
the
management
cluster.
You
didn't
deploy
on
cluster
one
and
two
and
the
glue
mesh
magically
based
on
the
context
of
which
parts
running
on
which
cluster
and
then
translate
the
right
network
policy
and
the
authorization
policy
for
for
you
in
your
environment.
B
A
A
C
C
C
B
B
Sorry,
I'm
going
to
port
forward
psyllium,
because
I
want
to
take
a
look
at
the
metrics
that
it's
outputting,
because
by
default
you
can
configure
psyllium
to
output
quite
a
lot
of
metrics
about
the
decisions
that
it's
making
and
about
the
services
that
exist
on
your
cluster.
And
these
are,
we,
we
think,
are
incredibly
useful
and
are
also
incredibly
performant
because,
as
scott
mentioned
they're
running
we're
basically
right
in
the
kernel.
B
So
if
I
go
ahead
and
curl
my
metrics
and
let's
look
for
drop
right
because
earlier
I
was
showing
how
the
reviews
packets
were
being
dropped.
So,
let's,
let's
take
a
look
at
that
and
look
at
that
just
like
that.
We
see
here
that
psyllium
is.
It
can
actually
tell
us
very
easily,
just
by
you
know,
without
having
to
do
anything
that
that
the
the
source
right
we
have
our
source
book
info,
slash
reviews,
pod
right,
is
talking
to
the
ratings
pod
over
tcp
and
the
it's
being
denied
and
that's
why
their
packets
being
dropped.
B
So
it's
it's
really
a
mix
of
of
a
lot
of
different
things.
You
are
100
right,
fay
that
that
there
are
right.
There
are
so
many
cni's
out
there
and
that's
exactly
one
of
the
reasons
why
we're
using
the
network
policy
here,
but
we
we
also
specifically
love
a
lot
of
the
the
the
power
that
edpf
allows
for
within
that
networking
layer.
A
B
A
A
A
A
Well,
I
want
to
take
a
minute
to
thank
both
of
you.
It's
been
really
interesting
chatting
with
you
and
also
you
know,
watch
the
demo
to
see
how
powerful
glue
match
can
provide
the
higher
layer,
access
policy
which
drives
lower
layer,
layer,
3
layer,
4
network
policy
with
psyllium,
and
also
the
istio
layer,
7
authorization
policy,
so
very
cool.
So
big
shout
out
to
both
of
you.
A
C
A
B
A
Awesome
well
thanks
again
to
everyone
for
your
questions
to
join
in
you
know,
if
you
find
this
interesting,
please
give
us
a
thumbs
up
and
also
hit
the
subscribe
button
to
our
channel.
So
you
don't
miss
any
of
our
futurehood
live
episode
where
we
learn
these
technologies
about
istio,
envoy,
ebpf
and
graphql
together,
and
if
you
have
any
topics
you
would
love
to
see.
Please
open
an
issue
or
make
a
comment.