solo.io Hoot Livestream, 29 Nov 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: What's NEW in Istio 1.16?

Description

Istio 1.16 is out recently! Very excited I have our lead release manager, Daniel Hawton, who is also an Istio ambient maintainer, joining me to discuss what is NEW in Istio 1.16 and how it relates to ambient mesh, with Daniel and myself live demo some of our favorite Istio 1.16 features! Bring your questions, we love to hear from you!
--
Join Solo on Slack: https://slack.solo.io
Follow us on Twitter: https://twitter.com/soloio_inc
Follow us on LinkedIn: https://www.linkedin.com/company/solo.io/
Past episodes: https://github.com/solo-io/hoot

A

A

It's so good to be back today we're going to talk about istio 1-16, welcome to Hoots episode, 41.! It's your windows, 16 went out recently before Thanksgiving break I am so excited today.

A

I will have our lead release manager, Daniel Horton, who is also a istio ambient maintainer, join me to discuss what is new in istio 116 and how it relates to ambient service mesh and Daniel, and myself will do some live demos of our favorite 116 features so I'm so excited about this live stream and I want you to help us bring your questions so with that I would like to welcome Daniel to the live stream and Daniel. Can you introduce yourself to our audience.

B

Thanks Lynn, uh so my name is Daniel uh software engineer on the open source team here under Lynn, uh as she said, I'm a maintainer for the Ambien branch and was involved in some of that when that was going on as well as uh was a secondary release, manager for 115 and the primary for istio 116, which is pretty exciting, I've been with playing with kubernetes for about five years now, and so just love the technology and the challenges it gives.

A

That's awesome, thank you so much Daniel. We are so lucky to have you here today uh with that. Let's get to the news. uh First of all, so if I can quickly have my screen sharing, yes, you guys can see my screen awesome, so we just got back from cubecon right. So the first thing I would like to share is from cubecon. We brought application networking day sponsored by solo, educating you on Technologies related to istio.

A

uh It's your ambient service, mesh, uh psyllium Envoy, so really good um talks from that event, and if you miss the event, um we have all the slides out for you. We also give a bunch of other talks. A service mesh, Kong, cute car and Christian and I had a signed book by the way I'm holding a book right now. So, if you haven't got a book, uh you can get it from solo.io. You can get the digital copy.

A

um You know have a signed copy uh next time when we are in conference, events um so definitely check out this blog, or else we give us a recap of you know all the education we've done around kubecon and application networking day. um The next thing I want to talk about is, is your 116 right, so that went out on November 15th, which is the primary in the live stream about, and we published a Blog uh with Daniel, um it's still 116 what it means to you and also means to and be a match right.

A

So uh we're going to talk about that a lot more today. um One last thing I want to mention is we also had a really interesting blog from Ron about istio multi-cluster traffic. How do you um analyze the configuration? How do you analyze the endpoint? How do you debugging a multi-cluster configuration for istio? So a really good blog, definitely worth checking out. Zetunnel is getting a lot of Attraction as part of the ambient service mesh.

A

The community recently decided that, instead of using Envoy to implement Z tunnel, we're going to switch to a rough space approach and see if it's better, so they are very active development on Zee tunnel.

A

um So um we'll we'll give you guys more updates later on, but today you know I want to call back to it's still 116, which is the focus of today. um So that's the news uh of one sick of this week uh with that, uh let's see now, I want you to talk to Daniel. uh What is your really responsibility as release manager and also as the lead release manager for Israel 116.

B

uh So primarily, it comes down to uh just making sure all the branches are cut across all the different uh repos that all the the change notes and everything are correct and up to date, um as well as making sure the bills occur properly. uh The long-running tests are run which usually the the guys at Google are nice enough to run for us, but we've got to make sure if they get one and if they pass, as well as coordinating amongst the the doc team.

B

Thanks Eric, because you were a big help for 116., uh but making sure that all the teams are on the same page to get the release out the door.

A

That's awesome. Thank you. Daniel uh now, I want to say hi to bongji. Thank you so much for joining us happy Tuesday and we always love questions from you so uh feel free to type them as you come across.

A

So uh Daniel was this an interesting experience for you.

B

It was very interesting, I learned a lot about how istio structure is I mean, as you know, I'm still relatively new in the istio community, especially being involved. So it was a great Hands-On way of learning all the different systems and how everything comes together to make this product as good as it is.

A

That's great uh always good to hear, and can you talk about the release qualification process? One thing about istio releases I find out: it's certainly a lot more stable than it used to be when I was working on the early releases and I think part of that towards the release qualification process.

A

There is a nice process in place.

B

Yeah so essentially the release process, uh the release managers will cut a new build uh so, for example, we're looking at 116 one for sometime next week, um so we'll cut a bill and we'll do some initial testings ourselves just to make sure everything looks right and then we trigger a 48 hour long, uh just a long running test that goes through and and tests, but I, don't know everything that it does tests.

B

But it's it's a long process that takes about 48 hours to run it's usually one of the guys at Google that runs it and then they, let us know whether or not that's passed if it didn't what what air it out and what needs to be looked at.

A

Yeah totally and also I think on top of that qualification tests on the long run. You also you mentioned, there's also a lot of uh pre-summits that we run for every single PR, there's post submit we run so this is a lot of Automation. In addition to this uh long running tests, you just mentioned yeah all right. So let's go to istio 1.16.

A

What are the most exciting features of 1.16 uh to you, Daniel I'll. Let you go first and then I'll. Try me as needed.

B

And so there's a few enhancements that got some promotions, like external authorization got promoted to Beta, which means you know it's not completely free of bugs, but it's it's ready for some production testing. uh The kubernetes Gateway API has been promoted to Beta from alpha, along with some upgrades there, uh the JWT claim-based routing got promoted to Alpha from experimental, so it's on its way to getting stable.

B

We introduced each bone for psych cars and ingresses uh that is very experimental and likely to break, and it's a little difficult to enable uh you have to kind of know what you're doing, but don't recommend that for production just yet. We added support for the maglev load, balancing and Envoy uh some open, Telemetry tracing provider, support which there's uh some bugs that came up that will be fixed in 116 one, uh so I would probably recommend waiting for 161 before playing too much with that. That's.

A

A good advice in general.

B

So those are some of the big ones that I saw that I I made sure I wanted to highlight. uh There was a deprecation for fetching charts from arbitrary URLs and istio operator. uh It was never really supposed to be in there, but we kind of okayed it and then now we're officially deprecating it and that'll be removed in 117.

A

So Daniel did you actually come up these items on this release blog also.

B

Yes, yeah- that was uh one of the things that the release major has to go. Do is go through all the changes that happened between.

A

B

Know 115 coming out and the 116 and highlighting some of the the big ones that you think are appropriate. They.

A

Got some help from.

B

The different teams, too, on on wording so.

A

Yeah very cool yeah to me, I I, totally agree with you, I mean the edge phone for psycha and Ingress. Well, it's experimental. It's interesting that it shows the direction of the community is moving to right, to be able to have uh the interoperability between the psycha and Ingress gateway to ambient right to pausing ambient to Z tunnel and Waypoint proxy. So that's really really cool, even though it's just experimental um that we want you to try it, you know, get feedback, definitely not in production. Kubernetes, API I think it's exciting.

A

It's being a lot of focus in the kubernetes community, to standardize the API to be able to enhance the API to support mesh right, um in fact, in 116, what's really caught, my eye was the Ingress uh a lot of the traffic management tasks that we have changed to not only have the istio API.

A

um We also added the Gateway API right. How do you do certain tasks with the Gateway API? So that's really exciting too. One thing I would caution, though I mean even though a kubernetes Gateway API is beta. I would definitely caution. You know used in production. Part of the reason is because it doesn't support mesh scenario yet right, the API is still being defined and part of the reason is also like.

A

If you look at these tasks right so many of these tasks, there is still the only way to do it with the classic istio API. In fact, someone I know very well just paid me about what about Envoy filter. Does it work with the Gateway API right? So those are the things people are looking at you using SEO.

A

That's a Gateway API support all that, so those are the things definitely was out watching out for, as you plan to decide, you know whether Gateway API is the right thing for you or for your organization to looking at yep.

A

um What about upgrade? Can you talk about? Is there anything user needs to pay attention to as part of the upgrade.

B

So the the biggest thing is, if you are using the Gateway API that you just talked about, uh there is a requirement to ensure that your gateway API is version 0.5.0 or higher, because we've added support to read V1 beta one, uh which I was also a requirement in 115 in the later versions, not the initial release, but for 116. uh If you are using the Gateway API, you do need to make sure that it is at least 0.5.0 or higher.

A

B

That's good to know: that's the typical.

A

So for so for folks who are not using Gateway API, then that wouldn't be your concern. That's only an upgrade for the Gateway API. Yes,.

A

Yep, thank you that's good to know, and as far as I know, most of you are not using Gateway API, yet so probably won't impact them yeah.

B

It's still very new.

A

All right um and uh Daniel did you did you find it interesting that there is actually a ambient profile in istio 116.

B

I did and it's it's kind of nice, uh it's a segue into uh the long-term goal of making ambient uh production ready, but it introduces H bone into psychar and Ingress. uh So it makes it easy just if you want to enable that that new enhancement, even though it is experimental, you can set the profile or you can Define it manually, especially if you're doing a helm-based Nostalgia to uh Define those manually.

A

Yeah totally all right uh anything else. You want to share on SEO 116 before we jump to the demo.

B

uh No I think we covered most of it.

A

Okay, awesome so with that uh I want to kind of start uh share some demo around this. So let me stop sharing and let me share my terminal window present subscribe.

A

Yeah. Are you guys ready to see a demo.

A

A

Can you see my terminal? Everything comes up. Fine awesome, so the first thing I'm going to do is I'm going to create a kubernet cluster um and I. Just blame the cluster ambient and the effectively there's going to be a surrey, node cluster right, I have a control plane, I have two worker VM and it's standing up, kubernetes 1.24 for me and on my cluster I, already download the istio so I already download the istio 116 binary, so I'm going to jump into that directory and show you the version.

A

I have okay so because I don't have a control plane. Yet, in fact my cluster is not fully ready. This is why I'm getting this Arrow, but you can see you know. 116 is my client version. Okay, so I do have a cluster now so right around this command. It actually gives me a more friendly error right.

A

So the next thing I want to show you guys is look. There is an ambient profile right, Daniel and I were just talking about. So how is this profile different than the actual ambient profile? So this is actually the ambient profile without um the like. The the entire ambient mesh right, the only thing it has uh so, but basically you shouldn't ignore the first line. It was just not right.

A

The second line is correct right, so basically it enables The Edge ball, HTTP overlay, Network environment for sidecars and gateways, and the full ambient mode is not yet implemented right. So how how it enables that it essentially enables that by turning on configuration knobs in the proxy config and also in the pilot environment variable by enabling The Edge phone configurations.

A

So what we're going to do is install the ambient profile using istiocado. Remember I already have istiocado 116 right, so this would install the ambient profile we just reviewed that enables HBO for cycle and and gateways. So now it's doing the installation so um and uh if I bring up my canines, hopefully it still works. I haven't tried it recently, so this would show me uh what's been created and what's been coming up right. So I have it's. Your D just reaches running I have istio Ingress Gateway. It's trying to come up and notice here.

A

If you are familiar with the ambient right, ambient uses uh Z tunnel as a demon set and being recoil, is geoci component right. So in this case uh the ambient profile in 116 doesn't install any of that components right because all the ambient profile does would just enable Edge ball for cycle and Gateway right. So this will be different if you actually try the ambient profile from the experimental Branch.

A

So that's one thing I want to highlight so now that I have the in profile in istio 116 installed successfully, and we view the parts already right. So what we are going to do next together is to enable SEO injection for the default namespace and then we're going to deploy the sleep and the hollow wood examples to the default namespace.

A

So you should see um it's coming up and it's going to be two slash two right, because we enable cycle injection and because it doesn't really support ambient. So I can't do you know, have sleep or hollow wood with just one pod uh and be part of the ambient.

A

So, as coming up, uh we should be able to check out the labels for the Sleep part, um so this would hopefully show us some labels and the deposits you're being initialized, but let's take a look at the labels, uh so one important label we want to review together is: um is the Pod label for the see for the Sleep part, and that has the tunneling information right. So if you record the Sleep part uh that I deployed? uh Actually, let's review that together, um it would not I, wouldn't expect I.

A

Have this information in the sleep app right, because the sleep app was from the istio upstream and it doesn't know the tunneling information right. So this uh tunneling information is automatically injected by istio through the mutating web hook and I'm. Hopefully it would reach running soon. I'm surprised, it's taking you a little bit too long. Okay, um let's see what's going on here.

A

So um so the initialization is complete. Okay, it just takes very long, looks like it's all running now: okay, so uh let's review the sleep pod right, so we recall that we deployed uh sleep right: sleep, dot, yamo right. So if you look at this sleep pod right, uh if you look at the Pod configuration right, we didn't specify. You know the particular tunneling information right, so that's actually injected by istio through the psychi injection, and it gives the knowledge of the istio to know whether this sleep pod is supporting Edge phone right.

A

So that's the API contract for that uh really important that the other thing we can do is we can curate. You know who else in the cluster. You know supports uh tunneling of HTTP tunnel in edgebone right, so you can see sleep and hollow wood. They all support that. Now. That's called from uh sleep to hollow wood that should work uh expected right.

A

We expect to work around Robin, so this means um the the client which is the Sleep caused the hollow wood and it's calling to the edge phone um uh The Edge bone tunnel, because both client and server supports the edge phone tunneling um yeah. So so that's that and uh I guess the long there's nothing interesting, because I have to enable uh access log, it's not enabled by default.

A

Let me see if there's anything logged yeah, probably not yeah I, have to enable access log to be able to see um to be able to see the it goes to the time learning. So that is um oh one. Other thing I want to share is, uh if you go back to, if you go back to uh the blog we have which is uh interesting about how this architecture is working right. So we purposefully accommodate different scenarios where the site car may be a classical sidecar without electrical support.

A

Oh this icon, maybe a psycha with Edge phone support right. So in this case, for example, the client side, which is FC sends a request to app B and if FB is on classical cycle without that edge Boom the hdb tunneling label. That's when we know it needs to send the classical Mutual TLS traffic and if the destination has the HTTP tunneling information or if the destination is a z-tunnel or Waypoint proxy which is provided by ambient, then we know it's sending. uh The client would need to send the edge Bowl in capitulation.

A

So that's an interesting Factor Why. This particular label is so important as part of the design of of HTTP tunneling. Any questions Daniel did I miss anything here.

B

Well, you got everything, I saw and I don't see anything on on the chat so.

A

Okay, great uh with that uh I will jump on to the second demo, um so the second demo is I want to show you guys, Discovery selector, which is one of the interesting feature, I added in 116, and we're particularly excited about Discovery selector. uh Sorry Etc, that's the amount of my folder! So let's go to manifest profile and ambient I believe I created a discovery, selector yeah.

A

So so we're particularly excited about Discovery selector, because it can't allow you, as a user, to select what are the namespaces can be discovered by uh by Israel control plane. So when solo initially contributed this feature to Upstream, we allow you to config what are the namespaces as part of uh kubernetes Services endpoints that can be discovered by SEO control plane with 116 the Upstream Community.

A

Have worked with Community to add additional configuration to allow istio resources to be configured as part of Discovery selector, so these can continually enabled by through mesh config you enable SEO, Discovery enabled and the on top of that there is also an important environment. Variable called enable enhanced racial scoping, and that needs to be set to true for the new feature uh in 1.16 to work. So it's your nose only Discovery the customer resource is your customer resource in the discoveries. Selector namespace. Okay. So let's see that in action.

A

So the first thing I'm going to do is to in update my cluster with the ambient Discovery files configuration files. We just review together right, so this shouldn't have a lot of change. The only thing is, though, uh the istio control plane is going to be restarted, which is why it's taking a little bit longer, and why is that? um So you can see this comes up 22 seconds ago is because the the environment variable of pilot does require a restart of the control plane.

A

Anything here doesn't require a restart of the control plane, so um other changes is basically change. The SEO config map, so on all the other deployments, like your gateway, your app should continue be there um now. What we're going to do next is uh we're going to create um a bunch of namespace, full and bar, and uh we're going to have the full and default with istio Discovery enabled uh along with istio system and the bar namespace is not going to have issue Discovery.

B

A

So that we can see how it works right so now, if I display the routes uh for uh from the sleep pod you can see. This is all the routes, that's visible to the sleep pod and because I'm not deploy any virtual service. So I'm not seeing anything interesting here. So what I'm going to do next is deploy a simple virtual service and I'm going to deploy that's impossible virtual service to full and also to bar to see how it works right, because only the full has it's your Discovery enabled and the bar doesn't right.

A

So if we repeat the same command to display the routes now you can see this review stuff full by the way which is created here. Okay is actually discovered by istio control play through the istio discovery configuration and that particular route is pushed to the envoy proxy running as a sidecar to the sleep pod right, but the review Star Bar is not because review. Star Bar is not discovered as part of the discovery. Selector configuration all right, so the next thing we are going to do is look at the config Maps uh generated by istio.

A

If you understand, how is your control plane works? There is a namespace uh controller, so all it does is for every single namespace. uh It creates the root CA uh as uh as a config map uh into each of the namespace. So as you create a new namespace, it always creates this istioca root search right.

A

So that's been there for istio for a long time and what's changing with SEO Discovery selector enhancement in 1.16, when you enable this feature, is it no longer create the istioca root search for the namespaces you config SEO, not to care about right like the bar namespace is not discovered by istio, so we no longer generate the SEO CA research for the bar namespace and we only generated for the default full and also SEO system yep, so that is the new enhancement of Israel Discovery selector.

A

So super excited this really enable you to properly scope your namespace to be part of the istio and also potentially enable you to run soft multi-tenancy on a single cluster with multiple control plane. Where you can scope, you know, each control plane is manage a fixed number of namespaces, uh with that I am going to use stock sharing and pass on the mic to Daniel, to talk about wasm and some of the exciting enhancements about weather.

B

Thanks Lynn, uh so for my demo, we're going to cover the uh wasm I'm having a total brain fart, uh the the new the new match, selectors for the the wasm plugins. Let me go ahead and just share. It might be easier that way.

B

All right so should be able to see that all right, so.

A

Yeah real quick.

B

Gonna kind of just walk you through what the laws and plug-in does so when we get into the demo you you know what to look for. uh So we have a HTTP request, header uh method here that basically just looks at the path if it sees the path to slash, get it's going to return uh SAS code of 418, which a lot of people know, is teapot along with some teapot ASCII art, and it's going to be in text plans. So basically we're going to see an output that looks like this.

B

If the wasm filters matched everything else, it just continues into uh to Envoy. So this assumes that you have a cluster already set up with istio 116 installed. So if I do version, I can see I've got a 116 client and on the control plane so uh make sure the Ingress is set up as the first time. So we got our external IP.

B

So let's go ahead and load that into an a environment variable just so that we have it for later we're going to create a new name, space called wasm and set it up for a sidecar injection and then we're going to deploy HTTP bin and its gateway to this new namespace. So we have something to test against that to come out and then we'll watch here as it initializes it spins up.

B

And now that it's running we're going to set the wasm, uh it's not what I wanted to copy now we're going to set the I wish I. Could there we go uh the vlogging level for the wasm components to info by default. Everything in Envoy is set for the the warning log level, but we've got some code in here that will debug to the info level.

B

So we want to be able to see that so we're going to just execute that and wait for it to go, and we can see that it's set to info so now we're going to uh uh basically install the Watson plug-in and the the new thing I should probably cover that first. uh So the new match here is this new uh match setting and you can set mode to either server or client uh sort of basically is outbound. Client is inbound. That's the easiest way to remember it uh default.

B

It's client and server which matches the current uh behavior of it. Matches everything in and out ports are port numbers to match, so uh in the demo. I'm only doing this because it's the only part that I can change that will have an effect on HTTP then, but basically it matches the port number that the service is uh serving from. In this case, HTTP Ben is port 80., uh so we're gonna install the plugin with match of port number 80.

B

and then now that's going. Let's just give it a quick tail to see proxy gotta gets started. So here we can see that it fetched the image from the registry, and then these are all the V8 VMS that are starting up in each of the threads and the plugin itself is set to log when it hits the on VM start, which is when the VM running the wasm plug-in is actually starting that plugin.

B

So now, if we curl to our our service, we can see that it's intercepted by the Watson plugin, and we can see that again. If we go into the logs, we can see the log that I had previously shows that it was intercepted and we got a nice little teapot here, because the Watson plugin matches. So now, if we change the port number to 81.

B

All right talk about this, but it's more fun.

A

B

If we, if we go edit- and we change this to one so now- it's only going to match on Port 81 and we save buy.

A

B

It does take a little bit for the the configuration to be generated and sent back to Envoy, so we can see here. A couple of threads have already seen it so now, if we re-execute our curl command, we might see it's a teapot if the threads get configured, but then we eventually start seeing HTTP and expected response, and that's because the Watson plugin is only set the match on Port 81, the HTTP bins serving on Port 80. So this wasn't filter doesn't apply to it.

A

That's great so I I know you just showed a teapot uh using a Vasa module to intercept the requester and generate a teapot. But imagine you know you could use that to do pretty much anything. You want to modify right on the request and the response flow, because I've talked uh I've heard like Shane. Did a demo to you know mask out maybe social security number because there's a bug out there yeah. So this is really powerful and Daniel.

A

uh You didn't point out this explicitly, but I don't believe you had to restart anything throughout the whole thing right. So all you had was just dynamically deploy and it automatically re-execute or executed the rather module created by you and uh you know, and the Pod continues to run without any disruption to it.

B

So if we look here, we can see ATV Ben's been running the entire time. It hasn't been a restart. So it's all dynamic application.

A

Yeah, that's really awesome I'm, so excited about this, the additional Improvement to the Ross and plugging resources to allow user to fine-tune you know their. uh They are much uh traffic Target for the port and also for the inbound and outbound. So that's really cool.

B

Yeah one of one of the applications for this kind of thing: let's say you have an application that serves the public on one port and has an admin interface. You can have the awesome plugin with the new match. Rules only apply to the public interface, but leave your admin interface unfiltered without the plugin. Instead of writing that logic into the lozen plug-in now is like. Is this on the public port? Or is this on the admin Port?

B

You can now do it from the actual plugin itself, and so Envoy won't even send it to the Wasson plugin, which is nice.

A

Yeah, that's a great example yeah so that you can rest assure you're only impacting the Target Port that you designed to the ones and plug-in resources for yeah yeah all right, um so that is our demo for today. If you have any questions, uh now is a great time to you know. Let us know if you have any question, if not uh we'll just wrap up for the session.

A

uh Thank you all for joining us and uh Daniel I want you particularly thank you, for you know doing all the work with the release management coordination with Upstream to get the release out.

A

um So, if folks have any questions that how you want folks to reach out to you.

B

uh They can reach out on the solo public slack or the istio slack, um also on Twitter at Daniel Hutton, um but primarily it's just like probably the better way to go. To be honest,.

A

Okay, that sounds great, and now you guys know how to reach out to Daniel. You can always reach out to me I'm also on istio and Solo's uh slack I was on Twitter and Linkedin. So folks, if you guys enjoyed this uh live stream, please give us a thumbs up, and if you have any particular topic, you are interested feel free to reach out to us. We are super grateful for everybody who joined our past live stream. You know who subscribed to your channel.

A

Thank you and we really appreciate you being part of our Learning Journey thanks. Everyone bye.