solo.io Hoot Livestream, 27 Sep 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Istio Ambient Mesh with Gloo Mesh

Description

The first experimental release of the new sidecar-less ambient mode in Istio is out, and we at Solo are eager to support it with Gloo Mesh and explore the value it offers! Join us to watch Nina demo LIVE some of our future directions of Istio ambient mesh with Gloo mesh and bring your questions!

A

Hello, everybody Welcome to hoot episode, 39. uh istio ambient service match with clumash yeah we're back with another Coach episode about nbms. If you remember about two weeks ago, we've done good episode, 36 37 38, it's all about ambient service mesh. uh We talk about common questions. People ask about ambient service manager. We talk about what ambient service match means to your wallet today. I'm so excited to have Nina join me to discuss some of the integration work. She has been doing with istio ambient service mesh with glue mesh Nina.

A

Can you introduce yourself to the audience.

B

Sure um so, I'm Mina polishikova I'm, a software engineer on the blue, mesh team and I've, been working on the ambient integration with glumesh. So I'm going to talk about like what uh you know, the difference between sidecar versus cyclists and ambient mode. um What are some ux improvements like the mesh has done to improve uh the way you manage your Waypoint proxy and uh what policies like work today and how they like work differently in sidecar like mode versus like psycholus, um so first I guess to get started.

B

I'll uh I'll share my screen um and uh pull up uh an example. I had so um you might be familiar with. um You know, regular sidecar mode, where, um in this example, I have like product page from book info uh like a reviews, service and then like ratings, and um uh in in this example, the sidecar gets injected into the Pod.

B

So if you apply an L7 policy like fault injection or header, manipulation, you'll see that the um you uh have a virtual service that gets created and that policy gets applied on the client side. So this sidecar on the product page would be the thing enforcing like fall injection um in ambient mode. However, um we have a slightly different setup. So, first of all, you have your Z tunnel, which is uh The L4 proxy.

B

Currently, that um will enforce like mtls and like authorization policies, but if you want to do any L7 routing or any L7 policies, you need to create a waypoint proxy um that will enforce that policy. So you can see compared to like the sidecar mode, where the L7 policy happens on the product page sidecar. Now the L7 policy is getting applied on the server side on the reviews.

B

Waypoint proxy, um which is, is a pretty big difference um on where the policy gets applied and um the way you create this Waypoint proxy in ambient istio today is by using the Gateway resource. So I have it pulled up here. So um basically you using the kubernetes Gateway API, you define uh this Gateway, you specify the the um you know, namespace that you wanted in, and you can optionally create annotations for uh specifying the service account.

B

You want to create the Waypoint, for, um if you don't uh add this annotation it'll create Waypoint proxies for everything in your namespace um yeah. So uh another thing.

A

That may not yeah I apologize I. Just realized I forgot to put your screen on. Oh no yeah, maybe.

B

A

B

Really quickly, yeah sorry cool um yeah, so, like I mentioned, uh first I think it's important to talk about the sidecar mode versus like sorry, Carlos and ambient. So here I have an example of uh the product, page reviews and ratings uh book info example.

B

um If you had everything in sidecar mode, so the sidecar you see is injected into the Pod and um you have mtlus between the sidecars and uh all the L7 and L4 policies are getting applied on the sidecar and uh another interesting thing is uh any L7 policy you have so like, be it like full injection or, like header, manipulation um you uh that virtual service is applied on the product, page sidecar, so on the client side uh site card um versus.

B

If we take a look at ambient, it's a little different setup because you have the Z tunnel, which is, is the the proxy that that's controlling All The L4 policies, so like mtls, like um like authorization.

B

um This uh like is that the node level and your Waypoint proxy is at the service account uh level and any L7 policy you apply is now going to be enforced by this Waypoint proxy. So um before like when we had uh like fault injection being enforced on the sidecar, now um it's uh being enforced by the square Point proxy here. So uh this is different right because, like instead of the client-side product page enforcing it now you have to create this Waypoint proxy to enforce your L7 policies um and.

A

That's a great point, I feel like this is something uh when we first uh launched SEO ambient service match in the launch, blog that we didn't highlight, particularly, but it's a important caveat for our user- that the Waypoint proxy has to be there has to be deployed, has to be running for your layer, 7 policy to work right. It's just not going to work magically as the psycha case. Well, all you need to do is just inject the site car, which you always have it in reject it.

B

Yeah exactly so, um if you install istio like you'll, see the Z tunnels come up per node automatically, but in order to create this Waypoint proxy you have to manually um like before, you can apply any L7 policies. Like Lin said you have to create this Waypoint proxy, using the kubernetes Gateway API, um and then this is what I was showing before.

B

So this is the um example where we're creating um a uh the Waypoint proxy and selecting the annotations for book and for reviews, if you don't specify this annotation here, like you'll, create Waypoint proxies for everything in that namespace um and, uh as you can see like it's pretty Limited in what you can specify so other than the annotations and like which namespace this Gateway is going to uh live in, there's very little uh other uh configuration.

B

You can do um so it's hard to like scale the Waypoint proxy up, so you can't have like multiple replicas of it. You can't really determine where it's going to land either. So if I had like another reviews uh in in like node one, it's a you can't guarantee that the Waypoint proxy for reviews, if they share a service account, is going to be in Node, 1 or node. Two.

A

um Yeah I do feel the istio Gateway resource to deploy. Waypoint proxy is pretty preliminary like you highlight here and in that way, there's very animated configuration and I do think this is going to be involving uh in Upstream, but you still have to kind of create the Gateway ratios and deploy it when the options become available, such as uh wrap number of replicas such as, like placement information that Nina just talked about.

B

Yeah um another I think interesting point is so before. uh When you had uh your sidecar, you would scale uh because the sidecar was injected to the pond right um you'd scale, the sidecar, with the Pod versus now the Waypoint proxies associated with a service account. So it scales uh separately from the Pod, um which is, is also like a big difference between the two models.

A

Yeah, which brings a lot of benefits. Actually these are some of the benefits we just talk about in our previous episode. I believe is 38. Well, uh we talk about what ambient means to your wallet right, because if you have 10 replicas, you don't necessarily need 10 replica of Waypoint procs. If your Waypoint proxy uh two also a replica handle the layer 7 proxy, then you save yourself from running 10 replica of uh of your of your past, because you didn't have such a choice in the sidecar world.

B

Yeah exactly um so like, as you see like it's, also very like invasive kind of having a sidecar per um Pawn. So like every time like after you inject it, you have to restart the Pod versus here. It's uh it's completely, independent of the the review spot that you have here.

A

Yeah, that's another great point. So that means, if your Waypoint proxy has a cve which we know uh there's a lot of cve with Envoy, then you actually could potentially update your Waypoint proxy without touching any of your services uh that Waypoint proxy is serving right, because if your reviews or ratings doesn't have um any coaching, you don't need to restart the Pod. All you need to do is update the rip Waypoint proxy um in the sun card world. That would not be option because they are bundled together right.

A

So, even though you have to pick up the the sidecar for a new cve, you kind of have to restart the review container as well, because you didn't have a choice.

B

B

Cool um well I guess we can move on to um me. Stop share briefly to actually seeing uh everything in action. So I have a.

A

Yeah, okay, so before you get that Nina, let me pick out your brain first, so I want to ask so you talk about the difference between psycha and psycha list right with ambient right. You talk about the difference of implementation.

A

um The Source uh was destination side for policies right, so uh you also talk about how it is hard to manage your Waypoint proxy, uh along with the deployment of the service. So what are some of the ux improvements? You are looking at to improve for glue match yeah.

B

Definitely um so one of the big ones is uh like I mentioned the Gateway resource that you have to create manually every time, um so the way that istio handles it um is you have a waypoint controller that will look for uh Gateway resources that get created and create a waypoint um proxy based on that, but in the blue mesh world.

B

We kind of know when you need an L7 policy enforced, because a lot of the policies can be reused um like the cold injection can be applied to multiple um different, like routes um and uh because we know like which, uh like in what cases you're using your L7 policy, we kind of can control when the Waypoint proxy gets deployed and like uh provide like sane configuration like defaults for that deployment.

B

So one example that um is like currently Limited in uh ambient for deploying your Waypoint proxies like where it actually goes so there's no way of specifying like pod, Affinity or like which node your Waypoint proxy will end up on um and uh like this. Can you know result in like configurations where, if you go from, you know product page to reviews, the Waypoint proxy could be on a separate node.

B

So you'll you haven't, uh you go from product page to the Waypoint proxy to like reviews, um because there's no guarantee that the the Waypoint proxy will be on the same node as reviews, um so that that's one big, you know uh UI Improvement that um so ux Improvement, that the glue mesh provides is that we kind of handle the entire life cycle for you, um because we know when, like what else learn, policies require Waypoint proxies and where um so, there's kind of two um actual uh like we talk mostly about L7 policies on the virtual service.

B

um So, like fall injection, um you know mirroring stuff like that, um and that happens on the server side. But some um like policies also have to happen on the client side. So anything that is on a destination rule like uh that requires a traffic policy. So failover, like outlier detection, uh would still happen on the client side. So you need to create a waypoint uh like client-side Waypoint proxy for that um and glumash kind of knows which policy you're playing and what kind of waypoints you have to create.

B

Based on, like the apis, that we have in place that like separate the um the policy you're creating from the actual like virtual Service uh API, so.

A

That's very cool, hey I, want to say hi to one of our audience. Thank you. So much for joining us, uh Nina I want to ask you about. What's the logic, to determine whether you deploy a server-side waypoint proxy automatically, with whether you deploy a client-side, waypoint proxy I, think you touch um some of the policies. uh What's the What's a clear guideline from your perspective, yeah.

B

So I think anything that requires um like a virtual service will be server-side. So, like header matching, um like um you know, mirror um like fall injection um heter manipulation. Those all would happen on the server-side Waypoint proxy.

B

um Everything that uh happens on the traffic policy destination rule would require a client-side proxy So, like um the I. Think. A good example is failover. Failover would happen on um is a traffic policy that you define on your destination Rule and that would need a client-side waypoint proxy to be able to like correctly enforce it.

A

And that's assuming that's regardless, whether you're a destination side, uh they have a waypoint proxy or not. Oh that's only when you don't have a that uh Waypoint proxy for your destination.

B

Only when you don't yeah so we don't have duplicate.

A

Okay: okay, that's why I was a little bit confused, okay, yeah! So if.

B

You already have like a a header, Administration policy in place, and you also apply uh failover. You won't create two duplicate, Waypoint proxies. um We also deduct logic because we know like you only need one to do that. Okay,.

A

Perfect yeah thanks so much for that clarification. I appreciate that okay, so um the other question before you get to the demo, I want to quickly repeat on your brain is what about the existing key features of glow mesh. So correct me: if I'm right, I'm thinking about glue mesh, the key features of glow mesh are workspaces right, so I as a owner of my particular service I got to config. You know what are my workspaces: what are the isolation?

A

What are the services I can consume what other services I can export to, which are the workspaces and the multi-cluster.

A

You know, instead of me, worry about which cluster has which Services I can just deploy, abstracted resources uh based on Google, mesh, API and then Google mesh automatically figure out for me, the generated industrial resources and where to deploy those HCL resources based on how we have my services are running. um Yes,.

B

A

Key features, or did you have other stuff.

B

Yeah I think um the first we can start with workspaces, so um workspaces provide like multi-tenancy so like your application, team can have a workspace where it defines its own policies and a separate application team can have its own policies defined, um and you can you know Import and Export uh policies based on like overlap, but for the most part you can enable like service isolation within your workspace.

B

So um you have uh like uh all of your authorization policies and and peer authentication policies automatically created for you for your workspace, so bluemash kind of handles. All of that like isolation for you, which is a really key feature that we have and it still works in in ambient mode, because uh the only thing you have to do is um you know, set up your workspace based on the namespaces and clusters.

B

You have and then uh set up the workspace settings to enable um that isolation and then all of the authorization policies will be created for you still, um because uh authorization policies now are either enforced on L4 or L7, depending on like, if you have the Waypoint proxy or not um that still like Works seamlessly, because if you don't have any Waypoint proxies, then uh everything's still enforced at The L4 level.

B

um If you do happen to have a waypoint proxy because, like you've created a blue mesh policy, um then it'll be enforced at the L7 level and you can see the the logs there as well. um So in terms of multi uh cluster capabilities. There's uh some limitations that ambient currently has with service entries, which doesn't like fully enable all of the multi-cluster support.

B

That glumash has so one key feature that the mesh has is like virtual destinations, where you can define a virtual destination for, like you, know, reviews Global across multiple clusters and then route to all the Clusters seamlessly. That currently is a limitation of ambient um that it's still like an experimental mode. So like there's still like some development to be done. So the demo I have is to be in a single cluster environment, but all the policies still work for Coop services, and you know on a single cluster.

B

You can still Define, like your your route, tables and stuff like that, um and.

A

Then yeah go ahead. I'll! Let you finish: yeah.

B

I'm trying to think what was the the last one I.

A

Had oh yeah, those are the two things I was asking. Is there any other key features? I would actually yes, I forgot.

B

That was my, um so the Ingress Gateway features still work as well. So um if you like currently, there's also limitations on like Envoy filters, so a lot of like um xed off and, like rate limiting features, don't work East-West, because there's no support for applying like an Envoy filter to a waypoint proxy, um but uh everything on the Ingress Gateway still works.

B

So you can still have an ambient mesh, but an Ingress Gateway that will enforce like great, limiting XD off, like other policies that um that you care about so that functionality is still there.

A

That's great and I assume all you said about that function. Is there that function is not there. It's just a Time statement right because Ambience so new we're constantly work with Upstream to improve uh ambient array. Along with, like the service entry issue, you just mentioned with multi-cluster support yeah all right I want to hi to a second attendee hi princeu. Thank you so much for joining us. uh By the way we love Nina and I love to hear from you guys.

A

If you have any questions, you know this is supposed to be interactive, so feel free just to comment in the chat and I'll bring your messages up, so we can answer them. So Nina I think we're ready to do a demo. If you have an environment yeah, let me make sure I bring up your screen.

A

B

Right, let's do that yep cool, um awesome! Okay. So, let's um also, if you're interested in trying out ambient I'm gonna pitch uh Lynn wrote a great blog about how to get started. Oh thank.

A

Goodness, just.

B

Using the the regular Upstream so you'll notice that um this uh you have to manage your your gateway resource. So if you go click to L4 authorization policy, you'll see that when you do the layer 7, uh you actually have to create um a Gateway resource manually um and you'll notice that, in in my demo, like I, don't create any Gateway resources just because glue mesh is doing that for me.

B

um But this is still like a great guide to try out ambient, so um cool, okay. Well, so I have uh the glue. Mesh um I have uh two clusters: um one management cluster, where I have uh the glue mesh management server installed and one cluster uh cluster, one which is my remote cluster, which has uh istio ambient installed, along with the glue mesh agent and uh book info. So in this example, I'm gonna have two workspaces.

B

One uh book info workspace, which will have um it currently doesn't have any policies so you'll see that there's no Waypoint proxies there and uh in my Gateway I just have um the the virtual Gateway and all the Ingress gateways defined in a separate workspace just to clean it up there um and then I also have my um on uh my remote cluster. I have um uh the product page example here and I have a pod.

B

That's like constantly uh curling this every couple of seconds, so I can generate some data to view in the graph. So uh here's our little graph of the book info example. So um this is the you can see that we actually um have the TCP metrics of for a number of byte sent and everything's enforced by mtls, which is what the little icon means here.

B

um So in this example, we're going to have um reviews, V1 reviews, V2 and reviews V3, which all share a service account um and they're going to be on separate nodes. So we, um but product page, is going to hit or reuse you, one which doesn't hit ratings and reviews V2 which do hit ratings, but then have different star colors so like. If you look at the the result here like based on the the star, colors are what you're seeing from uh readings getting hit um cool?

B

Okay, let's uh actually take a look at the cluster, so uh here I have um all my pods up. So um one thing you might notice is that there's no uh sidecars because we're in ambient mode. So if I I look at a product page uh this one's kind of weird, because I have a curl uh container here, just to be able to test some some stuff.

B

um But everything else is is just the uh there's no side car injected here. So um another thing you might notice is I. Have the Z camel up so um I have three Z tunnels, because I have three nodes. So if I look at the nodes in in canine um and see what's on each node, I can see that reviews the three and details on this node and they have a z tunnel.

B

um But um okay and here's like the x-off service that we have and then here's uh reviews V1 and reviews V2, um and they also have a z panel there as well cool okay. So um the first thing I'm going to do is apply a um a wrap table, so uh all of glue mesh's apis still work in ambient mode.

B

um So there's no API changes really for the the routing and traffic policies, and uh you know uh L7 policies that you might want to apply so in this example, I'm going to apply a route table uh that has a simple East West uh route table for East-West traffic. So it's not selecting a virtual Gateway. It's just like doing routing between two pods in the mesh.

B

um So uh the two routes I have uh route. One uh doesn't have any header match, but Route 2 has this header match where, if I specify user and istio custom user, then I'm going to route to V2, which is the um the destination that has the the stars because it hits ratings and this one we'll see that it doesn't have any uh ratings associated with it. So the first thing I'm going to do is apply the route table and, um let's.

A

uh Finally, which namespace are you applying around here yeah, so any restriction on that.

B

um Yeah so I'm applying it to book info and uh the way I have my workspace uh settings setup is um I have uh like I mentioned two different workspaces. um The book info workspace, Imports Gateway. So then this is why we're able to see.

A

B

Like here, oh I think it went down, um but uh the um the Gateway settings here just also important export um book info, so they're, both important exported and service isolation is disabled. So, like you can actually um access all the services there. So let's go back and look at the pods we have um so you can see uh before where we didn't have any uh waypoints. Now we have a new uh book info reviews Waypoint.

B

So um if I uh curl um from product page to um like reviews without any um header, uh then you can see that I keep getting um a response. That's that's good, but it doesn't have any stars associated with it. So now, if I add the um so I think I have it copied here. So.

A

um User is still customer uses so.

B

I, don't save it um so if I add the header, I should be hitting now uh the one with the Stars, so you can see that I get the the black stars back from that response um and that's consistently happening. So if we go back and um look at what's happening on the Waypoint, you can see that we actually got some traffic here. So it's hitting like the uh the thing that does the routing goes through the Waypoint to determine um where which reviews uh the service is going to hit um cool. Okay.

B

So another thing we can do in addition, so that was just a simple route table again like this is the same API as any sidecar mode that we mesh supports. um The only difference is like what happens uh with this Waypoint proxy like it gets brought up and it does applies the the L7 like routing on on the uh server side, instead of it happening on the Sidecar um cool.

B

So the next thing I'm going to do is apply a um let's uh I, a L7 policy, so I have a simple fault: injection policy that I'm going to test. So again, this is the same API um for resilience. Policies in in glumesh there's no, no difference we're just going to apply it to Route One. So like you're, going to see that when we curl um the route, one was like the the basic reviews example that we had.

B

So when we curl reviews, we should see now uh the 418 response instead of um the 200 response with the uh the reviews. So, if I apply this.

B

And then go back to uh the product page and then go back to the curl container um and then curl it I I can see I get the 418 response.

A

B

um And then going back, nothing has changed in um the in terms of the weekbrain proxy because we're using the same Waypoint box as we were before um and now just the the fault injection is getting applied here, cool um see what what else do I have.

B

uh Yeah so I think the next thing is the custom deployment. So this is one Improvement that Gloom rash has over um the regular uh kubernetes Gateway is. We can actually have a deployment override that we specify so I have two examples for that. One is just uh incrementing the replica Set, uh a number of replicas, so I'm, going to currently I only have one Waypoint proxy, but if I apply this ambient life cycle manager, I um can increase.

B

The number of replicas I have because glue mesh provides the opportunity to like overwrite anything in the deployment spec for the Waypoint proxy. So you can specify like where it gets deployed how many replicas? What image to use stuff like that.

A

So this ambient life cycle manager is that per workspace. So that's per.

B

Namespace yeah, so it's um per uh everything is uh regard relating to the Waypoint proxy. Is per service account, so um this would have to select the service account in uh the workspace.

B

um So if you had uh like multiple workspaces, um you'd want a separate ambient lifecycle manager per workspace to be able to select it.

B

um Unless you have this like imported, um but currently like it's, uh um it's not like per namespace, because it's uh like it's specifically like selecting a service account that uh is, is tied to the uh Waypoint proxy. It's not um selecting everything in a namespace.

A

Okay, so what this is an optional thing, if I only need to tweak the configuration of the Waypoint box Beyond, what's provided by default? Okay.

B

Yeah, so let's uh we'll play that.

B

um Cool and then, if we go back to our pods, we can see we created another one here. So now we have two boyfriend proxies.

B

um This is also like I mentioned uh useful for um uh the um the pot affinity, for example. So, um right now, if I look at the the nodes, I have um you'll notice that the both Waypoint properties are both being deployed in um one node and that's because the default we're using is we're using because we know that it needs the Waypoint proxy is for reviews we're using the oldest deployment um to determine, which node to um add the waypoints by default.

B

um But if, for whatever reason that you wanted to do like um reviews V2 instead, we can apply that and see what happens.

B

So um if I go back so we're saying it's, it's terminating.

B

So, and in this example, I also only have one of them, so there's uh I instead of having two replicas just to show the difference, um and then, if I go back to the nodes, uh you can see that now it's it's on on this node, where we use VQ, is so.

A

Very cool so basically, I have ambient uh Waypoint proxy life cycle management, where I can provide further customization, and why not just talk about the replica number there I guess it could be mostly everything that you would override the kubernetes yamos yeah.

B

A

Yeah, very nice, um yeah I guess the other thing is I guess it will be a good practice to kind of. If you have a particular ambient life cycle configuration you want to use it's good to have that deploy before you deploy like a seven policy right. So when you level seven policy is there, you would have the right Waypoint proxy, automatically provisioned by glumash. Yes,.

B

Exactly yeah the order doesn't matter so this, um like you, can have this in place before uh you create the L7 policy or after, um but when when so like. If we delete the route table for example, um then um the weapon Proctor should get cleaned up. So if we go back, you'll see that it's getting cleaned up because there's nothing um the default injection that we have is tied to a route. So there's no route table anymore. So there's no L7 policy to enforce.

A

Okay, so the only saving, if you do deploy the life cycle management. First, it's to save your Waypoint proxy form, I, guess, redeployed right when you later attach lifecycle management- maybe it's different. So it's going to be like it's probably just do a restart or actually scale out more yeah, exactly yeah, okay, cool, very nice yeah! That's a great uh simplification, because I do know.

A

um Some of the feedback we heard from the Israel Community was about the life cycle management. uh You know how user would be. It seems pretty primitive just to manage it through the Gateway resources. Yeah.

B

Yeah- and this provides like uh you, know, flexibility of like how many you want um like where you want to deployed um what image you want to use. So um all of that um is is pretty nice and um also uh like one thing. I've noticed is that in um the um so the Waypoint controller is, if you are looking at the the studio code, that to see like what actually controls how the the Waypoint proxy gets created.

B

um It's this file here called the Waypoint controller and um in the like, the last couple updates to it have been all like just improvements on like making the image uh policy configurable. So I can imagine, there's going to be a lot more improvements there on like um what we like how to actually control like where the Waypoint gets deployed and and stuff like that.

A

B

Gloomesh, does it for you, which is, is a pretty big Improvement to the current model.

A

Yeah, it's definitely make uh ambient adoption a lot easier, particularly when user needs layer, 7, processing, yeah.

A

And I think you, you didn't demo this, but I think you talk about this earlier, that you also have logic to determine whether I guess whether the source and the target uh is part of the ambient, so that you can leverage that information to determine where you would place the Waypoint proxy, either on a source or destination side.

B

Yeah, there's also that reminds me um one thing, I didn't point out is that the namespace I have has so book info. Has the istio data plane mode.

A

B

Here um and that's what we're using to determine that, like, yes, reviews needs a waypoint. um If it didn't have this label, then glue mesh would assume you're like inside car mode um for that like because you can have hybrid modes where um not everything in your mesh is in ambient mode. So in that case, like you would have a sidecar that would be enforcing the the policy.

A

um Yeah, oh, you could have no mesh right, yeah, yeah, yeah,.

B

A

That that's very cool, so basically you check. If the parts are in ambient and then you check, source and destination and the label are the namespace level tells glue mash, um and then you use that information to determine whether you place uh Waypoint proxy on the destination or on the suicide yeah.

B

And that's based on the type of policy you're applying so um I think I've pulled up somewhere supported policies, so a glue match supports a bunch of different policies um and all of these have different. um uh So some of them are tied to like um the virtual Service uh that istio has and some are tied to like the traffic policies. So um like failover and LR detection are applied to the destination, so they would be applied on the client side, but everything that's applied on the route.

B

um That is, um you know, supported and ambient is applied on the server-side proxy. So like fall injection uh retry timeouts they're all um route selectors, so they would be that you'd need like a waypoint proxy that um is on the server side to enforce it.

A

um Interesting yeah.

B

A

I know just making sure we're on the same page, I think the apply to that concept, whether it's on the route and destination matches to the labels. You were showing earlier right, because I think earlier you showed a 40 injection policy where you should on a particular route or which you had a label for that router. So that's what that applied to Maps too yeah.

B

Exactly so, if I, um it's a fault, injection I also have a header manipulation. Example. Both of these are applied to routes, and this is just in the glimmesh API for like specifying um that you need a route table to apply this policy to um and uh in ambient mode.

B

This also means that it's going to be applied on the server side, um because, uh like you, need the server-side Routt table to be able to enforce it versus um like outlier detection or uh failover they're, both um eventually translated into destination rules and um uh the traffic policy is on the destination rule, so those are both applied to destination, um and that's uh what we mean by um like outlier detection being applied to destination is like when you uh Define, the outlier detection, CR like you're gonna, be applying it to a specific destination.

A

Okay, God yeah, I guess the robbed configuration tends to be a little bit more flexible because you could have multiple routes to a given destination: yeah, yeah, yeah, okay, very cool I, actually really like the fact that you can just you know, apply a label and then be able to apply a particular policy on this particular destination or route. Yeah yeah.

A

Exactly make reuse so much simpler and also it could be a nice separation of rose and person, personality personas right so that maybe a central person can create in the policy and then you can just use it as a developer to say: hey I want this particular resilience policy on my routes, yeah.

B

A

Okay, cool: is there anything else? You would like to show Nina I'm trying to think um so. You show the graph you showed about the life cycle management of the Waypoint proxy. You showed us a header base routing you showed us I. Think some of the.

B

A

B

um Yeah overrides.

A

You showed us four or eight um yeah yeah.

B

I think, um let's see if I it might be so Ingress policies still work. I think I have to restart the Ingress Gateway, because there's an h-bone issue um on the so I can try applying an Ingress uh policy. But let me restart the Gateway first.

B

A

This is the istio English Gateway. Oh.

B

Yes yeah, so this is Gateway um I! Think because we're sending traffic consistently there's a bug where, um after a certain while, like um the there's, an issue with the Ingress Gateway um being able to connect to pods in the mesh, but.

A

B

uh After restarting it, it should be fine. Oh, let's see.

B

um Yeah I think it's just because we're sending so much traffic there, um but um in theory, let's, let's try it again quickly apply the rate limit policy.

B

um If I go uh um if so I, if uh I think I also have to bring the um the right table back, but basically the limit policy. We have a rate limit um server in the Pod uh in the the and on the remote cluster. So um where is it on? So, um uh if I apply like an Ingress rate limit policy, everything still works because um the policy is getting enforced at the Ingrid ingress level.

B

If it's like north south, um but currently like Waypoint proxy, uh like uh Envoy filters, don't work so you won't be able to get East-West rate limiting, um but uh like policies applied to thing, risk Gateway, like rate limiting and xtof, should work um I'm, seeing that it's still, let's see if we can restart it again, but it might be a little tricky to show just because I've been sending so much traffic, yeah yeah, it no I think it's.

A

It's okay, well,.

B

Yeah but, um and and this works for like any uh like uh other- you know- blue mesh policies so like xdov, free limiting um uh like uh anything, that's not um fully supported ambient will still be like applied on the Ingress, Gateway and function as expected. So.

A

Yeah, that's great to do I guess we need to really meet your wife.

B

Yeah I might be able to kill. Let's see, uh wait, there's it yeah.

A

Yeah folks, if you guys have any questions, we would love to hear from you uh or anything, particularly that will be interesting.

A

See you uh anything else that you want to discuss I think we hit all the major points.

A

Did you just try restarting again, oh.

B

Is it back all right, no I, don't think so. I think.

A

B

Yeah yeah thank.

A

You for that message, demo guys it's a little bit unpredictable, sometimes, but that's the song of love, diamond right.

A

All right, um I, don't see any further questions. Mina I think we've kind of talked quite a lot today. So we talk about. Let's do a quick recap on what we talk about. We talk about in ambient uh when comparing with psycha to ambient a lot of policies uh uh enforced on the destination side with ambient right and then we talk about the key features of glue mesh and we discuss these features.

A

We expect to continue to work in glue match with ambience such as multi-class multi-clustered down the road, such as workspace with multi-tenancy, which is already in place, and on top of the existing feature. We talk about how glutamus is automatically manage, Waypoint proxy for you and how you can potentially customize your Waypoint proxy deployments through, like yaml override with the life cycle manager.

A

um We talk about the UI, the layer for Telemetry right with symmetric, Diaz icon. That's all provided with just see tunnel without Waypoint proxy, um and then we talk about apply some of the layer, 7 policy, and then you showed how these layers have been policy in action was just the destinations. I would have Waypoint proxy.

B

A

Okay, great well I guess I want to thank you Nina. Thank you. So much for joining me on the hood. I feel like I got, educate you quite a lot um blue mesh and mdn integration too. So thank you for preparing the wonderful demo live to everybody and folks. If you guys find this interesting, uh what other topics you would like to see uh we're trying to roll out quite a lot of topic about Ambience, because their solo we're very excited about ambient.

A

uh We're also excited about some of the evpf work, we're going to do as solo, so we we plan to have more education session around it's still around ambient around evpf, so definitely reach out to us either on the hood. uh Github. Oh just comment in this uh in this YouTube uh video and we'll get back to you. Thank you so much for joining us today. Thank you. Nina bye, everybody.