solo.io SoloCon 2022, 5 May 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SoloCon 2022 [Lightning Talk]: Lambda - Gloo Edge 1.10

Description

SoloCon 2022:
[Lightning Talk] Lambda - Gloo Edge 1.10

Speakers:
Nathan Fudenberg
Software Engineer, Solo.io

Abstract:
Learn all about Gloo Edge's new lambda invocation features and how they make invoking functions easier and safer then ever before.

Track:
Edge and API Gateway

A

Hi welcome to today's lightning talks. I'm nikki and I work in product marketing here at solo. I o I'm excited to welcome our first lightning talk speaker for the day. So please help me extend a warm welcome to nathan fudenberg, who will be showing us how to use aws, lambda serverless functions and how they've changed in glue edge 1.10 over you nathan.

A

Thank you. Nikki.

B

Thank you, everyone for coming to this lightning talk. uh Today, I'm going to be talking about once again edius lambda in glue edge, 1.10 in particular, but also sort of how we integrate with it in general. uh I hope you'll pardon at the top of the screen. There's uh some extra things that sort of show what's to come. You know a taste of the the demo, just some technical difficulties, difficulties around that. um So please ignore that and we're going to go through it.

B

So yeah, I'm nathan, fudenberg, I'm a software engineer here at solo.I, o on the glue edge team.

B

Today we're going to be going through four different portions uh to sort of tell you about how we interact with aws lambda and how that's changed so first we're gonna be covering the basics I like to call them. So what you should know before really digging into this, where historically glue edge, has sat within this and then showing progress more deeply down the road of how edge has been in the space, then we're going to get into what's changed.

B

So what you can be looking forward, or not even forward to it's now actually accessible and then finally, we're going to finish with a little demo of one of the features that I think personally is really really awesome, so fantastic great, so basics. What pieces of the puzzle do you need to know to sort of understand what we're doing here?

B

Well first, this is a talk in aws lambda, so you probably want to know what that is so aws lambda is a serverless offering from aws that is seeing a ton of usage across the industry, whether that's for small jobs or you know, for scalable uh serverless uh functions. You know, there's there's a lot of different places and avenues to use, aws lambda uh and you can really empower developers with it. um So you might want to know a little bit about that.

B

Second, on by proxy, if you've been listening to, you know the rest of the glue edge track, you're, probably familiar with envoy proxy, but if you aren't once again it's nice to be sort of hard to follow and then finally glue edge. So, where do we fit in with uh our config config discovery? Discovery in general, then also the translation, envoy and what's pieces. We slot into envoy in particular for aws lambda.

B

Cool, so why might we care once again about lambda?

B

So this is a slide over from datadog's state of serverless and just showing how explosive this uh this growth has been right and these lambda functions can either be invoked from a developer's laptop. It can be invoked from an ec2 instance where you have some microservice running.

B

It could be in particular, when you focus in this case in eks or kubernetes pod, whether that's truly in eks itself or living somewhere else right.

B

It can be from any of those places. So by default great you have all this functionality. You can make uh all the different different versions of it. You can slot in some observability around your lambdas, so you can do a lot of things there, but if you have to implement that every time well, you're losing all the great things that a proxy or load balancers might sort of help you with right. So some sandy checks some some of those extra services.

B

So that's where we come in right, it's. How do you treat lambda like everything else and do it in a safe way, so fantastic, so glue edge? How? How are we helping you with that? Historically right and once again, uh this is not with a 1.10 thing. This is just sort of staying where we have been slotting in so great, so the first portion is invocation so with glue edge, you can have your routes on envoy proxy they've been configured via glue and you're, getting all the great things that come with envoy.

B

You know whether it's any filters before or after whether that's with glue edges mod security. If you want to put transformations around it, everything you're used to in glue edge you're able to apply to any of your lambda calls.

B

Second, as with glue edge and kubernetes when looking for kubernetes resources, glue edge can actually discover new lambdas or lambdas within a space. So if you have an upstream and it's pointing to say us east one with some privileges in aws, so some region, aws glue, can actually go and populate that list with all the lambdas that are there, that, given the permissions you've granted to glue edge, whether that's via static credentials or via scs or any other space like that, we can actually automatically populate those for you, then.

B

Finally, the thing that is perhaps my mind, one more special parts about glue in particular is credential management. So we support static. You know credentials, fine great! uh You can put those on a given up stream or you can link. We can have a credential discovery.

B

So, if you're in an environment that say, for example, if you're in eks, we can pull that and use that to populate things and then finally, uh through the mutating web hook that is in uh that is in eks as of a few versions ago, it's sort of default, so amazon, if you have annotated, which we'd sort of take care of, if you install with the right helm configuration, then amazon will update a token for us to use to get short term and therefore sort of not create a long term credential which, as we all know, can be problematic.

B

So before we move on from this. One of the reasons why I said credential management is to some degree the glue edge secret sauce is that it turns out envoy proxy has, in its upstream implementation an aws lambda filter as well, so just to make sure that we're not confused throughout the rest of this. This is glues, custom, so the solo custom filter and the reason we have that is pretty much at the end of the day, because credential management uh is not fully baked there.

B

It's static credentials rather than being able to work with this sts assumption via mutating web hook, which mutating web hook, while native in amazon in eks.

B

This is cloud gnostic right, you could, if you wanted to do the exact same thing as the aws mutating web hook, and then the glue code will all work with that right. So you have your jaw and you can authenticate there, though it is easiest with eks awesome, so that's glue edge as it was uh now. We've seen recently a lot of customers, a lot of people who have been using aws lambda for quite a while and they may put behind the alb.

B

They have some of the good things, but not everything at proxy like a full-fledged proxy like uh envoy proxy, can give us and it sort of works, but it does have a lot of vendor lock-in. It's kind of hard. The other thing they can't do is go across account. So this is the feature that I think is most exciting for 1.10 we've now added the ability to actually assume roles and interact across count, boundaries which uh is not super trivial, to say the least.

B

So this actually illustrates what your environment might look like with discovery reaching out to the region to identify what lambdas exist and then also configuring envoy such that it can actually make calls to any of these fantastic.

B

So, just to summarize some some of these updates we've seen uh so we talked about cross account right. uh We haven't really talked about lb migration, so in that first slide we're saying here's an alb um space or a potential setup, with l b for calling lambdas from some kubernetes microservices.

B

But now we've actually made it easier to migrate from such a setup, whether that's the new flag called unwrap as alb, which will mean that you don't have to conform to the really strict formatting requirements that an alb aws lambda invocation requires.

B

So if you're migrating from alb, you can start with that format and then, as you clean your lambdas or make new lambdas, you can sort of untoggle that so that they can have easier payloads and you can once again use all the great stuff that comes with glue such as transformations.

B

Finally, I just want to throw it in there as well. We've done some nice polishing uh in glue ctl, so it's a little bit cleaner when you're interacting with some of these sts aws definitions. So upstreams in upstream that are using scs will now report more cleanly. For example,.

B

And now I wanted to give a quick demo of what we've sort of done, namely I really want to focus in on this cross cross account lamp cross account lambda invocation, uh so let's go and do that quickly.

B

So we have in one account this crop this lambda, which is just going to uppercase and tell us that it's from across account and we've set up.

B

This other account the right permissions as well as also I'm skipping over some of the x permissioning, and this is not the most fine-grained and I not probably exactly what you'd use for permissions in production, because this are very permissive but associate our oidc provider and then just to show a second.

B

B

To show what we have here, I've set up an environment whereby we have a lambda upstream, that is within our own, and it's actually discovered a whole series of functions and then I've also set up one which is cross accounts.

B

um So let's see that in action, and so first I'm going to illustrate we've set in in place a runtime guard, so you can actually revert back to the old functionality at any time if you so desire without a restart of envoy, proxy or proxy.

B

So then, if we're to call our normal lambda should work fine, so it's come through and we've given it abc and it's come along and uppercased it, but because we made this call to um I've already part-forted. I should have stated that, but I did run time modify to disable this functionality.

B

Our cross account won't work. It claims there's nothing found.

B

B

End it we'll see that we're getting access there.

B

So now the other great thing is so I'm looking at the proxy logs right now. As with our previous implementations, this is all cached. So every time we do the calls again, we can actually see that it has not had to do another lookup. It already has it from you know, in memory space and we're cooking across account in hungary, proxy and aws lambda awesome.

B

Well, that's all I have for for this today. uh It looks like we're at time. So thank you so much for for coming and listening to me talk about both aws lambda invocation in glue edge and also more specifically, the updates that we've put in for 1.10.

A

All right, thank you, nathan, for those of you attending. If you have any questions, be sure to drop them here in the chat room or post them on our general slack channel for solocon also check out the other tracks for our next sessions by clicking the reception button at the top left of your window. But thanks for attending today and thanks nathan for a great demo.