Istio - Get Started with Istio and Kubernetes

Mohan Pawar

Containers are Future Deployment Units.

The Dev people managing infrastructure just want a PaaS. The only requirement is:

It has to be build by them.

Kubernetes Key Concept

Pod: Group of tightly coupled containers and volume

Replication Controller: A loop that drives the current state to desired state

Service: A set of running pods that work together

Volumes: Pod level storage and configuration

Evolving Stack...

Connect, Manage and Secure Services

End application

Packaging

e.g. tarball

Better cluster

Deployment

Istio

• Policy - Create a policy between the application.
• Observability - Observer the behaviour
• Security - per application instance
• Reliability - consistent performance according to specification

“Kubernetes changed how we deploy applications, Istio is going to change how we connect, manage and secure them.”

We must treat the data center itself as one massive warehouse-scale computer

Istio Architecture

Istio Key Components

Pilot: Responsible for configuring the Envoy and Mixer at runtime.

Enovy: Sidecar proxies per micro-service to handle ingress/egress traffic b/w services in the cluster and from a service to external services.

Mixer: Enforce policies such as ACLs, rate limit, quotas, auth, request tracing and telemetry collection at an infrastructure level.

Ingress/Egress: Configure path based routing

Istio CA: Secure service-to-service communication over TLS, automate key, certificate generation, distribution, rotation, and revocation

​

Design Goals

• Maximum Transparency
• Incrementality
• Portability
• Policy Uniformity

Traffic Management

Pilot

Rule Configurations

Split Traffic between Service Versions

• Multiple Registered instances with specified tags
• Routing based on load-balancing policy
• Or Round-robin by default

​

“You could write your own custom rule”

Istio Auth Arch.

Mixer

• Precondition Checking: consumer is authenticated, in the whitelists, passes ACL checks, etc.
• Quota Management: enables services to allocate the free quota on a number of dimensions
• e.g. Rate limits
• Telemetry Reporting: enable services to report logging and monitoring.

Demo Time

• Deploying Book Info Application using Istio and Kubernetes

BookInfo Application

Roadmap [ Istio 0.4 ]

• Support for additional logging, tracing, rate limiting, etc. adapters.
• Configuration rollout and management.
• Support for multiple clusters in a single mesh.
• Client oriented telemetry collection and distribution.
• Global load balancing with auto-scaling.
• Basic Authorization using RBAC.
• Support for backward compatibility and istio upgrades.

An open platform to connect, manage and secure microservices

Zero code changes to application code

Q/A

Thank you

Ask any further questions.

/in/mohan08p

@mohan08p