& the architecture along the way! @mt165 mt165.co.uk The life - - PowerPoint PPT Presentation

▶
the architecture along the way
SMART_READER_LITE
LIVE PREVIEW

& the architecture along the way! @mt165 mt165.co.uk The life - - PowerPoint PPT Presentation

Apr 21, 2023 242 likes •758 views

QCon London March 2019 & the architecture along the way! @mt165 mt165.co.uk The life of a packet through Istio @mt165 Objectives Learn how a packet traverses an Istio/Envoy/Kubernetes system See what control plane calls are made in that

slide-1
SLIDE 1

@mt165 mt165.co.uk QCon London March 2019

& the architecture along the way!

slide-2
SLIDE 2

The life of a packet through Istio @mt165

Objectives

Learn how a packet traverses an Istio/Envoy/Kubernetes system See what control plane calls are made in that process Build a useful mental model for reasoning about, and debugging Istio

slide-3
SLIDE 3

The life of a packet through Istio @mt165

Prerequisites

Basic networking knowledge Intermediate Kubernetes knowledge An understanding of what Istio is and does

slide-4
SLIDE 4

The life of a packet through Istio @mt165

Outline

  • Context and Introduction
  • Networking and Containers
  • Pilot and Routing
  • Mixer and Policy
  • Citadel and mTLS
slide-5
SLIDE 5

The life of a packet through Istio @mt165

Context and Introduction

slide-6
SLIDE 6

The life of a packet through Istio @mt165

Why?

slide-7
SLIDE 7

The life of a packet through Istio @mt165

slide-8
SLIDE 8

The life of a packet through Istio @mt165

slide-9
SLIDE 9

The life of a packet through Istio @mt165

Istio

“An open platform to connect, secure, control, and observe services.”

slide-10
SLIDE 10

The life of a packet through Istio @mt165

Networking and Containers

slide-11
SLIDE 11

The life of a packet through Istio @mt165 Service A Ingress

slide-12
SLIDE 12

The life of a packet through Istio @mt165 Service A Envoy Envoy Envoy Envoy Ingress Load Balancer Node port Cluster IP *.example.com Cluster IP

slide-13
SLIDE 13

The life of a packet through Istio @mt165 Service A

slide-14
SLIDE 14

The life of a packet through Istio @mt165 Envoy SvcA Service A

slide-15
SLIDE 15

The life of a packet through Istio @mt165

“Containers”

nginx nginx supervisord mnt uts pid user ipc net

slide-16
SLIDE 16

The life of a packet through Istio @mt165

Kubernetes Pods

nginx nginx supervisord mnt uts pid user ipc net logger fluentd mnt uts

slide-17
SLIDE 17

The life of a packet through Istio @mt165

Kubernetes Pods

nginx nginx supervisord mnt uts pid user ipc net logger fluentd mnt uts 192.168.0.42 eth0 lo sockets iptables routes

slide-18
SLIDE 18

The life of a packet through Istio @mt165

Kubernetes Pods

nginx nginx supervisord mnt uts pid user ipc net logger fluentd mnt uts 192.168.0.42 eth0 lo sockets iptables routes :8080/tcp

slide-19
SLIDE 19

The life of a packet through Istio @mt165

Kubernetes Pods

nginx nginx supervisord mnt uts pid user ipc net proxy envoy mnt uts 192.168.0.42 eth0 lo sockets iptables routes :8080/tcp

slide-20
SLIDE 20

The life of a packet through Istio @mt165

Sidecar Injection

pid user ipc net 192.168.0.42 eth0 lo sockets iptables routes

slide-21
SLIDE 21

The life of a packet through Istio @mt165

Sidecar Injection

pid user ipc net 192.168.0.42 eth0 lo sockets iptables routes alpine sysctl -w kernel.core_pattern=...

slide-22
SLIDE 22

The life of a packet through Istio @mt165

Sidecar Injection

pid user ipc net 192.168.0.42 eth0 lo sockets iptables routes istio/proxy_init /usr/local/bin/prepare_proxy.sh -p 15001 -u 1337

slide-23
SLIDE 23

The life of a packet through Istio @mt165

Sidecar Injection

nginx nginx mnt uts pid user ipc net istio/proxy envoy mnt uts 192.168.0.42 eth0 lo sockets iptables routes :15001/tcp

slide-24
SLIDE 24

The life of a packet through Istio @mt165 Envoy SvcA Service A

slide-25
SLIDE 25

The life of a packet through Istio @mt165

Pilot and Routing

slide-26
SLIDE 26

The life of a packet through Istio @mt165 Envoy SvcA Service A

? ? ?

slide-27
SLIDE 27

The life of a packet through Istio @mt165

Services

$ kubectl get service -o wide service-b NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR service-b ClusterIP 10.98.84.169 <none> 80/TCP 90s app=service-b

slide-28
SLIDE 28

The life of a packet through Istio @mt165

Service DNS exposure

$ dig service-b.default.svc.cluster.local. ;; ANSWER SECTION: service-b.default.svc.cluster.local. 5 IN A 10.98.84.169

slide-29
SLIDE 29

The life of a packet through Istio @mt165

Pods

$ kubectl get pods -o wide | grep service-b service-b-644856485c-4rk88 1/1 Running 0 7m46s 10.32.0.4 kind-1-control-plane <none> service-b-644856485c-dc2zv 1/1 Running 0 7m46s 10.32.0.6 kind-1-control-plane <none> service-b-644856485c-gr75k 1/1 Running 0 7m46s 10.32.0.5 kind-1-control-plane <none>

slide-30
SLIDE 30

The life of a packet through Istio @mt165

Endpoints

$ kubectl get endpoints service-b NAME ENDPOINTS AGE service-b 10.32.0.4:8080,10.32.0.5:8080,10.32.0.6:8080 8m55s

slide-31
SLIDE 31

The life of a packet through Istio @mt165

Endpoints

$ kubectl get endpoints service-b -o yaml ... subsets:

  • addresses:
  • ip: 10.32.0.4

nodeName: kind-1-control-plane targetRef: kind: Pod … ports:

  • name: http

port: 8080 protocol: TCP

slide-32
SLIDE 32

The life of a packet through Istio @mt165 Envoy SvcA Pilot Control Plane API Service A Config to Envoys

slide-33
SLIDE 33

The life of a packet through Istio @mt165 Envoy SvcA Pilot Control Plane API Service A Config to Envoys k8s consul zk Data plane API

slide-34
SLIDE 34

The life of a packet through Istio @mt165

Pilot

  • Ingress Routing
  • Traffic Mirroring
  • Traffic Shifting
  • Canary Deployments
  • Circuit Breaking
  • Fault Injection
slide-35
SLIDE 35

The life of a packet through Istio @mt165

Mixer and Policy

slide-36
SLIDE 36

The life of a packet through Istio @mt165 Envoy SvcA Pilot Control Plane API Service A Service B Config to Envoys

slide-37
SLIDE 37

The life of a packet through Istio @mt165 Envoy SvcA Envoy SvcB Pilot Mixer Control Plane API Service A Service B Config to Envoys Policy checks, Telemetry

slide-38
SLIDE 38

The life of a packet through Istio @mt165

IP 5-tuple

(src_addr, src_port, dst_addr, dst_port, proto)

slide-39
SLIDE 39

The life of a packet through Istio @mt165

IP Router Architecture

Interrupt Kernel module User process DATA PLANE CONTROL PLANE OSPF ARP BGP STP Router Information Base Forwarding Information Base

slide-40
SLIDE 40

The life of a packet through Istio @mt165

IP Router Architecture

DATA PLANE CONTROL PLANE OSPF ARP BGP STP PILOT MIXER ENVOY Interrupt Kernel module User process Router Information Base Forwarding Information Base

slide-41
SLIDE 41

The life of a packet through Istio @mt165 Envoy SvcA Envoy SvcB Pilot Mixer Control Plane API Service A Service B Config to Envoys prom ES REPORT CHECK RBAC Rate limit Mixer fat client Mixer fat client

slide-42
SLIDE 42

The life of a packet through Istio @mt165

Mixer

  • Check

○ ACLs / Authorization ○ Rate Limiting

  • Report

○ Logs ○ Metrics ○ Tracing

slide-43
SLIDE 43

The life of a packet through Istio @mt165 Envoy SvcA Envoy SvcB Pilot Mixer Control Plane API Service A Service B Config to Envoys Policy checks, Telemetry

slide-44
SLIDE 44

The life of a packet through Istio @mt165 Envoy SvcA Envoy SvcB Pilot Mixer Citadel Control Plane API Service A Service B Config to Envoys TLS certs to Envoys Policy checks, Telemetry

slide-45
SLIDE 45

The life of a packet through Istio @mt165 Envoy SvcA Envoy SvcB Pilot Mixer Citadel Control Plane API Service A Service B Config to Envoys TLS certs to Envoys Policy checks, Telemetry

slide-46
SLIDE 46

The life of a packet through Istio @mt165 Envoy SvcA Envoy SvcB Pilot Mixer Citadel Control Plane API Service A Service B Config to Envoys TLS certs to Envoys Policy checks, Telemetry Envoy Envoy Envoy Envoy Envoy Envoy Envoy Envoy Ingress Egress

slide-47
SLIDE 47

The life of a packet through Istio @mt165 Envoy SvcA Envoy SvcB Pilot Mixer Citadel Control Plane API Service A Service B Config to Envoys TLS certs to Envoys Policy checks, Telemetry API Server etcd kubectl

slide-48
SLIDE 48

The life of a packet through Istio @mt165 Envoy SvcA Envoy SvcB Pilot Mixer Citadel Control Plane API Service A Service B Config to Envoys TLS certs to Envoys Policy checks, Telemetry Galley etcd kubectl

slide-49
SLIDE 49

The life of a packet through Istio @mt165

Outline

  • Context and Introduction
  • Networking and Containers
  • Pilot and Routing
  • Mixer and Policy
  • Citadel and mTLS
slide-50
SLIDE 50

The life of a packet through Istio @mt165

Recap

We learned:

  • How a packet traverses an Istio/Envoy/Kubernetes system
  • What control plane calls are made in that process
  • A useful mental model for reasoning about, and debugging Istio
slide-51
SLIDE 51

Thanks!

@mt165

QR CODE