book

Istio in Action

by Rinor Maloku, Christian E. Posta

March 2022

Intermediate to advanced

480 pages

13h 18m

English

Manning Publications

Read now

Unlock full access

forewordprefaceacknowledgmentsabout this bookWho should read this bookHow this book is organized: A roadmapAbout the codeliveBook discussion forumabout the authorsabout the cover illustration
1.1 Challenges of going faster1.1.1 Our cloud infrastructure is not reliable1.1.2 Making service interactions resilient1.1.3 Understanding what’s happening in real time1.2 Solving these challenges with application libraries1.2.1 Drawbacks to application-specific libraries1.3 Pushing these concerns to the infrastructure1.3.1 The application-aware service proxy1.3.2 Meet the Envoy proxy1.4 What’s a service mesh?1.5 Introducing the Istio service mesh1.5.1 How a service mesh relates to an enterprise service bus1.5.2 How a service mesh relates to an API gateway1.5.3 Can I use Istio for non-microservices deployments?1.5.4 Where Istio fits in distributed architectures1.5.5 What are the drawbacks to using a service mesh?Summary
2.1 Deploying Istio on Kubernetes2.1.1 Using Docker Desktop for the examples2.1.2 Getting the Istio distribution2.1.3 Installing the Istio components into Kubernetes2.2 Getting to know the Istio control plane2.2.1 Istiod2.2.2 Ingress and egress gateway2.3 Deploying your first application in the service mesh2.4 Exploring the power of Istio with resilience, observability, and traffic control2.4.1 Istio observability2.4.2 Istio for resiliency2.4.3 Istio for traffic routingSummary
3.1 What is the Envoy proxy?3.1.1 Envoy’s core features3.1.2 Comparing Envoy to other proxies3.2 Configuring Envoy3.2.1 Static configuration3.2.2 Dynamic configuration3.3 Envoy in action3.3.1 Envoy’s Admin API3.3.2 Envoy request retries3.4 How Envoy fits with IstioSummary

4.1 Traffic ingress concepts4.1.1 Virtual IPs: Simplifying service access4.1.2 Virtual hosting: Multiple services from a single access point4.2 Istio ingress gateways4.2.1 Specifying Gateway resources4.2.2 Gateway routing with virtual services4.2.3 Overall view of traffic flow4.2.4 Istio ingress gateway vs. Kubernetes Ingress4.2.5 Istio ingress gateway vs. API gateways4.3 Securing gateway traffic4.3.1 HTTP traffic with TLS4.3.2 HTTP redirect to HTTPS4.3.3 HTTP traffic with mutual TLS4.3.4 Serving multiple virtual hosts with TLS4.4 TCP traffic4.4.1 Exposing TCP ports on an Istio gateway4.4.2 Traffic routing with SNI passthrough4.5 Operational tips4.5.1 Split gateway responsibilities4.5.2 Gateway injection4.5.3 Ingress gateway access logs4.5.4 Reducing gateway configurationSummary
5.1 Reducing the risk of deploying new code5.1.1 Deployment vs. release5.2 Routing requests with Istio5.2.1 Cleaning up our workspace5.2.2 Deploying v1 of the catalog service5.2.3 Deploying v2 of the catalog service5.2.4 Routing all traffic to v1 of the catalog service5.2.5 Routing specific requests to v25.2.6 Routing deep within a call graph5.3 Traffic shifting5.3.1 Canary releasing with Flagger5.4 Reducing risk even further: Traffic mirroring5.5 Routing to services outside your cluster by using Istio’s service discoverySummary
6.1 Building resilience into the application6.1.1 Building resilience into application libraries6.1.2 Using Istio to solve these problems6.1.3 Decentralized implementation of resilience6.2 Client-side load balancing6.2.1 Getting started with client-side load balancing6.2.2 Setting up our scenario6.2.3 Testing various client-side load-balancing strategies6.2.4 Understanding the different load-balancing algorithms6.3 Locality-aware load balancing6.3.1 Hands-on with locality load balancing6.3.2 More control over locality load balancing with weighted distribution6.4 Transparent timeouts and retries6.4.1 Timeouts6.4.2 Retries6.4.3 Advanced retries6.5 Circuit breaking with Istio6.5.1 Guarding against slow services with connection-pool control6.5.2 Guarding against unhealthy services with outlier detectionSummary
7.1 What is observability?7.1.1 Observability vs. monitoring7.1.2 How Istio helps with observability7.2 Exploring Istio metrics7.2.1 Metrics in the data plane7.2.2 Metrics in the control plane7.3 Scraping Istio metrics with Prometheus7.3.1 Setting up Prometheus and Grafana7.3.2 Configuring the Prometheus Operator to scrape the Istio control plane and workloads7.4 Customizing Istio’s standard metrics7.4.1 Configuring existing metrics7.4.2 Creating new metrics7.4.3 Grouping calls with new attributesSummary
8.1 Using Grafana to visualize Istio service and control-plane metrics8.1.1 Setting up Istio’s Grafana dashboards8.1.2 Viewing control-plane metrics8.1.3 Viewing data-plane metrics8.2 Distributed tracing8.2.1 How does distributed tracing work?8.2.2 Installing a distributed tracing system8.2.3 Configuring Istio to perform distributed tracing8.2.4 Viewing distributed tracing data8.2.5 Trace sampling, force traces, and custom tags8.3 Visualization with Kiali8.3.1 Installing Kiali8.3.2 ConclusionSummary
9.1 The need for application-networking security9.1.1 Service-to-service authentication9.1.2 End-user authentication9.1.3 Authorization9.1.4 Comparison of security in monoliths and microservices9.1.5 How Istio implements SPIFFE9.1.6 Istio security in a nutshell9.2 Auto mTLS9.2.1 Setting up the environment9.2.2 Understanding Istio’s PeerAuthentication resource9.3 Authorizing service-to-service traffic9.3.1 Understanding authorization in Istio9.3.2 Setting up the workspace9.3.3 Behavior changes when a policy is applied to a workload9.3.4 Denying all requests by default with a catch-all policy9.3.5 Allowing requests originating from a single namespace9.3.6 Allowing requests from non-authenticated legacy workloads9.3.7 Allowing requests from a single service account9.3.8 Conditional matching of policies9.3.9 Understanding value-match expressions9.3.10 Understanding the order in which authorization policies are evaluated9.4 End-user authentication and authorization9.4.1 What is a JSON web token?9.4.2 End-user authentication and authorization at the ingress gateway9.4.3 Validating JWTs with RequestAuthentication9.5 Integrating with custom external authorization services9.5.1 Hands-on with external authorization9.5.2 Configuring Istio for ExtAuthz9.5.3 Using a custom AuthorizationPolicy resourceSummary
10.1 The most common mistake: A misconfigured data plane10.2 Identifying data-plane issues10.2.1 How to verify that the data plane is up to date10.2.2 Discovering misconfigurations with Kiali10.2.3 Discovering misconfigurations with istioctl10.3 Discovering misconfigurations manually from the Envoy config10.3.1 Envoy administration interface10.3.2 Querying proxy configurations using istioctl10.3.3 Troubleshooting application issues10.3.4 Inspect network traffic with ksniff10.4 Understanding your application using Envoy telemetry10.4.1 Finding the rate of failing requests in Grafana10.4.2 Querying the affected Pods using PrometheusSummary
11.1 The control plane’s primary goal11.1.1 Understanding the steps of data-plane synchronization11.1.2 Factors that determine performance11.2 Monitoring the control plane11.2.1 The four golden signals of the control plane11.3 Tuning performance11.3.1 Setting up the workspace11.3.2 Measuring performance before optimizations11.3.3 Ignoring events: Reducing the scope of discovery using discovery selectors11.3.4 Event-batching and push-throttling properties11.4 Performance tuning guidelinesSummary
12.1 The benefits of a multi-cluster service mesh12.2 Overview of multi-cluster service meshes12.2.1 Istio multi-cluster deployment models12.2.2 How workloads are discovered in multi-cluster deployments12.2.3 Cross-cluster workload connectivity12.2.4 Common trust between clusters12.3 Overview of a multi-cluster, multi-network, multi-control-plane service mesh12.3.1 Choosing the multi-cluster deployment model12.3.2 Setting up the cloud infrastructure12.3.3 Configuring plug-in CA certificates12.3.4 Installing the control planes in each cluster12.3.5 Enabling cross-cluster workload discovery12.3.6 Setting up cross-cluster connectivity12.3.7 Load-balancing across clustersSummary
13.1 Istio’s VM support13.1.1 Simplifying sidecar proxy installation and configuration in a VM13.1.2 Virtual machine high availability13.1.3 DNS resolution of in-mesh services13.2 Setting up the infrastructure13.2.1 Setting up the service mesh13.2.2 Provisioning the VM13.3 Mesh expansion to VMs13.3.1 Exposing istiod and cluster services to the VM13.3.2 Representing a group of workloads with a WorkloadGroup13.3.3 Installing and configuring the istio-agent in the VM13.3.4 Routing traffic to cluster services13.3.5 Routing traffic to the WorkloadEntry13.3.6 VMs are configured by the control plane: Enforcing mutual authentication13.4 Demystifying the DNS proxy13.4.1 How the DNS proxy resolves cluster hostnames13.4.2 Which hostnames is the DNS proxy aware of?13.5 Customizing the agent’s behavior13.6 Removing a WorkloadEntry from the meshSummary
14.1 Envoy’s extension capabilities14.1.1 Understanding Envoy’s filter chaining14.1.2 Filters intended for extension14.1.3 Customizing Istio’s data plane14.2 Configuring an Envoy filter with the EnvoyFilter resource14.3 Rate-limiting requests with external call-out14.3.1 Understanding Envoy rate limiting14.4 Extending Istio’s data plane with Lua14.5 Extending Istio’s data plane with WebAssembly14.5.1 Introducing WebAssembly14.5.2 Why WebAssembly for Envoy?14.5.3 Building a new Envoy filter with WebAssembly14.5.4 Building a new Envoy filter with the meshctl tool14.5.5 Deploying a new WebAssembly Envoy filterSummary
A.1 The IstioOperator APIA.2 The Istio installation profilesA.3 Installing and customizing Istio using istioctlA.4 Installing and customizing Istio with the istio-operatorA.4.1 Installing the istio-operatorA.4.2 Updating the installation of a mesh
B.1 Sidecar injectionB.1.1 Manual sidecar injectionB.1.2 Automatic sidecar injectionB.2 Security issues with istio-init
C.1 Authentication using PKI (public key infrastructure)C.1.1 Traffic encryption via TLS and end-user authenticationC.2 SPIFFE: Secure Production Identity Framework for EveryoneC.2.1 SPIFFE ID: Workload identityC.2.2 Workload APIC.2.3 Workload endpointsC.2.4 SPIFFE Verifiable Identity DocumentsC.2.5 How Istio implements SPIFFEC.2.6 Step-by-step bootstrapping of workload identityC.3 Understanding request identityC.3.1 Metadata collected by the RequestAuthentication resourceC.3.2 Overview of the flow of one request
D.1 Information exposed by the Istio agentD.1.1 Endpoints to introspect and troubleshoot the Istio agentD.1.2 Querying Istio Pilot debug endpoints through the Istio agentD.2 Information exposed by the Istio PilotD.2.1 The Istio Pilot debug endpointsD.2.2 The ControlZ interface

Content preview from Istio in Action

4 Istio gateways: Getting traffic into a cluster

This chapter covers

Defining entry points into a cluster
Routing ingress traffic to deployments in your cluster
Securing ingress traffic
Routing non HTTP/S traffic

We usually run interesting services and applications inside our cluster. And as we’ll see throughout the book, Istio allows us to solve some difficult challenges in service-to-service communication. It is this intra-service communication where Istio shines (within a cluster or across clusters).

Before services communicate with each other, something must trigger the interactions. For example, an end user purchasing an item, a client querying our API, and so on. What each of these triggers have in common is that they originate outside ...