GKE Fleet Management

• This allows you to management multiple clusters both GKE and Anthos Clusters as a unified entity
• GKE Fleet Enables you to
  • centralize management for multiple clusters
  • provides cross cluster service discovery
  • Enforce policies consistently across clusters
• Refer Here for fleet setup
• GKE Fleet management Features Refer Here

---

Service Mesh

• This is a dedicated infrastructure layer that controls service to serivce communication within a microservices architecture
• It provides key functionalities such as
  • traffic management: Manages and optimizes traffic and communication between services
  • observability: Provide tools for monitoring, tracing and logging network traffic between services
  • security and reliabilty without requiring to change the application code: offers featurs such as mTLS(mutal TLS) for encrypted communications between services
  • Resilience: Ensure HA of services through retries, timeouts and circuit breaking
• Key Components of serivce mesh
  • Proxy: A sidecar container that intercepts network traffic, applies policies and handles communication
  • Control Plane: Manage configuration and policies typically centralized
  • Data Plane: Consists of Proxies that handle the communication between service
• Service Mesh Providers
  • Istio
  • Linkerd
  • Consul

---

Istio

• Most popular service mesh, primary designed to manage microservices in kuberenetes.
• It provides automatic sidecar injection for pods, traffic routing, service discovery, mTLS security and observability features like monitoring and logging

Istio Architecture

Istio is a powerful service mesh that enhances the management of microservices by providing features such as traffic management, security, and observability. Its architecture is logically divided into two main components: the control plane and the data plane.

Control Plane

The control plane is responsible for managing and configuring the data plane. It consists of several key components:

• Istiod: This component consolidates the functionalities of previous components like Pilot, Galley, Citadel, and Mixer. It handles service discovery, configuration management, and certificate generation for secure communication between services.
• Pilot: Manages the lifecycle of Envoy proxies and provides service discovery.
• Galley: Responsible for configuration validation and distribution (now largely integrated into Istiod).
• Citadel: Manages security, including issuing and renewing TLS certificates for mutual TLS (mTLS) communication.
• Mixer: Previously used for policy enforcement and telemetry collection; its functionalities have been transitioned to Envoy proxy plugins in the latest versions.
• Ingress Gateway: Manages inbound traffic to the mesh.
• Egress Gateway: Controls outbound traffic from the mesh.

Data Plane

The data plane consists of a set of intelligent proxies, specifically Envoy, which are deployed as sidecars alongside each microservice. These proxies perform several critical functions:

• Traffic Mediation: Envoy proxies intercept all inbound and outbound traffic between services, allowing for fine-grained control over routing and load balancing.
• Telemetry Collection: They gather metrics and logs about service interactions, enabling observability into the system’s performance.
• Security Enforcement: Proxies enforce security policies, including authentication and authorization using mTLS.

Key Features

1. Traffic Management:
2. Advanced routing capabilities (HTTP, gRPC, TCP).
3. Load balancing and retries.
4. Fault injection for testing resilience.
5. Security:
6. Automated mTLS for secure service-to-service communication.
7. Role-based access control (RBAC) policies.
8. Observability:
9. Rich telemetry data collection via Envoy.
10. Integration with monitoring tools like Prometheus and Grafana for visualization.
11. Extensibility:
12. Support for custom policies through a pluggable architecture based on WebAssembly.

Conclusion

Istio’s architecture allows it to effectively manage complex microservices environments without requiring changes to application code. By separating concerns between the control plane and data plane, Istio provides a robust framework for enhancing security, observability, and traffic management across distributed systems. This modular design enables organizations to adopt Istio incrementally while leveraging its powerful features to improve their microservices architecture.

Citations:
[1] https://www.istioworkshop.io/03-servicemesh-overview/istio-architecture/
[2] https://istio.io/latest/docs/ops/deployment/architecture/
[3] https://techblost.com/istio-architecture-explained/
[4] https://www.groundcover.com/blog/istio-architecture
[5] https://www.baeldung.com/ops/istio-service-mesh
[6] https://istio.io/latest/about/service-mesh/
[7] https://www.solo.io/topics/istio/istio-architecture/
[8] https://www.youtube.com/watch?v=16fgzklcF7Y

Istio Traffic Management

• Traffic Splitting: Route Traffic to different service versions (Canary releases, A/B testing)
• Retries and Timeouts
• Circuit breaking
• Fault Injections

Traffic Flow in Istio

Installing Istio

Refer Here

---

Istio Tutorial

Service Mesh Overview

1. Introduction to Service Mesh

A Service Mesh is a dedicated infrastructure layer that controls service-to-service communication within a microservices architecture. It provides key functionalities such as traffic management, observability, security, and reliability without requiring changes to the application code.

2. Why Use a Service Mesh?

• Traffic Management: Can manage network traffic and optimize communication between services.
• Security: Offers features like Mutual TLS (mTLS) for encrypted communication between services.
• Observability: Provides tools for monitoring, tracing, and logging network traffic between services.
• Resilience: Ensures high availability of services through retries, timeouts, and circuit-breaking mechanisms.
• Load Balancing: Dynamically balances requests across service instances.

3. Key Components of a Service Mesh

• Proxy: A sidecar container (e.g., Envoy) that intercepts network traffic and applies policies, handles communication.
• Control Plane: Manages configuration and policies, typically centralized.
• Data Plane: Consists of proxies that handle the communication between services.

---

Istio Service Mesh Tutorial

Step 1: Introduction to Istio

Istio is one of the most popular open-source service meshes, primarily designed to manage microservices in Kubernetes. It provides automatic sidecar injection for services, traffic routing, service discovery, mTLS security, and observability features like monitoring and logging.

Step 2: Set Up the Environment

1. Create a Kubernetes Cluster:
2. Set up a Kubernetes cluster using Azure Kubernetes Service (AKS), Google Kubernetes Engine (GKE), or Minikube (for local development). For AKS, you can use the Azure CLI:
   bash
az aks create --resource-group myResourceGroup --name myAKSCluster --node-count 1 --enable-addons monitoring --generate-ssh-keys
az aks get-credentials --resource-group myResourceGroup --name myAKSCluster
3. Install kubectl:
4. Ensure kubectl is installed and configured with your Kubernetes cluster.
   bash
kubectl version --client
5. Install Helm:
6. Helm is the package manager for Kubernetes, and it will be used to install Istio.
   bash
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

Step 3: Install Istio

1. Download and Install Istio CLI:
2. Download the Istio release and move the istioctl binary to your path.
   bash
curl -L https://istio.io/downloadIstio | sh -
cd istio-<version>
export PATH=$PWD/bin:$PATH
3. Install Istio Base and IstioD Components:
4. You can use Helm to install Istio’s base and IstioD, the core component that manages configuration.
   bash
helm install istio-base istio/base -n istio-system --create-namespace
helm install istio-istiod istio/istiod -n istio-system --wait
5. Install the Ingress Gateway:
6. The Ingress Gateway manages external traffic into the cluster.
   bash
helm install istio-ingressgateway istio/gateway -n istio-ingress --create-namespace --wait
7. Verify Installation:
8. After installation, verify the Istio components:
   bash
kubectl get pods -n istio-system

Step 4: Deploy an Application with Istio

1. Enable Sidecar Injection:
2. Label the namespace where your applications reside to enable automatic sidecar injection:
   bash
kubectl label namespace default istio-injection=enabled
3. Deploy the Sample Application (BookInfo):
4. Deploy Istio’s sample application (BookInfo) to demonstrate the service mesh capabilities:
   bash
kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
5. Verify the pods are running:
   bash
kubectl get pods

Step 5: Expose the Application using Istio Gateway

1. Create Gateway and VirtualService:
2. A Gateway is an entry point for traffic, while a VirtualService defines routing rules.
   “`yaml
   apiVersion: networking.istio.io/v1alpha3
   kind: Gateway
   metadata:
   name: bookinfo-gateway
   spec:
   selector:
   istio: ingressgateway
   servers:
   • port:
     number: 80
     name: http
     protocol: HTTP
     hosts:
     • “*”

   ---

   apiVersion: networking.istio.io/v1alpha3
   kind: VirtualService
   metadata:
   name: bookinfo
   spec:
   hosts:
   – “*”
   gateways:
   – bookinfo-gateway
   http:
   – match:
   – uri:
   exact: /productpage
   route:
   – destination:
   host: productpage
   port:
   number: 9080
   “`

3. Apply the Gateway Configuration:
   bash
kubectl apply -f bookinfo-gateway.yaml
4. Access the Application:
5. Get the external IP of the Istio Ingress Gateway:
   bash
kubectl get svc -n istio-ingress
6. Access the application in your browser using http://<EXTERNAL-IP>/productpage.

Step 6: Traffic Management in Istio

1. Traffic Splitting:
2. Route a percentage of traffic to different versions of a service using VirtualService.
   “`yaml
   apiVersion: networking.istio.io/v1alpha3
   kind: VirtualService
   metadata:
   name: reviews
   spec:
   hosts:
   • reviews
     http:
   • route:
     • destination:
       host: reviews
       subset: v1
       weight: 50
     • destination:
       host: reviews
       subset: v2
       weight: 50
       “`
3. Retries and Timeouts:
4. Configure retry logic for failed requests:
   “`yaml
   apiVersion: networking.istio.io/v1alpha3
   kind: VirtualService
   metadata:
   name: reviews
   spec:
   hosts:
   • reviews
     http:
   • route:
     • destination:
       host: reviews
       retries:
       attempts: 3
       perTryTimeout: 2s
       “`

Step 7: Observability in Istio

1. Install Kiali for Visualization:
2. Install Kiali for visualizing traffic flows and dependencies:
   bash
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.13/samples/addons/kiali.yaml
3. Enable Prometheus and Grafana:
4. Istio collects metrics automatically, and you can visualize them using Prometheus and Grafana.
   bash
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.13/samples/addons/grafana.yaml

Step 8: Securing Services in Istio

1. Enable Mutual TLS (mTLS):
2. Apply a policy to enforce mTLS between services:
   yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
name: default
namespace: default
spec:
mtls:
mode: STRICT
3. Authorization Policies:
4. Define fine-grained access control between services.
   “`yaml
   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
   name: reviews-viewer
   namespace: default
   spec:
   action: ALLOW
   rules:
   • from:
     • source:
       principals: [“cluster.local/ns/default/sa/bookinfo”]
       to:
     • operation:
       methods: [“GET”]
       “`

Step 9: Cleaning Up

• To remove Istio from your cluster, run:
  bash
helm uninstall istio-base -n istio-system
helm uninstall istio-istiod -n istio-system