Istio As An API Gateway Discussion Flow ● What is an API Gateway? ● What is a Service Mesh? ● Common Features ● API Gateway + Service Mesh together! ● Istio as the API Gateway ● Advantages ● ● Challenges ● Where It Isn’t a Good Fit? What is an API Gateway? What is a Service Mesh? Common Features Common Features ● Load Balancing ● Request Routing ● Service Discovery ● JWT Authentication Logging, Monitoring, Tracing API Gateway + Service Mesh together! Limitations of This Approach ● Maintaining Two Tools ● Maintaining Two Expert Pools Istio as the API Gateway Advantages Advantages

Creating API Tests Low Effort API Testing for Microservices | CONFIDENTIAL • What has changed? – Migration to microservices triggering need for extensive API tests • Problem: – Creating API tests • What is our solution? – Leverage Istio sidecar to listen to API traffic data and create tests from the data – 10x speed in creating API tests • Can also be sped up by just navigating the application Significantly reduced time and cost for API testing for microservices architectures with Istio – Fewer failures higher up the test pyramid as a result of improved API tests • Istio benefits – Venky / Prasad

…Istio目前的突出问题 • API稳定性问题：流量管理也仅仅是v1alpha3，用alpha特性发布 1.0的情况似乎比较罕见。 • 发布进度和质量：大版本以月计算的发布延迟，据我所知的 Release撤回发生了两次。 • 世纪难题：多出一层Sidecar造成的延迟。 • Pilot的性能，近几个版本一直在出问题。 • Mixer按照我个人的看法，API较为混乱，重构风险比较大Istio还用不用？ o还用不用？ • 你要的是不是API网关？ • Service Mesh为什么诞生的？ • Istio 为什么诞生的？ • 它能在我们的环境里运行么？ • 它能解决我们的问题么？ • 有条件的，慎重的用选定试用功能 • 性价比的灵魂拷问： • 会给业务带来什么风险？ • 需要什么程度的投入？ • 可能出现什么故障？ • 能有什么好处？ • 个人看法 • 可观察性 • 路由 • 策略 • 安全试用服务范围 影响范围分析。 • 选定测试版本：研读开放Issue以及Release Notes。测试方案部署 • Istio部署 • 复查集群环境 • 调整资源参数 • 调整亲和性参数 • 调整HPA • 日志输出和调试开关复查 • Istio功能裁剪 • 备用业务部署 • 试用服务部署 • 服务YAML复查 • 缺省路由设置 • 根据功能需求，编写和部署 Istio相关功能YAML • 监控和告警部署

• HTTP、Mysql、Dubbo协议处理、元数据交换，四层限流，开发调试支持等。 • onNewConnection新连接建立，可以决定是否拒绝 • onData处理连接数据到达 • onWrite处理连接数据发送 • L7 HTTP过滤器 • 修改HTTP请求头，限流处理，Lua扩展、WASM扩展、开发调试支持、压缩、元数据交换、 路由等。 • decodeHeaders处理HTTP请求头部 Accesslog：格式 https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage • 调试日志：pilot-agent request POST /logging?connection=trace #Cxxx • 抓包 • 进入pod容器网络空间执行 tcpdump -i any 'port

Istio control plane along with a set of TCP services that it exposes. One of which is the “/debug” API hosted on 15014/TCP by default. This service exposes a web interface that is accessible without authentication remote: multi-cluster remote control plane setup • default: default settings of the IstioOperator API • demo: enables a variety of extra features • empty: provides a template • minimal: minimal config names- pace. If, in the future, a privilege escalation vector is identified for any of the Kubernetes API Groups, escape from a specific namespace is possible. Description Istio documentation in the above

1 Istiod Cluster 2 API server API server Ingress Ingress Service A Service B Service B Mirror Simplified Istio Multicluster Model #IstioCon Istiod Cluster API server Gateway Service #IstioCon Istio Standardize APIs Adopt Kubernetes service API Protocol declaration in Kubernetes service descriptor Transform informal API to formal API External authz #IstioCon analyze describe bug-report

(Service) POD Workload (Service) POD Workload (Service) VM Workload (Service) VM Workload (Service) VM API Gateway Ingress & Egress Mesh can include VMs ● Multi tenancy ● Traffic shaping and canary controls reporting ● Service discovery across multiple clusters ● Fine-grained ingress & egress controls ● API GW is part of the mesh ● Workflows for collaborative agility More About Multi Cluster ● Multi tenancy zero dependency WebAssembly runtime written in Go. ● Contribute to Go/TinyGo/Rust ● Using WasmPlugin API to extend Istio ● GitHub: tetratelabs/wazero Istio Security Scanner ● Make Istio Security Best Practices

svcB svcA Rules API Pilot 80% Istio 灰度发布：基于请求内容 Version2 Envoy SVC Envoy SVC Pod1 Pod2 Pod3 Envoy SVC Pod1 Pod2 Version1(canary) group=dev svcB svcA Rules API Pilot apiVersion: 在Google：microservices become API Apigee API Management complements Istio with the robust features of Google Cloud's Apigee API management platform, Apigee Edge, by extending API management natively into

: Istio Mixer authz adapt Implement role-based authorization – whether this user can access this api based on its role => Version 2: Envoyfilter ext_authz #IstioCon Wise Platform #IstioCon Wise Excellent Observability - Access logs Log Files Parse Istio-proxy Log • Each API Access Count • Each API Fail Rate • Each API Latency Easy to debug Easy to report Easy to alert Elastalert #IstioCon Istio-proxy log showed in kibana after parse #IstioCon Excellent Observability - Access logs API Error In last 30 days #IstioCon Thank you! WeChat: johnzhengaz Github: johnzheng1975

#IstioCon eBay Applications eBay is powered by ● More than 5,000 Microservices ranging from ○ API services, Search Engine, etc. ○ Databases, Key-Value stores - Oracle, MySQL, etc. ○ Big data systems in AZ K8s Cluster K8s Cluster #IstioCon Step 2: Replace Hardware LBs with Software K8s API Server NLB Controllers Istiod Network Load Balancer (NLB) Network Load Balancer (NLB) Ingress within an AZ AZ AZ Cluster Ingress Gateways API Server Istiod East-West Gateway watch API Server Pods, Services Workload Cluster API Server Pods, Services Workload Cluster watch