#IstioCon eBay Applications eBay is powered by ● More than 5,000 Microservices ranging from ○ API services, Search Engine, etc. ○ Databases, Key-Value stores - Oracle, MySQL, etc. ○ Big data systems & an AZ ○ Each K8s cluster ~ 200 - 5,000 nodes ○ Upto 100,000 Pods in a cluster ○ 10,000+ K8s services - including prod, pre-prod, staging, etc. ● Applications deployment for HA ○ In all regions Hosts global services - Global IPAM, Access-control Policy store, etc. ● AZ Control Plane ○ Syncs specs to workload K8s clusters in the AZ ○ Shared-Nothing Architecture ■ Hosts services catering to

Mercari What Is Mercari? ● Service start: July 2013 ● OS: Android, iOS *Can also be accessed by web browsers ● Usage fee: Free *Commission fee for sold items: 10% of the sales price ● Regions/languages First release in production Feb 2021 ~25% production services ~50% development services migrated to Istio End of 2021 100% services migrated to Istio 8 Features currently used: ● HTTP/2 Stabilizing Istio The reality: ● The control plane is burning down when pushing your thousand services updates to the hundreds of proxies running ● Proxies are OOM Killed every X minutes since they

discovery. • Istio Ingress/Egress: Networking controls allowing inbound and outbound access of Istio services. • Istio Envoy Usage: The configuration and implemen- tation of Envoy within Istio (NOTE: Envoy assessment). • Istio Control Plane: Istio operator, side car injector, and other Istio control plane services • Istio Documentation: The documentation and secu- rity guides hosted on istio.io. NCC Group started either by the controlPlaneSecuri ty configuration directive or other means. This left all default services exposed within the cluster. • The default istio profile that is labeled for produc- tion lacks

Service Proxy Ingress 1. Define ingress security policies to control accesses to services. Deploy web application firewall to defend against DDoS, injection, remote execution attacks. Edge

Jianfei Hu, Google Cloud Next ‘19 #IstioCon Why Add VMs to the Mesh? ● = Why Service Mesh? ○ More services = more complexity ○ Need consistent policy enforcement ○ Need consistent metrics aggregation ● Traffic management ○ Load balancing for VMs, failover, A/B testing, modern rollouts for VM services ● Security ○ Enforce the same policies in the same way, across compute environments ● Observability #IstioCon Legacy Scenarios ● Stateful applications ○ Data store ● Legacy software ○ Financial services ○ Enterprise/Workshop applications ○ Hard to lift and shift ● Packaged software ○ Non-Linux

#rollbacks, MTTR, #bugs-in-production, Reduced eng effort for testing, velocity) – Early testing of services components auto-generated from end-to-end tests – Significantly reduced time and cost for API testing Testing E2E API Tests Engineering effort grows superlinearly as #APIs grow Customer services Order services Catalog Customer history … Order details Payments Audit Search Suggest … Order service in isolation. All producer services are mocked. 4 Terminology Component testing Test a set of services as a single sub-system while isolating them from other services, for example payment processing

in mesh traffic ● Summary #IstioCon Istio Architecture Connect, secure, control, and observe services. #IstioCon Security Architecture #IstioCon Bookinfo architecture without service mesh ● Reviews-v1 calls ratings, black stars ● Reviews-v3 ○ calls ratings, red stars Initializing services 1) Deploy bookinfo services with istio sidecar without reviews-v2 2) Deploy bookinfo gateway 3) Deploy reviews-v2 kubectl label namespace default istio-injection=disabled/enabled ） Initializing services 1) Deploy bookinfo services with istio sidecar without reviews-v2 2) Deploy bookinfo gateway 3) Deploy reviews-v2

Best client experience Technological leadership In financial services 98+ mn retail clients 2.7 mn corporates The leader in digital services and sales New IT Platform Reliability 99.99% 0 loses, 0 standalone, RAS As of December 1, 2020 In non-financial services by 2023 10+ mn SberPrime subscribers ~500+ bn RUB e-commerce GMV In financial services Market shares in Russia, % 32.2 42.3 23.5 44.9 1.0 Make It Simple Event Hub DBs SERVICE MESH Istio Ingress Istio Egress Other External Services Tracing Store Logging Store LB January 2019 PROD PoC March 2020 Innovation trigger Peak

included in Istio 1.6.0+ resolved this issue. o Istiod MEM bumped with large numbers of Knative Services (#25532) Mem usage optimization of pilot resolved this issue. • Tune CPU/MEM to ensure enough values o ingress_ready bumped to ~=800 seconds with 500+ Knative Services • Detect and analyze Istio scalability issue 550 Knative Services #IstioCon Istio scalability optimization during Knative Service (we tested with 100ms, 1s, 2s, 5s, 10s) o With 800 Knative Services in total, ingress_ready p98 < 30s 30s #IstioCon o With 1400 Knative Services in total, envoy overload issue still exists Istio scalability

for client traffic ● gRPC for inter-service traffic ● Around 100+ microservices ● Majority of services written in Go #IstioCon Architecture Overview - Discovery and Routing ● Service Discovery and of central proxy layer (HAProxy/Envoy) ● More control over load balancing ● Offload application services from networking and configuration ● Avoid other sources of failures (Consul etc) ● Possible benefits Passthrough mode during rollout ● Service entry to connect internal proxy ● Kubernetes Cluster-IP services deployed across clusters #IstioCon Rollout - Istio setup and Microservices ● Export metrics