Kubernetes容器应用基于Istio的灰度发布实践 张超盟 @ Huawei Cloud BU 2018.08.25 Service Mesh Meetup #3 深圳站 Agenda • Istio & Kubernetes • Istio & Kubernetes上的灰度发布 An open platform to connect, manage, and secure microservices 通信基础 服务发现 负载均衡 熔断容错 动态路由 … for (封装++) { 应用侵入--； 治理位置--； } 微服务角度看Istio: 服务网格 服务网格控制面 从基础设施(Kubernetes)看Istio: 服务访问 Node svca svcc svcb.ns svcc.ns svcb svcd svce svce.ns svcd.ns svcd.ns Kube-proxy Backend Pod2 Labels:app=svcb Port:9379 svca 基础设施(Kubernetes)看Istio: 能力增强 服务部署运 维 服务治理 • 调用链追踪 • 动态路由 • 熔断限流 • 负载均衡 • 服务发现 • 扩缩容 • 运维 • 部署 Kubernetes Istio Istio治理的不只是微服务，只要有访问的服务，都可以被治理。 Istio关键能力

1 Kubernetes容器应用基于Istio的灰度发布实践 张超盟 @ Huawei Cloud BU 2018.08.25 Service Mesh Meetup #3 深圳站2 Agenda • Istio & Kubernetes • Istio & Kubernetes上的灰度发布3 An open platform to connect, manage, and secure 通信基础 服务发现 负载均衡 熔断容错 动态路由 … for (封装++) { 应用侵入--； 治理位置--； }6 微服务角度看Istio: 服务网格 服务网格控制面7 从基础设施(Kubernetes)看Istio: 服务访问 Node svca svcc svcb.n s svcc.ns svcb svcd svce svce.n s svcd.n s svcd.n Backend Pod2 Labels:app=svcb Port:9379 svca8 基础设施(Kubernetes)看Istio: 能力增强 服务部署运 维 服务治理 • 调用链追踪 • 动态路由 • 熔断限流 • 负载均衡 • 服务发现 • 扩缩容 • 运维 • 部署 Kubernetes Istio9 Istio治理的不只是微服务，只要有访问的服务，都可以被治理。10 Istio关键能力

Optimal Canary Deployments using Istio and how it scores over Spring Cloud and Kubernetes Presented by Archna Gupta What is a Canary Release or Deployment? • A canary deployment, or canary release Canary Releases Using Kubernetes Deployment POD POD POD POD S E R V I C E (Load balancer) www.my-application.com External Traffic 75% 25% Deployment Canary Releases Using Kubernetes Deployment POD Using Kubernetes Deployment POD S E R V I C E (Load balancer) www.my-application.com External Traffic POD POD 0% 100% Deployment Deployment Deployment Canary Releases Using Kubernetes – Across

控 2018.11.25 徐运元关于我 2008年毕业于浙江大学，曾在思科和浙大网新有超过 9年的工作经验和5年的云计算领域工作经验，带领团 队完成公司第一代基于Kubernetes的云平台开发和第 二代基于Kubernetes的DevOps云平台开发。目前致力 于公司基于Istio的微服务平台打造。 来自于浙江大学SEL实验室目录 CONTENTS 微服务平台的监控演进 Mixer组件的功能介绍 logfile APP logfile Kubernetes console APP logfile APP logfile APP logfile Kubernetes console DC2 DMZ Intranet APP logfile APP logfile APP logfile Kubernetes console APP logfile logfile APP logfile APP logfile Kubernetes console search &analysis Prometheus TSDB基于请求和日志的关联性改进架构 A Agent B Agent C Agent Request(Transaction ID) A(application) Trasanctionid（CA SDK support）

Istio OSS to Enterprise Service Mesh 宋净超（Jimmy Song） September 24, 2022 Shanghai, China Cloud Native Application Networking Secure, Observe and manage microservices Outline ● Background ● Enterprise lack of operational agility ● You can't be Cloud Native at scale without a modern application- aware network Cloud!=Cloud Native Bare metal VMs Kubernetes VMs ● Monolith was decoupled to Microservices Go developers ● Istio Security Scanner ● Envoy Gateway: Manages Envoy Proxy as a standalone or Kubernetes-based application gateway ● Tetrate Istio Distro: Simple, safe enterprise-grade Istio distro ●

Quick Summary (from Google Cloud Next ’19 [1]) VM works on Istio! [1] Istio Service Mesh for VM Native, Chris Crall, Jianfei Hu, Google Cloud Next ‘19 #IstioCon Why Add VMs to the Mesh? ● = Why Service mesh ○ Istio control plane services (Pilot, Mixer, CA) accessible from the VMs ○ (optional) Kubernetes DNS server accessible from the VMs ● Onboard steps ○ Setup Internal Load Balancers (ILBs) for representation for the workloads themselves #IstioCon V1.6-1.8 Better VM Workload Abstraction Item Kubernetes Virtual Machine Basic schedule unit Pod WorkloadEntry Component Deployment WorkloadGroup Service

Cloud, which based on these Opensource technologies. Before he was architect for Cloud Foundry on Kubernetes in IBM Cloud. #IstioCon ● Knative and Istio ● How Istio is leveraged in a Knative based platform that introduce event-driven and serverless capabilities for Kubernetes clusters for deploying, running, and managing serverless, cloud- native applications. It provides benefits: Focus on code Scale fully managed, serverless platform(including knative and istio) that can host all of your cloud native workloads: https://www.ibm.com/cloud/code-engine ● Kperf, a public Knative benchmark tool helps

io/latest/blog/2020/tradewinds-2020/ #IstioCon Other improvement areas ● Native Kubernetes API integration ○ Kubernetes Service APIs ○ Kubernetes Multi-cluster APIs ● Adopt & drive innovation in Envoy community

discipline ● Decentralized maintenance ● Rich Network functionalities across the ecosystem ● Kubernetes Native ● Large and active community Challenges Challenges ● Doing Service Mesh is complicated Debugging EnvoyFilters is even harder!! Where It Isn’t a Good Fit? Where It Isn’t a Good Fit? ● Non Kubernetes Ecosystem ● You don’t want Sidecar Proxies ● Project is too small ● Need best tool for both

SidecarIstio + Envoy Representative Service Mesh implementorObserve on mesh Metric from Service Mesh by native supportedPower of out of process adaptor Bypass adpator Adaptor In process Bypass adaptor SkyWalking Service Instance. Each one workload in the Service group is named as an instance. Like pods in Kubernetes, it doesn't need to be a single process in OS. Also if you are using instrument agents, an instance URI path or gRPC service class + method signature. Core ConceptsIstio telemetry formatSkyWalking native telemetry formatTelemetry to Analysis scope • After you received the telemetry, either from