#IstioCon Moving large scale consumer e-commerce Infrastructure to Mesh Rajath Ramesh Principal Software Engineer @Carousell Harshad Rotithor Software Architect @Carousell #IstioCon About Carousell

#IstioCon Performance tuning and best practices in a Knative based, large-scale serverless platform with Istio 张龚, Gong Zhang, IBM China Development Lab 庄宇, Yu Zhuang, IBM China Development Lab #IstioCon The envoy mem release fix included in Istio 1.6.0+ resolved this issue. o Istiod MEM bumped with large numbers of Knative Services (#25532) Mem usage optimization of pilot resolved this issue. • Tune

size of requests made on an h2c connection, which could lead to a denial of service scenario if a large request was sent. This is a vulnerability, however, to be vulnerable, users would need the MultiplexHTTP com/istio/istio Language Golang Istio API definitions Repository https://github.com/istio/api Language Golang Istio documentation Repository https://github.com/istio/istio.io Language n/a; documentation mesh which is an infrastructure layer applicable to so�ware applications. Istio is platform and language agnostic, but is o�en used on top of Kubernetes. It offers users easy access to features such as

whether their design adheres with industry best practices. Description Istio’s documentation is rather large but also has some gaps related to recent changes. Some blog posts describe security features that about running programs. It could be used to target other services or potentially in a DoS attack if a large request is made repeatedly. Description Pilot, runs in the “istiod” Deployment within the Istio control immediate threat of system compromise, or an easily accessible threat of large-scale breach. Medium A difficult to exploit threat of large-scale breach, or easy compromise of a small portion of the application

Fast Any Language Outside the Web Web Assembly 7 | Copyright © 2020 Extend Envoy Proxy with Web Assembly (Wasm) Polyglot: Envoy Filters are written in C++ and Wasm expands to any language Secure 2020 Web Assembly lifecycle 12 | Copyright © 2020 Build > meshctl wasm init addheader-filter --language rust > meshctl wasm build rust -t webassemblyhub.io/yuval/addheader-rust:v1 ./addheader-filter

errors are retryable? ● Who knows the answer to all the questions? ● How to implement this to be language agnostic? #IstioCon Virtual Services API ● Solves our problems, but… ● All Service Owners must Service configs become a release artifact. ● Easy abstraction for defining timeouts and retries in a language agnostic way. ● Application developers using Istio/Envoy for retries and timeouts without knowing

Any other mesh data/control panel • Format the telemetry toObservability Analysis Language • A compile language • Scopes • All • Service • ServiceInstance • Endpoint • ServiceRelation

Decentralized maintenance ● Rich Network functionalities across the ecosystem ● Kubernetes Native ● Large and active community Challenges Challenges ● Doing Service Mesh is complicated ● Writing EnvoyFilters

docker pull + No local resource utilization + Closely resembles production environments + Can test large scales - Slow, especially without fast upload speeds - Expensive #IstioCon Local Machine Local

original source address within Istio Performance tuning and best practices in a Knative based, large-scale serverless platform with Istio Company presenting Intel and Tetrate Tetrate, HP and others