middle boxes) ● High performance networking ○ Much higher multi-Gbps peak data speeds ○ Ultra low latency ○ And of course, reduce overheads introduced! ● High availability ● CapEx, OpEx #IstioCon Security Overheads introduced ● No high performance data path support ○ Multi-Gbps bandwidth ○ Ultra low latency #IstioCon Performance Limitations: Solutions ● Software techniques ○ (eBPF-based) TCP/IP stack co-designs #IstioCon Latency Analysis ● ~3ms P90 latency added ○ Istio v1.6 ○ More for VM usage ● Hotspots ○ 1  2 ○ 3  4: 30%~50% ● Others ○ Latency between Pods ○ Latency introduced by C/S #IstioCon

● Putting sidecars everywhere has a cost ○ Latency ○ Compute resources The Istio 1.9 community reference values for sidecar performance are: ● Latency: +2.65 ms at p90 (no telemetry) ● Compute resources: capacity Adopting Istio ● Each workload may be different, even in a same product. Some examples: ○ Latency-sensitive workloads ○ Long-lived batches (ML) ○ Web platforms ● How do you define a common answer

Gateway Book Info Payments Product Info ✓ Security ✓ Visibility ✓ Traffic Shaping ✘ Latency ✘ Single Point of Failure Service Mesh API Gateway Book Info Payments Product Info Proxy + k8s Istio mTLS mTLS mTLS ✓ Security ✓ Visibility ✓ Traffic Shaping ✓ Latency ✓ Single Point of Failure Adoption Challenges ● Multi-region deployments ● Non-flat networks

same node Configurations ◦ mTLS enabled ◦ Number of Envoy workers: 2 ◦ Response payload size: 1KB Latency ◦ 11-17% improvement Istio Meetup China Summary ● eBPF functionality enabled with a DaemonSet to envoy) ● Works with Istio >= 1.10 ● CNI agnostic and should work with all CNIs (wo/ eBPF) ● Latency：11~17% improvement Istio Meetup China Thank you! luyao.Zhong@intel.com

Zonal routing, zonal deployment and HPA ● Endpoint accessed by service via config #IstioCon Latency improvement #IstioCon Tooling and Automation ● Automate the Istio setup during Kubernetes cluster

logs Log Files Parse Istio-proxy Log • Each API Access Count • Each API Fail Rate • Each API Latency Easy to debug Easy to report Easy to alert Elastalert #IstioCon Excellent Observability - Access

Matter? 5G wireless technology is meant to deliver higher multi-Gbps peak data speeds, ultra low latency, more reliability, massive network capacity, increased availability, and a more uniform user

error ○ ... ● Observability with application layer metrics ○ HTTP status code ○ Thrift request latency ○ ... ● Application layer security ○ HTTP JWT Auth ○ Redis Auth ○ ... IP Data IP Header