existing infrastructure to run tests #IstioCon Why don’t you ? ● Mock ? ● Contract testing ? #IstioCon Mock ? Contract testing ? At a scale of 800+ providers ? Mocks are like any other software: function envoy_on_response(request_handle) #IstioCon Who and where to reroute ? #IstioCon The contract GET / HTTP/1.1 Host: example.com User-Agent: curl/7.64.1 X-devroute: { “foo”:”192.168.1.12:8001” handle) 2 contract = request_handle:headers():get("x-devroute") 3 if string.match(contract, "foo") == nil then 4 return 5 end #IstioCon 6 -- we have a contract match 7 address

svc.cluster.local SVC IP: 10.4.4.4 #IstioCon DNS Issues on ext-TCP SVCs without VIPs #IstioCon Smart DNS Proxying 1. DNS query httpbin.ns1.svc.cluster.local 2. Cached DNS response – 10.4.4.4 DNS ns1.svc.cluster.local SVC IP: 10.4.4.4 http req to 172.16.1.3 GET /status/200 #IstioCon V1.8 Smart DNS Proxy: A Step Further ● Taking control of DNS! ○ VMs to Kubernetes integration ○ Reduced load management: CNI needs improvements ○ Much required to avoid escalated Pod privileges ○ No support for smart DNS proxying (yet…) ● Further security middle boxes support ○ Deep packet inspection (DPI) ○ DDoS

HorizontalPodAutoscaler (HPA) ● VerticalPodAutoscaler (VPA) Unfortunately, Kubernetes is (was) not very smart at scaling out pods with multiple containers with HPA. ● Fixed in Kubernetes 1.20 by specifying Load testing application, load testing the sidecar -> seems the only way We just want a dynamic smart autoscaler for Istio sidecars! 60 Istio proxy performance and capacity Adopting Istio ● When load-testing

Istio的配置管理缺少兼容性设计，CRD无法做到平滑升级 • Istio的架构和基本原理 • FreeWheel的Istio实践 • 未来工作 • FreeWheel的痛点 未来工作 • Service Contract: 封装Istio以及平台层的其他配置的复杂度，抽象出 一个安全、高效的应用运维体系 • Chaos Testing：解决复杂的微服务系统的持续运营和风险控制问题

com/istio/istio12/23 MOSN MOSN 是一款使用 Go 语言开发的网络代理软件，作为云原生的网络数据平面，旨在为服务提供 多协议、模块化、智能化、安全的代理能力。MOSN 是 Modular Open Smart Network 的简称。 MOSN 可以与任何支持 xDS API 的 Service Mesh 集成，亦可以作为独立的四、七层负载均衡， API Gateway，云原生 Ingress 等使用。