Jason Webb Vrushali Joshi Istio Service Mesh at Enterprise Scale Feb, 2021 Who are we? Founded 5,000 Developers 50M Customers 1993 IPO $6.8B FY19 Revenue 20 Locations 1983 Why Service

#IstioCon Moving large scale consumer e-commerce Infrastructure to Mesh Rajath Ramesh Principal Software Engineer @Carousell Harshad Rotithor Software Architect @Carousell #IstioCon About Carousell

Istio at Scale: How eBay is building a massive Multitenant Service Mesh using Istio Sudheendra Murthy #IstioCon Agenda ● Introduction ● Applications Deployment ● Service Mesh Journey ● Scale Testing Management & Security Enforcement ■ Updating hardware devices is slow ○ Achieving micro-segmentation at scale ○ Enabling TLS for all applications in a consistent way ● Service Mesh ○ An architectural pattern Istio #IstioCon How does it all scale …? ● Extensive Data-plane & Control-plane scale testing ● Data-plane performance of Envoy is well documented ● Control-plane scale testing ○ Primary Goal ■ Understand

#IstioCon Performance tuning and best practices in a Knative based, large-scale serverless platform with Istio 张龚, Gong Zhang, IBM China Development Lab 庄宇, Yu Zhuang, IBM China Development Lab #IstioCon running, and managing serverless, cloud- native applications. It provides benefits: Focus on code Scale to zero Quick entry to serverless computing … … traffic management observability security

is utopian, know what you need only Stabilizing Istio In fact, Istio is impossible to use at any scale other than small PoCs without restricting the exposed resources to each proxy in the mesh. It is linter-level (inventory) Please check my last year presentation: “Preparing the guardrails for Istio at scale” (Slides, Video) for more details 41 Takeaways Stabilizing Istio ● Kubernetes doesn’t handle sidecar doesn’t scale Istio-enabled pods well ○ Use ContainerResource to fix HPA on the application container (From K8S 1.20) ○ Otherwise, add the Sidecar proxy CPU usage into calculation for HPA scale target

following sections describe the risk rating and category assigned to issues NCC Group identified. Risk Scale NCC Group uses a composite risk score that takes into account the severity of the risk, application’s threat of system compromise, or an easily accessible threat of large-scale breach. Medium A difficult to exploit threat of large-scale breach, or easy compromise of a small portion of the application.

generation 5G platform I want to sketch a mesh for you Istio service mesh at enterprise scale Improving security with Istio What Envoy hears when Istio speaks Company presenting Google source address within Istio Performance tuning and best practices in a Knative based, large-scale serverless platform with Istio Company presenting Intel and Tetrate Tetrate, HP and others

Background ● Leads to complexity and lack of operational agility ● You can't be Cloud Native at scale without a modern application- aware network Cloud!=Cloud Native Bare metal VMs Kubernetes VMs distribute traffic at the DMZ zone Solving the OSS Istio pain with TSB: ● Managing multi cluster at scale ● They can’t have k8s cluster in the DMZ zone ● Simpler and better VM onboarding expereince ● Better

services, for example payment processing system | CONFIDENTIAL 5 Current approaches do not scale with #APIs Service Tests E2E API Tests Component Tests E2E Component Service Unit - E2E, component Usage Staging/UAT Env API catalog | CONFIDENTIAL #Rollbacks MTTR #Bugs Release Velocity Scale API Functional & Integration Testing Improve productivity of each of your developers 10x API test

Why don’t you ? ● Mock ? ● Contract testing ? #IstioCon Mock ? Contract testing ? At a scale of 800+ providers ? Mocks are like any other software: ● Bugs ● Maintenance Why don’t you ?