automation of Virtual Service generation Vladimir Georgiev, Thought Machine #IstioCon Sync calls failures inside the mesh ● Everyone says to fail fast and retry quickly, but... ● How fast to timeout

the AZ, e.g., AZ IPAM, Network Load-balancers, etc. ■ Full isolation by confining service failures to AZ boundary AZ 1 AZ 2 AZ n Data Center DC1 K8s Cluster K8s Cluster K8s Cluster K8s Control Plane AZ Control Plane Global Control Plane Region Rn Controllers Sync to AZ Controllers Sync to clusters in AZ K8s Cluster K8s Cluster #IstioCon Step 2: Replace Hardware

few hundred developers ● Multiple Kubernetes Clusters ● 250+ microservices ● 150M+ internal API calls ● 3000+ deployments every week ● REST as well as gRPC services ● Services written in Golang, Java certificate management manage our certificate lifecycle for HTTPS and mutual TLS communication. ● Renew & sync to our Kubernetes cluster, also support syncing to VM with an agent installed, this is also used

balancing ● Offload application services from networking and configuration ● Avoid other sources of failures (Consul etc) ● Possible benefits on Observability #IstioCon Requirements and Improvements ●

Lessons Learned 1. Init containers maybe not the best option • NET_RAW and NET_ADMIN • Traffic failures due to init restarts (#16768) 2. Be careful with secrets rotation 1. Hot restarts for TCP-traffic

runs in isolated VM, can dynamically update w/o Envoy restarts, no hard dependencies or cascading failures Speed: Near native performance Sustainable: Eliminates need to recompile and maintain a build

Significantly reduced time and cost for API testing for microservices architectures with Istio – Fewer failures higher up the test pyramid as a result of improved API tests • Istio benefits – Venky / Prasad

runtime. This web interface also allows unauthenticated users to force force all Istio objects to sync their current configuration. This in itself is not malicious but could cause a denial-of-service if istio-operator roleRef: kind: ClusterRole name: istio-operator apiGroup: rbac.authorization.k8s.io --- # SYNC WITH manifests/charts/base/files apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition

-> Cash App EKS Internal Presentation “New” Cash App EKS -> Square DC Internal Presentation ir-sync Internal Presentation Do you like ? We’re Hiring! cash.app/careers tetrate.io/careers Internal

service mesh ● Reviews-v1 ○ doesn’t call the ratings service. ● Reviews-v2 ○ calls ratings, black stars ● Reviews-v3 ○ calls ratings, red stars Initializing services 1) Deploy bookinfo services with