Home

Course Plan

We're going to have a series of scenarios, angled to where a specific feature of Istio can help. Here's the list, I'll mark off progress as I go along...

Tags Inventory

Warm up

Demo: obscure problem with a microservice is causing a system slowdown. What's going on?

I want this to be a quick start with Istio, a quick win to sell its features. I need to be careful to keep my powder dry though - using grafana, jaeger AND kiali at once would be overkill I think. Maybe a short look at them???

Aim: 20 minutes all in, brief overview of Istio, followed by the install of the demo system and then onto the scenario.

To add: I think it would be better to semi-resolve this situation, so I suggest that we rewire around the blockage. We can provide the yaml for this maybe....either a timeout or just a straight fault (you can throw 200 as a fault).

Telemetry

This was scheduled to be later in the course, but it was brought forward so we can use these tools in later demos. Tag :6 used here.

Metrics

Logs

Distributed Tracing

Visualizing the Mesh

No special code was needed here, we decided not to use a faulty system as that put too much strain on minikube.

Traffic Management

Destination Rule

• Scenario 1: Canary on the web front end. Q: Do we need the Istio Gateway for this? I believe we've answered this already but I want a double check (could make for a much cleaner "startup" scenario)
• Canary on a backend microservice
• Header for a specific user (front end only)

Envoy Filter

• might do this as part of envoy session. Use AOP as way in, so could do some trivial tracing as demo

Fault Injection

• break a lower level microservice and check that the front end isn't affect (need a "static" html for this - staff management?)

Circuit Breaking and Timeouts

• show a heavily loaded component (eg tracker) failing (possibly with injected fault) and show (somehow) that this can cascade upwards, causing failures elsewhere. Introduce a circuit breaker

Traffic Mirroring

• Not sure how we could pull this off? Staging/Production minikube?

Egress:

• show a call to a remote system somewhere. (need an idea on what?) Want to switch off external calls generally.

External Services

• let's add in a very brittle external service over which we have no control. We can make a service entry for it, inject some faults and check that we're tolerant to failure. THEN, we can finally add a retry in Istio to paper over the crack!

Policies:

Rate Limiting

• Have the simulator run too fast for the tracker (maybe frig a delay into here). Show we can slow traffic down - what happens?

Control Headers and Routing:

• Mmmm - interesting! Investigate, urgently, could be a solution for header propagation.

Black/Whitelisting

• how this is different to authorization in security.

Security:

Authorisation

• show we can have ONLY allowed microservices calling others. (think of example)

Mutual TLS

• show how to enable SSL within the cluster. How to demo this? Might need tracing, so this section might come last!