Istanbul: The city where the East and the West meet

Istanbul is one of those crazy dynamic cities with friendly people, amazing history, great shopping and above all, a food heaven. Naturally, I was excited to be back for Java Day Istanbul conference.

I came a day early to meet with a partner and visit a customer. They had lots of questions on Kubernetes and hybrid-cloud. It was quite useful for me to hear about their challenges about moving to the cloud and propose some solutions.

The biggest benefit of conferences for me is meeting or reconnecting with people. This time, I got to meet my friends Edson and Rustam. We went to the famous steak house called Nusret where the owner is a social media sensation.

Java Day

Java Day is a community driven conference that happens all over Europe. I spoke in Java Day Istanbul for the first time last year about Kubernetes. This year, it was at a different venue and seemed a little bigger than last year with about 800 developers (my guess). I got to speak about Istio in the main room to a group of about 100 developers.

They also have my video talk if you want to watch.

After my talk, I had to leave immediately to catch my flight, as I went to visit my parents for a long weekend.

Questions

The questions I received about Istio were mostly about the performance overhead of Envoy and also the production readiness of Istio. I’m sure I received some other questions that I cannot think of anymore but overall, no unique question stood out.

 

 

 

Advertisements

Manchester after 20 years

After my time in Beijing, I flew back to the UK but instead of London, I went to Manchester for IPExpo conference. The first time I visited Manchester was 20 years ago. I was a 15 year old high school kid and I visited my great aunt and uncle one summer with my sister. I remember I had such a good time back then.

Unfortunately, I never had a chance to visit Manchester again and it was quite nostalgic for me to be back. I was hoping that I would remember Manchester a little bit but to my surprise, it was like a brand new city to me.

Apparently, Google has a small office in Manchester. I did a quick visit (my 36th Google office visit!) and after my talk, I got to visit Manchester United’s iconic stadium, Old Trafford. I was too late for a tour but it was still nice to see it from outside. I also had dinner with my great aunt and uncle again after 20 years 🙂

mvimg_20180426_163012_1-018282994584321676083.jpeg

IPExpo

IPExpo is a 2 day conference that happens in locations like London, Manchester and Nordics. I spoke at IPExpo in London for the first time last year. It’s a conference that happens in a giant expo hall where they have a number of companies with their booths. The talks happens in the four corners of the expo hall.

IPExpo in London last year was a unique and challenging experience for me because I wasn’t used to speaking in a large open expo hall with a ton of background noise. This time, I was much more comfortable with the setup and enjoyed doing my talk.

I did my Intro to Kubernetes talk to about 100 people. After the talk, I got a number of basic Kubernetes questions, so it was an engaged audience but I don’t remember the questions anymore unfortunately.

First time in China

Visiting a new country is always extra special for me and a couple of weeks ago, I got to do just that and visited Beijing, China for the first time.

After TDC in Floripa, I flew to Beijing for QCon conference and for a Google Developer Group (GDG) meetup. It was the first time for me in China (my 48th country!) and first time speaking at QCon, so I was naturally excited. I didn’t know what to expect in Beijing but I was pleasantly surprised. Beijing is a modern city with good public transportation and interesting sites to visit. I got the feeling that it’s also very international with many expats, definitely more than I expected. I visited the iconic sites like Tiananmen Square and the Great Wall of China. I also visited Google’s Beijing office (my 35th Google office visit!)

QCon Beijing

QCon is a global conference that happens in multiple locations like New York, London, San Francisco, Sao Paulo, Beijing, Shanghai. QCon Beijing was a multi-day multi-track conference with more than 1000+ attendees on a diverse set of topics. I could only attend the last day of the conference on Sunday.

I did my Istio 101 talk to a full room of probably 200 people. I was surprised by the number of attendees and the level of questions I received after my talk. It seems like many people in Beijing are active users of the cloud related technologies like Kubernetes and they were very curious about Istio.

Questions

After my talk, I received the usual Istio questions such as:

  • When will Istio be production ready?
  • What’s Istio roadmap, what features are planned in the upcoming releases?
  • What’s the performance overhead of Envoy proxy?
  • What are the performance characteristics of Istio?

I also received a couple unique questions such as:

  • How do you talk from Istio to an external database?
  • What’s the state of CloudFoundry with Istio?
  • How to upgrade Istio? What’s the recommended procedure?

GDG Beijing

A couple of days after QCon Beijing, I did the same Istio talk at Google Developer Group in Beijing. It was at a co-working space and organizers did a great job in putting the event together with banners, videos before the event and a great Q&A session after my talk.

Questions

After the talk, we had an extensive Q&A session. There were the usual Istio questions on roadmap, production readiness and envoy overhead. More interesting questions I remember were:

  • How long lived connections are handled in Istio?
  • How to delete route rules without yaml?
  • How does Istio see user agent headers when encrypted?
  • Will Istio replace or integrate with Spring Cloud?
  • How is Istio different from Rancher?

Overall, I was very happy to get the chance to visit this great city and country and hope to come again in the near future.

Trip Report: TDC in Florianópolis

Back in my favorite country: Brazil

Last week, I was in my favorite country, Brazil, for The Developer Conference (TDC) in Florianópolis (aka Floripa). I went to Brazil for the first time last July. Since then, I’ve been there 3 more times and I gradually fell in love with it. People are friendly, their BBQ is amazing, scenery is beautiful. I always have a good time in Brazil and this time wasn’t an exception.

In all previous times, I was mainly in Sao Paulo for a conference followed by a short trip to Rio (my favorite city!) for myself. This time, I went to Florianópolis which is a city to the south of Sao Paulo. It has a similar feeling as Rio (i.e. beach town) but smaller and felt safer than Rio. It had amazing views of mountains and sea, great food and friendly people, as always the case with Brazil.

TDC

TDC is probably the biggest tech conference in Brazil, along with QCon. It’s a community driven conference that happens in multiple locations (Sao Paulo, Porto Alegre, Floripa) throughout the year. It is usually multi-day, multi-track conference on a number of diverse topics (cloud, microservices, big data, .NET, Java) and a big technical audience of usually 1000+ people. I was told that TDC Floripa was close to 4000 people which is amazing. Most of the talks are in Portuguese with a few exceptions in English, like my talk.

At TDC, I got to meet my friend, Rafael Benevides from RedHat and made some new friends such as Elder Moraes and Rodrigo Cândido Silva who were the track leads for microservices track that I was speaking at. Although the conference was 4 days, I could only attend the first day. I had to fly out the next day for another conference.

My talk on Istio

I first spoke at TDC last July in Sao Paulo about running .NET Containers with Kubernetes on Google Cloud. This year, I was happy to be selected again for Floripa for my Istio talk. It was a big room full of people, in the end probably about 120+ people.

It was the same talk I did in Codemotion Rome a couple weeks ago on introduction to containers, Kubernetes and Istio with demos sprinkled along the talk.

Questions

After the talk, the audience was engaged and asked a number of questions. These are some of them that I remember.

Production readiness and roadmap. People asked when Istio will be considered production ready and what’s the roadmap of features coming up.

What’s the overhead of Envoy? People want to know what’s the performance overhead of Envoy and Istio in general. While the overhead of Envoy is supposed to be minimal, I don’t have exact figures. I intend to look into this further to give people more guidance.

Existing ingress rules. Someone mentioned that they have an existing Kubernetes cluster with a number of existing ingress rules and they were curious how Istio ingress work or doesn’t work with existing ingress rules.

DOS attacks with ingress. Someone asked if Istio ingress handles Denial of Service attacks. I don’t think ingress itself has DOS protection but a loadbalancer infront of DOS would handle that in Google Cloud.

Rancher and Istio. How’s Istio different than Rancher? Rancher is about deploying Kubernetes to multiple clouds and making that process easy. Istio is built on top of Kubernetes and provides microservice level features. So it’s much more than just Kubernetes and Rancher.

WebSockets with Envoy. Someone mentioned that they had issues using WebSockets with Envoy. I told him that latest versions of Istio have WebSocket support, you just need to enable it but I couldn’t really comment on the issue without seeing the details.

After talk interview

After my talk, an Oracle LATAM DevRel person, briefly interviewed me about my talk and here’s the video:

Istio 101 with Minikube

 

As part of my Istio 101 talk, I like to show demos locally (because conference Wifi can be unreliable) and Minikube is perfect for this. Minikube gives you a local Kubernetes cluster on top of which you can install Istio.

In this post, I want to show how to do Istio 101 on Minikube. More specifically, I will show how to install Istio, deploy a sample application, install add-ons like Prometheus, Grafana, Zipkin, ServiceGraph and change traffic routes dynamically.

Minikube and kubectl

First, you need to install Minikube. There are instructions are on Minikube page. Once installed, you can start it with minikube start command and make sure it is running with minikube status:

> minikube status
minikube: Running
cluster: Running
kubectl: Correctly configured: pointing to minikube-vm at ...

Also make sure kubectl points to your minikube cluster with this:

> kubectl config use-context minikube
Switched to context "minikube"

Download & Setup Istio

Let’s download the latest Istio (0.7.1 as of today):

> curl -L https://git.io/getLatestIstio | sh -

Add Istio’s command line tool istioctl to your PATH. We’ll need it later:

> export PATH="$PATH:./istio-0.7.1/bin"

Install Istio

Now it’s time to install Istio. You can install Istio with or without mutual TLS enabled between services. In this case, let’s go with mutual TLS. Inside istio folder:

> kubectl apply -f install/kubernetes/istio-auth.yaml
...
service "istio-pilot" created
serviceaccount "istio-pilot-service-account" created
deployment.extensions "istio-pilot" created
service "istio-ingress" created
serviceaccount "istio-ingress-service-account" created
deployment.extensions "istio-ingress" created
serviceaccount "istio-ca-service-account" created
deployment.extensions "istio-ca" created
...

This installs Istio and its core components like ingress, mixer, pilot into a separate istio-system namespace. Let’s make sure Istio related pods and services are running:

> kubectl get svc -n istio-system
NAME          TYPE          CLUSTER-IP     EXTERNAL-IP 
istio-ingress LoadBalancer  10.99.175.236  <pending> 
istio-mixer   ClusterIP     10.101.16.135  <none>
istio-pilot   ClusterIP     10.97.241.47   <none> 

> kubectl get pods -n istio-system
NAME                           READY STATUS
istio-ca-86f55cc46f-p8npd      1/1   Running
istio-ingress-868d5f978b-nsjt6 1/1   Running
istio-mixer-65dc5549d6-cqg4j   3/3   Running
istio-pilot-657cb5ddf7-8dsr7   2/2   Running

Deploy BookInfo app

Now, we can deploy a sample app and get it managed by Istio. You have two choices here. First, you can install Istio initializer. This way, when a pod is created, a sidecar Envoy proxy will be created automatically but this requires a more complex setup with WebHooks and certificates. Your second option is to use istioctl command and inject the sidecar proxy yourself when you create the application pod. I’ll go for the second option as it’s easier to setup.

Istio comes with a number of sample apps under samples folder. Let’s go with the BookInfo app:

> kubectl create -f <(istioctl kube-inject -f samples/bookinfo/kube/bookinfo.yaml
service "details" created
deployment.extensions "details-v1" created
service "ratings" created
deployment.extensions "ratings-v1" created
service "reviews" created
deployment.extensions "reviews-v1" created
deployment.extensions "reviews-v2" created
deployment.extensions "reviews-v3" created
service "productpage" created
deployment.extensions "productpage-v1" created
ingress.extensions "gateway" created

As you can see, this creates bunch of microservices and some microservices have different versions as well.

Show BookInfo app

Now, let’s take a look at the app. External load balancers are not supported in Minikube. However, you can use the host IP of the ingress service, along with the NodePort, to access the ingress. To do that, we’ll set a GATEWAY_URL variable:

> export GATEWAY_URL=$(kubectl get po -l istio=ingress -n istio-system -o 'jsonpath={.items[0].status.hostIP}'):$(kubectl get svc istio-ingress -n istio-system -o 'jsonpath={.spec.ports[0].nodePort}')

And test with curl:

> curl -o /dev/null -s -w "%{http_code}\n" http://${GATEWAY_URL}/productpage
200

You can also open a browser and see the web frontend for product page:

BookInfo app managed by Istio

At this point, we got the app deployed and managed by a basic installation of Istio. Next, we’ll install some add-ons.

Prometheus for metrics

The first add-on we’ll install is Prometheus for metrics.

> kubectl apply -f install/kubernetes/addons/prometheus.yaml
configmap "prometheus" created
service "prometheus" created
deployment.extensions "prometheus" created
serviceaccount "prometheus" created
clusterrole.rbac.authorization.k8s.io "prometheus" configured
clusterrolebinding.rbac.authorization.k8s.io "prometheus" configured

In a separate command tab, start sending some traffic to our app, so we can have some metrics flowing in our system:

> for i in {1..10}; do curl -o /dev/null -s -w "%{http_code}\n" http://${GATEWAY_URL}/productpage; done
200
200
...

And setup port forwarding, so we can take a look at Prometheus:

> kubectl -n istio-system port-forward $(kubectl -n istio-system get pod -l app=prometheus -o jsonpath='{.items[0].metadata.name}') 9090:9090

You can navigate to http://localhost:9090 and query some metrics, such as istio_request_count:

Prometheus in Istio

Grafana for dashboard

To visualize metrics in a nice dashboard, we can install Grafana. First install Grafana add-on:

> kubectl apply -f install/kubernetes/addons/grafana.yaml

And then setup port forwarding:

> kubectl -n istio-system port-forward $(kubectl -n istio-system get pod -l app=grafana -o jsonpath='{.items[0].metadata.name}') 3000:3000

Navigate to http://localhost:3000 and go to Istio Dashboard to see the dashboard:

Istio Dashboard in Grafana

Zipkin for tracing

Another useful add-on is Zipkin for distributed HTTP tracing. Just like other add-ons, first install it:

> kubectl apply -f install/kubernetes/addons/zipkin.yaml
deployment.extensions "zipkin" created
service "zipkin" created

Then, setup port forwarding:

> kubectl port-forward -n istio-system $(kubectl get pod -n istio-system -l app=zipkin -o jsonpath='{.items[0].metadata.name}') 9411:9411

Navigate to http://localhost:9411 to and take a look at traces for productpage:

Zipkin in Istio

ServiceGraph for dependency visualization

Finally, the last add-on we’ll take a look is my-favorite ServiceGraph. It gives us a nice graph of all microservice dependencides in our service mesh. First, install it:

> kubectl apply -f install/kubernetes/addons/servicegraph.yaml
deployment.extensions "servicegraph" created
service "servicegraph" created

Then, setup port forwarding:

> kubectl -n istio-system port-forward $(kubectl -n istio-system get pod -l app=servicegraph -o jsonpath='{.items[0].metadata.name}') 8088:8088

There are a few different graphs you can take a look:

ServiceGraph in Istio

Traffic Management

One of the nice things about Istio is that you can change routing rules between microservices dynamically. By default, there are no routing rules and you can see that by:

> istioctl get routerules 
No resources found.

When you go to the product page of BookInfo application and do a browser refresh a few times, you will see that the reviews section on the right keeps changing (the stars change color). This is because there are 3 different reviews microservices and everytime, a different microservice is invoked .

It is very easy though to pin microservices to a certain version. For example, let’s pin all microservices to version1:

> istioctl create -f samples/bookinfo/kube/route-rule-all-v1.yaml
Created config route-rule/default/productpage-default at revision 185533
Created config route-rule/default/reviews-default at revision 185534
Created config route-rule/default/ratings-default at revision 185535
Created config route-rule/default/details-default at revision 185536

Now, if you back to the product page and do a browser refresh, nothing changes because reviews microservice is pinned to version 1 now.

You can do even more complicated routing rules. For example, you can pin certain users to certain versions of a microservice. In this case, let’s pin the user “Jason”:

> istioctl create -f samples/bookinfo/kube/route-rule-reviews-test-v2.yaml
Created config route-rule/default/reviews-test-v2 at revision 185630

With this rule, if you login to the product page with username “Jason”, you should see the v2 version of reviews microservice.

Cleanup

This wraps up all the basic functionality of Istio that I wanted to show in Minikube.

To cleanup, let’s first delete the route rules:

> istioctl delete -f samples/bookinfo/kube/route-rule-all-v1.yaml
Deleted config: route-rule/default/productpage-default
Deleted config: route-rule/default/reviews-default
Deleted config: route-rule/default/ratings-default
Deleted config: route-rule/default/details-default

> istio-0.7.1 istioctl delete -f samples/bookinfo/kube/route-rule-reviews-test-v2.yaml
Deleted config: route-rule/default/reviews-test-v2

To delete Istio:

> kubectl delete -f install/kubernetes/istio-auth.yaml

At this point, everything related about Istio is deleted but the sample app is running. It’s just not managed by Istio anymore. If you want to delete the sample app as well:

> kubectl delete -f samples/bookinfo/kube/bookinfo.yaml
service "details" deleted
deployment.extensions "details-v1" deleted
service "ratings" deleted
deployment.extensions "ratings-v1" deleted
service "reviews" deleted
deployment.extensions "reviews-v1" deleted
deployment.extensions "reviews-v2" deleted
deployment.extensions "reviews-v3" deleted
service "productpage" deleted
deployment.extensions "productpage-v1" deleted
ingress.extensions "gateway" deleted