#IstioCon Is Your Virtual Machine Really Ready-to-go with Istio? Kailun Qin, Intel Haoyuan Ge #IstioCon Quick Summary (from Google Cloud Next ’19 [1]) VM works on Istio! [1] Istio Service Mesh Hybrid and Multi Clouds #IstioCon Istio VM Integration is? A Tumultuous Odyssey… [1] Istio 1.8: A Virtual Machine Integration Odyssey, Jimmy Song #IstioCon V0.2 Mesh Expansion ● Prerequisites ○ IP connectivity the workloads themselves #IstioCon V1.6-1.8 Better VM Workload Abstraction Item Kubernetes Virtual Machine Basic schedule unit Pod WorkloadEntry Component Deployment WorkloadGroup Service registry

#IstioCon Building resilient systems inside the mesh: abstraction and automation of Virtual Service generation Vladimir Georgiev, Thought Machine #IstioCon Sync calls failures inside the mesh implement this to be language agnostic? #IstioCon Virtual Services API ● Solves our problems, but… ● All Service Owners must be aware of the Virtual Services API in order to define their SLOs. ● Potential errors when dealing with YAMLs. ● Potential drift between the state of the service API and the Virtual Service config. ● Hard to manage when having hundreds of services. #IstioCon Abstracting to proto

https://github.com/istio-ecosystem/consul-mcp 欢迎大家试用、共建！ 4 Istio 流量管理 – 控制面 – 流量管理模型 Gateway Virtual Service Destination Rule 外部请求 内部客户端 Service2 Service1 网格内部 定义网格入口 • 服务端口 • Host • TLS 配置 • 路由配置 • LB 策略 • 连接池配置 • 断路器配置 • TLS 配置 Gateway External Service 统一网格出口 • 出口地址（Gateway Workload） • 出口端口 Virtual Service CLB 对外请求 对外请求（Passthrough/ServiceEntry） 缺省路由 （服务名） 5 Istio 流量管理 – 数据面 – Envoy配置模型和xDS协议 - name: ”default" route: - destination: host: reviews.prod.svc.cluster.local subset: v1 Pilot { "virtual_hosts": [ { "name": "reviews.default.svc.cluster.local:9080", "services": [ "reviews.default.svc

backend 8123 Virtual outbound -15001 Envoy backend:8123 127.0.0.1:8123 zipkin Pod1 Pod2 业务容器 业务容器 Istio-proxy容器 Istio-proxy容器 Istio-init 容器 Istio-init 容器 Pod内共享网络 Pod内共享网络 Virtual inbound -15006 线程2 线程3 handler1 handler2 handler3 fd1 envoy Virtual listener1 backend listener1 Listener filter dst conn2 内核随机 挑选目标线程 解析发送 默认选链接 策略 Virtual listener3 backend listener3 dst conn1 解析发送 fd2

all event partner logos displayed according to the level they are engaging at. 3. Swag bags. The virtual swag bag will have the logos of all the companies offering swag. 4. Slack / event chat mentions: activities, and it will be named as the sponsor: #photobooth-by-SPONSORNAME $850usd one time payment Virtual photo booth [Unavailable] Available sponsorship: 1 ● Contributing partners can give away cloud will share their PII with the sponsor ● The sponsor will be responsible of sending the gifts Virtual swag bag Available sponsorships: ANY ● We hire a cartoonist to join during social hour, and they

productpage-credential 3) Define a gateway which specifying above secret and define corresponding virtual service which configuring traffic routes Secure ingress gateway via TLS terminating Using ingress productpage-credential 3) Define a gateway which specifying above secret and define corresponding virtual service which configuring traffic routes Secure ingress gateway via TLS terminating https http terminate TLS in gateway using istio cert ● PASSTHROUGH: pass through the TLS traffic using SNI and virtual Service ● AUTO_PASSTHROUGH: pass through the TLS traffic purely using SNI without VS apiVersion:

Discovery Service (SDS) ○ Auto mTLS ● API and feature promotion ○ Networking/Security APIs ○ Virtual Machine expansion/Multi cluster mesh https://istio.io/latest/blog/2020/tradewinds-2020/ #IstioCon #IstioCon Feature Graduation ● Enhancement workflow ○ CNI ○ IPv6 ○ Dual-stack (IPv6/IPv6) ○ Virtual Machine Expansion ○ Multi cluster mesh ○ Helm v3 life-cycle management ● Evaluate current feature

– my-data-svc POD POD S E R V I C E (ClusterIP) – demo-canary-svc ISTIO VIRTUAL SERVICE + Destination Rules ISTIO VIRTUAL SERVICE + Destination Rules Header: X-User-Type: Non-Admin Header: X-User-Type:

Mesh Dynamics Services | CONFIDENTIAL 14 Configure mocks with Istio virtual service Route requests to mock svc with a virtual service - match: - uri: prefix: /reviews rewrite:

namespace ○ Only allow configuration for a “service’s” hostname ● Validated ○ Deployments ○ Virtual Service ○ Service Entry ○ Destination Rule ● Blocked ○ Envoy Filters ○ Gateways Developer Platform