Service Mesh and Istio: The Solution to Challenges in Microservices Architecture

Introduction

As microservices architecture grows in popularity, the need for a reliable and secure way to manage communication between microservices becomes increasingly important. This is where service mesh comes in. In this article, we'll take a look at what service mesh is, its core features, and how it can help solve some of the challenges of microservices architecture. We'll also take a closer look at Istio, one of the most popular service mesh implementations, and how to configure it.

Challenges of Microservices Architecture

As microservices architecture continues to grow in popularity, new challenges arise. One of the most significant challenges is managing communication between microservices. Microservices need to talk to each other, handle business logic, and communicate effectively to provide a cohesive application experience. Additionally, when a new microservice is added, other services should know so that they can communicate with each other. Security is required at the microservice level for sensitive data, and retry logic is needed to handle service failures. Finally, metrics for services are necessary for monitoring and tracing logic. All of this additional logic adds complexity to microservices, which detracts developers from the development of actual business logic.

What is Service Mesh?

The solution to these challenges is to have a sidecar that can handle all these networking logic and act as a proxy. This sidecar application can be a 3rd party application that can be easily integrated by Kubernetes cluster operators and should be easily configurable. Now developers can focus on handling actual business logic, and these sidecar configurations need not be provided in microservice deployment.yaml. Instead, there will be a separate control plane that can inject these proxies in microservice pods.

Core Features of Service Mesh

Service mesh is a pattern, and Istio is one of the most popular implementations. Istio uses Envoy proxy, an independent open-source project. The core features of service mesh include:

Control Plane: This manages the overall configuration of the service mesh, including policies, traffic routing, and monitoring. Istiod is the control plane component in Istio, which manages the proxies.
Data Plane: This is the infrastructure where the microservices run, and the proxies are injected into the microservice pods. Proxies handle traffic between microservices, enforce security policies, and provide telemetry data.
Dynamic Service Discovery: Istiod has an internal service registry and service discovery. As soon as a new service is deployed, it gets registered automatically and is available for communication.
Metrics and Tracing: Istiod can collect metrics and tracing data that can be consumed by monitoring or tracing services for analyzing and visually showing the data.

Service Mesh and Istio Architecture

Istio's architecture involves a data plane and a control plane. The data plane consists of a set of intelligent proxies deployed as sidecars. These proxies handle traffic between microservices, enforce security policies, and provide telemetry data. The control plane manages the overall configuration of the service mesh, including policies, traffic routing, and monitoring. Istiod is the control plane component in Istio, which manages the proxies. Earlier versions of Istio used to have multiple components in the control plane, including Pilot, Galley, Citadel, and Mixer. But in version 1.5, all these components are combined into Istiod to make it easier to configure and manage these components and operate Istio.

Configuring Istio

Istio configuration is separate from your application configuration. Istio is configured with Kubernetes YAML files, and it uses CRDs (CustomResourceDefinition) by extending the Kubernetes API. CRDs allow the configuration of external 3rd party technologies (Istio, Prometheus) as custom Kubernetes objects. The two main CRDs to configure service-to-service communication are:

Virtual Service: This is how you route your traffic to a destination. It allows you to configure rules for routing traffic based on different criteria such as the URL path or headers. For example, you can create a virtual service that routes traffic to different versions of a microservice based on the URL path.

Below given YAML defines a virtual service that routes all traffic for example.com to the example-service:v1 subset.
```
 apiVersion: networking.istio.io/v1alpha3
 kind: VirtualService
 metadata:
   name: example-virtualservice
 spec:
   hosts:
   - example.com
   http:
   - route:
     - destination:
         host: example-service
         subset: v1
```
Destination Rule: This CRD configures what happens to the traffic for that destination. It allows you to specify policies such as load balancing algorithms, connection pool settings, and circuit breaking. You can also use destination rules to configure traffic splitting for canary deployments.

Below given YAML defines a destination rule that specifies subsets for the example-service host. It includes subsets for v1 and v2, with labels specifying the version for each. It also includes a traffic policy that configures a simple load balancer and a connection pool for the v2 subset.
```
 apiVersion: networking.istio.io/v1alpha3
 kind: DestinationRule
 metadata:
   name: example-destinationrule
 spec:
   host: example-service
   subsets:
   - name: v1
     labels:
       version: v1
   - name: v2
     labels:
       version: v2
     trafficPolicy:
       loadBalancer:
         simple: RANDOM
       connectionPool:
         tcp:
           maxConnections: 100
```

Istiod converts these high-level routing rules to Envoy-specific configurations and sends these configurations to Envoy proxies. So, we are configuring the control plane, and the control plane is configuring the proxies. Proxies can directly communicate with each other without connecting to Istiod.

Dynamic service discovery

Istiod has an internal service registry and service discovery mechanism. As soon as a new service is deployed, it gets registered automatically and is available for communication. With the dynamic service discovery mechanism in place, there is no need to manually configure the services.

mTLS(Mutual TLS):

Istio can help secure microservice configuration by using certificates. Mutual TLS (mTLS) authentication can be used to enforce secure communication between services. Istio can manage the certificates, rotation, and distribution of them automatically, making it easier to secure the communication.

Metrics and tracing:

Istiod can collect metrics and tracing data that can be consumed by monitoring or tracing service for analyzing and visually showing the data. Istio uses Jaeger for distributed tracing, which provides complete visibility into microservices communication.

Istio Ingress Gateway:

Istio Ingress Gateway is the entry point to the Kubernetes cluster. The Istio gateway runs your pod in the cluster while accepting incoming traffic in your cluster and directs the traffic to microservices using the virtual service component. The Istio Gateway can be configured using the gateway CRD.

Canary Deployment:

In canary deployment, we do traffic splitting. Let’s say a new version of service is deployed v3 in production, and then you realize it has some bugs. In this scenario, you don't want to use v3 entirely. The service mesh can be configured to pass 90% of requests to v2 and 10% to v3. This is also called canary deployment, where you can test your new release in the production environment while minimizing the risk.

Conclusion

In conclusion, Istio is a powerful tool for managing service-to-service communication in a microservices architecture. By using a sidecar proxy, Istio handles all the networking logic and allows developers to focus on handling actual business logic. Istio can be configured using Kubernetes YAML files and CRDs, which make it easy to integrate with other 3rd party technologies. Istio provides features such as dynamic service discovery, mTLS, and canary deployment, which are essential for a scalable and secure microservices architecture.

Ajay Singh's Blog