Implementation of Service Mesh in DataWorks Microservice Clusters

Image for post
Image for post

About the author

The Original Aspiration

Image for post
Image for post

Pack Light

Capabilities of Microservice Clusters

Image for post
Image for post

DMSP Service Mesh Architecture

Image for post
Image for post

Why the Operator and CRD?

Image for post
Image for post

Eventual Consistency Guarantee

Abstract Design of Istio

spec:
service: myservice1
rules:
- version: "1.1"
weight: 70
- version: "1.2"
weight: 30
- version: "2.0"
weight: 100

Service Routing (Route)

Weight Grayscale

示例:
spec:
service: httpbin
rules:
- version: "1.0"
weight: 80
- version: "1.1"
weight: 20
- version: "2.0"
weight: 100
Image for post
Image for post

Rule Grayscale

spec:
service: myservice1
rules:
- version: "2.0"
matches:
- headers:
gray:
exact: "1"
- queryParams:
debug:
exact: "true"
Image for post
Image for post

Service Security

Ingress Traffic

Egress Traffic

kind: IstioControlPlane
spec:
gateways:
components:
egressGateway:
enabled: true
values:
global:
outboundTrafficPolicy:
mode: REGISTRY_ONLY
$ kubectl exec -it sleep-788f7c9bcb-m67rh -c sleep -- curl -I www.aliyun.com
HTTP/1.1 502 Bad Gateway
Image for post
Image for post
spec:
service: sleep
hosts:
- "www.aliyun.com"
Image for post
Image for post

Service Access Control

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: deny-all
spec:
{}
$ kubectl exec -it sleep-788f7c9bcb-m67rh -c sleep -- curl -i httpbin:8000/get
HTTP/1.1 403 Forbidden
content-length: 19
content-type: text/plain
date: Mon, 13 Jan 2020 16:09:16 GMT
server: envoy
x-envoy-upstream-service-time: 0
RBAC: access denied

Looking Ahead

Original Source:

Follow me to keep abreast with the latest technology news, industry insights, and developer trends.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store