ServiceMeshCon North America 2021

Building and managing data-intensive microservices applications have their challenges. Cellular architecture, Service Mesh & Gitops together help create an independently deployable, manageable, and observable solution. We moved from running multiple expensive non-prod inconsistent environments to testing in production. Istio along with a custom envoy filter let you run account-based canary in production.

Confidential computing (CC) is a new and emerging security paradigm. It enables the always encrypted and verifiable processing of data on potentially untrusted hosts, e.g., the cloud or maybe even your local cluster. Do you wanna add an extra layer of data protection to your Kubernetes workloads? In this talk, we introduce the open-source project Marblerun and discuss the challenges that arise when you deploy CC-enabled workloads on K8s. Marblerun is the control plane for confidential computing, designed to run on Kubernetes. It is an open-source solution that extends the confidentiality, integrity, and verifiability properties of a single enclave to a Kubernetes cluster. Marblerun does not replace your service mesh; it is built to run alongside your existing cloud-native tooling. In essence, Marblerun simplifies deploying, scaling, and verifying end-to-end encrypted apps on vanilla K8s. We will demo how to CC-fy a cloud-native app and run it with K8s+Linkerd+Marblerun.

Observability is a key tenet of any service mesh so each mesh implementation provides several features around observing the state of your mesh. One important aspect of observability is the exporting of metrics which enable operators or service owners to monitor both application and service mesh behavior. However, with service meshes that utilize a sidecar proxy, the exporting of metrics from both the application and the proxy itself is not as straightforward as it seems. In this session we will explore the challenge of consistently and transparently exporting metrics for all components comprising a service mesh workload. We will then dive into how Istio solves this problem with its “metrics merging” feature. This feature provides a simple way of exporting an aggregated set of metrics from all of the pieces in a sidecar-injected workload, including metrics from the Istio agent, sidecar Envoy proxy, and application workload itself. Attendees will leave with a clear picture of why metrics merging is important in general as well as how it works in the Istio service mesh.