Testing a Kubernetes Networking Implementation Without Kubernetes
How Istio tests its networking proxy without Kubernetes, Docker, or root.
Securing Prometheus with Istio Ambient
tl;dr: it just works
Building a better Kubernetes Client
Like most other Kubernetes controllers in, Istio is written in Go and relies on the client-go library. While this provides an excellent low-level building block, usage in higher level code in Istio led to a variety of issues that led us to develop our own higher level, opinionated client for Istio. This post covers the issues we faced and how we incrementally solved them. Background knowledge At a high level, client-go provides a few layers for interactions with the API server:...
Advanced Helm Techniques
Rage bait for YAML templating haters
Opinionated Istio Feature Recommendations
Which features I recommend using, or not using, in Istio
Analyzing Go Binary Sizes
In Analyzing Go Build Times, I went over how to analyze and understand Go build times, and what factors impact build times. A close cousin to build times is build sizes. Large binaries can lead to a variety of issues such as: Generally, slower build times Increased costs of storage Increased costs and time to distribute Increased memory usage at runtime (more on this in another article, hopefully) So its generally nice to keep them small....
Truly Extensible Proxies
Exploring an extreme service mesh architecture to maximize extensibility.
Proxy Layers
The OSI model attempts to build a model for network communications, where increasingly high level layers are built upon lower layers. This is only slightly useful in practice, as the real world is not so simple. In service mesh, generally discussion is reduced to L4 and L7, or TCP and HTTP. This oversimplifies the problem, leading to some confusion. Thinking in terms of termination Simply saying "HTTP" is not really clear about what is going on....
Service Mesh Proxy Classes
When looking at service mesh (or even general networking) architectures, the basic idea is to send network traffic through some component, which handles various functionality. This could be authentication, authorization, encryption, observability, reliability, networking, etc. There are a few different classes of components that can do this, though: Different types of proxy deployments Native application enhancement. The application itself is compiled in with functionality. This could be something like gRPC (or, even more "meshy", gRPC with xDS), Finagle, Hystrix, etc....
User space isn't slow
In-kernel networking solutions, such as WireGuard, are not always faster than user space.