thanks for joining us again at the azure academy today we have another new
creator to introduce you all to and Phil Gibson is someone who i worked with on
the fast track team for a couple years and now he's moved on to be part of the
product group so this is a very special video and phil
is going to cover things around containers
kubernetes open source and i'm sure several other things as we go on
so thanks for joining us phil take it away thanks Dean! Are you operating a
containerized computing environment where you need the ability to securely
manage your microservices communication easily manage access policies and
quickly get access to visualize all of your telemetry metrics
today i'm going to introduce and help you deploy open service mesh
i am phil gibson and this is the azure academy if you want to master the azure
cloud you can start right now by clicking the subscribe button and the
notification bell so you don't miss anything
before we get into the open service mess demo it's first to get a good
understanding of the service mesh interface specification commonly known
as the smi spec this specification is the guiding principle for the
architecture of open service mesh at the heart of the smi specification is
a standard for all service measures to universally provide
a common portable set of apis for the most common capabilities of a surface
mesh such as traffic policy traffic telemetry
and traffic management just so we're on the same page let's
talk about where a service mesh fits into a containerized computing
environment you can think of a container as an
operating system kernel level virtualization this is where there is
one operating system and the operating system has a kernel that runs
everything so containers will typically have less operational overhead and less
cost over traditional hardware virtualization
solution so since we are in the cloud the next
obvious question is how can i deploy and manage containers at scale to managing
hundreds or even thousands this is where we need
an orchestrator and as of today the open source project
kubernetes is the most popular azure has a kubernetes service solution called
aks which stands for you guessed it azure kubernetes service which we will
be getting into later in this series for now what's
important to understand for today's talk is that kubernetes has the concept of a
pod which can be a managed group of containers
and this is where we will dig in for today's talk about service meshes
service meshes are used to control and authorize traffic to containers in pods
and what is popularly known as a sidecar pattern this at a high level means that
there is an accompanying container separate from your applications
container by separating the communications functions from the
application this allows app developers to do what
they do best which is develop awesome applications
and the service mess to take care of proxying traffic to the rest of the
world with all that said microsoft released a new project into
the open source community which is called
open service mesh and i'm going to help you deploy this today
so i'm here on the open service mesh dot io page let's click the
github link and that'll take us over to our osm repo
and if we scroll down we'll see the actual table of contents and we actually
have a link here called demos if you're ready
to jump in just start using osm you can use the automated demo
today is really me walking you through the manual demo and providing context
where you need it first thing we're going to do is let's
go ahead and grab a clone of this repo locally and i'm
going to put this into my github directory okay so now that i have
that local repo and then the next thing we're going to do is we're going to grab
the latest release so as of today that's going to be version 0.2.0
and since i'm using the wsl i'll grab the linux amd64 link to the tar file
i will go to my downloads directory and bring this down
and now let's just go ahead and unpack this and now let me go ahead and just
move this over to my path so i can just reference this anywhere on my
system and let me just type osm and there you go so i got osm in my path
now let's go back to the repo let's click on the demos over to the
manual demo and again this is our osm manual demo
guide so we're essentially just going to walk through this and again i'm just
going to provide you some context hopefully make everything clear for you
a couple of housekeeping things just make sure you meet all the
prerequisites it's essentially sure that you have a kubernetes cluster
that's 1.15 or greater but you have crew control and then that you're focused on
that cluster and then this last bullet we've already done we've already got our
repo so now let's go ahead and install osm
with the osm install command and that's it so now we actually have osm
installed into our kubernetes cluster and what i could do is i could just
check the pods into the or some system namespace we
have four pods that were actually deployed the osm controller is osm
and then you'll see that we have a grafana and the prometheus pods
later on in this demo we'll actually show some of the out-of-the-box
dashboards that we have using grafana and the prometheus scrapes from the
metrics and then last we have a zipkin pod and
that pod is basically grabbing the metrics that are going to showcase in
our ui for a demo bookstore application here
now that we have osm installed let's go ahead and create the
necessary namespaces for the bookstore application
we have our little for loop here that's going to create the bookstore the book
buyer the book thief and the book warehouse
and then now what we're going to do is we're going to onboard those namespaces
to the osm mesh essentially what this is doing is
once we onboard a namespace to osm no pod communication from a service to
service perspective is gonna happen in that name space so that's by design
you're gonna need to have policies deployed for
your services to talk if that's not the experience that you want
uh there actually is a flag on the osm install called the enable permissive
traffic policy uh and essentially what that will do is pods that are deployed
in a osm enabled namespace they'll still get the envoy sidecar injected but we
won't have any policy enforcement let's go ahead and
onboard namespaces to osm and there we go
namespaces are osm enabled now the next thing we're going to do is now we're
going to deploy our bookstore application demo app and
so that's going to be in the docs example manifest apps
directory so i'm just gonna copy and paste all of
this so now that we have our bookstore
application uh installed and let's talk about really
what happens as of now there's four application
services that got installed there's the book buyer the book thief bookstore
v1 service and the book warehouse and then essentially what this application
is showing is that book buyer and book thief
need to talk to bookstore v1 which is then fetching books out of the warehouse
so we're going to basically enable this whole communication
allow and deny things based with osm policies
these are all internal services to the cluster we they don't have any external
endpoints so the way that we're going to reach these
uis is actually through a port forwarding trip that we've developed
the first thing that we're going to need to do to run this port forwarding strip
is to actually copy this environment example file over
to env to know which namespaces to enable the port forwarding to
since we're going to be proceeding with the demo and still need to have
connections into these applications to kind of show all the ui
it's actually best for us to go ahead and create that port forwarding in a
separate terminal session so that those connections stay persistent and then we
can continue on with the demo in the other terminal here so now that
we have that going let's go ahead and open up some browsers and just make sure
that we can see some of the services show up here so we have our book buyer
and we have our book store v1 and then last
but not least is our book thief so as you'll notice
there's no metrics happening because there's there's really no policies
that have been deployed and in fact let me go and
show you and if we just do a coup control
when you install osm obviously there's some crds that are created and
the resources that we're really going to be concerned about and
working with today are the traffic targets among the others
but the traffic targets are really what you're telling the mesh
who can talk to who so if we go and we just look at
traffic targets right now you'll see that there are no traffic targets and
hence why there's kind of no activity happening from the book buyer being able
to talk to the bookstore fetching that from the book warehouse so
the next step is for us to actually start to lay down these osm policies to
allow that traffic to start happening let's go ahead and deploy our smi access
control policies we have a traffic target as well as a
http route group installed now if we go back
and kind of look at our traffic targets you'll see that we
have one traffic target that's in the bookstore
called bookstore v1 and if we go ahead and describe that we have our traffic
target who can talk to it is actually the book buyer so the book buyer we are
enabling the book by service to actually talk to the
bookstore v1 service and so now if i go back to the book
buyer we now see the increments happening from purchases
from the bookstore now if we go to the book thief he has
not had any policy applied to him so he is
denied to talk to the bookstore v1 service let's go ahead
and now start to allow the book thief to start
stealing some books out of the book warehouse to do that we just
simply need to edit this traffic access yaml let's go ahead and open that up in
the terminal and we'll go into our docs example
manifest access and then we're going to look at
the traffic access yaml here's the actual traffic target
policy allowing currently the book buyer to speak to the
bookstore v1 service and what we have commented out is the
actual book thief so let's go ahead and allow the book
thief to start stealing books and then all we
have to do now is just apply this now that that's applied let's
go back and look at our traffic target and now
you see that we have both the book buyer and the book thief able to talk to
bookstore v1 one other thing i want to show before we
move on is the http route groups uh one thing to
understand what the http route group is doing is
now that we've allowed the service to service communication via the
traffic targets there's an extra layer that we can
basically provide policy for which is the type of traffic that we want to
allow to go across from service to service in
this case this is all http traffic but if it was
something other than http a different tcp port etc you would have
to define this here with the http route group now let's
go ahead and deploy that second service and then we will
talk about the traffic split which is basically
shifting that service where it's currently going to bookstore v1
and moving it over to bookstore v2 let's go ahead and
deploy bookstore v2 service once we enable the bookstore v2 service
what we'll need to do is first stop our port forwarding
activities and then restart them again to
establish that new connection and there we go now we see that our bookstore v2
is now online it's not selling any books because again
all the traffic is going to bookstore v1 service
we basically only have one back end which is the bookstore v1 service
and it's weighted a 100 percent of the traffic so let's go ahead and now
shift 100 of that traffic to the bookstore v2 service
if i go back to bookstore v1 we shouldn't see
any more increments here because neither the book buyer or the book thief is
able to talk to it since all the traffic is shifted off to bookstore v2 you still
will see the book buyer increment and also the
book thief increment essentially they're going
through the bookstore v2 service now and then if we go to bookstore v2
it is keeping up with the book so from the warehouse now
and then last what we're going to show you is really the out of the box
dashboards that you can get via the smi specs so we were very easily able to
have grafana pull metrics from osm about activities that are happening in the
mesh to do this let's go ahead and stop our port
forwarding the osm dashboard command will actually
automatically kick off port forwarding for us to get to the grafana endpoint
let's go ahead and run the osm dashboard command now that's up and
running so now we just need to go to uh localhost
3000 and here we are at our grafana page and
for the demo uh the password is just admin admin
now we're in the grafana dashboard let's go ahead to the home
screen and what you'll see is we have a couple of directories here uh
with some dashboards so we have the osm control plane
as well as the the data plane this is the osm pod
service metrics you'll see that we have some data here
we just deployed this so some of this is not going to show
as of yet but it will trickle in and lastly let's go ahead and look at the
osm control plane metrics and this is showing our
request count for http and failure count as well as some traffic to control plane
and active connections to the control plane as well so hopefully you found
this helpful and can see how easy it was to get osm installed and configured if
you have any questions or run into any issues feel free to post issues on the
osm repo and if there's any other scenarios you
would like to see please post that feedback as well
also if you want to contribute and make osm better please do this is a community
project and we love to have your participation in making osm
better and please don't forget to keep checking back and join us for the rest
of the series let us know in the comments what you
would like to see in a series around kubernetes or any other open source
projects we're involved in we'd love to hear from you if you
want to keep the learning going check out the latest video on the top right
or watch one of the other videos we have picked just for you
keep safe out there and enjoy your learnings