Lukonde Mwila
Lukonde Mwila
  • 24
  • 94 063
Optimizing Istio Ingress Gateway Performance
How do you optimize the Istio ingress gateway? When and why would you need to perform this? In this video, I discuss scenarios where a single Istio ingress gateway may not be suitable for your Kubernetes environment because of the degraded performance from bearing the load of many service proxy configurations. You may be running multiple unrelated workloads (in a multi-tenant environment) with varying configurations and requirements. In situations like this, it may be better to have multiple ingress gateways that serve the different types of applications in your Kubernetes cluster. In addition to that, to avoid stressing a single ingress gateway with all the configurations for every proxy in the Istio service mesh, you can optimize each gateway's performance by filtering the proxies it should know about.
#kubernetes #istio
Timestamps:
00:00 - Introduction
00:20 - Running multiple gateways for different purposes
00:55 - Improving ingress gateway performance by creating multiple gateways
01:59 - Improving ingress gateway performance by filtering the virtual services attached to it
02:18 - The cost implication of running multiple gateways in a cloud environment
02:35 - Code-walk-through and demo
Other resources:
Using Istio Gateway to Route Traffic to Microservices on Amazon EKS - th-cam.com/video/_ImVPrUZ6yY/w-d-xo.html
Secure Istio Gateway Traffic with TLS Encryption on Amazon EKS - th-cam.com/video/sn4_j_E62VE/w-d-xo.html
Connect:
GitHub: github.com/LukeMwila
Twitter: LuKE9ine
Medium: medium.com/@outlier.developer
LinkedIn: www.linkedin.com/in/lukonde-mwila-25103345/
If you found this video helpful, please like the video and subscribe to the channel!
มุมมอง: 1 557

วีดีโอ

Taints and Tolerations in Kubernetes
มุมมอง 1.1Kปีที่แล้ว
What are taints and tolerations in Kubernetes? In this video, I discuss and demonstrate how you can apply taints to the nodes in your cluster, and how to run workloads on dedicated nodes by applying matching tolerations to pods. In Kubernetes, you can use taints to tell your nodes to repel or reject certain pod placements, as well as influence how strictly the scheduler should take the effects ...
Pod Topology Spread Constraints in Kubernetes
มุมมอง 3.4Kปีที่แล้ว
How do you configure pod topology constraints in Kubernetes? In this video, I'll address this very topic so that you can learn how to spread out your application workloads in Kubernetes for high availability and better resource utilization. In this video, I will also compare pod topology constraints to pod anti-affinity rules, and why topology constraints are a better option for application ava...
How to Setup External CA Integration in Istio
มุมมอง 2.8Kปีที่แล้ว
Wondering how to set up an external CA (certificate authority) in Istio? In this video, I give a detailed walk-through on why it can be helpful to set up an external root certificate authority for your Istio service mesh, as well as a walk-through of the setup process. The external CA used in this video is AWS Private CA. Certificate management in Istio is at the heart of issuing identities to ...
Security with Istio: Using Authorization Policies
มุมมอง 4Kปีที่แล้ว
When securing your container workloads in Kubernetes, it's important to have defence in depth. This. means having layers of security. As important as it is to have mTLS enabled in the Istio service mesh, you should also implement access control between services. To do this in Istio, you make use of Authorization Policies. After we've validated the identity of a service, we should check whether ...
How to Configure mTLS in Istio for Secure Kubernetes Workload Communication
มุมมอง 6Kปีที่แล้ว
To secure network communication between container applications in the Istio service mesh, you can make use of mutual Transport Layer Security (mTLS). With mTLS, you can validate the sender of any request in your application network environment, as well as encrypt the network traffic from being understandable to any other party that might intercept it. Istio automatically enables mTLS in the ser...
GitOps Canary Deployments to Kubernetes with Istio, Argo CD and Flagger
มุมมอง 4.7Kปีที่แล้ว
Deploying a new version of a software application is the bread and butter of the development lifecycle. However, you still have to think through and strategize around how you're going to get this newly deployed version into the hands of your end users or whatever clients will be consuming it. In this video, I'll discuss how you can make use GitOps with a canary strategy to release newly deploye...
Secure Istio Gateway Traffic with TLS Encryption on Amazon EKS
มุมมอง 5Kปีที่แล้ว
In this video, I discuss and demonstrate how you can mitigate the risks of network interception attacks by encrypting the traffic that comes into the Istio service mesh with TLS. This video is a follow-up to a previous video titled Using Istio Gateway to Route Traffic to Microservices on Amazon EKS (link provided below). As much as a single point of entry provides a superior measure of security...
Using Istio Gateway to Route Traffic to Microservices on Amazon EKS
มุมมอง 13Kปีที่แล้ว
One of the glaring challenges of deploying microservices to Kubernetes is figuring out optimal and secure network communication from outside the cluster to your services inside of it and network communication between the services themselves. In some scenarios, we can use Kubernetes services like LoadBalancers and NodePorts to expose our applications to the world. However, there are use cases wh...
Secure Your Kubernetes Software Supply Chain using Snyk, Amazon Inspector, Datree and NeuVector
มุมมอง 3172 ปีที่แล้ว
Security around containers and Kubernetes is a very hot topic at the moment because of the increasing awareness of the vulnerabilities that exist in these technologies. To improve your container and Kubernetes security posture, you should start by identifying the vulnerabilities and then pick a tool or tools that will help you address the identified weaknesses and risks. The software supply cha...
Container Best Practices with Datree
มุมมอง 2542 ปีที่แล้ว
Getting started with containers is relatively straightforward. If you have an environment like your personal laptop with a container runtime such as docker or containerd, the docker CLI, and a docker file for your application then you can have a container up and running in no time. However, there's still a lot of groundwork that has to be done to configure your containers to be considered optim...
Scaling Kubernetes with Karpenter: Advanced Scheduling with Pod Affinity & Volume Topology Awareness
มุมมอง 1.5K2 ปีที่แล้ว
One feature that draws people to Kubernetes is its ability to scale automatically. Auto-scaling Kubernetes is an essential part of your cloud-native strategy. In addition, you may be dealing with use cases requiring advanced Kubernetes scheduling requirements like pod affinity, pod anti-affinity, and volume topology awareness. In this video, I'll show you how to automatically scale the compute ...
Using Argo CD and Rancher for Kubernetes Multi-tenancy & GitOps
มุมมอง 6K2 ปีที่แล้ว
Kubernetes multi-tenancy is one of the biggest challenges when operating Kubernetes at scale. It's not easy figuring out the best way to manage, organize and isolate teams and unrelated workloads on shared clusters. In some cases, you might have one big cluster, and in other cases, you might have multiple big clusters housing different teams and workloads. In this video, I talk about how organi...
Multicloud Kubernetes with Rancher
มุมมอง 1.2K2 ปีที่แล้ว
Multicloud strategies are becoming increasingly popular, with a number of companies looking to adopt this model and distribute their architecture across different cloud environments. For organizations running containerized workloads at scale, this can work especially well because of the infrastructure agnosticism that Kubernetes offers. In this video, I talk about the pros and cons of multiclou...
Prevent Kubernetes Misconfigurations in Argo - Using Datree with Argo CD & Argo Rollouts
มุมมอง 5K2 ปีที่แล้ว
In this video, I demonstrate how you can make use of Datree's new Argo policy rules as a defensive strategy from misconfigurations. This video follows up on a previous video where I walked through a GitOps CI/CD pipeline with AWS CodeBuild and Argo CD for deployments to an Amazon EKS cluster. In that video, I used Datree to ensure best practices are upheld and to protect from common container a...
Managing Sensitive Data in Kubernetes with Sealed Secrets and External Secrets Operator (ESO)
มุมมอง 6K2 ปีที่แล้ว
Managing Sensitive Data in Kubernetes with Sealed Secrets and External Secrets Operator (ESO)
Using Argo CD & Datree for Stable Kubernetes CI/CD Deployments
มุมมอง 2.2K2 ปีที่แล้ว
Using Argo CD & Datree for Stable Kubernetes CI/CD Deployments
Getting Started with ArgoCD for GitOps Deployments
มุมมอง 6K2 ปีที่แล้ว
Getting Started with ArgoCD for GitOps Deployments
Using Skaffold and GitHub Actions for Deployments to Amazon EKS
มุมมอง 2.1K2 ปีที่แล้ว
Using Skaffold and GitHub Actions for Deployments to Amazon EKS
CI/CD Deployments with AWS CodeBuild and GitOps to EKS and AKS Kubernetes Clusters
มุมมอง 2.8K2 ปีที่แล้ว
CI/CD Deployments with AWS CodeBuild and GitOps to EKS and AKS Kubernetes Clusters
Create an RKE Kubernetes Cluster in AWS with Terraform
มุมมอง 2.2K2 ปีที่แล้ว
Create an RKE Kubernetes Cluster in AWS with Terraform
Port Forwarding in Kubernetes with kubectl
มุมมอง 4.6K3 ปีที่แล้ว
Port Forwarding in Kubernetes with kubectl
Manage Amazon EKS Cluster with Rancher
มุมมอง 7K3 ปีที่แล้ว
Manage Amazon EKS Cluster with Rancher
Local Kubernetes Development with RKE (Rancher Kubernetes Engine)
มุมมอง 4.4K3 ปีที่แล้ว
Local Kubernetes Development with RKE (Rancher Kubernetes Engine)

ความคิดเห็น

  • @alialtaher8995
    @alialtaher8995 18 วันที่ผ่านมา

    wonderful explaination, Thanks

  • @shaunakkakade1325
    @shaunakkakade1325 หลายเดือนก่อน

    Hi, where do I get the live iron man wallpaper from? 😊

  • @palashrangari7854
    @palashrangari7854 2 หลายเดือนก่อน

    Can we use traefik ingress controller instead of istio-ingress gateway? Traffic coming from traefik routers fails when the peerauthentication mode is STRICT in all namespace

  • @youtux2
    @youtux2 2 หลายเดือนก่อน

    Brilliant! THanks for a clear and easy to understand explanation of what I've seen perceived as a relatively obscure and underappreciated setting, but a very important one!

  • @palashrangari7854
    @palashrangari7854 2 หลายเดือนก่อน

    Please make a video for Let's Encrypt as external CA.

  • @int3rned497
    @int3rned497 3 หลายเดือนก่อน

    Thank you very much - This helped me set it up in our project! Can you please tell me what is that beautiful VSCode Theme?

  • @modestas2890
    @modestas2890 3 หลายเดือนก่อน

    Hi, is there any way to make sure skaffold dev does not delete your persistent volumes? I find this is a deal-breaker when trying to set up a k8s local environment since it erases all of your data everytime.

  • @ajprasad6865
    @ajprasad6865 3 หลายเดือนก่อน

    Thanks so much!

  • @chandrasekhar5858
    @chandrasekhar5858 4 หลายเดือนก่อน

    Hi you explained very well but i have one doubt that where destination rule configuration Please reply me back that helps me to go further in understanding istio

  • @yashowantanipun1551
    @yashowantanipun1551 5 หลายเดือนก่อน

    How do we connect to product service from order pod when strict mode was enforced for both services? How do we get the client certificates ?

  • @ranrubin7377
    @ranrubin7377 5 หลายเดือนก่อน

    Thanks for the video, I'm new to Istio and it's very helpful. You've changed the Istio ingress controller service to NodePort and created another service of LoadBalancer. Why not changing the Istio ingress controller service to LoadBalancer with ALB annotation and avoid the need to another service?

  • @matc8085
    @matc8085 6 หลายเดือนก่อน

    How do you get autocomplete in your terminal

  • @tuliphitler8159
    @tuliphitler8159 6 หลายเดือนก่อน

    How to generate loadbalancer using aws ingress

  • @vibales
    @vibales 6 หลายเดือนก่อน

    Great example, finally got working my project 🎉

  • @matc8085
    @matc8085 6 หลายเดือนก่อน

    Your content on istio is the best

  • @yehimadojot
    @yehimadojot 6 หลายเดือนก่อน

    Like your videos, because you explain the important things in a good way. Can you do also a video about the descheduler? Because if you use Anti-Affinity or Topology Spread Contraints this is only for the scheduler. If you scale down an application (manual or autoscaling), this rules will not be taken in consideration by the descheduler to keep the high-availability. So imo there is a need to keep also a look at the descheduler if you want high availability when autoscaling.

  • @matc8085
    @matc8085 7 หลายเดือนก่อน

    Your content is superb

  • @tomasferrari92
    @tomasferrari92 8 หลายเดือนก่อน

    Do you think having a gateway for each environment (Dev,uat, prod) is a good decision? Thank you!

  • @matc8085
    @matc8085 8 หลายเดือนก่อน

    This was an excellent explanation know I understand the benefit of istio

  • @TechyWithLorna
    @TechyWithLorna 8 หลายเดือนก่อน

    Thank you for the video, so helpful

  • @sadhucat4476
    @sadhucat4476 8 หลายเดือนก่อน

    Solid video, really appreciate the overview explanation at the beginning. Subscribed!

  • @arozendojr
    @arozendojr 8 หลายเดือนก่อน

    Can you answer a question, is it possible to use jaeger + istio, for every request and response event of each microservice? automatic without changing microservice/pod code? How can I look for the configuration I should do?

  • @domw2391
    @domw2391 9 หลายเดือนก่อน

    What protocol you use between communication between services? Rest or gPRC?

  • @danshepard6851
    @danshepard6851 9 หลายเดือนก่อน

    Hey dude, you really helped me with setting this up, even better than AWS's Containers from the Couch. You'll probably never see this, but I really appreciate it!

  • @ryebridgeriver5473
    @ryebridgeriver5473 10 หลายเดือนก่อน

    Great video, I'm subscribing ! I was wondering if I could use topology spread constaints to deploy Pods which consume EBS volumes accross multiple availabilty zones ? Say you have 3 redis replicas and you want to spread them into 3 zones so they'll be able to consume their respective volume if a zone goes down ?

  • @Angeloti8052
    @Angeloti8052 11 หลายเดือนก่อน

    Wow. That was a lot to unpack. very well articulated and delivered. Keep up the good work.

  • @trevor369
    @trevor369 11 หลายเดือนก่อน

    Subscribed 😊

  • @MrLearner-zr2by
    @MrLearner-zr2by 11 หลายเดือนก่อน

    Nice work, Mr. Mwila. It would be great if you could provide a walkthrough of the app you're going to mesh!

  • @chrispure7461
    @chrispure7461 ปีที่แล้ว

    I have kube installed on my bare metal . I have a rest service running on master mode machine ( not in kube). In kube i have some pods which want to access the rest service. How do pods communicate with on kube rest service on one of the node(master node). Pods are getting host not resolved error.

  • @TheProximator
    @TheProximator ปีที่แล้ว

    Great content, thanks a lot :)

  • @deepsy2k
    @deepsy2k ปีที่แล้ว

    about the bridging configuration I didn't have to do it when configuring a cluster without RKE, does kubeadm do it for you when creating a cluster? and even though RKE does all the configuration it doesn't know how to configure the bridging?

  • @mhosseinhosseini-ld4km
    @mhosseinhosseini-ld4km ปีที่แล้ว

    if anyone knows please...does istio uses workload to register/deploy application?

  • @tintin-wr7vt
    @tintin-wr7vt ปีที่แล้ว

    Thank @Lukonde for istio content, it helps me

  • @Explore_with_Azizul-maqsud
    @Explore_with_Azizul-maqsud ปีที่แล้ว

    Awesome. please carry on. Ty

  • @RafaelDurelli
    @RafaelDurelli ปีที่แล้ว

    Great videos. Keep going :)

  • @saddamsidimouhamed3205
    @saddamsidimouhamed3205 ปีที่แล้ว

    Thank you so much for what you doing. That very helpful! Great!

  • @user-pv3is5zb9u
    @user-pv3is5zb9u ปีที่แล้ว

    if we scale the nodes do they add to rancher directly?

  • @DamienMalakay
    @DamienMalakay ปีที่แล้ว

    great video but the guy clearly doesn't reply on his content, I see 2 comments below and still no reply

  • @rahulgupta395
    @rahulgupta395 ปีที่แล้ว

    Do you know how does it work during AZ failure or when specific AWS has capacity issue in a specific AZ?

  • @ayeleru7489
    @ayeleru7489 ปีที่แล้ว

    Nice concise, simple. Great vid. thanks

  • @HrishikeshLimaye
    @HrishikeshLimaye ปีที่แล้ว

    how can we do it for multi setup environments where clusters resides on different region or different aws accounts?

  • @Luther_Luffeigh
    @Luther_Luffeigh ปีที่แล้ว

    I saw you on AWS couch channel but didn’t realize you had your own channel. Thanks to ESO page that pointed to this channel…love your content 🙌🏽🚀🔥

  • @mrvadym1
    @mrvadym1 ปีที่แล้ว

    Nice explnation and demo!

  • @sabeernitb
    @sabeernitb ปีที่แล้ว

    thanks Lukonde for the excellent content, very well explained.

  • @feezankhattak1573
    @feezankhattak1573 ปีที่แล้ว

    Please make an video with let's encrypt for ssl. for parent as well as subdomains. Thanks.

  • @MrKofiray71
    @MrKofiray71 ปีที่แล้ว

    Excellent demo. Are you able to do the same for a Multi Cluster Mesh ?

  • @kevinm2567
    @kevinm2567 ปีที่แล้ว

    I'm just here to say congrats Luke! You taught me Flutter years ago 😄Your growth in tech has been an inspiration to me and many others 💯 Kubernetes is the new frontier and I'm glad to see that you already have experience in this field 🔥

  • @sg8168
    @sg8168 ปีที่แล้ว

    ArgoCD will self-heal the changes by flagger, how to handle this?

  • @taniaduggal6459
    @taniaduggal6459 ปีที่แล้ว

    🔥🔥 Amazing!!