You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 130 Next »

Background

L7 Proxy Service Mesh Controller intends to provide connectivity, shape the traffic, apply policies, RBAC and provide

mutual TLS for applications/microservices running across clusters (with service mesh), within the cluster

and with external applications. The functionalities are subjected to the usage of underlying service mesh technology. 

Design Overview


Traffic Controller Design Internals

Internal Implementation Details



NOTE - Current implementation will support the ISTIO service mesh technology and SD-WAN load balancer and ExternalDNS as DNS provider.  The plugin architecture of the controller makes it extensible to work with any Service mesh technology and any external load balancer as well. It is also designed to configure and communicate with external DNS servers. 

JIRA

ComponentJIRA Items
  1. REST API Interface

MULTICLOUD-913 - Getting issue details... STATUS

2. Controller Interface, Backend Process

MULTICLOUD-914 - Getting issue details... STATUS

3. Developing backend code with interfaces

MULTICLOUD-915 - Getting issue details... STATUS

4. Loadbalancer configuration (Firewall, IPVS, NAT, and other L3 connectivity) 

MULTICLOUD-924 - Getting issue details... STATUS

MULTICLOUD-925 - Getting issue details... STATUS MULTICLOUD-926 - Getting issue details... STATUS
5. External DNS Configuration 

MULTICLOUD-909 - Getting issue details... STATUS

6. Testing 

MULTICLOUD-918 - Getting issue details... STATUS

7.Documentation

MULTICLOUD-923 - Getting issue details... STATUS




Elements of Traffic Controller with ISTIO as the service mesh

  1. Gateways - The inbound/outbound access for the service mesh. It is an envoy service
  2. VirtualServices -  To expose the service outside the service mesh
  3. DestinationRule - To apply rules for the traffic flow
  4. AuthorizationPolicy - Authorization for service access
  5. serviceEntry - add an external service into the mesh
  6. Authentication Policy - Authenticate external communication


These are the Kubernetes resources generated per cluster. There will be multiple of these resources depending on the intent

API

RESTful North API (with examples)


TypesIntent APIsFunctionality



1.  outbound service communication/v2/projects/{project-name}/composite-apps/blue-app/{version}/traffic-intent-set/inbound-intents/communication from  external service to internal micro service
2.  inbound service communiation/v2/projects/{project-name}/composite-apps/blue-app/{version}/traffic-intent-set/outbound-intents/communication from internal service to access external service 
URL: /v2/projects/{project-name}/composite-apps/{composite-app-name}/{version}/traffic-intent-set
POST BODY:
{
	"name": "john",
	"description": "Traffic intent groups"
    "set":[
      {
         "inbound":"abc"
      },
      {
         "outbound":"abc"
      }
   ]
}

1. Inbound access 

POST

POST
URL: /v2/projects/{project-name}/composite-apps/blue-app/{version}/traffic-intent-set/inbound-intents/

POST BODY:
{
	"metadata": {
	"name": "<>" // unique name for each intent
    "description": "connectivity intent for stateless micro-service to stateless micro-service communication"
	"userdata1": <>,
	"userdata2": <>
	}

	"spec": { // update the memory allocation for each field as per OpenAPI standards
	"application": "<app1>",
	"servicename": "<>" //actual name of the client service - {istioobject - serviceEntry of client's cluster}
	"externalName": "<>" // prefix to expose this service outside the cluster
	"protocol": "", // supported protocols are HTTP, TCP, UDP and HTTP2
	"headless": "", // default is false. Option "True" will make sure all the instances of the headless service will have access to the client service
	"mutualTLS": "", // default is simple. Option MUTUAL will enforce mtls {istioobject - destinationRule}
	"port" : "80", // port on which service is exposed as through servicemesh, not the port it is actually running on
	"serviceMesh": "istio", // get it from cluster record
	"sidecar-proxy": "yes", // The features (mTLS, LB, Circuit breaking) are not available to services without istio-proxy. Only inbound routing is possible.

	// Traffic management fields below are valid only if the sidecar-proxy is set to "yes"
	"traffic-management-info" : {
		// Traffic configuration - Loadbalancing is applicable per service. The traffic to this service is distrbuted amongst the pods under it.
		"loadbalancingType": "", // "Simple" and "consistentHash" are the two modes - {istioobject - destinationRule}
		"loadBalancerMode": "" // Modes for consistentHash - "httpHeaderName", "httpCookie", "useSourceIP", "minimumRingSize", Modes for simple - "LEAST_CONN", "ROUND_ROBIN", 	"RANDOM", "PASSTHROUGH" // choices of the mode must be explicit - {istioobject - destinationRule}
		"httpCookie": "user1" // Name of the cookie to maitain sticky sessions - {istioobject - destinationRule}

		// Circuit Breaking
		"maxConnections": "" //connection pool for tcp and http traffic - {istioobject - destinationRule}
		"concurrenthttp2Requests": "" // concurent http2 requests which can be allowed - {istioobject - destinationRule}
		"httpRequestPerConnection": "" // number of http requests per connection. Valid only for http traffic - {istioobject - destinationRule}
		"consecutiveErrors": "" // Default is 5.  Number of consecutive error before the host is removed - {istioobject - destinationRule}
		"baseEjectionTime" : "" // Default is 5, - {istioobject - destinationRule}
		"intervalSweep": '', //time limit before the removed hosts are added back to the load balancing pool. - {istioobject - destinationRule}
		}

	// credentials for mTLS.
	"Servicecertificate" : "" // Present actual certificate here.
	"ServicePrivateKey" : "" // Present actual private key here.
	"caCertificate" : "" // present the trusted certificate to verify the client connection, Required only when mtls mode is MUTUAL

	// Access Control
	namespaces: [] // Workloads from this namespaces can access the inbound service - {istioobject - authorizationPolicy}
	serviceAccountAccess : {[ "SaDetails": ["ACTION": "URI"]} // {istioobject - authorizationPolicy, will be applied for the inbound service}
	
	}
}

RETURN STATUS: 201
RETURN BODY: 
{ 
  "name": "<name>"
  "Message": "inbound service created"
}

GET

GET
URL: /v2/projects/{project-name}/composite-apps/{composite-app-name}/{version}/traffic-intent-set/{set-name}/us-to-us-intents/<name>

RETURN STATUS: 201
RETURN BODY:
{
	"metadata": {
	"name": "<>" // unique name for each intent
    "description": "connectivity intent for stateless micro-service to stateless micro-service communication"
	"userdata1": <>,
	"userdata2": <>
	}

	"spec": { // update the memory allocation for each field as per OpenAPI standards
	"application": "<app1>",
	"servicename": "<>" //actual name of the client service - {istioobject - serviceEntry of client's cluster}
	"externalName": "<>" // prefix to expose this service outside the cluster
	"protocol": "", // supported protocols are HTTP, TCP, UDP and HTTP2
	"headless": "", // default is false. Option "True" will make sure all the instances of the headless service will have access to the client service
	"mutualTLS": "", // default is simple. Option MUTUAL will enforce mtls {istioobject - destinationRule}
	"port" : "80", // port on which service is exposed as through servicemesh, not the port it is actually running on
	"serviceMesh": "istio", // get it from cluster record
	"sidecar-proxy": "yes", // The features (mTLS, LB, Circuit breaking) are not available to services without istio-proxy. Only inbound routing is possible.

	/ Traffic management fields below are valid only if the sidecar-proxy is set to "yes"
	"traffic-management-info" : {
		// Traffic configuration - Loadbalancing is applicable per service. The traffic to this service is distrbuted amongst the pods under it.
		"loadbalancingType": "", // "Simple" and "consistentHash" are the two modes - {istioobject - destinationRule}
		"loadBalancerMode": "" // Modes for consistentHash - "httpHeaderName", "httpCookie", "useSourceIP", "minimumRingSize", Modes for simple - "LEAST_CONN", "ROUND_ROBIN", 	"RANDOM", "PASSTHROUGH" // choices of the mode must be explicit - {istioobject - destinationRule}
		"httpCookie": "user1" // Name of the cookie to maitain sticky sessions - {istioobject - destinationRule}

		// Circuit Breaking
		"maxConnections": "" //connection pool for tcp and http traffic - {istioobject - destinationRule}
		"concurrenthttp2Requests": "" // concurent http2 requests which can be allowed - {istioobject - destinationRule}
		"httpRequestPerConnection": "" // number of http requests per connection. Valid only for http traffic - {istioobject - destinationRule}
		"consecutiveErrors": "" // Default is 5.  Number of consecutive error before the host is removed - {istioobject - destinationRule}
		"baseEjectionTime" : "" // Default is 5, - {istioobject - destinationRule}
		"intervalSweep": '', //time limit before the removed hosts are added back to the load balancing pool. - {istioobject - destinationRule}
		}	

	// credentials for mTLS.
	"Servicecertificate" : "" // Present actual certificate here.
	"ServicePrivateKey" : "" // Present actual private key here.
	"caCertificate" : "" // present the trusted certificate to verify the client connection, Required only when mtls mode is MUTUAL

	// Access Control
	"namespaces": [] // Workloads from this namespaces can access the inbound service - {istioobject - authorizationPolicy}
	"serviceAccountAccess" : {[ "SaDetails": ["ACTION": "URI"]} // {istioobject - authorizationPolicy, will be applied for the inbound service}
	
	}
}

DELETE 

DELETE
DELETE
URL: /v2/projects/{project-name}/composite-apps/{composite-app-name}/{version}/traffic-intent-set/{set-name}/us-to-us-intents/servicehttpbin

RETURN STATUS: 204

2. Outbound access

POST - 

POST
URL: /v2/projects/{project-name}/composite-apps/{composite-app-name}/{version}/traffic-group-intent/outbound-intents/
POST BODY:
{
	"metadata": {
	"name": "<name>" // unique name for each intent
    "description": "connectivity intent add client communication"
	"application": "<app1>",
	"userdata1": <>,
	"userdata2": <>
	}

	spec: {
		"clientServiceName": "<>", // Name of the client service
		"type": "", // options are istio, k8s and external
		"inboundServiceName": "<>"
		"headless": "false", // default is false. Option "True" will generate the required configs for all the instances of headless service
	}
}

RETURN STATUS: 201
RETURN BODY:
{ 
  "name": "<name>"
  "Message": "Client created"
}


Scenarios supported for the current release

Nature of applicationPage link comments
HTTPHTTP
HTTPSHTTPS
TCPTCP




Development

  1. go API library - https://github.com/gorilla/mux
  2. backend - mongo - https://github.com/onap/multicloud-k8s/tree/master/src/k8splugin/internal/db - Reference
  3. intent to config conversion - use go templates and admiral? https://github.com/istio-ecosystem/admiral
  4. writing the config to etcd - WIP
  5. Unit tests and Integration test - go tests


External DNS - Design and intent API

See here:  External DNS provider update design and intent API




External application communication intents

Considering DNS resolution,  No DNS resolution (IP addresses), Egress proxies of the Service Mesh, Third-party egress proxy


User facing communication intents

Considering Multiple DNS Servers

Considering multiple user-facing entities

Considering RBAC/ABAC


Internal Design details

Guidelines that need to keep in mind

  • Support for metrics that can be retrieved by Prometheus
  • Support for Jaeger distributed tracing by including open tracing libraries around HTTP calls.
  • Support for logging that is understood by fluentd
  • Mutual exclusion of database operations (keeping internal modules accessing database records simultaneously and also by replication entities of the scheduler micro-service).
  • Resilience - ensure that the information returned by controllers is not lost as the synchronization of resources to remote edge clouds can take hours or even days when the edge is not up and running and possibility of restart of scheduler micro service in the meantime.
  • Concurrency - Support multiple operations at a time and even synchronizing resources in various edge clouds in parallel.
  • Performance - Avoiding file system operations as much as possible.

Modules (Description, internal structures etc..)

....


Sequence flows


Test cases











  • No labels