---
# System prepended metadata

title: Service Mesh

---

# Service Mesh

Miro: https://miro.com/app/board/uXjVOJ3miMM=/?invite_link_id=969776180468


Istio + Envoy architecture
Hashicorp Consul Connect architecture
How service mesh(above two) handle mTLS
For service mesh, why no using zookeeper
If we have time, could we do a hands on lab to try out Istio + envoy



TODOs:
- Withina Pod, how does container nginx know all traffics need to go through sidecar container busybox (xudong)
    - https://www.servicemesher.com/blog/sidecar-injection-iptables-and-traffic-routing/
```
apiVersion: v1
kind: Pod
metadata:
  name: webserver
spec:
  volumes:
    - name: shared-logs
      emptyDir: {}

  containers:
    - name: nginx
      image: nginx
      volumeMounts:
        - name: shared-logs
          mountPath: /var/log/nginx

    - name: sidecar-container
      image: busybox
      command: ["sh","-c","while true; do cat /var/log/nginx/access.log /var/log/nginx/error.log; sleep 30; done"]
      volumeMounts:
        - name: shared-logs
          mountPath: /var/log/nginx
```

- How Istio CNI works: overlay  on top of existing CNI ? (Xudong)

> The Istio CNI plugin replaces the istio-init container, which provides the same functionality, but without requiring Istio users to enable elevated privileges. It performs traffic redirection in the pod’s network setup phase, thereby removing the NET_ADMIN capability requirement for users deploying pods into the Istio mesh.

    - https://istio.io/latest/docs/setup/additional-setup/cni/
    - https://banzaicloud.com/blog/istio-cni-plugin/

- Deploy two contains, how to use one container hijack all the traffic. (lucheng, Daniel)
    - https://jimmysong.io/en/blog/sidecar-injection-iptables-and-traffic-routing/
    - https://github.com/istio/istio/blob/098cc47dfcbdca202208bd241d9dee35cd230a4d/pkg/kube/inject/inject.go

- Does Service Mesh depends on NetworkPolicy ?
    - https://www.linkedin.com/pulse/service-mesh-vs-network-policy-bruno-andrade/
    - https://www.tigera.io/blog/network-policy-and-istio-deep-dive/

- mTLS deep dive: cert expiration, rotation, Root CA management. (Daniel)

- Follow up if have time: Hands on lab to try out Istio + envoy


- service mesh comparaiton: https://platform9.com/blog/kubernetes-service-mesh-a-comparison-of-istio-linkerd-and-consul/

- https://github.com/linkerd/linkerd2-proxy


TODO: 
https://medium.com/@ahmetensar/kubernetes-network-plugins-abfd7a1d7cac






----------------------------------------------------------------------------------

- Localhost
- Internal process call
    - Kind
    - Pod with 2 container: A, B
    - Try internal process call from A to B



                                     Root CA
                             
                             
                             
            [az-1]:China                                [az-2]:US
                                                         Root CA
                                                          \- Child Root CA
             s1-1                                        s1-2
                                                         s1-3
            Child Root CA                                                     
                    -----------------------------------
                               mTLS
                               where is the CA ?
                               1. transfer root CA acroos AZ: Secure
                               2. trust chain




- CSI
- Knative/Serverless
- CPI
- CNI
- CRI
