Live data from Hacker News

Google and IBM announce Istio – easily secure and manage microservices

developer.ibm.com

31–40 of 123 posts

Re: Google and IBM announce Istio – easily secure and manage microservices

#31
post #2

Google Cloud Platform Blog Post: https://cloudplatform.googleblog.com/2017/05/istio-modern-ap...

There seems to be also other companies involved:

IBM: https://developer.ibm.com/dwblog/2017/istio/

Redhat: https://blog.openshift.com/red-hat-istio-launch/

Pivotal: https://content.pivotal.io/blog/pivotal-and-istio-advancing-...

Re: Google and IBM announce Istio – easily secure and manage microservices

#32
post #30

Earlier quoted context omitted.

My read of the documentation also indicates a large overlap with linkerd. Hopefully one of the creators is around and can do a compare/contrast.

One important difference I see is istio works only with kubernetes/bluemix, whereas linkerd has many more deployment options.

The initial release for Istio is targeted at kubernetes. However, Istio is designed to be easy to adapt to other environments. With community help, we anticipate extending it to enable services across cloud foundry, VM, and hybrid clouds. We hope to have major new releases every 3 months, including adding new environments.

Re: Google and IBM announce Istio – easily secure and manage microservices

#33
post #30

Earlier quoted context omitted.

One important difference I see is istio works only with kubernetes/bluemix, whereas linkerd has many more deployment options.

The initial release for Istio is targeted at kubernetes. However, Istio is designed to be easy to adapt to other environments. With community help, we anticipate extending it to enable services across cloud foundry, VM, and hybrid clouds. We hope to have major new releases every 3 months, including adding new environments.

Thanks, This is interesting. Currently where I work, we have not started using containers/schedulers etc. We simply use VMs for services. For now I simply want to experiment with these new technologies.

Re: Google and IBM announce Istio – easily secure and manage microservices

#34
This may be the most important project in distributed computing in a long time. It solves some fundamental problems that layer 3 networking has been unable to tackle. Its initial integration with Kubernetes is great but long term it could be the basis of all application level communication whether it is deployed in a container orchestration system, VMs, bare metal or as an enabler for Lambda (function) frameworks.

Re: Google and IBM announce Istio – easily secure and manage microservices

#35

What happened to dumb pipes, smart endpoints? We do the same things again that we did before with SOA, having hard-to-replace middleware / bus systems.

The REST architecture always included the possibility of gateways and proxies in the end-to-end communication path to delegate shared responsibilities out of the user agent or origin server. This balances the need for centralized admin of some things and decentralized deployment of other things. Most microservices systems, even if they're not using HTTP in favor of something like gRPC, Kafka, or Rabbit, are taking a lot of WebArch lessons to heart in how they manage their policies, routes, etc. balancing centralized management over decentralized evolution.

The problem with SOA-in-practice was that everything flowed through a monolithic ESB as both client and origin server, that needed to have omniscient knowledge of every route, transformation, etc., and was often a single administrative bottleneck, fault domain, etc. Some SOA frameworks had service mesh patterns where you could deploy decentralized engines with your services, but without cloud IaaS/PaaS circa 2006-2007, there was no way to maintain/deploy/upgrade these policy agents without a heavy operational burden.

In sum: CORBA, COM+ or SOAP/HTTP were about mostly-centralized approaches to distributed services, REST was about extreme decentralized evolution over decades, most are looking for something akin to a dial where they can have something a bit more controlled than dozens of independent gRPC/HTTP/Rabbit/Kafka producers-consumers but not stupid like the SOAP/HTTP days.

Modern cloud native service mesh approaches like this Istio thing (NetflixOSS Zuul+Eureka+Ribbon or Linkerd are alternatives) are just decentralized gateways and proxies, possibly with a console/management appliance that makes it easy to propagate changes out across a subset of your microservices. This has the benefit of allowing you to default to decentralized freedom for your various microservices but for areas where you want administrative control over policy over a set of them , you don't have to go in and tweak 15 different configs.

NetflixOSS really pioneered this pattern. Netflix managed to use things like Cassandra and Zuul hot-deploy filters as the means to updated routing/health/balancing configs across their fleet of microservices. There are alternative ways to handle this of course - Hashicorp's Consul piggybacks DNS and expects your client to figure things out via their REST API or DNS queries. There are also things like RabbitMQ or a REST-polling mechanism to propagate config changes perhaps, as not everyone wants Cassandra. New frameworks like Istio or Linkerd are further alternatives. We're spoiled for choice, better or worse..

Re: Google and IBM announce Istio – easily secure and manage microservices

#36
post #18

[Deleted]

IBM Research continues to do a lot of interesting research in AI/ML (and also into basic sciences in general). I'm not sure about Watson; I've heard both good and bad things about it so I do understand the skepticism. But to call it a joke is probably taking it too far :).

Full Disclosure: work at IBM, but not in Watson.

Re: Google and IBM announce Istio – easily secure and manage microservices

#37
post #18

[Deleted]

Well surprised or not, what you see in Istio is the result of contributions from all 3 founding parties. My team on the IBM side did much of the work on the Istio Manager and added capabilities in Envoy too, such as support for zipkin tracing.

Re: Google and IBM announce Istio – easily secure and manage microservices

#38
post #30

Earlier quoted context omitted.

My read of the documentation also indicates a large overlap with linkerd. Hopefully one of the creators is around and can do a compare/contrast.

One important difference I see is istio works only with kubernetes/bluemix, whereas linkerd has many more deployment options.

Not sure it's right to compare linkerd with istio. Likely you should compare envoy (which istio is built around) with linkerd. Envoy can be deployed without kubernetes.

Re: Google and IBM announce Istio – easily secure and manage microservices

#39

What happened to dumb pipes, smart endpoints? We do the same things again that we did before with SOA, having hard-to-replace middleware / bus systems.

It depends on how you view it. Baking everything into the application logic works if you have a homogeneous stack. When you start going down the polyglot route, with 5-6 language runtimes, multiple databases, it becomes really really hard to maintain all the communication logic (discovery, load balancing, resilience) in the app code. Take a look at AirBnB's smartstack, Yelp, Lyft's Envoy mesh. These are all polyglot…

Just pointing it out, but Envoy is a key piece of Istio (as I understand it).

Re: Google and IBM announce Istio – easily secure and manage microservices

#40

What happened to dumb pipes, smart endpoints? We do the same things again that we did before with SOA, having hard-to-replace middleware / bus systems.

The REST architecture always included the possibility of gateways and proxies in the end-to-end communication path to delegate shared responsibilities out of the user agent or origin server. This balances the need for centralized admin of some things and decentralized deployment of other things. Most microservices systems, even if they're not using HTTP in favor of something like gRPC, Kafka, or Rabbit, are taking a…

Very well put. From what I see this is like moving hysterix from the sidecar level to the network level. No need for applications to care of even know about leveraging the circuit-breaking. Very excited to try it out!
Post reply on HN