Live data from Hacker News

Google and IBM announce Istio – easily secure and manage microservices

developer.ibm.com

51–60 of 123 posts

Re: Google and IBM announce Istio – easily secure and manage microservices

#51

https://istio.io/docs/concepts/network-and-auth/auth.html No option for OAuth2 or JWT? Maybe I'm not understanding the problem Istio solves vs. Envoy

Good question. The auth work for this release is mainly focusing on service-to-service authentication. We are looking into adding OAuth2 and JWT support for enduser auth in the future release.

Disclaimer: I work on Istio

Re: Google and IBM announce Istio – easily secure and manage microservices

#52
post #44
post #29

There seems to be also other companies involved: Redhat: https://blog.openshift.com/red-hat-istio-launch/ Pivotal: https://content.pivotal.io/blog/pivotal-and-istio-advancing-...

and isn't the entire solution just packaging a proxy developed and open-sourced by Lyft?

Istio adds an automation layer on top of Envoy proxy mesh that allows global cross-cutting policy enforcement. Many of us actively contribute back to Envoy, and there's a lot of exchange of ideas between the two projects on designing the next generation of the config for Envoy.

Re: Google and IBM announce Istio – easily secure and manage microservices

#53

https://istio.io/docs/concepts/network-and-auth/auth.html No option for OAuth2 or JWT? Maybe I'm not understanding the problem Istio solves vs. Envoy

Good question. The auth work for this release is mainly focusing on service-to-service authentication. We are looking into adding OAuth2 and JWT support for enduser auth in the future release. Disclaimer: I work on Istio

Cool. Also - what does Istio use for persistence? I imagine it's gonna persist the data for auth'ing stuff somewhere.

Re: Google and IBM announce Istio – easily secure and manage microservices

#54

https://istio.io/docs/concepts/network-and-auth/auth.html No option for OAuth2 or JWT? Maybe I'm not understanding the problem Istio solves vs. Envoy

Good question. The auth work for this release is mainly focusing on service-to-service authentication. We are looking into adding OAuth2 and JWT support for enduser auth in the future release. Disclaimer: I work on Istio

BTW, if you are interested in Istio auth future work, here is the list: https://github.com/istio/auth#future-work

Disclaimer: I work on Istio

Re: Google and IBM announce Istio – easily secure and manage microservices

#55
post #49
post #3

Interesting, but there's currently a lot of overlap between competing things that want to inject themselves between service consumers and service producers. There's API gateway products (Apigee, Kong, etc). Load balancers and proxies of various types. Caching and CDN products. More niche stuff like bot blocking, and this attempt to bundle control and statistics. It would be nice if some sort of standard pattern emerg…

Regarding API gateway products, Apigee will actually work with Istio https://apigee.com/about/blog/digital-business/simplifying-m...

That's an example of the breakage though. Apigee's cloud runs in only 2 specific AWS regions. So once you tie all these pieces together, you end up with a long path, with some functionality that should be closer to the end user.

Re: Google and IBM announce Istio – easily secure and manage microservices

#56
post #26

Earlier quoted context omitted.

Maybe it depends on the size / complexity of the services. In the 'serverless' trend, such a middleware makes more sense. But essentially, moving too much logic into a middleware may support bad, lazy design decisions that make the middleware a single point of failure - like ESBs.

I'm a big fan of buses or perhaps more accurately I guess semi intelligent pipes with semi intelligent endpoints. I have used RabbitMQ (and Kafka at times) for large portion of my career and anytime I tell people this the bring up the single point of failure. The single point of failure arguments is getting really old and is fairly baseless particularly if your storage (e.g. RDBMS) or network (single zone or even mul…

> The single point of failure arguments is getting really old and is fairly baseless particularly if your storage (e.g. RDBMS) or network (single zone or even multi zone load balancer) is also not a single point of failure.

That sounds like multiple single points of failures, which just means you have more work to do, not that you can throw your hands in the air and say "welp".

Re: Google and IBM announce Istio – easily secure and manage microservices

#59

Earlier quoted context omitted.

Good question. The auth work for this release is mainly focusing on service-to-service authentication. We are looking into adding OAuth2 and JWT support for enduser auth in the future release. Disclaimer: I work on Istio

Cool. Also - what does Istio use for persistence? I imagine it's gonna persist the data for auth'ing stuff somewhere.

[deleted]

Re: Google and IBM announce Istio – easily secure and manage microservices

#60

Earlier quoted context omitted.

Good question. The auth work for this release is mainly focusing on service-to-service authentication. We are looking into adding OAuth2 and JWT support for enduser auth in the future release. Disclaimer: I work on Istio

Cool. Also - what does Istio use for persistence? I imagine it's gonna persist the data for auth'ing stuff somewhere.

If you're referring to where the key/cert is persisted, it's currently facilitated by Kubernetes' secrets and mounted into Envoy container

Disclaimer: I work on Istio

Post reply on HN