What is a Service Mesh? And Why Would You Want One?

Episode 274 · Fri, 15 Sep 2023 14:45:58 +0200 · 31:44 · SRT · archive.org · all Tanzu Talk

you know just real quickly we were talking about prince before we started streaming here and that reminded me that i was in the minneapolis airport recently and uh i'm happy to report that they have a prince gift store in the minneapolis gift store for the i mean airport for those who don't know that's where prince is from so i'd say that's quite specific but that makes sense yeah i didn't know that it was i i i don't you know i don't know about about youtube but so often i'll see something like you know of course like a a faux vintage purple rain t-shirt or when i was in des moines iowa and there was just kind of like a faux 70s style des moines t-shirt and my first thought is i should buy one of those because that's cool and then i'm like i don't know i got enough t-shirts and then here i am thinking like man why didn't i buy those shirts like of course you should buy those those would be great and just throw out some you know conference shirt that i got a while ago i don't need that anymore and and uh of course you want a purple rain shirt well speaking of purple rain uh i thought this episode well you know uh we're all three back together again it's been a while we've been on a uh a summer hiatus which is fine uh i think it's good to have hi hiatus see is hiatus latin i should look that up hiatus hey hi hi hi hi yeah it's a country isn't it it's also good to have my tie oh yes guys on your holidays but i thought we would come in i think i forget when this was published but there was a uh there was kind of a gartner overview of what service mesh is i was just at sre day in london uh yesterday uh um and i saw a talk um from one of the the solo guys i i'm i'm thinking it's it was alessandro sorry if i got that wrong but he was going over service mesh stuff and you know i always wonder what a service mesh is so it was i thought it'd be a good time to check in now ed of course here here's here's the lineup that i'm thinking we're gonna have one i'm just gonna be like what is the deal with service meshes right like that's that's my role as always and i think i think you

know ed you follow all this stuff closely so you know what we're supposed to think about service meshes like you know you've got like the the analyst things right and and i think i think for those listening the kind of like maybe head head shake is exactly what we're supposed to be thinking about service meshes at the moment so good job and then ben what what i'm gonna ask from you is like why don't we just use spring cloud right like like it seems like this is this is a weird category of stuff that that i don't know but let's let's start with that is like i i remember uh man golly three years ago or more like i had someone i interviewed someone on my other podcast software to find talk uh uh from the istio project and i was yeah i was i was basically like i don't understand what the service mesh thing is right like i i i keep reading about it and like and i also don't understand exactly what istio does and i think that was also the point where knative was something than it otherwise so i get confused about knative every now and then uh you know to me the the cloud native orchestration word world is just like you know you made you made a gumbo and tripped on the way out of the kitchen and it's kind of all there on the floor it's delicious it smells good but you're trying to make sense of it like uh to use another latin word like the the hoss bricks you know who would like look at the intestines of a bird to tell the future um but moving on uh like tell me you two tell me if i'm wrong but my understanding of a service mesh let's start with the definition is that as the gartner overview said of course you could do this with vms but essentially it's if you have a kubernetes based platform and inherently again you can always do the bad things that you're not supposed to uh with this stuff but if you have a kubernetes stack the application architecture you're

supposed to have is what uh older gentlemen like me would call a distributed application which is to say you break an application into different components that collaborate over a network uh even if that's a fake network but basically they're going to be making calls over a network maybe it's an event-based system but you don't just have like one chunk of code that's that's coordinated with each other you've got these components that are working over a network and i think the notion of a service mesh is that like this is the first Coté is is just like shocked that gambling's going on in in kubernetes is is is like it turns out i think that kubernetes doesn't do that and so you need this whole other layer of a service mesh that basically coordinates uh your your different the components of your application finding each other coordinates how they communicate with each other and coordinates most importantly for our enterprise world the security and access control of it and then also since we're in the uh the multi-cloud uh uh camp of of uh the cloud native world also what a service mesh does for you and maybe other things do this is it allows you to link together um previously what's the word disparate distinct previously their own kubernetes world so that if i had if i had a kubernetes install i mean i guess it could be on the on the i have one running on this side of the wall and another running on that side of the wall or it could be on different sides of the atlantic ocean these are different is the word you use cluster i don't know my vocabulary well i told you i was going to be playing the village idiot all of you about different clouds different clusters right so you're different you've got you've got different kubernetes kubernetes eyes i don't know how to pluralize greek kubernetes i no i don't think kubernetes eyes and and you want to basically have uh them communicate with each other and then a service mesh can do that for you as well and then

as with any time when you're doing networking stuff if you want to which you usually do if you want to drag in like i was mentioning you know access control and certificate management and load balancing and all that kind of stuff that you can do at layer six i i've lost track of the seven layer like uh networking burrito which layer is which but you can kind of push that stuff down in into the networking layer as opposed to the application layer and i think that's what a service mesh does is that in the ballpark that's what i think it does yeah yeah yeah i mean i was gone oh no no go ahead i was just gonna fill dead air i mean i've so my problem is that i'll go off and i'll read about service mesh i'll understand what it's telling me which is largely what you just said at very high level i i can read and get more about the low level and then two months later someone asks me about it and i have forgotten a lot of the detail and i just come back to this same thing in my head my analogy has always been actual sort of real traffic and google maps so i'm like real traffic like if i want to drive off across my little island okay it's small i don't have far to go but you know said maybe it's a multi island who knows either way if i want to go off to somebody else's house and see all my mates it was easy when we were all small and we all lived a mile away and then we all broke up and we all went off to different places now suddenly i have to drive off to see them and someone's got to coordinate all the traffic the network pipes and stuff all there right the roads and the traffic lights but i go to something like google maps to say actually what route should i take to get from here to there and it will show me and it will show me things like traffic bottlenecks so if there's too much traffic in one place it will show it red and it might well say you know what it'd be quicker if you went that way not this way and i kind of look at service meshes being that overlay on top of just the road system yeah but you control it you know google maps for me is i i can't say you know what stop all that traffic down my road and let only me go down it please or let me and my five friends go down it whereas in service mesh land you can you can say great you know send all my blue cars this way send all my green cars that

way it just lets you have more control and visibility and like you said secures always you know i've got roadworks outside my house right now so they've shut the road and that's another thing the security is right you can pass you can't it just lets you regulate all that traffic pick and choose where it goes and visualize it all in real time in a way that as you said kubernetes wouldn't provide out the box that traffic would still be flowing but in a very chaotic random manner that you wouldn't have visibility into no that makes sense well first of all i've been having some mic problems so if my audio sounds annoying i apologize but it's only in stream yard which we record this in and also in chrome and zoom it's fine i don't know and in other areas so so maybe one day i'll fix that uh hopefully soon but but yes following up on what you were saying ed i guess after all these years and we of course sell a service mesh so i'm not going to be too negative about it of course uh because why would i it's great uh but it does seem like if you boil down there's two other than what it does there's two reasons that you use a service mesh one is that kubernetes doesn't do what a service mesh does and so you need that but then i think too that the even more compelling reason that maybe emerges is as you were saying you can you have more control over the flow of network traffic and therefore because the applications you're running in kubernetes are distributed applications because they need a network to function you have a lot of control over how your applications are executing and what the applications are doing so it's really just like you just have more control which in general especially if you're my bank i want you to have as much control as possible i i appreciate that like it's it's great yeah i think the challenges have been like so the the difference for me google maps is as simple as it can be i can fire that out in an app on any device i've got i seal my roads i click with a finger i'm done and if service mesh were that easy i suspect

everyone would have one buy one everything's great yeah but they are not as easy to implement right they have this extra you know the sidecar pattern all these extra technical constraints they have and operational concerns people who need expertise in service message to operate them and that seems to be one of the big stumbling blocks in terms of the adoption and and i think that's like that's the part to go back to the the thing both of us have said but especially me it's like it is it seems like something that should just be built into kubernetes not only because like conceptually at least to me it seems like isn't that what that does but also i i mean i feel like maybe the lesson the lesson one of the lessons of if you remember software defined networking i remember spending a lot of time trying to figure out what that was but it was kind of similar where i don't think there was like a standard it was just like an outcome that people were looking to achieve and so there were all these different ways to do it and then that was just a lot of cognitive overload and and also compatibility problems so it seems like if you just made it part of kubernetes just like with a lot of stuff in kubernetes it would just be like standardized but i don't know that's that's not how it is i suppose which which brings me to so ben like you know you you you are the one who has programmed much more recently than me since i stopped programming in 2005 but it feels like a lot of what a service mesh is trying to accomplish like first we had jndi which did that sort of and and then like and now i mean it's not only spring cloud but now at the application layer you have like spring cloud and and spring cloud is a whole bunch of different stuff but you basically have like built into i think most every enterprise programming stack is a concept of uh i'm i'm i'm a

little teapot i'm i'm a little chunk of code and i need a network connection to connect to another little chunk of code to hang out with it and so therefore i need a registry so i can look up the other chunks of code i need a way of getting that connection and it also needs to be secured and configured right and it seems like this is always my maybe naive view of networking stuff is just like well one doesn't that exist already and is this really just a way to not have to schedule a meeting with with like the network admin like like like it seems because it seems like what you'll end up with is you'll have a service mesh so one you would have your like whatever you know your router configuration is your your network admins and then you might even have your your virtualization admin setting things up and then you're gonna have your kubernetes admin setting up their service mesh and now you've got three network configurations going on and then the developers don't want to talk to any of those people so they're going to be like hey what if we just do our own service mesh layering and then we never have to talk to those people and it seems like you would just go all the way down the stack and be like what if we talk to that original network admin and we had them do this but i i don't know what uh am i am i making up some tempest in a teapot here no i think i think there's some truth in that um i i think i think it there's a huge amount of it depends to this whole conversation really isn't it um you're right when you mentioned that there are alternative mechanisms for doing much of what exists in a service mesh you know you mentioned spring cloud has some uh things in there like spring cloud gateway that will give you access to all sorts of features like load balancing and you have stuff in spring for observability around micrometer and things um there's all sorts of options in

there but of course you got to remember not everyone's writing spring right if you're writing python or whatever it's not really it's not it's not naturally your first choice right it it you you still you still but there are options okay so so what you're saying is true there are there are options and i think even in kubernetes land there are options you know if you if you want to do um service discovery there's a way to do that in kubernetes with the built-in dns features right but it depends on on your point of view if your point of view is that you would like ubiquity and control then a service mesh might be ideal for you but if you have the point of view that it is complex which a lot of people seem to have or that it slows you down or that it adds a degree of um cognitive load that you don't want then maybe you'll be quite happy with some of you know mix and matching some alternatives that already exist out there that are closer to your stack and closer to the way that you work so yeah it's it's a challenge because it's a there's a great deal of it depends it depends on on your enterprise and what it is that you're trying to achieve and your point of view and and and i get you know the other thing you're you're bumping up against there well intentionally or or or you're uh playing around with is the idea of like yes all of that's true and there's very rarely a uh well architected kind of rational stack that you can work with right like you often have a bunch of incompatible things that weren't built together and then you've got to span different geographies and zones and so like you can't just like you you actually are forced to deal with various layers that that you have and then even kind of like we were

talking about ed like you need something that lets you control all of this mess because like for whatever reason or prioritization you can't go fix it right like like you can't you can't take the time to make it all like to go and have that meeting with the the networking admin and just fix all 500 of your applications and and how they uh how they use the network but you could you know layer a service mesh in there which would allow all the current behavior of how applications work they could do all their own stuff but it would give you a huge amount of control to essentially secure and manage all the network traffic that you have which again sounds like something i would like my bank to do that that sounds great i i that's my new that's my new use case for everything is like i don't i don't want my bank innovating i i would prefer they just stay exactly the same and uh not ever try anything new uh yeah well that's that's kind of i mean that that that gets to another area of kind of uh abstract thinking which is like i'm i'm starting to wonder if that picture that i was just painting is it's a little un devopsy and that you're we're intentionally building a stack where we have these layers that are almost like silos that we've knocked over instead of them being vertical and we're totally cool with having these layers of people who don't coordinate and talk with each other like the networking layer the infrastructure layer and then we we and then you just let the application developers do whatever they want within this like very controlled uh environment uh i think it's decoupling is what you described it's not it's not the idea that i don't want to talk to anyone it's the idea that if you can decouple the dependencies between those layers and those folks to a certain extent they can all get on with what they're good at and not spend countless hours in meetings debating rfc protocols right yes if anything i mean it should make the fact even if they

if that becomes a technology silo in terms of a separate application but it doesn't necessarily become a silo from a process point of view i mean a if it's sort of designed from the ground up being devopsies should we say then potentially it can all be automated and built in and integrated to whatever processes you've got but like ben said i think it's a decoupling it's right the idea especially the service mesh is the application developers don't have to care about that it takes some stuff off their plate and if the network guys just built it in like i said ideally if it was just built into kubernetes anyway then the kubernetes team operate it you don't even need your network team to be involved sort of thing or it's just part of but it's the decoupling and just you know that being the whole point of abstractions right it makes life simpler for people because they only have to worry about certain considerations um but it feels to me like service mesh isn't necessarily it hasn't nailed the abstraction level you know is it right to have that the network team doing it or do some people want some of that stuff sort of at the development stack level do you put it in spring cloud do you put it in you know i think dapper's one that i've seen which was originally microsoft thing wasn't it but is now sort of a cncf one but again that's like a middleware layer uses sidecars overlaps with a lot of the service mesh mesh functionality but is geared more at developers not at like a platform team in the same way so they sort of see that some of that functionality might be better off at that persona level um and it just clearly doesn't resonate with everybody that this is the right thing they want this is an abstraction they need yeah yeah yeah it does seem to have failed to deliver on a certain amount of promise perhaps you know if we're looking back at it retrospectively and thinking about i don't know the last five years of service mesh discussions seems to have not been as pervasive as hoped and not um been as highly adopted as hoped and when you sort of retrospect on the reasons why that might be there there are several and you know we've talked about some of them already complexity definitely an issue um consistency uh getting folks consensus as well around service

mesh actually building a consensus around it it's probably very difficult so there yeah there it seems to be a certain amount of not not quite delivered on the promise yet so maybe there's more to come maybe there's there's ways to make it even simpler bake it into platforms you know right at the start so that the introduction of a service mesh isn't isn't as jarring as it perhaps is if you come along and do it later yeah yeah yeah yeah that was that was one of gartner's sort of recommendations in this report wasn't it so they basically pulled up the same of you know that it hasn't seen the success or the adoption that was maybe expected from it um and that they didn't really see that changing um and also that one of the things you do you know a lot of people do bundle in a service mesh with a platform to look at those um and i wasn't you know there were a bunch of things in there that i guess from the vmware point of view were very good the the things they said they felt a service mesh should be doing to be successful which is what we talked about multi-cloud multi-whatever you know connecting disparate meshes or being an overlay on top offering management at scale all the things that our product is sort of geared towards it's the one or one of the use cases where they did see value in them and say these ones may be the successful ones um and that might be also you know we had this other report i don't know if we mentioned it or not giga rom did a report um and that's more of a just comparison of service meshes we say rather than a state of the industry but we scored very well in that one as well we can put those in the show notes oh this was a radar wasn't it i love a good radar yeah yeah i love a good radar how close are they how close are they uh you got to watch your back with the radars haven't you uh yeah you know i i i like the framing or framing is like a rhetorical thing but i like the um why does this thing exist explanation that we're getting to which is like another way of putting it is that like so you have your application developers and to put it very broadly like you don't really want them worrying about networking issues outside of

their own application right like and versus like the whatever you want i'm going to say the operations people the people running all this stuff instead of focusing on the application development like they're the ones who can worry about like your multi-site kubernetes stuff like what networking issues are as far as your ingress and egress once it's actually on the public internet and like all of that sort of stuff is sort is like not really anything you want your application developers dealing with right like inside their application sure they can do whatever they want uh and and if that's the case it does make sense almost to some to some extent that your service meshes this kind of external thing like a tool that you choose that fits the needs that you have to fit into your like multi-cloud setup and that and and equally you don't really want kubernetes assuming that it knows what you need like you want you want to keep the core of kubernetes pretty small and just focused on uh you know kind of its orchestration and it's it's uh being an api and a specification for how to do all this stuff and then you get that that that not only like security controls but also just like performance controls and stuff i don't really know anything about network administration but i think they do that kind of thing i i like that idea too the idea that you know actually it's it's what you can relieve folks from having to deliver you know look don't worry about observability we've got this apm monitoring built in through the service mesh right you don't need to worry about it we know every traffic call that's going anywhere we know exactly what if your cpu is spiking we know about it if you're running out of memory we know about it you know just don't worry about that stuff it's all sorted you know that's great that's our bill quadrupled this month because of egress charges but we can see that it's fine it's it's kind of like i i forget what there's some practice that emerged

what is it even like xp.io where like developers would set up these like really easy to make uh public domain names that you could use that would just loop back to to you know localhost or whatever i forget what these urls are but it's it was it's one of those services where it's like well we could go and actually do regular internet dns setup or we could just use this faked out thing that we have right and and it's a similar thing of just like removing the need to actually do real network administration you know it's it's like my my my uh uh i don't know not perennial but any chance i get i make the snarky comment of like you know it sounds like a lot of what we've been doing for the last 15 years we if we just had fixed dns we could have saved a lot of time like at some point someone should realize like well maybe you should fix how this works if it's so complicated has anyone thought of that uh but but apparently not uh instead we put up with it we were the fundamental substrate that you have an issue with then the fundamental substrates of the internet as long as we just fix all this yeah it's just like i mean again i'm a naive application developer but it's like i just have a string that i want to go to this set of numbers and that's it like how hard can it be right like that's in the comments right yeah distributed name system you make something distributed it gets more complex and we thought that seems good let's do it to everything and now you have kubernetes and even more complexity i don't know you're just you're just like a a record c names what is all this who needs this well yeah i i think well that that's that's uh i think that makes a lot of sense i mean it is it's similar to software defined networks for like you can't really have a standard but you can have the uh the the outcomes around that well i i think we've solved that problem uh yeah really got that that cinched up that's that was easy yeah so i think you know just to just to bring it in the talk

that i saw um alessandro giving right like he he it was it was an sre day right and and it is kind of a uh a validation but it kind of adds the direction we're going is he did kind of articulate like and therefore if you look at what a service mesh does it makes sense that an sre would be interested in using it to accomplish many of their goals right it allows you to have a lot of control over and and kind of they don't say promises but establishing a contract your your your slo is with people that we can kind of like you were saying ed like don't worry about the cost we can monitor that and kind of deal with it when it happens and uh you know that's that's i don't know if that has anything to do with sre stuff but it does make sense that it would be a good tool for an operations person to use to have a lot more control over that versus to use my jokey thing like oh now we got to go talk to the network admin right like you have the um uh uh your layers of abstraction what did you say ben component realization yeah well decoupling decoupling that's the one that's that's supposed to be good decoupling always preferable it's not if you're in the last train car that's you want some strong coupling it's been a very strong coupling there yeah i guess i guess with automobiles that's a decoupled architecture but a train is uh is is uh coupled that's almost i i always shy away from metaphors and programming because you might as well just talk about the actual programming but uh there are there's a lot of efficiencies in coupling just like with trains versus uh you give up a lot of efficiencies to have the agility of a uh of a car system uh but but that's nice like if you take an uber from uh even from like canary island canary canary wharf to london city airport you're gonna see a lot of different things as the car agilely goes to the neighborhood versus just taking the uh the regular

train there anyhow uh yeah well we'll put some some links to uh the the reports that we were going over and uh you know we also have i should mention there's a couple of things coming up we had vmware explore uh already in the us but the um the uh the the this part of the world the europe one is coming up the first week of november is that right ben yeah that's right and ed you were in the us uh maybe you could tell us how it was uh in a second but yeah that's right the first week of november i think it's november is it third through six something i think it might be sixth to ninth but again i'm not 100 on that that's the right answer thank you if you just search for a vmware explorer eu it'll be in barcelona and uh uh i think we've got one in singapore haven't we so yes there's a lot of explorers going on and uh i'll i'll be i'll be involved in two talks there uh which will be nice and then ben you're going to be at backstage con which i am i'm really excited about that i can't tell you how excited i am about that it's going to be awesome yeah i mean that's you're giving a talk right you're not just attending your speaking yeah i've got a i've got a brief uh stint as a speaker at uh backstage con i think that is uh the day before cubecon starts proper right because it's one of the uh sort of uh adjacent conferences to uh cubecon in chicago in november yeah yeah and then and then also just the the last of things on october 9th we have a SpringOne tour in amsterdam where i will be there that's your hometown oh my word you'll be so in demand you'll be telling folks where stuff is and exactly i'll uh i'll be emceeing it and hosting the q a at the end and then uh we have a another SpringOne tour coming up october 12th in london uh so if you're if you're in amsterdam

or uh or london and you're interested in programming and especially if you're interested in java or spring programming that'll be a great chance to just it's a good free educational event um and as i as i like to only not half joke i mean fully fully not as as i seriously it's a serious comment that is also a joke there you go that like you know it beats actually doing your real job but it's a legit like you don't have to take a holiday to go do it because it's a continuing education so you should definitely come to it uh since it's great and free well with that as always this has been uh tanzu talk if you want to get the show notes we mentioned uh see the conferences we suggested if you go to tanzutalk.com you can find this episode and see it or if you've watched the video you should be able to see it uh below there and with that we'll see everyone next time bye bye good job waving that was that was classic

Tanzu Talk · 🍕 Get more pizza.