6 ms·

AWS Mesh Generally Available

94 points by aginovski 8y ago

erulabs 8y ago
Envoy must have one of the fastest adoption stories in the history of FOSS. It is excellent software, although the space is full of contenders - Traefik and Istio are also exciting projects!
- cc81 8y ago
  Istio uses Envoy.
- stock_toaster 8y ago
  And linkerd (2.0) too.
  - inquisitiveio 8y ago
    I'm pretty sure linkerd 2 has switched to their own rust/tokio based solution
    - spockz 8y ago
      They do and that is why they are a contender. Not a user of envoy.
- manigandham 8y ago
  Istio is service-mesh software with several components and the data plane is Envoy. Linkerd 2 is a competitor with its own data plane. Traefik is not a service mesh, it's a webserver and reverse-proxy and similar to Nginx and HAProxy, although all of them have been trying to get into this space along with Kong and others. In the other direction there's also Heptio Contour and Datawire Ambassador that use Envoy as a reverse-proxy.
- philip1209 8y ago
  Kong has a service mesh now, too
jcims 8y ago
Currently we wire all of our VPCs into a large network to access services, and that brings with it all of the associated security concerns. I wonder if moving to something like this would allow us to eliminate the global network and let VPCs run in an isolated context save for services published via mesh.
- femto113 8y ago
  Look into VPC Endpoint Services, it may address your use case. "You can create your own application in your VPC and configure it as an AWS PrivateLink-powered service (referred to as an endpoint service). Other AWS principals can create a connection from their VPC to your endpoint service using an interface VPC endpoint. You are the service provider, and the AWS principals that create connections to your service are service consumers." https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-service.html https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-se...
  - jcims 8y ago
    Thank you, actually doing a POC of that now and to your point it's probably a more appropriate solution to the problem. Appreciate the suggestion!
wstrange 8y ago
I really wish Amazon would have contributed resources to istio instead of rolling their own mesh...
rocgf 8y ago
> App Mesh uses the open source Envoy proxy, making it compatible with a wide range of AWS partner and open source tools. Yet another Amazon product based on open source software, while still contributing almost nothing to this space.
- lawnchair 8y ago
  https://github.com/envoyproxy/envoy/blob/master/LICENSE https://github.com/envoyproxy/envoy/blob/master/LICENSE Permissions: Commercial use, Modification, Distribution, Patent use, Private use
  - rocgf 8y ago
    Apologies, I'm not sure if you are disagreeing with me in any way or not. :) Envoy is indeed open source and freely-available for corporations to use. That is not what I was implying. Amazon, out of all the big companies (Google, Netflix, Microsoft etc.), is the one with the least contribution to the open source world, despite using many of open source tools to build their AWS products.
    - scarface74 8y ago
      If you make something open source and free for anyone to use, don’t complain when anyone uses it. That’s kind of the point.
      - IshKebab 8y ago
        No it isn't. Just because users aren't legally required to contribute doesn't mean that they don't have a moral duty to support the project, if they can. Given Amazon's vast resources I think it is reasonable to feel that they should help out a bit.
    - cthalupa 8y ago
      Is this really true, though? Looks like Amazon has multiple github accounts with lots of projects, including some high profile ones like Firecracker, etc. This has become a bit of an interesting topic to me because it keeps being brought up by people who sort of just state it as fact without providing any real argument. How much is enough? One full time developer? Ten? What if the project doesn't want to merge their contributions? Amazon just got killed on HN for open sourcing all of their ElasticSearch work in a separate repository. I feel like they can't win on open source with some of you guys.
sbr464 8y ago
Also check out Ambassador, which uses Envoy too. Friendly team and easy to grok API.
sbr464 8y ago
Is there a planned date when Mesh will be added to the AWS HIPAA covered services list? Didn’t see it currently listed.
- BurritoAlPastor 8y ago
  AWS generally doesn’t announce dates for BAA coverage ahead of time, but your account manager may be able to give you a heads-up a couple weeks beforehand if you ask.
  - sbr464 8y ago
    Thx, probably a common question, but service routing is a hot topic, looking forward to the announce.
sbr464 8y ago
Can Mesh transparently route/redirect to non-AWS URLs, without deploying another service to handle that need?
- jtoberon 8y ago
  Yes. An example can be found in the issue about making this simpler to set up: https://github.com/aws/aws-app-mesh-roadmap/issues/2 https://github.com/aws/aws-app-mesh-roadmap/issues/2.
Cacti 8y ago
One more new cloud service intended to fix what’s wrong with existing cloud services. At what point do you just go back to traditional app architecture with normal servers?
- bg24 8y ago
  My understanding is that it solves a specific customer problem by seamlessly connecting the workloads running on various forms (ec2, ecs, k8s etc.).
- manigandham 8y ago
  This is all running on normal servers. A service mesh is about communication. If you're doing any kind of communication between components then that has to be facilitated somehow, and production requirements like security, retries, load-balancing, observability, etc have to live somewhere. A mesh just extracts it all into a single external system.
ris 8y ago
I thought AWS Xray was the non-transferrable skill that you were supposed to pour your time into and amalgamate into your project to solve this problem. Always space for one more I guess!
- cthalupa 8y ago
  X-Ray is for tracing your overall application across multiple services/components. It's more akin to New Relic and similar products.
trpc 8y ago
Again, AWS proves to be shamelessly exploitative of others' work and success. This must be a culture there or something.
- yjftsjthsd-h 8y ago
  > shamelessly exploitative of others' work and success i.e. using open source under the published license? Look, I'd prefer that everyone using open software supports it with public patches, but if it's not under A/GPL or something, then clearly the authors weren't so worried about it. If you don't like others using your work without publishing their changes, use A/GPL. If you don't like others using your work without paying you, go with shared source (and accept that you're writing proprietary software) or use a noncommercial license or something. But don't publish something and then complain that people used it under the exact terms that you published it!
- ralusek 8y ago
  Hey, don't use it.
guhcampos 8y ago
I can't really disagree with Redis here. Traditional licenses forced you to contribute back if you used community's code. SaaS changed everything: you can now "leech" software without giving back. We need a new model. We need to force contribution, because software corporations won't give back otherwise. I've worked for big corps and the bureaucracy will not allow it, even if developers wish to. If we don't force legal departments to comply we will lose the whole culture of freedom we've built in the past 40 years.
- manigandham 8y ago
  What freedom has been lost? You're free to build what you want and others are free to use it by the license you set. Forcing contribution would actually remove freedom.
- SlowRobotAhead 8y ago
  >We need to force contribution I’m interested in your proposed mechanism for that!
  - hopler 8y ago
    After GPL solves this exact problem. The new problem is that no one wants that solution because massive cloud deployments ate business projects not open source hobby nrojects
  - paulryanrogers 8y ago
    Perhaps they meant force contributing back improvements they're already making. I imagine AGPL may be what they had in mind. EDIT: fixed typo
- jjeaff 8y ago
  I think it would be reasonable to require that if you use the open source software for commercial reasons, you must also open source your modifications. The real problem is companies building their proprietary solutions on top of free labor. If they at least had to open source then that would hold back their competitive advantage they are trying to create by not contributing.
reilly3000 8y ago
How does App Mesh vs Istio shake out? I’ve been reticent to use Istio on GKE but it seems to offer some great features. Something with this basic feature is pretty useful with just a few more micro services, than I current manage.
- greyskull 8y ago
  I'm not super well versed frankly but my attempt: They're both control planes for envoy proxy. App Mesh is a managed proprietary solution, Istio is open source and self-hosted but there are managed options available. Istio explicitly supports k8s and consul; app mesh doesn't care where the envoy proxies run (great for migrating). I _think_ Istio is a full knowledge model where everyone knows about everyone else in the mesh, App Mesh is explicit. The configuration pushed to the proxies only have the targets that have been modeled as such in the app mesh model (great for larger organizations). App Mesh roadmap: https://github.com/aws/aws-app-mesh-roadmap https://github.com/aws/aws-app-mesh-roadmap Istio's: https://istio.io/about/feature-stages/ https://istio.io/about/feature-stages/
etaioinshrdlu 8y ago
I actually don't understand what problem this and other API gateways solve? Let's say I have a bunch of services calling each other. Which I already do... Why should I add this?
- trpc 8y ago
  This is a service mesh like Istio not an API gateway, it's mainly used for automatic and transparent service discovery and load balancing where client and server service endpoints don't have to worry about that, also other features are automatic handling of failure when one server endpoint isn't responding, traffic management, securing communications between services, enforcing L7/L4 kind of a firewall between services, telemetry, etc..., you probably don't want to use a service mesh like this until your software architecture gets really complex
- williamallthing 8y ago
  Is this helpful? https://buoyant.io/2017/04/25/whats-a-service-mesh-and-why-do-i-need-one/ https://buoyant.io/2017/04/25/whats-a-service-mesh-and-why-d...

94 points by aginovski 8y ago

Envoy must have one of the fastest adoption stories in the history of FOSS. It is excellent software, although the space is full of contenders - Traefik and Istio are also exciting projects!

cc81 8y ago
Istio uses Envoy.
stock_toaster 8y ago
And linkerd (2.0) too.
- inquisitiveio 8y ago
  I'm pretty sure linkerd 2 has switched to their own rust/tokio based solution
  - spockz 8y ago
    They do and that is why they are a contender. Not a user of envoy.
manigandham 8y ago
Istio is service-mesh software with several components and the data plane is Envoy. Linkerd 2 is a competitor with its own data plane. Traefik is not a service mesh, it's a webserver and reverse-proxy and similar to Nginx and HAProxy, although all of them have been trying to get into this space along with Kong and others. In the other direction there's also Heptio Contour and Datawire Ambassador that use Envoy as a reverse-proxy.
philip1209 8y ago
Kong has a service mesh now, too

jcims 8y ago

Currently we wire all of our VPCs into a large network to access services, and that brings with it all of the associated security concerns. I wonder if moving to something like this would allow us to eliminate the global network and let VPCs run in an isolated context save for services published via mesh.

femto113 8y ago
Look into VPC Endpoint Services, it may address your use case. "You can create your own application in your VPC and configure it as an AWS PrivateLink-powered service (referred to as an endpoint service). Other AWS principals can create a connection from their VPC to your endpoint service using an interface VPC endpoint. You are the service provider, and the AWS principals that create connections to your service are service consumers." https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-service.html https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-se...
- jcims 8y ago
  Thank you, actually doing a POC of that now and to your point it's probably a more appropriate solution to the problem. Appreciate the suggestion!

wstrange 8y ago

I really wish Amazon would have contributed resources to istio instead of rolling their own mesh...

rocgf 8y ago

> App Mesh uses the open source Envoy proxy, making it compatible with a wide range of AWS partner and open source tools. Yet another Amazon product based on open source software, while still contributing almost nothing to this space.

lawnchair 8y ago
https://github.com/envoyproxy/envoy/blob/master/LICENSE https://github.com/envoyproxy/envoy/blob/master/LICENSE Permissions: Commercial use, Modification, Distribution, Patent use, Private use
- rocgf 8y ago
  Apologies, I'm not sure if you are disagreeing with me in any way or not. :) Envoy is indeed open source and freely-available for corporations to use. That is not what I was implying. Amazon, out of all the big companies (Google, Netflix, Microsoft etc.), is the one with the least contribution to the open source world, despite using many of open source tools to build their AWS products.
  - scarface74 8y ago
    If you make something open source and free for anyone to use, don’t complain when anyone uses it. That’s kind of the point.
    - IshKebab 8y ago
      No it isn't. Just because users aren't legally required to contribute doesn't mean that they don't have a moral duty to support the project, if they can. Given Amazon's vast resources I think it is reasonable to feel that they should help out a bit.
  - cthalupa 8y ago
    Is this really true, though? Looks like Amazon has multiple github accounts with lots of projects, including some high profile ones like Firecracker, etc. This has become a bit of an interesting topic to me because it keeps being brought up by people who sort of just state it as fact without providing any real argument. How much is enough? One full time developer? Ten? What if the project doesn't want to merge their contributions? Amazon just got killed on HN for open sourcing all of their ElasticSearch work in a separate repository. I feel like they can't win on open source with some of you guys.

sbr464 8y ago

Also check out Ambassador, which uses Envoy too. Friendly team and easy to grok API.

sbr464 8y ago

Is there a planned date when Mesh will be added to the AWS HIPAA covered services list? Didn’t see it currently listed.

BurritoAlPastor 8y ago
AWS generally doesn’t announce dates for BAA coverage ahead of time, but your account manager may be able to give you a heads-up a couple weeks beforehand if you ask.
- sbr464 8y ago
  Thx, probably a common question, but service routing is a hot topic, looking forward to the announce.

sbr464 8y ago

Can Mesh transparently route/redirect to non-AWS URLs, without deploying another service to handle that need?

jtoberon 8y ago
Yes. An example can be found in the issue about making this simpler to set up: https://github.com/aws/aws-app-mesh-roadmap/issues/2 https://github.com/aws/aws-app-mesh-roadmap/issues/2.

Cacti 8y ago

One more new cloud service intended to fix what’s wrong with existing cloud services. At what point do you just go back to traditional app architecture with normal servers?

bg24 8y ago
My understanding is that it solves a specific customer problem by seamlessly connecting the workloads running on various forms (ec2, ecs, k8s etc.).
manigandham 8y ago
This is all running on normal servers. A service mesh is about communication. If you're doing any kind of communication between components then that has to be facilitated somehow, and production requirements like security, retries, load-balancing, observability, etc have to live somewhere. A mesh just extracts it all into a single external system.

ris 8y ago

I thought AWS Xray was the non-transferrable skill that you were supposed to pour your time into and amalgamate into your project to solve this problem. Always space for one more I guess!

cthalupa 8y ago
X-Ray is for tracing your overall application across multiple services/components. It's more akin to New Relic and similar products.

trpc 8y ago

Again, AWS proves to be shamelessly exploitative of others' work and success. This must be a culture there or something.

yjftsjthsd-h 8y ago
> shamelessly exploitative of others' work and success i.e. using open source under the published license? Look, I'd prefer that everyone using open software supports it with public patches, but if it's not under A/GPL or something, then clearly the authors weren't so worried about it. If you don't like others using your work without publishing their changes, use A/GPL. If you don't like others using your work without paying you, go with shared source (and accept that you're writing proprietary software) or use a noncommercial license or something. But don't publish something and then complain that people used it under the exact terms that you published it!
ralusek 8y ago
Hey, don't use it.

guhcampos 8y ago

I can't really disagree with Redis here. Traditional licenses forced you to contribute back if you used community's code. SaaS changed everything: you can now "leech" software without giving back. We need a new model. We need to force contribution, because software corporations won't give back otherwise. I've worked for big corps and the bureaucracy will not allow it, even if developers wish to. If we don't force legal departments to comply we will lose the whole culture of freedom we've built in the past 40 years.

manigandham 8y ago
What freedom has been lost? You're free to build what you want and others are free to use it by the license you set. Forcing contribution would actually remove freedom.
SlowRobotAhead 8y ago
>We need to force contribution I’m interested in your proposed mechanism for that!
- hopler 8y ago
  After GPL solves this exact problem. The new problem is that no one wants that solution because massive cloud deployments ate business projects not open source hobby nrojects
- paulryanrogers 8y ago
  Perhaps they meant force contributing back improvements they're already making. I imagine AGPL may be what they had in mind. EDIT: fixed typo
jjeaff 8y ago
I think it would be reasonable to require that if you use the open source software for commercial reasons, you must also open source your modifications. The real problem is companies building their proprietary solutions on top of free labor. If they at least had to open source then that would hold back their competitive advantage they are trying to create by not contributing.

reilly3000 8y ago

How does App Mesh vs Istio shake out? I’ve been reticent to use Istio on GKE but it seems to offer some great features. Something with this basic feature is pretty useful with just a few more micro services, than I current manage.

greyskull 8y ago
I'm not super well versed frankly but my attempt: They're both control planes for envoy proxy. App Mesh is a managed proprietary solution, Istio is open source and self-hosted but there are managed options available. Istio explicitly supports k8s and consul; app mesh doesn't care where the envoy proxies run (great for migrating). I _think_ Istio is a full knowledge model where everyone knows about everyone else in the mesh, App Mesh is explicit. The configuration pushed to the proxies only have the targets that have been modeled as such in the app mesh model (great for larger organizations). App Mesh roadmap: https://github.com/aws/aws-app-mesh-roadmap https://github.com/aws/aws-app-mesh-roadmap Istio's: https://istio.io/about/feature-stages/ https://istio.io/about/feature-stages/

etaioinshrdlu 8y ago

I actually don't understand what problem this and other API gateways solve? Let's say I have a bunch of services calling each other. Which I already do... Why should I add this?

trpc 8y ago
This is a service mesh like Istio not an API gateway, it's mainly used for automatic and transparent service discovery and load balancing where client and server service endpoints don't have to worry about that, also other features are automatic handling of failure when one server endpoint isn't responding, traffic management, securing communications between services, enforcing L7/L4 kind of a firewall between services, telemetry, etc..., you probably don't want to use a service mesh like this until your software architecture gets really complex
williamallthing 8y ago
Is this helpful? https://buoyant.io/2017/04/25/whats-a-service-mesh-and-why-do-i-need-one/ https://buoyant.io/2017/04/25/whats-a-service-mesh-and-why-d...