4 ms·

It seems that they recreated a Service Mesh. Running Istio or Consul Connect takes care or the vast majority of issues listed in this post: Encryption, Identity

by Marako 7y ago

It seems that they recreated a Service Mesh. Running Istio or Consul Connect takes care or the vast majority of issues listed in this post: Encryption, Identity, access control. And even trasparently for the developpers (no modification of the code...)

StreamBright 7y ago
Only the scale that these solutions can support is different.
- bogomipz 7y ago
  Isn't Istio implemented mostly as a sidecar container(Envoy Proxy) though? The article mentions they are running containers via their Tupperware orchestrator. If they are largely running containerized where is the scaling issue with adding sidecars to implement the service mesh? I don't have any experience with Istio but I'm genuinely curious along which axis it(or Connect, Linkerd etc) doesn't scale.
  - shereadsthenews 7y ago
    Envoy is so slow that deployment at this scale would be too costly, or if you could afford it would immediately present itself as a huge opportunity for cost reduction. People who are measuring their tail latency in microseconds aren't going to tolerate Envoy's marginal latency, which will be milliseconds even at the median.
    - programd 7y ago
      Indeed, Istio is very CPU heavy and probably not great for cloud use on a truly large scale just due to cost concerns. Shopify found it uses 50% more CPU then an alternative like Linkerd [1]. Istio also incurs much larger latency and lower throughput then Linkerd [2]. (To be clear, I don't have a dog in this Istio vs Linkerd fight, those are just some recent benchmarks I'm aware of) [1] https://medium.com/@michael_87395/benchmarking-istio-linkerd-cpu-c36287e32781 https://medium.com/@michael_87395/benchmarking-istio-linkerd... [2] https://medium.com/@ihcsim/linkerd-2-0-and-istio-performance-benchmark-df290101c2bb https://medium.com/@ihcsim/linkerd-2-0-and-istio-performance...
      - deleted 7y ago
        [deleted]
    - bogomipz 7y ago
      Interesting, I wasn't aware that Istio has such performance issues. Isn't Google using this though as well or at least an internal version of it? Surely they are on the same scale as FB. I'm curious at to what the cause of the latency is. TLS handshakes?
      - StreamBright 7y ago
        To be fair, most software projects have performance issues at FB's scale.
      - Terretta 7y ago
        That report resulted in an update to Istio docs: “Warning not to use demo profile for performance evaluation” https://github.com/istio/istio.io/pull/4220 https://github.com/istio/istio.io/pull/4220 More here, which basically suggests, don’t stop Istio from scaling out before 500 rps, it doesn’t like that at all: https://kinvolk.io/blog/2019/05/performance-benchmark-analysis-of-istio-and-linkerd/ https://kinvolk.io/blog/2019/05/performance-benchmark-analys...

by Marako 7y ago

StreamBright 7y ago

Only the scale that these solutions can support is different.

bogomipz 7y ago
Isn't Istio implemented mostly as a sidecar container(Envoy Proxy) though? The article mentions they are running containers via their Tupperware orchestrator. If they are largely running containerized where is the scaling issue with adding sidecars to implement the service mesh? I don't have any experience with Istio but I'm genuinely curious along which axis it(or Connect, Linkerd etc) doesn't scale.
- shereadsthenews 7y ago
  Envoy is so slow that deployment at this scale would be too costly, or if you could afford it would immediately present itself as a huge opportunity for cost reduction. People who are measuring their tail latency in microseconds aren't going to tolerate Envoy's marginal latency, which will be milliseconds even at the median.
  - programd 7y ago
    Indeed, Istio is very CPU heavy and probably not great for cloud use on a truly large scale just due to cost concerns. Shopify found it uses 50% more CPU then an alternative like Linkerd [1]. Istio also incurs much larger latency and lower throughput then Linkerd [2]. (To be clear, I don't have a dog in this Istio vs Linkerd fight, those are just some recent benchmarks I'm aware of) [1] https://medium.com/@michael_87395/benchmarking-istio-linkerd-cpu-c36287e32781 https://medium.com/@michael_87395/benchmarking-istio-linkerd... [2] https://medium.com/@ihcsim/linkerd-2-0-and-istio-performance-benchmark-df290101c2bb https://medium.com/@ihcsim/linkerd-2-0-and-istio-performance...
    - deleted 7y ago
      [deleted]
  - bogomipz 7y ago
    Interesting, I wasn't aware that Istio has such performance issues. Isn't Google using this though as well or at least an internal version of it? Surely they are on the same scale as FB. I'm curious at to what the cause of the latency is. TLS handshakes?
    - StreamBright 7y ago
      To be fair, most software projects have performance issues at FB's scale.
    - Terretta 7y ago
      That report resulted in an update to Istio docs: “Warning not to use demo profile for performance evaluation” https://github.com/istio/istio.io/pull/4220 https://github.com/istio/istio.io/pull/4220 More here, which basically suggests, don’t stop Istio from scaling out before 500 rps, it doesn’t like that at all: https://kinvolk.io/blog/2019/05/performance-benchmark-analysis-of-istio-and-linkerd/ https://kinvolk.io/blog/2019/05/performance-benchmark-analys...