Taming Thousands of Knative Services for Thousands of Users
summary
Operates Knative at multiple-thousand services per cluster across multi-cluster, multi-region tenancy using Istio and Let’s Encrypt per-namespace certificates (mTLS), Envoy filters that inject and validate a secret for cluster-local access, pre-pulled sidecar images, and a static activator configuration with the activator always in-path to avoid 503s. Increases API QPS/burst, pins sidecar resources, and enforces a limit of one non-active revision per app plus Istio mesh debounce tuning to cut XDS churn; it works but costs resource efficiency and requires careful trade-offs.
AI-written summary · about
chapters (5)
- 0:00IBM Cloud Code Engine intro
- 3:41Securing multi-tenant Knative
- 13:07Scaling Knative to thousands
- 26:48Future plans and community
- 27:08Q&A on cluster limits
