Running Istio and Kubernetes On-prem at Yahoo Scale
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 14:25· Ballroom Sec 20AB - San Diego Convention Center, Upper Level·
summary
Yahoo runs 18 production clusters and a single on‑prem cluster that manages 150K+ containers, ~1k applications and 1–1.5M RPS. Built an Athens identity platform plus a CSI/CA flow that mints short‑lived certs and mounts them to Envoy sidecars, currently injected into <5% of pods with a goal of full mutual TLS via short‑lived certs. Teams use a single YAML abstraction, Screwdriver CI templates, an Athens→Istio controller for dynamic service roles, NetApp Trident storage and a Redis operator.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:15Yahoo Media circa 2017...
- 1:44Number Crunching
- 2:35Key Prod Cluster Statistics
- 3:28How it all fits together
- 5:25What's in a Pod?
- 6:37Auth and Multi-Tenancy
- 13:37Istio Service Mesh
- 15:01Secure Communication with Istio .
- 16:10How it works
- 19:59Istio mTLS Authorization
- 21:31Service RBAC definition in Athenz
- 24:18Design Goals
- 25:49Simple YAML Interface
- 26:26Standardized templates
- 26:51Generated Artifacts for K8s Deployment
- 27:36Standardized CI/CD Pipeline Flow O
- 28:43Sample Developer Use Case
- 30:04Behind the scenes ...
- 30:42Open-Source
- 31:16Conclusion
related talks
35mAuto Operation of Hundreds of K8s Clusters in Yahoo!
35mAuto Operation of Hundreds of K8s Clusters in Yahoo! Japan
46mThe Journey of Migrating 2500 Apps to Multi-Cluster Kubernetes and Zero Trust Istio
36m101 Ways to “Break and Recover” Kubernetes Cluster
36mExperiences From Running Istio in a K8s Production Environment
24mIstio in Production: Expected Value, Results, and Effort
47mIstio on Kubernetes: Chaos, Canaries, Dark Launches
29mAccelerate AppDev with KIK (Kubernetes-Istio-Knative)