Cours 15 — Service Mesh

---

1. Qu'est-ce qu'un Service Mesh ?

Un service mesh est une infrastructure dédiée à la gestion des communications entre microservices.

Diagramme en cours de génération...

Fonctionnalités clés :

• Traffic management : Canary, blue/green, circuit breaking, fault injection
• Security : mTLS automatique, autorisation, authentification
• Observability : Métriques, logs distribués, tracing
• Reliability : Retries, timeouts, rate limiting

---

2. Istio

2.1 Architecture

Diagramme en cours de génération...

2.2 VirtualService

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: web-vs
spec:
  hosts:
    - web-service
  http:
    - match:
        - headers:
            version:
              exact: v2
      route:
        - destination:
            host: web-service
            subset: v2
    - route:
        - destination:
            host: web-service
            subset: v1
          weight: 90
        - destination:
            host: web-service
            subset: v2
          weight: 10

2.3 DestinationRule

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: web-dr
spec:
  host: web-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        http1MaxPendingRequests: 50
        maxRequestsPerConnection: 10
    loadBalancer:
      simple: LEAST_CONN
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 60s
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2

2.4 AuthorizationPolicy

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: web-authz
spec:
  selector:
    matchLabels:
      app: web
  action: ALLOW
  rules:
    - from:
        - source:
            principals:
              - cluster.local/ns/default/sa/frontend
        - source:
            namespaces:
              - ingress
      to:
        - operation:
            methods: ["GET", "HEAD"]
            paths: ["/api/public/*"]
    - from:
        - source:
            principals:
              - cluster.local/ns/default/sa/admin
      to:
        - operation:
            methods: ["POST", "PUT", "DELETE"]
            paths: ["/api/admin/*"]

2.5 Observabilité

apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: mesh-default
  namespace: istio-system
spec:
  metrics:
    - overrides:
        - match:
            metric: REQUEST_DURATION_MILLISECONDS
          tagOverrides:
            response_code:
              value: "response.code"
      providers:
        - name: prometheus
  accessLogging:
    - providers:
        - name: envoy

---

3. Linkerd

3.1 Architecture

Diagramme en cours de génération...

Caractéristiques :

• Proxy ultra-léger (Rust, ~10Mo)
• Pas de configuration complexe (annotations)
• HTTP/2, gRPC, mTLS automatique
• Tap pour le debugging

3.2 Installation

# Installer Linkerd CLI
curl -sL https://run.linkerd.io/install | sh

# Vérifier
linkerd check --pre

# Installer le control plane
linkerd install | kubectl apply -f -

# Ajouter un namespace au mesh
kubectl get ns default -o yaml | linkerd inject - | kubectl apply -f -

# Vérifier
linkerd stat ns default

3.3 Tap

# Inspecter le trafic en temps réel
linkerd tap deploy/web

# Voir les métriques
linkerd stat deploy/web
linkerd routes svc/web-api

# Dashboard
linkerd viz install | kubectl apply -f -
linkerd dashboard

---

4. Consul Connect

4.1 Architecture

Diagramme en cours de génération...

4.2 Intentions

# Consul intention
intention {
  source_name      = "web"
  destination_name = "api"
  action           = "allow"
}

4.3 Configuration

service {
  name = "web"
  port = 8080
  connect {
    sidecar_service {
      proxy {
        upstreams {
          destination_name = "api"
          local_bind_port  = 8081
        }
      }
    }
  }
}

---

5. Comparaison

---

6. mTLS automatique

Tous les service mesh implémentent mTLS automatique via des certificats SPIFFE.

Diagramme en cours de génération...

---

Résumé

Diagramme en cours de génération...