Istio moved to CNCF Graduation stage

https://github.com/cncf/toc/commit/25b2ead46d56e3c39d48a6a87e3c558c2120d179

by AlexB138 • 3 years ago

197 117 3 years ago

github.com

AlexB1383• 3 years ago

Here's the PR: https://github.com/cncf/toc/pull/1000

aidenn02• 3 years ago

Enough searching around told me what CNCF is, but I still don't know what it means to "graduate"

gattacamovie• 3 years ago

there are 3 stages of a CNCF project: incubation,sandbox,graduated

for each there are conditions, including number of contributors, number of companies oficially backing it, etc.

GenericDev• 3 years ago

Why would you want this?

akhayam3• 3 years ago

You can read more about incubated and graduates CNCF projects here: https://www.cncf.io/projects/

akhayam3• 3 years ago

Tldr: you can bring your open source project to CNCF and if there are enough infra/platform developers vouching for it then you can become an incubated project. After that, there is a bunch of boxes (traction, integration, stability) that you need to check before CNCF endorses you as a graduated project.

zgluck3• 3 years ago

It's about the modern day J2EE - Kubernetes. Approximately the same cost per "getting something done" ratio. Exactly the same kind of orgs (both on the seller and buyer sides). I hear the money is good though, if you're into that kind of slow work.

jupp0r• 3 years ago

You might not know what J2EE or Kubernetes do if you compare them like that.

meepmorp• 3 years ago

In case anyone wants to read the rendered markdown:

https://github.com/cncf/toc/blob/main/proposals/graduation/i...

akhayam3• 3 years ago

Finally… took a while.

Now CNCF needs to figure out how to get Istio to work nicely with the networking k8s addons

dirteater_• 3 years ago

The CNCF doesn't really dictate that kind of stuff. If something doesn't play nice try the Istio slack or file an issue on the main repo: https://github.com/istio/istio

AlexB1383• 3 years ago

Here's the official CNCF announcement: https://www.cncf.io/announcements/2023/07/12/cloud-native-co...

hsaliak2• 3 years ago

And yet -- grpc is still "incubating". Do these statuses really mean much?

phillipcarter• 3 years ago

They do have meaning, but the meaning is orthogonal from metrics like total use throughout an industry: https://github.com/cncf/toc/blob/main/process/graduation_cri...

There is little doubt in my mind that gRPC is a larger and more impactful project than Istio.

sdesol3• 3 years ago

Here's the insights for grpc https://devboard.gitsense.com/grpc/grpc They are attracting less people than istio but not by much.

Full disclosure: This is my tool

verst• 3 years ago

The CNCF has their own tool - a Grafana dashboard for all their projects:

https://devstats.cncf.io

A bit awkward to use but lots of great info there. I use it every now and then (I'm a maintainer of Dapr).

qbasic_forever• 3 years ago

IMHO that's accurate for grpc. The project works great if you're all golang on backend. As soon as you use other languages it gets complicated and the story falls apart--you almost certainly have to pull in tooling to manage protobuf generation, and proxying your grpc backend code to web frontend code (easy if your backend is golang, but many more options and questions if not). The fact grpc (and protobufs in general) need so much extra tooling is a bit of a code smell of immaturity and incubation IMHO.

pjmlp2• 3 years ago

.NET tooling is quite good, although I have only used it in toy examples.

hsaliak2• 3 years ago

Yes you need additional tooling but often, such as in C++ it's the nature of the build environments for that language. There are many organizations using gRPC in mission critical environments along with C++.

lopkeny12ko2• 3 years ago

Surely Google has been using gRPC across many languages for a decade or more at this point, and surely this is a solved problem at Google. How is this not solved outside of Google?

tgma2• 3 years ago

Perhaps the tooling feel somewhat overkill for toy apps that can be done with Ruby on rails or such. Many large orgs with billions of dollars of revenue per year companies are utilizing gRPC across many languages.

kubota• 3 years ago

Bazel, rules_proto and its grpc rules for various languages is the tooling you are looking for in my opinion! It's so nice to be able to share your proto files and generate stubs / clients across language boundries, being able to see exactly which pieces of your application break when a shape or signature changes in a proto file. Without a monorepo, it would be hard to see the impact of proto changes across disparate code repositories.

akshayshah3• 3 years ago

gRPC had a graduation application open for 3 years. It was rejected very recently: https://github.com/cncf/toc/pull/300.

Reading between the lines, it sounds like the main problem is Google's tight control over the project. Apple contributes to the Swift implementation and MSFT drives the native .NET implementation, but there's little non-Google input in decision-making for Go, Java, C++ core, or any of the implementations that wrap core.

More subjectively, I'm impressed by the CNCF's willingness to stick to their stated graduation criteria. gRPC is widely used (even among other CNCF projects), and comes from the company that organized the CNCF - there must have been a lot of pressure to rubber-stamp the application.

bushbaba2• 3 years ago

100% this. GRPC has nearly all its code contributions by google. If google removed its funding the project would be at risk. It’s closer to a proprietary offering with source code available than a mature FOSS ecosystem. Think redhat enterprise Linux is to gRPC where-as istio/k8s is closer to Debian.

evntdrvn• 3 years ago

It’s really hard to have any influence on it unless you’re inside the Google fence. Even for the primary maintainers of those two external parties that you mentioned.

tgma2• 3 years ago

You acknowledge contributions from several large companies. It's obvious it won't go away if Google pulls support or anything. Perhaps the fact that some random folks across the internet don't feel compelled to submit patches is simply due to the low level nature of the project and that it does the job quite well and its scope is limited by its nature, thereby limiting the need for customization by every individual. I really wonder what the standard is. If I recall correctly, for instance a certain proxy graduated by CNCF was such crap at one point that it linear searched routes. That naturally necessitates contributions if you actually use such software in production at scale.

havnagiggle• 3 years ago

Why is there a need to read between the lines? The post seems quite clear what is needed and it sounds like the ball is just in gRPC court. If anything it seems promising that there was movement after 3.5 years.

arein32• 3 years ago

Hopefully grpc will never graduate as to not encourage people to use it. There are better ways.

hardwaresofton• 3 years ago

c'mon, you gotta at least drop some of the "better ways" you prefer.

retinaros• 3 years ago

what do you people use for inter service com? http??? why?

throwawaaarrgh• 3 years ago

Some of Google Cloud's critical APIs only seem to use gRPC over HTTPS. It relies on such an esoteric part of the TLS specification that many (most?) proxies can't carry the traffic. You end up hunting for 2 days to find out why your connections don't work only to realize they probably never will. So I would say it's good that gRPC isn't being pushed hard yet.

On a personal level, it's one of those projects that someone obsessed with "perfect engineering" develops, regardless of the human cost. Crappier solutions (ex. JSON-over-HTTP) are better in almost all cases.

akshayshah3• 3 years ago

I've never encountered a proxy that can't do the portions of TLS 1.3 that gRPC requires - NGINX, Envoy, linkerd, all the managed cloud offerings I know of, and any random Go binary can handle it. What esoteric portions of the spec are you referring to?

gRPC _does_ require support for HTTP trailers, which aren't used much elsewhere. If you want to use streaming RPCs, you also need a proxy that doesn't buffer (or allows you to disable buffering).

discreteevent• 3 years ago

perfect engineering

You couldn't get a better example of good pragmatic engineering than gRPC compared to something like CORBA or DCOM. I can't talk about "all cases" but in the cases I've come across it's a much better solution than JSON over http.

sdesol3• 3 years ago

Here is some community information for istio https://devboard.gitsense.com/istio/istio

Not kubernetes level https://devboard.gitsense.com/kubernetes/kubernetes but still very good.

Full Disclosure: This is my tool, but I figure the insights would be interesting/useful.

alanwreath• 3 years ago

I may have missed the announcement where Istio’s ownership was being transfered to a vendor-neutral foundation like the CNCF, or is the Open Usage Commons What can be used in place?

mikeyouse• 3 years ago

Yeah they joined CNCF last September;

https://istio.io/latest/blog/2022/istio-accepted-into-cncf/

SomaticPirate• 3 years ago

I think this just demonstrates the power of vendor-neutral Open Source. I don’t mean that in an inflammatory way. Istio, a collaborative project from Google/IBM that was arguably going to be a slight differentiator for their respective clouds was forced to go vendor-neutral after Linkerd did.

Same thing happened to Knative.

CNCF definitely has some politics but its been interesting to see large OSS projects be essential dead on arrival now if its not in a vendor neutral holding org.

I personally try to favor vendor neutral projects now. Slightly smaller chance of being burned like I was with Grafana switching licenses.

awestroke2• 3 years ago

If I needed a service mesh, I'd probably use Linkerd. What would I be missing out on?

crb3• 3 years ago

I like to equate the question to "If I needed a container orchestrator, I'd probably use Nomad. What would I be missing out on with Kubernetes?"

Ignore the CNCF for a second. Both are open source, so will survive regardless, but the former has a single vendor behind it, and the latter has almost all the cloud industry.

There are valid use cases for FreeBSD, but the default choice is Linux.

0xEFF• 3 years ago

This is a good analogy. For more context in the past 5 years working with customers in the Bay Area I’ve not encountered one who mentioned linkerd let alone ran it in production.

More than half those companies ran istio in production at large scales.

otterley• 3 years ago

the former has a single vendor behind it, and the latter has almost all the cloud industry

The same could be said about Apple products, but that doesn't mean people should be dissuaded from using them. Quite the opposite: being in charge of a technology means you can be 100% focused on it and be relentlessly focused on making it great for your customers.

campbel3• 3 years ago

Interesting. IMO Istio is built to entice VPs and Linkerd is built to entice engineers.

cpretzer• 3 years ago

I'd love to hear a compelling comparison between linkerd and istio without having to compare either with other (unrelated) categories of software.

Anyone who reads these comments should be able to get an understanding of both service meshes without having to research other software.

Are you saying that istio IS kubernetes and linkerd is not? I don't think linkerd WANTS to be kubernetes.

I love your podcast, Craig, but this "hot take" is too hot to hold

vbezhenar7• 3 years ago

No need to ignore CNCF. Linkerd has had a "Graduated CNCF" rubber stamp for a 2 years.

awestroke2• 3 years ago

You have not given me one single reason why I would be better of with Istio

ceposta072• 3 years ago

I think it does come down to risk and risk mitigation. As someone who works for an “Istio vendor” we see some of the largest deployments of Istio in the world for mission critical/tier-0 workloads… and all the steps it took to get there including evaluation/POC of other vendors/mesh technologies.

Part of these decisions are based on things like “What is the rest of the industry doing?” “How vibrant/diverse is the community?” “How mature is the project _for enterprise adoption_?” “What vendors are available for enterprise support?” “Is it already available in my platform of choice?” etc.etc.

The sting of “picking the wrong container orchestrator” is still fresh in a lot of organizations.

We see Istio make it through these questions with good answers for a lot of organizations where other/alternative service mesh vendors strike out pretty quickly.

This is even before we get to the “feature comparisons” for usecases these large organizations focus on/have.

throwawa34322• 3 years ago

What didn't you like about Traefik, Consul, NGINX Service Mesh, or AWS AppMesh?

campbel3• 3 years ago

I think you could disregard a few of these without too much thought. Nginx - predatory vendor, AWS - only makes sense if you need the deep integration, Consul - only makes sense if you are on the hashi stack. Traefik I haven't spent much time with recently, but I'm a bit suspect of ingresses that reposition themselves as mesh to gain adoption.

goalonetwo• 3 years ago

We are using istio at scale.

I have a love-hate relationship with it. It is very complex and builds on 5 other layer of abstraction (K8s, Envoy, Iptables,...). Grasping what is going on requires you to understand all of those layers first. Istio essentially adds one layer of proxy for all your ingress/egress requests and from an engineering/performance/cost perspective that is not amazing.

Once it is working and deployed though it provides a solid set of functionalities as part of the infrastructure directly. AuthN/Z, mTLS, security, metrics and logs are all deployed by default without the end-user having to do anything.

Eventually I expect Istio will evolve to a model that makes more sense with Ambient/eBPF (For cost/performance reasons)

The community behind Istio is especially helpful and one of the main reasons why we went with this project.

datadeft• 3 years ago

It is very complex and builds on 5 other layer of abstraction

Yeah this is a definite no for me.

Niksko• 3 years ago

Boy do I have bad news for you about all of modern software...

ushakov• 3 years ago

have you tried Contour yet?

https://projectcontour.io

crb3• 3 years ago

Contour is a gateway: a controller that manages Envoy proxies at the edge of a Kubernetes environment. Istio is a service mesh: a controller that manages Envoy proxies at the edge and alongside each workload. If you are using Istio, you probably don't need Contour.

A year ago, a number of Envoy gateway maintainers (including Contour) announced their intention to join up to build one implementation of an Envoy gateway. They haven't made a lot of noise since, but they are apparently up to v0.4.

https://blogs.vmware.com/opensource/2022/05/16/contour-and-c...

You can also use the Gateway API to manage Istio. So, if you are using Istio, you probably don't need Envoy Gateway either.

Wherever you look, it's still Envoy. Unless of course you look at Linkerd, who have their own thing.

davewritescode• 3 years ago

We also run Istio at scale and feel the same way. During adopting it’s a pain, when it’s up and running it’s a dream.

slygon2• 3 years ago

Did you folks try to upgrade it? For us it was a nightmare (breaking changes, etc.)

JohnMakin• 3 years ago

“once it is working and deployed” is the caveat here. debugging issues with it at my last job was such a constant headache we nearly scrapped it for consul.

williamallthing3• 3 years ago

You have no idea how many Istio companies have turned to Linkerd because of this very complexity. Here's one of my favorite writeups. https://nais.io/blog/posts/changing-service-mesh/

campbel3• 3 years ago

It's malpractice to not seriously consider Linkerd over Istio at this point.

ttul• 3 years ago

I don’t deal with Istio daily but I observed it sucked up a vast number of hours. Mysterious cracks seem to lurk in its bowels but nobody has any idea precisely where because it’s such a complex beast. Beware.

slygon2• 3 years ago

We tried Istio, but our Devops team (8 people) said they don't have the capacity to manage that complexity. We're rolling with Linkerd ever since, still a joy

crb3• 3 years ago

Hi everyone, I'm the person who drove the CNCF process for Istio (and made the linked commit). I'm happy to answer any questions.

ec109685• 3 years ago

Congrats on the graduation. My company has been using it for a long while through all its design iterations.

We still haven’t achieved an amazing distributed tracing strategy, we don’t use its MySQL or Redis interfaces, and haven’t rolled out more advanced features like smart retries. It’s hard to get momentum on that versus other must have work.

But for mTLS and authn and authz, it works great. Thanks for the hard work.

throwawa34322• 3 years ago

I think it should be titled Envoy+Istio in the same spirit of GNU+Linux.

Jokes aside, Envoy really deserves some spotlight.

tflinton• 3 years ago

Istio is amazing once you grok how it works and get it running. It has a lot of gotchas (objects in istio-system become global?) and there’s a lot of ways to abuse or misuse it.

vbezhenar7• 3 years ago

What's an alternative to istio? I want to have http metrics between our services inside kubernetes. I don't really want all the fancy shmancy mtls, dpi and stuff, they don't bring value to me.

shitlord2• 3 years ago

If you don't want any of the fancy stuff, then you can just use Envoy without Istio and configure it yourself.

vbezhenar7• 3 years ago

That's an interesting thought. Even if I would throw it away for istio in the end, the experience for managing Envoy, might be valuable.

How do I do that exactly? I need to install some iptables rules inside a pod to redirect pod traffic to envoy?

agracey• 3 years ago

https://linkerd.io/ is a much lighter-weight alternative but you do still get some of the fancy things like mtls without needing any manual configuration. Install it, label your namespaces, and let it do it's thing!

vbezhenar7• 3 years ago

I don't think that I need mtls and extra CPU load for useless (to me) encryption does not sound so good. Can I opt-out of this specific feature?

Also I'm worried about its pervasiveness. Is it possible to enable those side-cars only on selected pods?

fosk2• 3 years ago

Try with Kuma (https://kuma.io/) also part of CNCF, which has been created with a much simpler model for supporting a fleet of Envoy across single and multiple cluster.

Istio moved to CNCF Graduation stage

Related Stories