You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/aks/istio-deploy-addon.md
+8-5Lines changed: 8 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,7 +34,7 @@ export LOCATION=<location>
34
34
35
35
## Install Istio add-on
36
36
37
-
This section includes steps to install the Istio add-on during cluster creation or enable for an existing cluster using the Azure CLI. If you want to install the add-on using Bicep, see [install an AKS cluster with the Istio service mesh add-on using Bicep][install-aks-cluster-istio-bicep]. To learn more about the Bicep resource definition for an AKS cluster, see [Bicep managedCluster reference][bicep-aks-resource-definition].
37
+
This section includes steps to install the Istio add-on during cluster creation or enable for an existing cluster using the Azure CLI. If you want to install the add-on using Bicep, see the guide for [installing an AKS cluster with the Istio service mesh add-on using Bicep][install-aks-cluster-istio-bicep]. To learn more about the Bicep resource definition for an AKS cluster, see [Bicep managedCluster reference][bicep-aks-resource-definition].
38
38
39
39
### Revision selection
40
40
@@ -98,12 +98,13 @@ Confirm the `istiod` pod has a status of `Running`. For example:
98
98
99
99
```
100
100
NAME READY STATUS RESTARTS AGE
101
-
istiod-asm-1-18-74f7f7c46c-xfdtl 1/1 Running 0 2m
101
+
istiod-asm-1-18-74f7f7c46c-xfdtl 2/2 Running 0 2m
102
+
istiod-asm-1-18-74f7f7c46c-4nt2v 2/2 Running 0 2m
102
103
```
103
104
104
105
## Enable sidecar injection
105
106
106
-
To automatically install sidecar to any new pods, you will need to annotate your namespaces with the revision label corresponding to the control plane revision currently installed.
107
+
To automatically install sidecar to any new pods, you need to annotate your namespaces with the revision label corresponding to the control plane revision currently installed.
107
108
108
109
If you're unsure which revision is installed, use:
Confirm that all the pods have status of `Running` with 2 containers in the `READY` column. The second container (`istio-proxy`) added to each pod is the Envoy sidecar injected by Istio, and the other is the application container.
208
+
Confirm that all the pods have status of `Running` with two containers in the `READY` column. The second container (`istio-proxy`) added to each pod is the Envoy sidecar injected by Istio, and the other is the application container.
208
209
209
210
To test this sample application against ingress, check out [next-steps](#next-steps).
210
211
@@ -240,6 +241,8 @@ az group delete --name ${RESOURCE_GROUP} --yes --no-wait
240
241
## Next steps
241
242
242
243
*[Deploy external or internal ingresses for Istio service mesh add-on][istio-deploy-ingress]
244
+
*[Scale istiod and ingress gateway HPA][istio-scaling-guide]
Copy file name to clipboardExpand all lines: articles/aks/istio-scale.md
+40-12Lines changed: 40 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,15 +1,15 @@
1
1
---
2
-
title: Istio service mesh AKS add-on performance
3
-
description: Istio service mesh AKS add-on performance
2
+
title: Istio service mesh Azure Kubernetes Service add-on performance and scaling
3
+
description: Istio service mesh Azure Kubernetes Service add-on performance and scaling
4
4
ms.topic: article
5
5
ms.custom:
6
6
ms.service: azure-kubernetes-service
7
7
ms.date: 03/19/2024
8
8
ms.author: shalierxia
9
9
---
10
10
11
-
# Istio service mesh add-on performance
12
-
The Istio-based service mesh add-on is logically split into a control plane (`istiod`) and a data plane. The data plane is composed of Envoy sidecar proxies inside workload pods. Istiod manages and configures these Envoy proxies. This article presents the performance of both the control and data plane for revision asm-1-19, including resource consumption, sidecar capacity, and latency overhead. Additionally, it provides suggestions for addressing potential strain on resources during periods of heavy load.
11
+
# Istio service mesh add-on performance and scaling
12
+
The Istio-based service mesh add-on is logically split into a control plane (`istiod`) and a data plane. The data plane is composed of Envoy sidecar proxies inside workload pods. Istiod manages and configures these Envoy proxies. This article presents the performance of both the control and data plane for revision asm-1-19, including resource consumption, sidecar capacity, and latency overhead. Additionally, it provides suggestions for addressing potential strain on resources during periods of heavy load. This article also covers how to customize scaling for the control plane and gateways.
13
13
14
14
## Control plane performance
15
15
[Istiod’s CPU and memory requirements][control-plane-performance] correlate with the rate of deployment and configuration changes and the number of proxies connected. The scenarios tested were:
@@ -20,7 +20,7 @@ The Istio-based service mesh add-on is logically split into a control plane (`is
20
20
#### Test specifications
21
21
- One `istiod` instance with default settings
22
22
- Horizontal pod autoscaling disabled
23
-
- Tested with two network plugins: Azure CNI Overlay and Azure CNI Overlay with Cilium [ (recommended network plugins for large scale clusters) ](/azure/aks/azure-cni-overlay?tabs=kubectl#choosing-a-network-model-to-use)
23
+
- Tested with two network plugins: Azure Container Networking Interface (CNI) Overlay and Azure CNI Overlay with Cilium [ (recommended network plugins for large scale clusters) ](/azure/aks/azure-cni-overlay?tabs=kubectl#choosing-a-network-model-to-use)
24
24
- Node SKU: Standard D16 v3 (16 vCPU, 64-GB memory)
25
25
- Kubernetes version: 1.28.5
26
26
- Istio revision: asm-1-19
@@ -70,43 +70,71 @@ The [ClusterLoader2 framework][clusterloader2] was used to determine the maximum
70
70
## Data plane performance
71
71
Various factors impact [sidecar performance][data-plane-performance] such as request size, number of proxy worker threads, and number of client connections. Additionally, any request flowing through the mesh traverses the client-side proxy and then the server-side proxy. Therefore, latency and resource consumption are measured to determine the data plane performance.
72
72
73
-
[Fortio][fortio] was used to create the load. The test was conducted with the [Istio benchmark repository][istio-benchmark] that was modified for use with the add-on.
73
+
[`Fortio`][fortio] was used to create the load. The test was conducted with the [Istio benchmark repository][istio-benchmark] that was modified for use with the add-on.
74
74
75
75
#### Test specifications
76
76
- Tested with two network plugins: Azure CNI Overlay and Azure CNI Overlay with Cilium [ (recommended network plugins for large scale clusters) ](/azure/aks/azure-cni-overlay?tabs=kubectl#choosing-a-network-model-to-use)
77
77
- Node SKU: Standard D16 v5 (16 vCPU, 64-GB memory)
78
78
- Kubernetes version: 1.28.5
79
79
- Two proxy workers
80
80
- 1-KB payload
81
-
-1000 QPS at varying client connections
82
-
-`http/1.1` protocol and mutual TLS enabled
81
+
-1,000 Queries per second (QPS) at varying client connections
82
+
-`http/1.1` protocol and mutual Transport Layer Security (TLS) enabled
83
83
- 26 data points collected
84
84
85
85
#### CPU and memory
86
-
The memory and CPU usage for both the client and server proxy for 16 client connections and 1000 QPS across all network plugin scenarios is roughly 0.4 vCPU and 72 MB.
86
+
The memory and CPU usage for both the client and server proxy for 16 client connections and 1,000 QPS across all network plugin scenarios is roughly 0.4 vCPU and 72 MB.
87
87
88
88
#### Latency
89
89
The sidecar Envoy proxy collects raw telemetry data after responding to a client, which doesn't directly affect the request's total processing time. However, this process delays the start of handling the next request, contributing to queue wait times and influencing average and tail latencies. Depending on the traffic pattern, the actual tail latency varies.
90
90
91
-
The following evaluates the impact of adding sidecar proxies to the data path, showcasing the P90 and P99 latency.
91
+
The following results evaluate the impact of adding sidecar proxies to the data path, showcasing the P90 and P99 latency.
92
92
93
93
| Azure CNI Overlay |Azure CNI Overlay with Cilium |
[](./media/aks-istio-addon/latency-box-plot/overlay-azure-p99.png#lightbox) | [](./media/aks-istio-addon/latency-box-plot/overlay-cilium-p99.png#lightbox)
96
96
[](./media/aks-istio-addon/latency-box-plot/overlay-azure-p90.png#lightbox) | [](./media/aks-istio-addon/latency-box-plot/overlay-cilium-p90.png#lightbox)
97
97
98
+
## Scaling
99
+
100
+
### Horizontal pod autoscaling
101
+
102
+
[Horizontal pod autoscaling (HPA)][hpa] is enabled for the `istiod` and ingress gateway pods. The default configurations for `istiod` and the gateways are:
103
+
- Min Replicas: 2
104
+
- Max Replicas: 5
105
+
- CPU Utilization: 80%
106
+
107
+
> [!NOTE]
108
+
> To prevent conflicts with the `PodDisruptionBudget`, the add-on does not allow setting the `minReplicas` below the initial default of `2`.
109
+
110
+
The following are the `istiod` and ingress gateway HPA resources:
Istio's ServiceEntry custom resource definition enables adding other services into the Istio’s internal service registry. A [ServiceEntry][serviceentry] allows services already in the mesh to route or access the services specified. However, the configuration of multiple ServiceEntries with the `resolution` field set to DNS can cause a [heavy load on DNS servers][understanding-dns]. The following suggestions can help reduce the load:
127
+
Istio's ServiceEntry custom resource definition enables adding other services into the Istio’s internal service registry. A [ServiceEntry][serviceentry] allows services already in the mesh to route or access the services specified. However, the configuration of multiple ServiceEntries with the `resolution` field set to DNS can cause a [heavy load on Domain Name System (DNS) servers][understanding-dns]. The following suggestions can help reduce the load:
100
128
101
129
- Switch to `resolution: NONE` to avoid proxy DNS lookups entirely. Suitable for most use cases.
102
130
- Increase TTL (Time To Live) if you control the domains being resolved.
An App Service Environment is an Azure App Service feature that provides a fully isolated and dedicated environment for running App Service apps securely at high scale. Unlike the App Service public multitenant offering where supporting ingfrastructure is shared, with App Service Environment, compute is dedicated to a single customer. For more information on the differences between App Service Environment and App Service public multitenant, see the [comparison of the offerings](ase-multi-tenant-comparison.md).
13
+
An App Service Environment is an Azure App Service feature that provides a fully isolated and dedicated environment for running App Service apps securely at high scale. Unlike the App Service public multitenant offering where supporting infrastructure is shared, with App Service Environment, compute is dedicated to a single customer. For more information on the differences between App Service Environment and App Service public multitenant, see the [comparison of the offerings](ase-multi-tenant-comparison.md).
14
14
15
15
> [!NOTE]
16
16
> This article covers the features, benefits, and use cases of App Service Environment v3, which is used with App Service Isolated v2 plans.
Copy file name to clipboardExpand all lines: articles/azure-app-configuration/quickstart-javascript-provider.md
+2-4Lines changed: 2 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -307,9 +307,7 @@ run().catch(console.error);
307
307
308
308
## Next steps
309
309
310
-
In this quickstart, you created a new App Configuration store and learned how to access key-values using the App Configuration JavaScript provider in a Node.js app.
311
-
312
-
For more code samples, visit:
310
+
In this quickstart, you created a new App Configuration store and learned how to access key-values using the App Configuration JavaScript provider in a Node.js app. To learn how to configure your app to dynamically refresh configuration settings, continue to the next tutorial.
0 commit comments