Building and Deploying Applications on Istio

In the previous chapter, we deployed Istio and Kiali into our cluster. We also deployed an example application to see how the pieces fit together. In this chapter, we're going to look at what it takes to build applications that will run on Istio. We'll start by examining the differences between microservices and monolithic applications. We'll start by deploying a monolithic application on Istio, and then transition to building microservices that will run on Istio. This chapter will cover:

• Technical requirements
• Comparing microservices and monoliths
• Deploying a monolith
• Building a microservice
• Do I need an API gateway?

Once you have completed this chapter, you'll have a practical understanding of the difference between a monolith and a microservice, along with the information you'll need to determine which one is best for you, and will also have deployed a secured microservice...

Technical requirements

To run the examples in this chapter, you'll need:

• A running cluster with Istio deployed as outlined in Chapter 12, An Introduction to Istio
• Scripts from this book's GitHub repository

You can access the code for this chapter by going to this book's GitHub repository: https://github.com/PacktPublishing/Kubernetes---An-Enterprise-Guide-2E/tree/main/chapter13.

Comparing microservices and monoliths

Before we dive too deeply into code, we should spend some time discussing the differences between microservices and monolithic architecture. The microservices versus monolithic architecture debate is as old as computing itself (and the theory is probably even older). Understanding how these two approaches relate to each other and your problem set will help you decide which one to use.

My history with microservices versus monolithic architecture

Before we get into the microservices versus monoliths discussion, I wanted to share my own history with this conversation. I doubt it's unique, but it does frame my outlook on the discussion and adds some context to the recommendations in this chapter.

My introduction to this discussion was when I was a computer science student in college and had started using Linux and open source. One of my favorite books, Open Sources: Voices from the Open Source Revolution, had an appendix on the debate...

Deploying a monolith

This chapter is about microservices, so why are we starting with deploying monoliths in Istio? The first answer is, because we can! There's no reason to not get the benefits of Istio's built-in capabilities when working with monoliths in your cluster. Even though it's not a "microservice" it's still good to be able to trace through application requests, manage deployments, and so on. The second answer is, because we need to. Our microservice will need to know which user in our enterprise is calling it. To do that, Istio will need a JWT to validate. We'll use our OpenUnison to generate JWTs first so we can call our service manually and then so we can authenticate users from a frontend and allow that frontend to call our service securely.

Assuming you started with a fresh cluster, we're going to deploy OpenUnison the same way we did in Chapter 5, Integration Authentication into Your Cluster, but this time we have a script...

Building a microservice

We spent quite a bit of time talking about monoliths. First, we discussed which is the best approach for you, then we spent some time showing how to deploy a monolith into Istio to get many of the benefits from it that microservices do. Now, let's dive into building and deploying a microservice. Our microservice will be pretty simple. The goal is to show how a microservice is built and integrated into an application, rather than how to build a full-fledged application based on microservices. Our book is focused on enterprise so we're going to focus on a service that:

1. Requires authentication from a specific user
2. Requires authorization for a specific user based on a group membership or attribute
3. Does something very important
4. Generates some log data about what happened

This is common in enterprise applications and the services they're built on. Most enterprises need to be able to associate actions, or decisions...

Do I need an API gateway?

If you're using Istio, do you still need an API gateway? In the past, Istio has been primarily concerned with routing traffic for services. It got traffic into the cluster and figured out where to route it to. API gateways have more typically been focused on application-level functionality such as authentication, authorization, input validation, and logging.

For example, earlier in this chapter we identified schema input validation as a process that needs to be repeated for each call and shouldn't need to be done manually. This is important to protect against attacks that can leverage unexpected input and also makes for a better developer experience to provide feedback to developers sooner in the integration process. This is a common function for API gateways, but is not available in Istio.

Another example of a function that is not built into Istio, but is common for API gateways, is logging authentication and authorization decisions and...

Summary

In this chapter, we learned how both monoliths and microservices run in Istio. We explored why and when to use each approach. We deployed a monolith, taking care to ensure our monolith's session management worked. We then moved into deploying microservices, authenticating requests, authorizing requests, and finally how services can securely communicate. To wrap things up, we discussed whether an API gateway is still necessary when using Istio.

Istio can be complex, but when used properly it can provide considerable power. What we didn't cover in this chapter is how to build containers and manage the deployment of our services. We're going to tackle that next in Chapter 14, Provisioning a Platform.

Questions

1. True or false: Istio is an API Gateway.
   1. True
   2. False

   Answer: b. False – Istio is a service mesh, and while it has many functions of a gateway, it doesn't have all of them (such as schema checking).

2. Should I always build applications as microservices?
   1. Obviously, this is the way.
   2. Only if a microservices architecture aligns with your organization's structure and needs.
   3. No, microservices are more trouble than they're worth.
   4. What's a microservice?

   Answer: b – Microservices are great when you have a team that is able to make use of the granularity they provide.

3. What is a monolith?
   1. A large object that appears to be made from a single piece by an unknown maker
   2. An application that is self-contained
   3. A system that won't run on Kubernetes
   4. A product from a new start-up
   ...