tldr - powered by Generative AI

• The Gateway API standardizes some of the Ingress stuff and is mostly for North-South traffic.
• Linkerd is working on adapting the HTTP route resources to make sense for East-West traffic.
• If all pods start returning 500 errors all at once, they will all be taken out of circulation and apply the back-off penalty.
• Linkerd does not yet support IPv6, but it is in the books.
• EBPF is a cool technology, but it cannot do any State Management inside of it, making it difficult to handle circuit breaking, retries, and timeouts.
• Linkerd supports EBPF, but when it comes to doing service mesh things, there is no substitute for the sidecar proxy.

tldr - powered by Generative AI

• The Gateway API is a well-designed API with extensibility points that make it intuitive to work with
• Adopting the Gateway API now makes sense for the project despite its newness and potential for API churn
• The Gateway API's policy attachment framework is useful for both gateways and meshes
• Distinguishing between traffic frontends and backends is crucial for effective service mesh management
• Leveraging existing API frameworks, such as the Gateway API, is preferable to reinventing the wheel

tldr - powered by Generative AI

• Users want reliable software, but they don't necessarily care about the internal details.
• API Gateway and service mesh can be used to mitigate the effects of badly behaving code and give users a better experience.
• Retry, timeout, and rate limit are simple yet effective tools to use in the API Gateway and service mesh.
• Developers, QA, and platform engineers need to think about the end-to-end solution, but they should ideally start with the services and communications.
• Observability and debugging tools can be helpful in identifying and fixing issues.
• Documentation and contribution to open-source projects are important for developer-focused and self-service solutions.

tldr - powered by Generative AI

• Linkerd is a service mesh that intercepts all network traffic for a pod and adds functionality like observability, reliability features, and transparent mtls between all services on by default
• Philosophy behind Linkerd is to make it easy to use and install without requiring extensive configuration
• Linkerd integrates with startmanager for automatic certificate rotation
• Linkerd uses HTTP back pressure mechanism for back pressure
• Linkerd is focused on workload identity rather than user identity
• Linkerd provides East West traffic for service to service within the cluster

tldr - powered by Generative AI

• Linkerd is a service mesh for Kubernetes that provides observability, reliability, and security
• It has a growing set of features including policy, circuit breaking, and header-based routing
• The project has a large and active community
• Linguity is a new extension that manages or installs the SMI CRDs and other SMI functionality
• Linkerd is working on supporting FIPS 140-2 compliance systems
• The project has graduated from the CNCF
• Linkerd is a popular choice for those who want to improve their observability, reliability, and security in their Kubernetes clusters

tldr - powered by Generative AI

• The company faces competition from pure tech companies and changing customer expectations, while also dealing with regulatory requirements and the need to maintain customer trust.
• The balancing act involves implementing the right level of security while finding common ground and allowing for both control and the ability to move fast.
• Traditional concerns like networking and web application firewalls still apply, but modern capabilities like Kubernetes and layering can help solve issues in new ways.
• The starting point involved interviewing teams and systematically gathering data to manage Kubernetes, which takes a lot of work.
• The solution involves questioning traditional approaches and finding new ways to solve issues with modern security approaches and layering.

tldr - powered by Generative AI

• Linkerd has been a valuable tool for securing over 50 microservices and 22,000 pods in Xbox Cloud Gaming's Kubernetes clusters
• Zero config MTLS and code-free visibility have saved the company thousands of dollars per month
• Canary deployments have been integrated into Azure DevOps release pipelines to enable auto rollbacks
• Future plans include implementing service-to-service off, multi-cluster communication, and fault injection testing

tldr - powered by Generative AI

• Emissary is a service mesh for Kubernetes that can achieve zero trust networking
• Emissary uses envoy for data wrangling and can consume ebpf modules for networking efficiency
• Emissary can generate unique certificates for each connection and recommends using cert manager for certificate rotation
• Emissary 2.11 introduced the ability to use policy for zero trust networking and 2.12 will have a more granular and easier to use policy system
• Installation of Emissary involves adding the helm repo, installing the Emissary CRDs, and using helm to install Emissary into a namespace