CNCF Serverless Landscape (Source: CNCF )

• Understanding clouds
• Free online course: Developing cloud-native applications with microservices architectures
• What is hybrid cloud?
• eBook: Building a hybrid cloud strategy
• What is Kubernetes?
• Understanding edge computing
• Latest articles for IT architects

Imagine combining service mesh and serverless for more advanced cloud-native microservices development and deployment. This combined architecture allows you to configure additional networking settings, such as custom domains, mutual Transport Layer Security (mTLS) certificates, and JSON Web Token authentication.

Here is a quick example of setting up service mesh on Istio with serverless on Knative Serving.

1. Add Istio with sidecar injection

When you install the Istio service mesh, you need to set the autoInject: enabled configuration for automatic sidecar injection:

    global:
      proxy:
        autoInject: enabled

If you'd like to learn more, consult Knative's documentation about installing Istio without and with sidecar injection .

2. Enable a sidecar for mTLS networking

To use mTLS network communication between a knative-serving namespace and another namespace where you want the application pod to be running, enable a sidecar injection:

$ kubectl label namespace knative-serving istio-injection=enabled

You also need to configure PeerAuthentication in the knative-serving namespace :

cat <<EOF | kubectl apply -f -
apiVersion: "security.istio.io/v1beta1"
kind: "PeerAuthentication"
metadata:
  name: "default"
  namespace: "knative-serving"
spec:
  mtls:
    mode: PERMISSIVE
EOF

If you've installed a local gateway for Istio service mesh and Knative, the default cluster gateway name will be knative-local-gateway for the Knative service and application deployment.

3. Deploy an application for a Knative service

Create a Knative service resource YAML file (e.g., myservice.yml ) to enable sidecar injection for a Knative service.

Add the sidecar.istio.io/inject="true" annotation to the service resource:

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: hello-example-1
spec:
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true" (1)
        sidecar.istio.io/rewriteAppHTTPProbers: "true" (2)
    spec:
      containers:
      - image: docker.io/sample_application (3)
        name: container

In the code above:

(1) Adds the sidecar injection annotation.

(2) Enables JSON Web Token (JWT) authentication.

(3) Replace the application image with yours in an external container registry (e.g., DockerHub, Quay.io).

Apply the Knative service resource above:

$ kubectl apply -f myservice.yml

Note: Be sure to log into the right namespace in the Kubernetes cluster to deploy the sample application.

Conclusion

This article explained the benefits of service mesh and serverless deployment for the advanced cloud-native microservices architecture. You can evolve existing microservices to service mesh or serverless step-by-step, or you can combine them to handle more advanced application implementation with complex networking settings on Kubernetes. However, this combined architecture is still in an early stage due to the architecture's complexity and lack of use cases.