@@ -49,8 +49,7 @@ Mixer is an attribute processing machine. Requests arrive at Mixer with a set of
49
49
and based on these attributes, Mixer generates calls to a variety of backend systems. The set of
50
50
attributes determines which backend systems Mixer calls for a given request and what parameters
51
51
each is given. In order to hide the details of individual backend systems, Mixer uses modules
52
- known as [ * adapters* ] ( {{site.baseurl}}/docs/concepts/mixer.html#adapters ) which you can think of as
53
- * device drivers* for backend systems.
52
+ known as [ * adapters* ] ( {{site.baseurl}}/docs/concepts/mixer.html#adapters ) .
54
53
55
54
Mixer's configuration has two central responsibilities:
56
55
@@ -62,8 +61,8 @@ abstractions:
62
61
63
62
|Concept |Description
64
63
|----------------------------|-----------
65
- |[ Adapters] ( #adapters ) | Low-level operationally-focused configuration state for individual mixer adapters.
66
- |[ Aspects] ( #aspects ) | High-level intent-focused configuration state for individual mixer adapters.
64
+ |[ Adapters] ( #adapters ) | Low-level operationally-focused configuration for individual mixer adapters.
65
+ |[ Aspects] ( #aspects ) | High-level intent-focused configuration for individual mixer adapters.
67
66
|[ Descriptors] ( #descriptors ) | Description of parameters used with individual aspects.
68
67
|[ Scopes] ( #scopes ) | Mechanism to select which aspects and descriptors to use based on a request's attributes.
69
68
|[ Manifests] ( #manifests ) | Description of various static characteristics of an Istio deployment.
@@ -73,7 +72,8 @@ The following sections explain these concepts in detail.
73
72
### Adapters
74
73
75
74
[ Adapters] ( {{site.baseurl}}/docs/concepts/mixer.html#adapters ) are the foundational work horses that the Istio mixer is built around. Adapters
76
- encapsulate the logic necessary to interface Mixer with specific external backend systems such as Prometheus or NewRelic. Individual adapters
75
+ encapsulate the logic necessary to interface Mixer with specific external backend systems such as [ Prometheus] ( https://prometheus.io ) ,
76
+ [ New Relic] ( https://newrelic.com ) , or [ Stackdriver] ( https://cloud.google.com/logging ) . Individual adapters
77
77
generally need to be provided some basic operational parameters in order to do their work. For example, a logging adapter may need
78
78
to know the IP address and port where it's log data should be pumped.
79
79
@@ -96,9 +96,10 @@ The `impl` field gives the name of the adapter being configured. Finally, the `p
96
96
actual adapter-specific configuration parameters are specified. In this case, this is configuring the URL the
97
97
adapter should use in its queries and defines the interval at which it should refresh its local caches.
98
98
99
- For each available adapter implementation, you can define any number of blocks of independent configuration state. This allows the same adapter
99
+ For each available adapter implementation, you can define any number of independent configuration blocks. This allows the
100
+ same adapter
100
101
to be used multiple times within a single deployment. Depending on the situation, such as which microservice is involved, one
101
- block of configuration will be used versus another. For example, here are two more blocks of configuration that can coexist
102
+ configuration block will be used versus another. For example, here are two more configuration blocks that can coexist
102
103
with the previous one :
103
104
104
105
` ` ` yaml
@@ -136,7 +137,7 @@ adapters and their specific configuration format can be found in *TBD*.
136
137
137
138
# ## Aspects
138
139
139
- Aspects define high-level configuration state (what is sometimes called intent-based configuration),
140
+ Aspects define high-level configuration (what is sometimes called intent-based configuration),
140
141
independent of the particular implementation details of a specific adapter type. Whereas adapters focus
141
142
on *how* to do something, aspects focus on *what* to do.
142
143
@@ -156,13 +157,13 @@ of aspects are shown in the following table.
156
157
157
158
|Kind |Description
158
159
|-----------------|-----------
160
+ |quotas |Enforce quotas and rate limits.
161
+ |metrics |Produce metrics.
162
+ |lists |Enforce simple whitelist- or blacklist-based access control.
159
163
|access-logs |Produces fixed-format access logs for every request.
160
164
|application-logs |Produces flexible application logs for every request.
161
165
|attributes |Produces supplementary attributes for every request.
162
166
|denials |Systematically produces a predictable error code.
163
- |lists |Verifies a symbol against a list.
164
- |metrics |Produces a metric that measures some runtime property.
165
- |quotas |Tracks a quota value.
166
167
167
168
In the example above, the aspect declaration specifies the `lists` kind which indicates
168
169
we're configuring an aspect whose purpose is to enable the use of whitelists or
@@ -206,7 +207,7 @@ aspects:
206
207
This defines an aspect that produces metrics which are sent to the myMetricsCollector adapter,
207
208
which was defined previously. The `metrics` stanza defines the set of metrics that are
208
209
generated during request processing for this aspect. The `descriptor_name` field specifies
209
- the name of a *descriptor* which is a separate block of configuration, described [below](#descriptors), which declares
210
+ the name of a *descriptor* which is a separate configuration block , described [below](#descriptors), which declares
210
211
the kind of metric this is. The `value` field and the four label fields describe which attributes to use
211
212
at request time in order to produce the metric.
212
213
@@ -230,7 +231,14 @@ We've already seen a few simple attribute expressions in the previous examples.
230
231
231
232
The sequences on the right-hand side of the colons are the simplest forms of attribute expressions.
232
233
They only consist of attribute names. In the above, the `source` label will be assigned the value
233
- of the `source.name` attribute.
234
+ of the `source.name` attribute. Here's an example of a conditional expression :
235
+
236
+ ` ` ` yaml
237
+ service: api.name | target.name
238
+ ` ` `
239
+
240
+ With the above, the service label will be assigned the value of the api.name attribute, or if that attribute
241
+ is not defined, it will be assigned the value of the target.name attribute.
234
242
235
243
The attributes that can be used in attribute expressions must be defined in an
236
244
[*attribute manifest*](#manifests) for the deployment. Within the manifest, each attribute has
@@ -336,6 +344,8 @@ programming language. Doing so enables a few important scenarios:
336
344
by Mixer. For example, a metric descriptor provides all the information needed to program a backend system to accept metrics
337
345
that conform to the descriptor's shape (it's value type and its set of labels).
338
346
347
+ - Descriptors can be referenced and reused from multiple aspects.
348
+
339
349
- It enables type checking of the deployment's configuration. Since attributes have strong types, and so do descriptors,
340
350
Istio can provide a number of strong correctness guarantees of the system's configuration. Basically, if a block of
341
351
configuration is accepted into the Istio system, it means the configuration passes a minimum correctness bar. Again, this
@@ -355,16 +365,16 @@ them to have control over their areas, but not other's.
355
365
356
366
Here's how this all works :
357
367
358
- - The various blocks of configuration described in the previous sections (adapters, aspects, and descriptors) are always defined
368
+ - The various configuration blocks described in the previous sections (adapters, aspects, and descriptors) are always defined
359
369
within the context of a hierarchy.
360
370
361
371
- The hierarchy is represented by DNS-style dotted names. Like DNS, the hierarchy starts with the rightmost element in
362
372
the dotted name.
363
373
364
- - Each block of configuration is associated with a *scope* and a *subject* which are both dotted names
374
+ - Each configuration block is associated with a *scope* and a *subject* which are both dotted names
365
375
representing locations within the hierarchy :
366
376
367
- - A scope represents the authority that created the block of configuration. Authorities
377
+ - A scope represents the authority that created the configuration block . Authorities
368
378
higher up in the hierarchy are more powerful than those lower in it.
369
379
370
380
- The subject represents the location of the block of state within the hierarchy. The subject
@@ -379,28 +389,28 @@ state is deployed. For example, a valid scope might be `svc.cluster.local` while
379
389
` myservice.ns.svc.cluster.local`
380
390
381
391
The scoping model is designed to pair up with an access control model to constrain which human is allowed to
382
- create blocks of configuration for particular scopes. Operators which have the authority to create
392
+ create configuration blocks for particular scopes. Operators which have the authority to create
383
393
blocks at a scope higher in the hierarchy can impact all configuration associated with lower scopes. Although this is the design
384
394
intent, Mixer configuration doesn't yet support access control on its configuration so there are no actual constraints on which
385
395
operator can manipulate which scope.
386
396
387
397
# ### Resolution
388
398
389
399
When a request arrives, Mixer goes through a number of [request processing phases](./mixer.md#request-phases).
390
- The Resolution phase is concerned with identifying the exact blocks of configuration to use in order to
400
+ The Resolution phase is concerned with identifying the exact configuration blocks to use in order to
391
401
process the incoming request. For example, a request arriving at Mixer for service A likely has some configuration differences
392
402
with requests arriving for service B. Resolution is about deciding which config to use for a request.
393
403
394
404
Resolution depends on a well-known attribute to guide its choice, a so-called *identity attribute*.
395
405
The value of this attribute is a dotted name which determines where the mixer begins to look in the
396
- hierarchy for blocks of configuration to use for the request.
406
+ hierarchy for configuration blocks to use for the request.
397
407
398
408
Here's how it all works :
399
409
400
410
1. A request arrives and Mixer extracts the value of the identity attribute to produce the current
401
411
lookup value.
402
412
403
- 2. Mixer looks for all blocks of configuration whose subject matches the lookup value.
413
+ 2. Mixer looks for all configuration blocks whose subject matches the lookup value.
404
414
405
415
3. If Mixer finds multiple blocks that match, it keeps only the block that has the highest scope.
406
416
@@ -443,6 +453,11 @@ manifests:
443
453
value_type: INT64
444
454
` ` `
445
455
456
+ # # Examples
457
+
458
+ You can find fully formed examples of Mixer configuration by visiting the [Samples]({{site.baseurl}}/docs/samples). As
459
+ a specific example, here is the [BookInfo configuration](https://raw.githubusercontent.com/istio/istio/master/demos/mixer-config-quota-bookinfo.yaml).
460
+
446
461
# # Configuration API
447
462
448
463
*TBD*
0 commit comments