Reading time 3 min

Bregt Coenen

In the complex world of modern software development, companies are faced with the challenge of seamlessly integrating diverse applications developed and managed by different teams. An invaluable asset in overcoming this challenge is the Service Mesh. In this blog article, we delve into Istio Service Mesh and explore why investing in a Service Mesh like Istio is a smart move." What is Service Mesh? A service mesh is a software layer responsible for all communication between applications, referred to as services in this context. It introduces new functionalities to manage the interaction between services, such as monitoring, logging, tracing, and traffic control. A service mesh operates independently of the code of each individual service, enabling it to operate across network boundaries and collaborate with various management systems. Thanks to a service mesh, developers can focus on building application features without worrying about the complexity of the underlying communication infrastructure. Istio Service Mesh in Practice Consider managing a large cluster that runs multiple applications developed and maintained by different teams, each with diverse dependencies like ElasticSearch or Kafka. Over time, this results in a complex ecosystem of applications and containers, overseen by various teams. The environment becomes so intricate that administrators find it increasingly difficult to maintain a clear overview. This leads to a series of pertinent questions: What is the architecture like? Which applications interact with each other? How is the traffic managed? Moreover, there are specific challenges that must be addressed for each individual application: Handling login processes Implementing robust security measures Managing network traffic directed towards the application ... A Service Mesh, such as Istio, offers a solution to these challenges. Istio acts as a proxy between the various applications (services) in the cluster, with each request passing through a component of Istio. How Does Istio Service Mesh Work? Istio introduces a sidecar proxy for each service in the microservices ecosystem. This sidecar proxy manages all incoming and outgoing traffic for the service. Additionally, Istio adds components that handle the incoming and outgoing traffic of the cluster. Istio's control plane enables you to define policies for traffic management, security, and monitoring, which are then applied to the added components. For a deeper understanding of Istio Service Mesh functionality, our blog article, "Installing Istio Service Mesh: A Comprehensive Step-by-Step Guide" , provides a detailed, step-by-step explanation of the installation and utilization of Istio. Why Istio Service Mesh? Traffic Management: Istio enables detailed traffic management, allowing developers to easily route, distribute, and control traffic between different versions of their services. Security: Istio provides a robust security layer with features such as traffic encryption using its own certificates, Role-Based Access Control (RBAC), and capabilities for implementing authentication and authorization policies. Observability: Through built-in instrumentation, Istio offers deep observability with tools for monitoring, logging, and distributed tracing. This allows IT teams to analyze the performance of services and quickly detect issues. Simplified Communication: Istio removes the complexity of service communication from application developers, allowing them to focus on building application features. Is Istio Suitable for Your Setup? While the benefits are clear, it is essential to consider whether the additional complexity of Istio aligns with your specific setup. Firstly, a sidecar container is required for each deployed service, potentially leading to undesired memory and CPU overhead. Additionally, your team may lack the specialized knowledge required for Istio. If you are considering the adoption of Istio Service Mesh, seek guidance from specialists with expertise. Feel free to ask our experts for assistance. More Information about Istio Istio Service Mesh is a technological game-changer for IT professionals aiming for advanced control, security, and observability in their microservices architecture. Istio simplifies and secures communication between services, allowing IT teams to focus on building reliable and scalable applications. Need quick answers to all your questions about Istio Service Mesh? Contact our experts

Reading time 5 min

Peter Jans

Like every year, Amazon held its AWS re:Invent 2021 in Las Vegas. While we weren’t able to attend in person due to the pandemic, as an AWS Partner we were eager to follow the digital event. Below is a quick rundown of our highlights of the event to give you a summary in case you missed it! AWS closer to home AWS will build 30 new ‘ Local Zones ’ in 2022, including one in our home base: Belgium. AWS Local Zones are a type of infrastructure deployment that places compute, storage, database, and other select AWS services close to large population and industry centers. The Belgian Local Zone should be operational by 2023. Additionally, the possibilities of AWS Outposts have increased . The most important change is that you can now run far more services on your own server delivered by AWS. Quick recap: AWS Outposts is a family of fully managed solutions delivering AWS infrastructure and services to virtually any on-premises or edge location for a consistent hybrid experience. Outposts was previously only available in a 42U Outposts rack configuration. From now on, AWS offers a variety of form factors, including 1U and 2U Outposts servers for when there’s less space available. We’re very tempted to get one for the office… AWS EKS Anywhere was previously announced, but is now a reality! With this service, it’s possible to set up a Kubernetes cluster on your own infrastructure or infrastructure from your favorite cloud provider, while still managing it through AWS EKS. All the benefits of freedom of choice combined with the unified overview and dashboard of AWS EKS. Who said you can’t have your cake and eat it too? Low-code to regain primary focus With Amplify Studio , AWS takes the next step in low-code development. Amplify Studio is a fully-fledged low-code generator platform that builds upon the existing Amplify framework. The platform allows users to build applications through drag and drop with the possibility of adding custom code wherever necessary. Definitely something we’ll be looking at on our next Ship-IT Day! Machine Learning going strong(er) Ever wanted to start with machine learning, but not quite ready to invest some of your hard-earned money? With SageMaker Studio Lab , AWS announced a free platform that lets users start exploring AI/ML tools without having to register for an AWS account or leave credit card details behind. You can try it yourself for free in your browser through Jupyter notebooks ! Additionally, AWS announced SageMaker Canvas : a visual, no-code machine learning capability for business analysts. This allows them to get started with ML without having extensive experience and get more insights in data. The third chapter in the SageMaker saga consists of SageMaker Ground Truth Plus . With this new service, you hire a team of experts to train and label your data, a traditionally very labor intensive process. According to Amazon, customers can expect to save up to 40% through SageMaker Ground Truth Plus. There were two more minor announcements: the AI ML Scholarschip Program , a free program for students to get to know ML tools, and Lex Automated Chatbot Designer , which lets you quickly develop a smart chatbot with advanced natural language processing support. Networking for everyone Tired of less than optimal reception or a slow connection? Why not build your own private 5G network? Yep: with AWS Private 5G , Amazon delivers the hardware, management and sim cards for you to set up your very own 5G network. Use cases (besides being fed up with your current cellular network) include warehouses or large sites (e.g. a football stadium) that require low latency, excellent coverage and a large bandwidth. The best part? Customers only pay for the end user’s usage of the network. Continuing the network theme, there’s now AWS Cloud WAN . This service allows users to build a managed WAN (Wide Area Network) to connect cloud and on-premise environments with a central management UI on a network components level as well as service level. Lastly, there’s also AWS Workspaces Web . Through this service, customers can grant employees safe access to internal website and SaaS applications. The big advantage here is that information critical to the company never leaves the environment and doesn’t leave any traces on workstations, thanks to a non-persistent web browser. Kubernetes anyone? No AWS event goes without mentioning Kubernetes, and AWS re:Invent 2021 is no different. Amazon announced two new services in the Kubernetes space: AWS Karpenter and AWS Marketplace for Containers Anywhere . With AWS Karpenter, managing autoscaling Kubernetes infrastructure becomes both simpler and less restrictive. It takes care of automatically starting compute when the load of an application changes. Interestingly, Karpenter is fully open-source, a trend which we’ll see more and more according to Amazon. AwS Marketplace for Containers Anywhere is primarily useful for customers who’ve already fully committed to container managed platforms. It allows users to search, subscribe and deploy 3rd party Kubernetes apps from the AWS Marketplace in any Kubernetes cluster, no matter the environment. IoT updates There have been numerous smaller updates to AWS’s IoT services, most notably to: GreenGrass SSM , which now allows you to securely manage your devices using AWS Systems Manager Amazon Monitron to predict when maintenance is required for rotating parts in machines AWS IoT TwinMaker , to simply make Digital Twins of real-world systems AWS IoT FleetWise , whichs helps users to collect vehicle data in the cloud in near-real time. Upping the serverless game In the serverless landscape, AWS announced serverless Redshift , EMR , MSK , and Kinesis . This enables to set up services while the right instance type is automatically linked. If the service is not in use, the instance automatically stops. This way, customers only pay for when a service is actually being used. This is particularly interesting for experimental services and integrations in environments which do not get used very often. Sustainability Just like ACA Group’s commitment to sustainability , AWS is serious about their ambition towards net-zero carbon by 2040. They’ve developed the AWS Customer Carbon Footprint tool, which lets users calculate carbon emissions through their website . Other announcements included AWS Mainframe Modernization , a collection of tools and guides to take over existing mainframes with AWS, and AWS Well-Architected Framework , a set of design principles, guidelines, best practices and improvements to validate sustainability goals and create reports. We can't wait to start experimenting with all the new additions and improvements announced at AWS re:Invent 2021. Thanks for reading! Discover our cloud hosting services

Reading time 4 min

Patrik Söderström

The yearly inspiring Azure conference CloudBrew organized by the Azure User Group took place on December 12th and 13th, 2024. The best speakers from all over Europe were invited to share their experiences and knowledge of the latest developments in Azure. ACA Group is one of the partners of CloudBrew and the Azure User Group in Belgium . This allowed us not only to participate but have selected customers join us into the ever evolving world of Azure at the event. With two action packed days of events, we want to highlight the topics which touched and inspired us. Opening Keynote: The opening keynote was delivered by no other than Sakari Nahi , the CEO of Zure. He talked about the advances in AI and specifically how it will impact the hard working engineers and architects in the public cloud. There’s no denying that AI will impact how we use and work with Azure. This may make us worried on different levels, some may worry that we will be replaced by AI, while others will have privacy concerns. Wherever you are on this scale, the AI revolution is positive for everyone. We have to see ourselves as operators of AI, not as replacements. It’s always DNS Rik Hepworth and his magnificent gray hair was present to explain how it’s always DNS. It’s always DNS in the sense that no matter what you decide to deploy, DNS has to be taken into consideration. Here we learned the importance of centralizing DNS with a HUB and SPOKE configuration. The Azure Private DNS Resolver is taking over as the go-to solution for DNS Conditional Forwarding. By centralizing this in the HUB, it’s possible to scale the environment into as many virtual networks and subscriptions as required. Avoid setting up Private DNS zones in individual SPOKE subscriptions as this is a recipe for management disaster as the environment grows. Orchestration vs Choreography As our daily work rarely involves software architecture, we weren’t sure what to expect from this talk. However, we were pleasantly surprised as Laila Bougria delivered one of the most captivating sessions on building microservice-based application architectures. Orchestration uses a coordination and management system between the different software components. Choreography on the other hand is decentralized offering and in some cases provides easier maintenance. There is no card to trump them all, it all depends on your situation. After this awesome session from Laila, we got more interested in the topic. You can find more about her work here . GPT-4 vs Starcraft II - Strategic Decision Making using Large Language Models AI is everywhere and CloudBrew is not an exception. This session from Alan Smith provided a practical example on how you can integrate GPT-4 into an existing system, which in this case was Starcraft II . Starcraft II is a strategy game released in 2010, where there is a wealth of information on the Internet on how to beat your opponent. All of this information has been picked up by GPT-4 and if you would ask it, based on the state of the game, such as what the opponent is doing, it can devise a strategy in text format to counter this. This was a live demonstration of how the screen output of Starcraft II was fed to GPT-4. GPT-4 returned a set of instructions on what the next actions would be to counter and beat your opponent. These were translated to in game activities and we could watch in awe how GPT-4 was beating the opponent. Granted, in this scenario GPT-4 was playing against the computer, which is also considered a type of AI. AI beating AI feels like we are coming full circle, in a surprisingly positive kind of way 🙂 Seriously securing an Azure PaaS application Joonas Westlin gave a lecture on Azure security for PaaS solutions, and he delivered it with a good dose of humor and relatable real-world examples. We started with the basics: affordable, standard solutions like Private Endpoints and Network Security Groups. Nice and simple, and budget-friendly. But the further you move the security slider up, the more serious it gets. Think WAF (Web Application Firewall) and Application Gateway , which lock down your environment completely — but can also stretch your budget significantly. Joonas presented his story in a way that made you laugh regularly because it was so relatable. His anecdotes struck exactly the right chord, while also providing useful insights. Especially on how to smartly balance security and costs, without feeling like you're running a fortress. Ending with Amazement: Although CloudBrew has only just passed, we can’t help but look back with a smile. The conference, the speaker lineup, and their engaging topics were nothing short of exceptional. The knowledge and insights we gained in just two days would have taken months to acquire elsewhere. We’re already looking forward to CloudBrew 2025 and hope to see you there as well!