Distributed Tracing, Istio and Your Applications

In the microservices world, distributed tracing is slowly becoming the most important tool for debugging and understanding your application dependencies.

During my recent conversations in meetups and conferences, I found there was a lot of interest in how distributed tracing works but at the same time there was a fair amount of confusion on how tracing interacts with service meshes like Istio and Aspen Mesh. In particular, I had these following questions asked frequently:

• How does tracing work with Istio? What information is collected and reported in the spans?
• Do I have to change my applications to benefit from distributed tracing in Istio?
• If I am currently reporting spans in my application how will it interact with spans reported from Istio?

In this blog post, I am going to try and answer these questions.

Before we get deeper into these questions, a quick background on why or how I ended up writing tracing related blogs. If you follow the Aspen Mesh blog, you would have noticed I wrote two blogs related to tracing, one on tracing requests to AWS services when using Istio, and the second on tracing gRPC applications with Istio.

We have a pretty small engineering team at Aspen Mesh and as it goes in most startups if you work frequently on a sub-system or component you quickly become (or labeled or assigned) a resident expert. I added tracing in our microservices and integrated it with Istio in the AWS environment and in that process uncovered various interesting interactions which I thought might be worth sharing. Over the last few months, we have been using tracing very heavily to gain an understanding of our microservices and it has now become the first place we look when things break. With that let’s move on to answering the questions I mentioned above.

How Does Tracing Work with Istio?

Istio injects a sidecar proxy (Envoy) in the pod in which your application container is running. This sidecar proxy transparently intercepts (iptables magic) all network traffic going in and out of your application. Because of this interception, the sidecar proxy is in a unique position to automatically trace all network requests (HTTP/1.1, HTTP/2.0 & gRPC).

Let’s see what changes sidecar proxy makes to an incoming request to a pod from a client (external or other microservices). From this point on I’m going to assume tracing headers are in Zipkin format for simplicity.

• If the incoming request doesn’t have any tracing headers, the sidecar proxy will create a root span (span where trace, parent and span IDs are all the same) before passing the request to the application container in the same pod.
• If the incoming request has tracing information (which should be the case if you’re using Istio ingress or your microservice is being called from another microservice with sidecar proxy injected), the sidecar proxy will extract the span context from these headers, create a new sibling span (same trace, span and parent ID as incoming headers) before passing the request to the application container in the same pod.

In the reverse direction when the application container is making outbound requests (external services or services in the cluster), the sidecar proxy in the pod performs the following actions before making the request to the upstream service:

• If no tracing headers are present, the sidecar proxy creates root span and injects the span context as tracing headers into the new request.
• If tracing headers are present, the sidecar proxy extracts the span context from the headers, creates  child span from this context. The new context is propagated as tracing headers in the request to the upstream service.

Based on the above explanation you should note that for every hop in your microservice chain you will get two spans reported from Istio, one from the client sidecar (span.kind set to client) and one from the server sidecar (span.kind set to server). All the spans created by the sidecars are automatically reported by the sidecars to the configured tracing backend systems like Jaeger or Zipkin.

Next, let’s look at the information reported in the spans. The spans contain the following information:

• x-request-id: Reported as guid:x-request-id which is very useful in correlating access logs with spans.
• upstream cluster: The upstream service to which the request is being made. If the span is tracking an incoming request to a pod this is typically set to in.<name>. If the span is tracking an outbound request this is set to out.<name>.
• HTTP headers: Following HTTP headers are reported when available:
  •   + URL
  •   + Method
  •   + User agent
  •   + Protocol
  •   + Request size
  •   + Response size
  •   + Response Flags
• Start and end times for each span.
• Tracing metadata: This includes the trace ID, span ID and the span kind (client or server). Apart from these, the operation name is also reported for every span. The operation name is set to the configured virtual service (or route rule in v1alpha1) which affected the route or “default-route” if the default route was chosen. This is very useful in understanding which Istio route configuration is in effect for a span.

With that let’s move on to the second question.

Do I Have to Change My Application to Gain Benefit from Tracing in Istio?

Yes, you will need to add logic in your application to propagate tracing headers from incoming to outgoing requests to gain full benefit from Istio’s distributed tracing.

If the application container makes a new outbound request in the context of an incoming request and doesn’t propagate the tracing headers from the incoming request, the sidecar proxy creates a root span for the outbound request. This means you will always see traces with only two microservices. On the other hand, if the application container does propagate the tracing headers from incoming to outgoing requests, the sidecar proxy will create child spans as described above. Creation of the child spans gives you the ability to understand dependencies across multiple microservices.

There are a couple of options for propagating tracing headers in your application.

2. Look for tracing headers as mentioned in the Istio documentation and transfer the headers from incoming to outgoing requests. This method is simple and works in almost all cases. However, it has a major drawback that you cannot add custom tags to the spans like user information. You cannot create child spans related to events in the application which you might want to report. As you are simply transferring headers without understanding the span formats or contexts there is limited ability to add application-specific information.
3. The second method is setting up a tracing client in your application and use the Opentracing APIs to propagate tracing headers from incoming to outgoing requests. I have created a sample tracing-go package which provides an easy way to setup jaeger-client-go in your applications which is compatible with Istio. The following snippet should be included in the main function of your application:

The key point to note is in the tracing-go package I have set the Opentracing global tracer to the Jaeger tracer. This enables me to use the Opentracing APIs for propagating headers from incoming to outgoing requests like this:

You can also use the Opentracing APIs to set span tags or create child spans from the tracing context added by Istio like this:

Apart from these benefits, you don’t have to deal with tracing headers directly but the tracer (in this case Jaeger) handles it for you. I strongly recommend using this approach as it sets the foundation in your application to add enhanced tracing capabilities without much overhead.

Now let’s move on to the third question.

How Do Spans Reported by Istio Interact with Spans Created by Applications?

If you want the spans reported by your application to be child spans of the tracing context added by Istio you should use OpenTracing API

StartSpanFromContext instead of using StartSpan. The StartSpanFromContext creates a child span from the parent context if present else creates a root span.

Note that in all the examples above I have used OpenTracing Go APIs but you should be able to use any tracing client library written in the same language as your application as long as it is OpenTracing API compatible.

Neeraj Poddar is the Platform Lead at Aspen Mesh. He has worked on various aspects of operating systems, networking and distributed systems over the span of his career. He is passionate about developing efficient and performant distributed applications. He loves...

Read more from Neeraj Poddar