Ad
More Related Content
What's hot (20)
Similar to Control Kubernetes Ingress and Egress Together with NGINX (20)
Ad
More from NGINX, Inc. (20)
Ad
Recently uploaded (20)
Control Kubernetes Ingress and Egress Together with NGINX
- 1. Control Ingress and Egress traffic in Kubernetes with NGINX Amir Rawdat Technical Marketing Engineer, NGINX Faisal Memon Software Engineer, NGINX
- 2. | ©2020 F5 2 Agenda • Common challenges with managing traffic inside Kubernetes • Controlling ingress/egrees traffic with a single configuration • Choosing the right solution depending on your requirements • Live demo • Q&A
- 3. | ©2020 F5 3 Kubernetes becoming platform for developing, testing and running applications Applications are becoming ephemeral by nature This brings limitations to Layer 4 Kubernetes Networking NGINX provides L5-7 networking policies as an alternative to IP addresses Cybersecurity is an ever- growing, ever-complicating field Traditional firewalls and anti virus security is irrelevant or obsolete. Data breaches on the rise and will continue to rise throughout 2021. What we see in the market KUBERNETES-CENTRIC PERSPECTIVE SOURCE: INFORMATION EXAMPLE Adoption of managed and commercial Kubernetes platforms We see rapid adoption of OpenShift and Rancher in the private cloud space EKS and GKE adoption in public cloud
- 4. | ©2020 F5 4 MY FAVORITE ARTICLE TITLES But K8s Adoption Brings Complexity “Let’s Use Kubernetes!”Now You Have 8 Problems” ”Will Complexity Kill Kubernetes?” “Has Kubernetes Already Become To Unnecessarily Complex for Enterprise IT?” ”Why Kubernetes Networking Is Hard – And What You Can Do About It”
- 5. | ©2020 F5 5 WHAT’S MISSING IN K8S AND WHAT DO YOU REALLY WANT AND NEED FROM A MESH? Networking: K8s, L4-L7 • K8s, and CNI, provides L4 servicing – IP endpoints • Many, complex options • https://kubernetes.io/docs/concepts/cluster-administration/networking/ • L7 Traffic Management is missing • Policy-based routing • Service-level access control • SSL/mTLS enforcement • Integrated Ingress/Egress • Enter: KIC + Service Mesh – Taking control of Kubernetes networking
- 6. | ©2020 F5 6 Controlling ingress/egress traffic with NGINX KIC + Service Mesh CONFIDENTIAL
- 7. | ©2020 F5 7 Integrated N/S Ingress/Egress • N/S as a core feature • Ingress/egress traffic treated as S2S service traffic • Full integration with service IdP and SSL key store • mTLS for ingress/egress • Egress name service support • Egress opt-in allowlist • Sidecar ”default route” to Ingress Controller
- 8. | ©2020 F5 8 apiVersion: k8s.nginx.org/v1alpha1 kind: Policy metadata: name: egress-mtls-policy spec: egressMTLS: tlsSecret: egress-mtls-secret trustedCertSecret: egress-trusted-ca-secret verifyServer: on serverName: on sslName: secure-app.example.com apiVersion: k8s.nginx.org/v1alpha1 kind: Policy metadata: name: ingress-mtls-policy spec: ingressMTLS: clientCertSecret: ingress-mtls-secret verifyClient: "on" verifyDepth: 1 Ingress/Egress mTLS (KIC) POLICIES
- 9. | ©2020 F5 9 apiVersion: k8s.nginx.org/v1 kind: VirtualServer metadata: name: app spec: host: app.example.com ... policies: -name: ingress-mtls-policy-cafe -name: egress-mtls-policy-cafe VIRTUALSERVER Applying Ingress/Egress policies to the IC
- 10. | ©2020 F5 10 apiVersion: k8s.nginx.org/v1 kind: VirtualServer metadata: name: app spec: host: app.example.com upstreams: - name: app service: app-svc port: 80 routes: - path: / action: proxy: upstream: app requestHeaders: pass: true set: - name: Content-Type value: application/json VIRTUALSERVER Applying Ingress HTTP header manipulation
- 11. | ©2020 F5 11 apiVersion: k8s.nginx.org/v1 kind: VirtualServer metadata: name: app spec: host: app.example.com upstreams: - name: app service: app-svc port: 80 routes: - path: / action: proxy: upstream: app responseHeaders: add: - name: Access-Control-Allow-Origin value: "*" always: true hide: - x-internal-version ignore: - Expires - Set-Cookie VIRTUALSERVER Applying Egress HTTP header manipulation
- 12. | ©2020 F5 12 Advanced App Centric Configuration Confidential – Do Not Distribute
- 13. | ©2020 F5 13 Data Plane Control Plane
- 14. | ©2020 F5 14 Bookinfo demo Confidential – Do Not Distribute
- 15. | ©2020 F5 21 § Download NGINX Service Mesh for free -- https://downloads.f5.com § Get Started with the NGINX Ingress Controller -- https://github.com/nginxinc/kubernetes-ingress § Get a free trial of NGINX Plus Ingress Controller -- https://www.nginx.com/free-trial- request-nginx-ingress-controller/ Get Started Today !!