INTERFACE, by apidays - Challenges of exposing and connecting microservices
0 likes97 views
The document discusses the challenges of exposing and connecting microservices, highlighting issues such as the need for better security, visibility, and traffic management. It emphasizes the benefits of using an API gateway and service mesh for managing microservices effectively. Additionally, it underscores the importance of tools like Envoy Proxy and Istio in enhancing service communication and management.
INTERFACE, by apidays - Challenges of exposing and connecting microservices
- 1. The challenges of exposing and connecting microservices Denis Jannot Director of Field Engineering - EMEA
- 2. 2022 SERIES OF EVENTS New York JULY (HYBRID) Australia SEPTEMBER (HYBRID) Singapore APRIL (VIRTUAL) Helsinki & North MARCH (VIRTUAL) Paris DECEMBER (HYBRID) London OCTOBER (HYBRID) Hong Kong AUGUST (VIRTUAL) JUNE (VIRTUAL) India MAY (VIRTUAL) APRIL (VIRTUAL) Dubai & Middle East JUNE (VIRTUAL) Check out our API Conferences www.a pida ys .globa l Want to talk at one of our conferences? apidays.typeform.com/to/ILJeAaV8
- 3. 2 | Copyright © 2021 About me @djannot [email protected] denisjannot Denis Jannot Director of Field Engineering - EMEA @ Solo.io
- 4. 3 | Copyright © 2021 From Monolith to Microservices MONOLITH MICROSERVICES
- 5. 4 | Copyright © 2021 Kubernetes became the most popular platform MONOLITH MICROSERVICES
- 6. 5 | Copyright © 2021 5 | Copyright © 2021 Exposing microservices
- 7. 6 | Copyright © 2021 How do you expose your apps ? The Ingress way MICROSERVICES Ingress TLS Basic routing Kubernetes Service Pods
- 8. 7 | Copyright © 2021 Each team reinvents the wheel MICROSERVICES Ingress
- 9. 8 | Copyright © 2021 Some capabilities must be implemented downstream MICROSERVICES Ingress API GATEWAY Rate limiting WAF
- 10. 9 | Copyright © 2021 Common challenges • Each team reinvents the wheel (setting up the same authentication) • Implementation is different for each language • Application teams should focus on the business logic instead • The security team doesn’t have visibility on what’s configured for each application • Other security mechanisms must be implemented outside of the Kubernetes cluster
- 11. 10 | Copyright © 2021 What about a Kubernete-native API Gateway ? MICROSERVICES API GATEWAY Rate limiting WAF
- 12. 11 | Copyright © 2021 That can even expose services outside of Kubernetes MICROSERVICES API GATEWAY Rate limiting WAF
- 13. 12 | Copyright © 2021 Benefits • Authentication is performed at the API Gateway level • Application teams can focus on the business logic • Everything is configured through Kubernetes Custom Ressources, so it’s Gitops-friendly • Other security mechanisms are enforced by the same Gateway • Visibility for the security team
- 14. 13 | Copyright © 2021 13 | Copyright © 2021 Connecting microservices
- 15. 14 | Copyright © 2021 No visibility MICROSERVICES API GATEWAY Rate limiting WAF
- 16. 15 | Copyright © 2021 Common challenges • No visibility • No security (plain text requests, all communications allowed in the cluster, …) • Limited traffic management • Complex cross cluster communications
- 17. 16 | Copyright © 2021 Service to Service communication requirements • Observability • Identity Management • Encryption • Certificate Management • Traffic Management • Health check • Access Control • ...
- 18. 17 | Copyright © 2021 Kubernetes alone doesn’t provide much Encryption Telemetry Traffic management Access control Identity Management Certificate management Health check Kubernetes Service Third Party Encryption
- 19. 18 | Copyright © 2021 An API gateway could solve some problems MICROSERVICES API GATEWAY Encryption Telemetry Traffic management Access control Health check Identity Management Certificate management Third Party Encryption
- 20. 19 | Copyright © 2021 But it would become a bottleneck MICROSERVICES API GATEWAY Encryption Telemetry Traffic management Access control Health check Identity Management Certificate management Third Party Encryption
- 21. 20 | Copyright © 2021 Welcome Service Mesh SERVICE MESH Control Plane Encryption Telemetry Traffic management Access control Identity Management Certificate management Health check Data Plane
- 22. 21 | Copyright © 2021 Benefits • Authentication and Authorization are performed at the Service Mesh level • Encryption is performed at the Service Mesh level • Advanced traffic management allows smarter deployments (canary, …) • End to end observability • Application teams can focus on the business logic
- 23. 22 | Copyright © 2021 Why Envoy Proxy • Neutral Foundation (CNCF) • Large, diverse, vibrant community • Built ground up for dynamic services environment • Dynamic configuration, driven by API • Highly extensible • L7 filters (HTTP/1, HTTP/2, gRPC, redis, mysql, Kafka, etc) • Deep signals telemetry out of the box • Versatile deployment options
- 24. 23 | Copyright © 2021 Istio is the dominant open-source leader Source: CNCF Survey 2020 raw data
- 25. 24 | Copyright © 2021 Multi-cluster operations is more involved
- 26. 25 | Copyright © 2021 Istio architecture
- 27. 26 | Copyright © 2021 26 | Copyright © 2021 Why Solo ?
- 28. 27 | Copyright © 2021 Application networking
- 29. 28 | Copyright © 2021 Gloo Edge MICROSERVICES Rate limiting WAF
- 30. 29 | Copyright © 2021 Gloo Mesh
- 31. 30 | Copyright © 2021 Enterprise Istio Production Support • Upstream first • Specialty builds available (FIPS, ARM, distroless, etc) • Long Term Support (LTS) N-4 • Critical security patches • Production break-fix • One hour SLA Severity 1 • Install / upgrade • Architecture and operational guidance, best practices Kubernetes Cluster Istiod Account User
- 32. 31 | Copyright © 2021 First analyst report covering service mesh
- 33. 32 | Copyright © 2021 32 | Copyright © 2021
- 34. 33 | Copyright © 2021
- 35. 34 | Copyright © 2021 34 | Copyright © 2021 https://slack.solo.io/
- 36. 35 | Copyright © 2021 35 | Copyright © 2021 Thank you !
- 37. 36 | Copyright © 2021