Kubernetes Journey of a Large FinTech
Download as PPTX, PDF1 like128 views
This document summarizes a large fintech company in the Philippines' journey to Kubernetes. It faced challenges of legacy systems, static vs dynamic infrastructure, on-prem vs cloud, and security. It adopted a microservices architecture running on Kubernetes with Docker containers. It started with multiple small clusters but consolidated to a single large cluster with namespace isolation for improved cost and manageability. Automations were implemented for operations. Monitoring and logging were set up with ELK and Prometheus/Grafana. A10 was selected for traffic management and security between services. The final deployment provides north-south load balancing and security and east-west traffic security and visibility between microservices.
Ad
More Related Content
What's hot (20)
Similar to Kubernetes Journey of a Large FinTech (20)
Ad
More from Akshay Mathur (19)
Ad
Recently uploaded (20)
Kubernetes Journey of a Large FinTech
- 1. Reliable Security Alwaysโข K8s Journey of a Large FinTech of Philippines
- 3. 3 Who is biggest Influencer? Users They demand a lot! And They need it yesterday!
- 4. 4 Itโs not the strongest of the species that SURVIVE nor the most intelligent but the one MOST RESPONSIVE TO CHANGE. โ Charles Darwin (1809-1882)
- 5. 5 APP/IT TEAMS NEED Speed Roll-out Of Revenue- Generating Services Team Agility Self-Service BUSINESS NEEDS Data Security & Privacy Protection For Customers Prevent External Attacks & Access Control Between Distributed Microservices Ease-of- Operations & Improved Team Efficiency Ensure Excellent & Consistent User Experience
- 6. 6 Challenges of running at Scale โข Dealing with Legacy (Technical Debt) โฆ Rewrite the application with microservices architecture โข Static vs Dynamic Infrastructure โฆ Select dynamic Infrastructure with K8s โข On-prem vs Cloud โฆ Select cloud but keep portable โข Security โฆ Implement high security because the application deals with monitory transactions and other sensitive information
- 8. 8 Dealing with various stakeholders โข CISO office โข Developers โข Project Managers โข Network Admins โข Operations Team โข Partners and Vendors
- 9. 9 Software Architecture โข Every module as microservice โข Clear separation of stateless and stateful microservices โข Microservices have REST APIs with JSON data exchange โข All microservices identified by KubeDNS FQDN โข Strict access control of data exchange between microservices โข No use of cloud specific features to ensure portability
- 10. 10 Deployment Architecture โข Microservices are deployed in Docker containers โข Containers are managed by Kubernetes โข Each group of services is deployed in separate namespace โฆ Started with multiple small clusters and ended into single large cluster โฆ A few services are still out of K8s โข Services of different group sending traffic via Gateway
- 11. 11 Cluster Design: Multiple small clusters โข Security and compliance require monitoring traffic between microservices โข In absence of policy enforcement, company isolated clusters โฆ Small machines are used โข Pro: Each Team had its own area โข Con: Cost of infrastructure and management was very high Kubernetes Node Kubernetes Node Kubernetes Node Kubernetes Node
- 12. 12 Cluster Design: Single large cluster with namespace isolation โข Separated microservices via namespaces โฆ Large machines are used โข Controlled traffic flow via application gateway โข Pro: Optimized cost and manageability โข Pro: Some E/W traffic info from app-gw โข Con: Load on app-gw and NW โข Con: Slow response Kubernetes Node Kubernetes Node Kubernetes NodeKubernetes Node
- 13. 13 Operations Automations Also helps in dealing with failure โข Complete infrastructure remains as code in SCM system (GIT) โข Entire cluster is deployed/destroyed via CI/CD tools (Jenkins and Ansible) โข Support system tools (controllers, log collectors etc.) follow same principles โข K8s rolling update along with readiness and liveness probe โฆ Entire application is redeployed in UAT on every code commit by any developer โข Sometimes rolling update happen multiple times in a min
- 14. 14 Monitoring and Log Collection โข Huge ELK deployment in K8s (separate cluster) collecting logs for every component/service โข Prometheus and Grafana for monitoring container infrastructure โข A10 Harmony Controller (separate cluster) for traffic observability
- 15. 15 Selection of Traffic Management Solution vs Kubernetes NodeKubernetes Node Sidecar Proxy Deployment Hub-Spoke Proxy Deployment Resource intensive Expensive TCO Low overhead Lower TCO
- 16. 16 Application Security and Traffic Management โข North-South Traffic โฆ AKAMAI cloud is taking care of SSL offload and WAF โฆ Additional security policies are implemented by A10 Lightning ADC โฆ A10 Lightning ADC takes care of traffic distribution between microservices โข East-West Traffic โฆ A10 Lightning ADC works as transparent service proxy โฆ Access control, Mutual TLS and transparent encryption by Lightning ADC eliminated requirement of external GW โข Harmony Controller provides observability on both N-S and E-W traffic
- 17. A10 Secure Service Mesh This Highly-Scalable Solution Provides the Following Capabilities o North-south traffic load balancing, service discovery and application security o East-west traffic security and policy enforcement between microservices o Centralised application traffic visibility and control
- 18. 18 Final Deployment Diagram POD Service-1 POD POD Service-2 Service-3 POD Service-1 POD POD Service-2 Service-3 Node 1 POD Service-1 POD POD Service-2 Service-3 Kubernetes Connector Harmony Controller Node 2 Node N
- 19. Thank You Reliable Security Alwaysโข
Editor's Notes
- #5: Users are demanding Users needs always evolving Quote To succeed in FINTECH, your business needsโฆ
- #6: Letโs take a look at some of the struggles and business challenges IT experts and CISOโs are dealing with on a daily basis: The average enterprise is running applications in at least 5 clouds. That represents quite a complex application networking and security environment. According to a recent survey by 451 Research, 71% of enterprises are either using or evaluating container orchestration options like Kubernetes and Docker. On the other hand and according to a study by Ponemon, 65% of all security issues are due to human error and inadequate in-house security expertise. The Ponemon Institute published a study recently whereas 79% of enterprises lack a comprehensive DDoS attack and mitigation strategy.