Advanced Observability & Security

© OPITZ CONSULTING 2023 / Öffentlich
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 1
Berlin, 2023-06-13
Philipp Kürsten,
Fabian Hardt
ADVANCED OBSERVABILITY & SECURITY
FOR YOUR KUBERNETES WITH A MODERN SERVICE MESH

WHY SERVICE MESH?
01
KUMA
02
CONCLUSION
04
DEMO
03

OPITZ CONSULTING
„Wir erreichen Kundennähe vor Ort und
durch moderne Delivery-Modelle auch
auf Entfernung!“ Peter Menne, GF
Essen
Bad Homburg
Stuttgart
München
Nürnberg
Gummersbach
Berlin
Hamburg
Kraków

MODERN
IT-Modernisierung
„Nachhaltiges Business durch
flexible, dynamikrobuste Lösungen
für die digitale Welt von morgen“
#MEHRWERT
AUTO-
MATISIERT
SICHER
INTEGRIERT
Security
„Sichere IT-Lösungen und
Infrastrukturen als Basis für
Geschäftsmodelle in
dynamischen Märkten“
Systemintegration
„Eine integrierte IT-Landschaft
als Grundlage für ein
#ZUKUNFTSWIRKSAMES
Business“
Intelligent Automation
„Effizienterer Ressourceneinsatz
durch die Automatisierung von
Business-Prozessen mit dem
Einsatz von KI-Technologien“

#TECHNOLOGIE & KOMPETENZEN
CONSULTING
nachhaltig-langfristig-
erfolgreich
APPLICATIONS
innovativ-herausragend-
benutzerfreundlich
INTEGRATION
flexibel-automatisiert-
performt
ANALYTICS
smart-intelligent-
verlässlich
INFRASTRUCTURE
cloud-hybrid-
elastisch
CHANGE
nachhaltig-achtsam-
verbindlich
 Serverless Microservices
 DevOps
 Modernisierung
 Entkopplung
 API first
 Bi-Modal
 UX-Design
 Lifecycle
 Cloud Based Integration
 Sensor Data
 IoT / Industrie 4.0
 API-Management
 Integration Third Party Apps
 Process Integration
 Application Integration
 Data Lakes
 Big Data & Fast Data
 AI & Machine Learning
 Intelligent Automation
 Analytics für IoT
 Data Labs
 Data Governance
 Open Data
 Hybride Architekturen
 Infrastructure as Code
 Cloud Consumption
 Multi-Cloud Management
 Sicherheit der Cloud
 Shared Cloud Services
 Compliance
 Managed Services
 Vision & Sinn
 Rolle und Identität
 Werte & Glaubenssätze
 Umwelt
 Fähigkeiten und
Verhalten
 Culture Gardening
 Digital Awareness
 Digitalisierungsstrategie
 Digitale Transformation
 Innovation
 Digitale Roadmap
 Governance
 Lizenzberatung
DIGITALE PLATTFORM
basierend auf dynamikrobusten Architekturen der Digitalisierung
Künstliche Intelligenz mit dem Fokus auf Automatisierung & Entscheidungsvorbereitung

WHY SERVICE MESH?
01

TREND TOWARDS DISTRIBUTED APPLICATION ARCHITECTURES
Centralized
STATIC
ON-PREM
MONOLITH
VIRTUAL MACHINES
MANUAL CHANGE PROCESS
Decentralized
DYNAMIC
CLOUD / MULTI-CLOUD
MICROSERVICES / SERVERLESS
CONTAINERS, KUBERNETES
AUTOMATED CI/CD TOOL CHAIN
# Services & APIs
CONTROL AND VISIBILITY

INCREASED COMPLEXITY AND COGNITIVE LOAD ON DEVS
Security Security
Logging Logging
Security
Tracing
Metrics Routing
Metrics Tracing
Application
AuthN/
Z
Rate-Limiting
Routing
Caching
Organization
Application
AuthN/
Z
Versioning
Versioning
Rate-Limiting

WHAT’S A SERVICE MESH?
 Efficient implementation of cross-cutting
concerns with respect to service integration
challenges
 Everything is a service!
 Cloud-native apps deployed to Kubernetes
 Non Cloud-native workloads
 Should be independent of
 Architecture (e.g. Monolithic or µService)
 Platform (e.g. VMs, Containers, Kubernetes)
Dedicated infrastructure layer that makes
service-to-service communication more
reliable, secure and observable

E2E SERVICE CONNECTIVITY WITH GATEWAY AND MESH
 Increased Developer experience
 Consistent security
 Seamless observability
 Reliable connectivity
 Resilience
 Flexibility
GW DP
CLIENT
PUBLIC TRAFFIC
GW DP
MESH CP
MESH 1 MESH 2

SERVICE-MESH IMPLEMENTATIONS
 Kuma
 Istio
 Consul
 Linkerd
 GlooMesh

KUMA
02

KUMA INTRODUCTION
 Initially invented by Kong and donated to CNCF in 2020
 Provides a modern distributed Control Plane
 Completely Envoy-based Data Plane proxies
 Platform agnostic open-source control plane for Service Mesh
 Hence Kuma is
 Universal
 Simple
 Scalable
 Flexible deployment options
 Standalone deployment
 Multi-Zone deployment
Source: https://tinyurl.com/xb57bhx5

KUMA STANDALONE ARCHITECTURE

KUMA MULTI-CLUSTER ARCHITECTURE
 One mesh can be deployed over multiple clusters (=> Zone)
 All traffic enters cluster over zone ingress
 One Remote (Zone) Control Plane in each cluster

KUMA NETWORKING / CNI
 Installed as DaemonSet on all Nodes
 Injects label on Pods - k8s.v1.cni.cncf.io/networks: kuma-cni
 CNI enables Transparent Proxying – redirects all traffic through Data Plane

KUMA NETWORKING / INIT-CONTAINER
 Injected to Pod and started individually before Data Plane
 Configures iptables / network routing

SERVICE MESH DNS
 Local DNS resolution directly in Data Plane (Envoy)
 Names are not resolvable in complete cluster, just inside service mesh (Envoy)
 Resolves “.mesh“ address to pre-defined service mesh IP address
 IP in other zone / cluster is routed over Kuma Zone Ingress

ZONE EGRESS
 Special Data Plane instance – like Zone Ingress
 All outgoing traffic is routed through this instance
 Usage of External Services just possible with deployed Zone Egress in the future

INTEGRATION OF LEGACY WORKLOAD
 Integration of vm and bare metal workload
 Local Data Plane instance connecting to Control Plane
 Seamless and secure commuication between vm and Kubernetes workload

DEMO
03

ARCHITECTURE OVERVIEW

ANALYZING AND MONITORING THE DATA
Advanced Observability & Security for your Kubernetes with a modern Service Mesh
 Using Grafana Stack to create a 360-degree view
 Component usage:
 Visualization: Grafana
 Logging: Loki (Log Shipping: FluentD / FluentBit / Promtail)
 Metrics: Prometheus
 Tracing: Jaeger or Tempo
 Alerting: Prometheus Alert Manager
 Operating models
 Self-managed (e.g. on-prem)
 Grafana SaaS offering
25

ARCHITECTURE OBSERVABILITY

DEMO

ASPECTS COVERED
 Mesh Management (Kuma UI)
 Managing Apps within the Mesh
 Locality Awareness
 Advanced Routing
 Security
 Mesh observability
 Metrics
 Logs
 Traces

CONCLUSION
04

SERVICE MESH BENEFITS
 Zero-trust security
 mTLS, Traffic Permissions
 Increased Developers productivity
 Crosscutting concerns (AuthN & AuthZ, …)
 Self-service network management
 Multi-Tenancy over multiple clouds
 Reliable connectivity
 Circuit Breaker, Traffic Routes, …
 Observability
 Metrics, Tracing, Logs

KEY TAKEAWAYS
 Service Mesh is essential to build and managing multi-cloud apps efficiently
 Kuma as mesh implementation provides
 Agnostic approach (independent of architecture or platform)
 Modern, flexible architecture supporting hybrid, multi-cloud scenarios
 Multi-zone
 Multi-cluster
 Multi-mesh
 Seamless CI / CD integration (GitOps)
 Intuitive design
 Spanning a mesh over multiple clusters and clouds can be done easily

MATERIALS
 Demo Source: https://github.com/KongChampions/kuma-multi-zone-mesh
 Kuma docs: https://kuma.io/docs/2.2.x/
 Kuma Counter Demo: https://github.com/kumahq/kuma-counter-demo
 Kuma introduction – Meetup recording “Service integration made easy with OpenSource Kuma”:
https://www.youtube.com/watch?v=f3GeuKzYrsA&t=1s
 Demo “Service integration made easy with OpenSource Kuma”:
https://github.com/svenbernhardt/service-integration-made-easy
 Kong / Kuma and friends (k3d)– https://github.com/FabianHardt/k3d-bootstrap-cluster

Q & A
https://opitzcloud.canto.global/b/H0EMG

www.opitz-consulting.com
KONTAKT
Philipp Kürsten
Senior Consultant
Philipp.Kürsten@opitz-consulting.com
+49 173 7279570
https://www.xing.com/profile/Philipp_Kuersten/
https://www.linkedin.com/in/philipp-kuersten/
Fabian Hardt
Solution Architect
Fabian.Hardt@opitz-consulting.com
https://twitter.com/fabian_hardt
https://www.xing.com/profile/Fabian_Hardt
https://www.linkedin.com/in/fabian-hardt/

Advanced Observability & Security

More Related Content

Similar to Advanced Observability & Security (20)

More from Fabian Hardt (12)

Recently uploaded (20)

Advanced Observability & Security

Editor's Notes