SlideShare a Scribd company logo

Data Plane Matters! A Deep Dive and Demo on NGINX Service Mesh

N
NGINX, Inc.

The NGINX Service Mesh (NSM) aims to improve application traffic control, observability, and security for distributed systems, enhancing service communication through policies and managed components. It supports end-to-end encryption, traffic management features, and integrates with Kubernetes. The documentation emphasizes security, proper deployment practices, and outlines when organizations may benefit from implementing a service mesh.

Technology
1 of 36
Downloaded 25 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
NGINX Service Mesh (NSM) DATA PLANE MATTERS Alan Murphy, PM NGINX Service Mesh
| ©2020 F52 NGINX Service Mesh:Agenda • What is a Service Mesh? • What does a Service Mesh solve? • NGINX Service Mesh Architecture • Demo Time! • Q&A
| ©2020 F53 What’s In A Service Mesh! CONFIDENTIAL
| ©2020 F54 L7 Logic (Ingress) L3-L4 Networking L3 – L7 Network Management == Service Mesh An Overly Simplified Picture
| ©2020 F55 WHAT’S MISSING IN K8S AND WHAT DO YOU REALLY WANT AND NEED FROM A MESH? What Is A Service Mesh? Service mesh aims to improve application traffic control, observability and security for distributed systems. - The New Stack
| ©2020 F56 WHAT’S MISSING IN K8S AND WHAT DO YOU REALLY WANT AND NEED FROM A MESH? What Is A Service Mesh? • A service mesh adds L7 traffic management & security: • sidecar deployment • policy management • application availability/health, • Service mesh isn’t just one “thing”, it’s a lot of managed and dependent components • Takes over where K8s networking stops (service/pod IP endpoints) • “Traffic management for containers”
| ©2020 F57 What DoesA Service Mesh Do? Service Mesh controls communications between pods and external apps Secure Traffic End-to-end encryption (Mutual TLS / mTLS), ACLs Manage All Service Traffic Load Balance, Circuit breaker, B|G, Rate Limiting… Orchestration Injection and sidecar management, K8s API integration Measure Traffic Generate transaction traces and real-time monitoring
| ©2020 F58 What Is A Sidecar? © 2017 F5 Networks A Sidecar is a containerized service that another containerized service depends on for some function: “Helper Containers” • Not just networking, can be used for any separationof process:API GW, logging, data mining, etc. In our world, a Sidecar would be a reverse proxy that sits beside an application service container (in the same pod) and provides all inbound and outbound network routing to that application container App Pod
| ©2020 F59 HowAre Sidecars Deployed? © 2017 F5 Networks Separate Container In The App Pod • The separate container is attached to the app service container in a pod • Networking in the app container is altered via a policy from the mesh that tells the app “You can only talk to your sidecar for network access.” • Policy and architecture are defined and orchestrated via the control plane,managed with a combo of ConfigMap and control plane. • A Service Mesh takes care of auto-associating the sidecar with the app container in the same pod via Sidecar Injection App Pod
| ©2020 F510 What DoesA Service Mesh Actually Do? © 2017 F5 Networks • Proxy • Orchestration • Policy Management • Policy Enforcement • Monitoring Data Plane Control Plane Management Plane Data Plane Data + Control Planes …[sidecar] proxies cache the state of the mesh but aren’t regarded as the source of truth for the state of the mesh. - Lee Calcote, O’Reilly
| ©2020 F511 Service Mesh Policies © 2017 F5 Networks Network Policy • Serviceto servicerouting • Serviceavailability • Servicediscovery Access Policy • IP allow/deny • Allow/Deny • JWT Security Policy • SSL/mTLSTermination • DDoS • WAF E F THE MOST IMPORTANT (AND DIFFICULT) PART
| ©2020 F512 I DON’T SAY THAT OFTEN, BUT SERIOUSLY: SECURITY It’s ReallyAll About Security: Data Plane Enforcement • Service Security • Identity Management • SSL Key Management • Injection Policies • Network Security • L3/L4 Networking Control • mTLS Between Services • Access Control • Auditing/Governance • Policy and Traffic Monitoring • Zero Trust • Cluster-wide L7 Networking Policies
| ©2020 F513 NSM Service Mesh The “Data Plane” Service Mesh CONFIDENTIAL
| ©2020 F514 Service Mesh Product Goals NGINX Service Mesh controls communications between pods and external apps Secure Traffic End-to-end encryption (Mutual TLS / mTLS), ACLs Manage All Service Traffic Load Balance, Circuit breaker, B|G, Rate Limiting… Orchestration Injection and sidecar management, K8s API integration Measure Traffic Generate transaction traces and real-time monitoring
| ©2020 F515 Why NGINX Service Mesh? Data Plane Matters
| ©2020 F516 Why NGINX Service Mesh? • Complete Microservices Traffic Management and Security • E/W (sidecar) and N/S (NGINX KIC) Ingress and Egress • Security policy definition, enforcement, and governance • Turn-key and Platform Agnostic • Everything you need is included, no need to piecemeal • Run in any K8s environment, anywhere • Data Plane Matters • Brings the world’s best software reverse proxy to container traffic management
| ©2020 F517 What is the NGINX Service Mesh? Data Plane East/West traffic Control Plane Management Plane Infrastructure Kubernetes VMware AWS Bare Metal SVC SVCSVCSVCSVC SVC Conf DbKubernetes Service Registry Inventory VMware, AWS… Inventory
| ©2020 F518 What is the NGINX Service Mesh? Data Plane East/West traffic Control Plane Management Plane Infrastructure Kubernetes VMware AWS Bare Metal Conf DbKubernetes Service Registry Inventory VMware, AWS… Inventory SVC SVCSVCSVCSVC SVC
| ©2020 F519 What is the NGINX Service Mesh? Data Plane East/West traffic Control Plane Management Plane Infrastructure Kubernetes VMware AWS Bare Metal NGINX Service Mesh control plane SVC SVCSVCSVCSVC SVC Topology Policies Conf DbKubernetes Service Registry Inventory VMware, AWS… InventoryCLI / API $>_
| ©2020 F520 What is the NGINX Service Mesh? Data Plane East/West traffic Control Plane Management Plane Infrastructure Kubernetes VMware AWS Bare Metal NGINX Service Mesh control plane Topology Policies Conf DbKubernetes Service Registry Inventory VMware, AWS… Inventory SPIRE SVC SVCSVCSVCSVC SVC CLI / API $>_
| ©2020 F521 What is the NGINX Service Mesh? Data Plane East/West traffic Control Plane Management Plane Infrastructure Kubernetes VMware AWS Bare Metal NGINX Service Mesh control plane Topology Policies Conf DbKubernetes Service Registry Inventory VMware, AWS… Inventory SPIRE Grafana OpenTracing SVC SVCSVCSVCSVC SVC CLI / API $>_
| ©2020 F522 What is the NGINX Service Mesh? Data Plane East/West traffic Control Plane Management Plane Infrastructure Kubernetes VMware AWS Bare Metal NGINX Service Mesh control plane Topology Policies Conf DbKubernetes Service Registry Inventory VMware, AWS… Inventory SPIRE Grafana OpenTracing SVC SVCSVCSVCSVC SVC CLI / API $>_ NGINX Ingress NGINX Egress
| ©2020 F523 What is the NGINX Service Mesh? Data Plane East/West traffic Control Plane Management Plane Infrastructure Kubernetes VMware AWS Bare Metal NGINX Service Mesh control plane Topology Policies Conf DbKubernetes Service Registry Inventory VMware, AWS… Inventory SPIRE Grafana OpenTracing NGINX Controller Centralized management Service Mesh connector Integrations SVC SVCSVCSVCSVC SVC CLI / API $>_ NGINX Ingress NGINX Egress
| ©2020 F524 NSM Components • NSM runs within a K8s cluster • Securely manages ingress/egress traffic to external services • Can be deployed in any K8s cluster platform
| ©2020 F525 Data PlaneControl Plane
| ©2020 F526 NSM Demo Time! CONFIDENTIAL
| ©2020 F527 NSM Features CONFIDENTIAL
| ©2020 F528 Security • Zero-trust model • mTLS enforcement • Service identity • Access control CRDs • Access control via mTLS • Config validation • Single source of truth for network (K8s) and identity (Spire) • Ingress mTLS • Egress opt-in allowlist • Iptables pod firewalling SVC
| ©2020 F529 Integrated N/S Ingress/Egress • NGINX Plus for sidecars and KIC • Ingress traffic treated as S2S service traffic • Full integration with Spire identity and SSL key store • mTLS for ingress into NSM • Egress name service support • Egress opt-in allowlist • Sidecar ”default route” to KIC
| ©2020 F530 Traffic Management • Full support for microservice traffic models − Circuit Breaker − Blue/Green − Canary − Weighted distribution • Rate shaping and QoS/priority queueing • Container-based load balancing • Dynamic service availability • SSL keepalive for performance SVC
| ©2020 F531 Lightweight andAgile • Data Plane Matters • Control plane designed to optimize NGINX Plus data plane • Standards-based: SPIFFE, SMI- spec • Single CLI for management of all mesh services • CI/CD pipeline’able for orchestrated deployment and policy management
| ©2020 F532 A reality check… Service Mesh technology addresses one specific set of problems It’s not a magic bullet that makes all applications ‘better’ There are many other, well-proven ways to address the same problems Service Mesh technology is very complex ever-evolving Cost of operating a mesh in production can be high, and there can be many risks
| ©2020 F533 WhenAm I Ready For A Service Mesh? ✓ You have a mature, fully-automated CI/CD pipeline (GitOps-enabled) ✓ You are fully invested in microservices and using Kubernetes ✓ You are deploying frequently to production (at least once per day) ✓ You have a zero-trust production environment (so need mTLS) ✓ You need/want additional visibility of container traffic interaction
| ©2020 F534 CONFIDENTIAL Where To Start? Define Your Microservice Mesh Needs GET AHEAD OF THE NEED • Why a mesh? • What goals are you trying to solve with a mesh? • Who will own/manage the mesh? • Where will the mesh be deployed? • Decide if you want to build your own components or use a complete mesh. • Plan. Plan. Test.
| ©2020 F535 How To Get NSM • Download − downloads.f5.com • Docs − docs.nginx.com/nginx-service-mesh • Tools/Support − github.com/nginxinc/nginx-service-mesh SVC
Data Plane Matters! A Deep Dive and Demo on NGINX Service Mesh

More Related Content

PPTX
Control Kubernetes Ingress and Egress Together with NGINX
NGINX, Inc.
 
PDF
NGINX DevSecOps Workshop
NGINX, Inc.
 
PDF
Nim tames sprawl
NGINX, Inc.
 
PPTX
Flexible, Powerful, and Easy-to-Use Ingress Load Balancing with NGINX and Ope...
NGINX, Inc.
 
PDF
Découvrez NGINX AppProtect
NGINX, Inc.
 
PDF
Control Kubernetes Ingress and Egress Together with NGINX
NGINX, Inc.
 
PDF
Strengthen Security and Traffic Visibility on Amazon EKS with NGINX
NGINX, Inc.
 
PDF
Relevez les défis Kubernetes avec NGINX
NGINX, Inc.
 
Control Kubernetes Ingress and Egress Together with NGINX
NGINX, Inc.
 
NGINX DevSecOps Workshop
NGINX, Inc.
 
Nim tames sprawl
NGINX, Inc.
 
Flexible, Powerful, and Easy-to-Use Ingress Load Balancing with NGINX and Ope...
NGINX, Inc.
 
Découvrez NGINX AppProtect
NGINX, Inc.
 
Control Kubernetes Ingress and Egress Together with NGINX
NGINX, Inc.
 
Strengthen Security and Traffic Visibility on Amazon EKS with NGINX
NGINX, Inc.
 
Relevez les défis Kubernetes avec NGINX
NGINX, Inc.
 

What's hot (20)

PDF
Get the Most Out of Kubernetes with NGINX
NGINX, Inc.
 
PDF
Fundamentals of microservices
NGINX, Inc.
 
PPTX
NGINX Basics and Best Practices Workshop
NGINX, Inc.
 
PDF
How to Get Started With NGINX
NGINX, Inc.
 
PPTX
NGINX Controller: Configuration, Management, and Troubleshooting at Scale
NGINX, Inc.
 
PPTX
NGINX Unit at Scale: Use Cases and the Future of Unit
NGINX, Inc.
 
PDF
Securing Your Apps & APIs in the Cloud
Olivia LaMar
 
PPTX
Production-Grade Kubernetes With NGINX Ingress Controller
NGINX, Inc.
 
PDF
Deep Dive: Automating the Application and Security Pipeline with NGINX and An...
NGINX, Inc.
 
PPTX
NGINX: Back to Basics – APCJ
NGINX, Inc.
 
PDF
Secured APIM-as-a-Service
NGINX, Inc.
 
PDF
Replacing and Augmenting F5 BIG-IP with NGINX Plus - EMEA
NGINX, Inc.
 
PDF
Application Security with NGINX
NGINX, Inc.
 
PPTX
Migrating from BIG-IP Deployment to NGINX ADC
NGINX, Inc.
 
PDF
Driving Success In The Cloud With NGINX
NGINX, Inc.
 
PPTX
Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAP
Olivia LaMar
 
PPTX
NGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controller
Katherine Bagood
 
PDF
Kubernetes Networking
NGINX, Inc.
 
PDF
What's New with NGINX Application Security Solutions
NGINX, Inc.
 
PDF
Secure, Strengthen, Automate, and Scale Modern Workloads with Red Hat & NGINX
NGINX, Inc.
 
Get the Most Out of Kubernetes with NGINX
NGINX, Inc.
 
Fundamentals of microservices
NGINX, Inc.
 
NGINX Basics and Best Practices Workshop
NGINX, Inc.
 
How to Get Started With NGINX
NGINX, Inc.
 
NGINX Controller: Configuration, Management, and Troubleshooting at Scale
NGINX, Inc.
 
NGINX Unit at Scale: Use Cases and the Future of Unit
NGINX, Inc.
 
Securing Your Apps & APIs in the Cloud
Olivia LaMar
 
Production-Grade Kubernetes With NGINX Ingress Controller
NGINX, Inc.
 
Deep Dive: Automating the Application and Security Pipeline with NGINX and An...
NGINX, Inc.
 
NGINX: Back to Basics – APCJ
NGINX, Inc.
 
Secured APIM-as-a-Service
NGINX, Inc.
 
Replacing and Augmenting F5 BIG-IP with NGINX Plus - EMEA
NGINX, Inc.
 
Application Security with NGINX
NGINX, Inc.
 
Migrating from BIG-IP Deployment to NGINX ADC
NGINX, Inc.
 
Driving Success In The Cloud With NGINX
NGINX, Inc.
 
Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAP
Olivia LaMar
 
NGINX Lunch and Learn Event: Kubernetes and the NGINX Plus Ingress controller
Katherine Bagood
 
Kubernetes Networking
NGINX, Inc.
 
What's New with NGINX Application Security Solutions
NGINX, Inc.
 
Secure, Strengthen, Automate, and Scale Modern Workloads with Red Hat & NGINX
NGINX, Inc.
 
Ad

Similar to Data Plane Matters! A Deep Dive and Demo on NGINX Service Mesh (20)

PDF
Service Mesh: Two Big Words But Do You Need It?
DevOps.com
 
PPTX
Building a Service Mesh with NGINX Owen Garrett.pptx
PINGXIONG3
 
PPTX
NGINX, Istio, and the Move to Microservices and Service Mesh
NGINX, Inc.
 
PPTX
MRA AMA Part 6: Service Mesh Models
NGINX, Inc.
 
PPTX
Do You Need A Service Mesh?
NGINX, Inc.
 
PDF
MRA AMA: Ingenious: The Journey to Service Mesh using a Microservices Demo App
NGINX, Inc.
 
PDF
MRA AMA Part 8: Secure Inter-Service Communication
NGINX, Inc.
 
PDF
What is a Service Mesh and what can it do for your Microservices
Matt Turner
 
PDF
Service mesh in Microservice World to Manage end to end service communications
Satya Syam
 
PDF
Amazon EKS 그리고 Service Mesh (김세호 솔루션즈 아키텍트, AWS) :: Gaming on AWS 2018
Amazon Web Services Korea
 
PDF
NGINX Microservices Reference Architecture: What’s in Store for 2019 – EMEA
NGINX, Inc.
 
PPTX
MRA AMA Part 10: Kubernetes and the Microservices Reference Architecture
NGINX, Inc.
 
PDF
Microservices with NGINX pdf
Katherine Bagood
 
PDF
App Simplified - Use a Mesh from Day 0.pdf
Ivan Porta
 
PDF
InfoQ_NGINX_Fundamentals_of_Microservices.pptx.pdf
usmanpk
 
PPTX
The 3 Models in the NGINX Microservices Reference Architecture
NGINX, Inc.
 
PPTX
Do I Need A Service Mesh.pptx
PINGXIONG3
 
PPTX
CloudNativeLondon 2017: "What is a Service Mesh, and Do I Need One when Devel...
Daniel Bryant
 
PPTX
apidays LIVE Hong Kong 2021 - Zero Trust security with Service Mesh by Lauren...
apidays
 
PDF
Docker microservices and the service mesh
Docker, Inc.
 
Service Mesh: Two Big Words But Do You Need It?
DevOps.com
 
Building a Service Mesh with NGINX Owen Garrett.pptx
PINGXIONG3
 
NGINX, Istio, and the Move to Microservices and Service Mesh
NGINX, Inc.
 
MRA AMA Part 6: Service Mesh Models
NGINX, Inc.
 
Do You Need A Service Mesh?
NGINX, Inc.
 
MRA AMA: Ingenious: The Journey to Service Mesh using a Microservices Demo App
NGINX, Inc.
 
MRA AMA Part 8: Secure Inter-Service Communication
NGINX, Inc.
 
What is a Service Mesh and what can it do for your Microservices
Matt Turner
 
Service mesh in Microservice World to Manage end to end service communications
Satya Syam
 
Amazon EKS 그리고 Service Mesh (김세호 솔루션즈 아키텍트, AWS) :: Gaming on AWS 2018
Amazon Web Services Korea
 
NGINX Microservices Reference Architecture: What’s in Store for 2019 – EMEA
NGINX, Inc.
 
MRA AMA Part 10: Kubernetes and the Microservices Reference Architecture
NGINX, Inc.
 
Microservices with NGINX pdf
Katherine Bagood
 
App Simplified - Use a Mesh from Day 0.pdf
Ivan Porta
 
InfoQ_NGINX_Fundamentals_of_Microservices.pptx.pdf
usmanpk
 
The 3 Models in the NGINX Microservices Reference Architecture
NGINX, Inc.
 
Do I Need A Service Mesh.pptx
PINGXIONG3
 
CloudNativeLondon 2017: "What is a Service Mesh, and Do I Need One when Devel...
Daniel Bryant
 
apidays LIVE Hong Kong 2021 - Zero Trust security with Service Mesh by Lauren...
apidays
 
Docker microservices and the service mesh
Docker, Inc.
 
Ad

More from NGINX, Inc. (20)

PDF
【NGINXセミナー】　Ingressを使ってマイクロサービスの運用を楽にする方法
NGINX, Inc.
 
PDF
【NGINXセミナー】 NGINXのWAFとは？その使い方と設定方法　解説セミナー
NGINX, Inc.
 
PDF
【NGINXセミナー】API ゲートウェイとしてのNGINX Plus活用方法
NGINX, Inc.
 
PPTX
Get Hands-On with NGINX and QUIC+HTTP/3
NGINX, Inc.
 
PPTX
Managing Kubernetes Cost and Performance with NGINX & Kubecost
NGINX, Inc.
 
PDF
Manage Microservices Chaos and Complexity with Observability
NGINX, Inc.
 
PDF
Accelerate Microservices Deployments with Automation
NGINX, Inc.
 
PDF
Unit 2: Microservices Secrets Management 101
NGINX, Inc.
 
PDF
Unit 1: Apply the Twelve-Factor App to Microservices Architectures
NGINX, Inc.
 
PDF
NGINX基本セミナー（セキュリティ編）～NGINXでセキュアなプラットフォームを実現する方法！
NGINX, Inc.
 
PDF
Easily View, Manage, and Scale Your App Security with F5 NGINX
NGINX, Inc.
 
PDF
NGINXセミナー（基本編）～いまさら聞けないNGINXコンフィグなど基本がわかる！
NGINX, Inc.
 
PDF
Keep Ahead of Evolving Cyberattacks with OPSWAT and F5 NGINX
NGINX, Inc.
 
PPTX
Install and Configure NGINX Unit, the Universal Application, Web, and Proxy S...
NGINX, Inc.
 
PPTX
Protecting Apps from Hacks in Kubernetes with NGINX
NGINX, Inc.
 
PPTX
NGINX Kubernetes API
NGINX, Inc.
 
PPTX
Successfully Implement Your API Strategy with NGINX
NGINX, Inc.
 
PPTX
Installing and Configuring NGINX Open Source
NGINX, Inc.
 
PPTX
Shift Left for More Secure Apps with F5 NGINX
NGINX, Inc.
 
PPTX
How to Avoid the Top 5 NGINX Configuration Mistakes.pptx
NGINX, Inc.
 
【NGINXセミナー】　Ingressを使ってマイクロサービスの運用を楽にする方法
NGINX, Inc.
 
【NGINXセミナー】 NGINXのWAFとは？その使い方と設定方法　解説セミナー
NGINX, Inc.
 
【NGINXセミナー】API ゲートウェイとしてのNGINX Plus活用方法
NGINX, Inc.
 
Get Hands-On with NGINX and QUIC+HTTP/3
NGINX, Inc.
 
Managing Kubernetes Cost and Performance with NGINX & Kubecost
NGINX, Inc.
 
Manage Microservices Chaos and Complexity with Observability
NGINX, Inc.
 
Accelerate Microservices Deployments with Automation
NGINX, Inc.
 
Unit 2: Microservices Secrets Management 101
NGINX, Inc.
 
Unit 1: Apply the Twelve-Factor App to Microservices Architectures
NGINX, Inc.
 
NGINX基本セミナー（セキュリティ編）～NGINXでセキュアなプラットフォームを実現する方法！
NGINX, Inc.
 
Easily View, Manage, and Scale Your App Security with F5 NGINX
NGINX, Inc.
 
NGINXセミナー（基本編）～いまさら聞けないNGINXコンフィグなど基本がわかる！
NGINX, Inc.
 
Keep Ahead of Evolving Cyberattacks with OPSWAT and F5 NGINX
NGINX, Inc.
 
Install and Configure NGINX Unit, the Universal Application, Web, and Proxy S...
NGINX, Inc.
 
Protecting Apps from Hacks in Kubernetes with NGINX
NGINX, Inc.
 
NGINX Kubernetes API
NGINX, Inc.
 
Successfully Implement Your API Strategy with NGINX
NGINX, Inc.
 
Installing and Configuring NGINX Open Source
NGINX, Inc.
 
Shift Left for More Secure Apps with F5 NGINX
NGINX, Inc.
 
How to Avoid the Top 5 NGINX Configuration Mistakes.pptx
NGINX, Inc.
 

Recently uploaded (20)

PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PDF
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
PDF
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
PPTX
ACSFv1EN-58255 AWS Academy Cloud Security Foundations.pptx
23bcla24
 
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
PPTX
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
PDF
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
PPTX
MYSQL Presentation for SQL database connectivity
Swati270511
 
PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
PDF
KodekX | Application Modernization Development
KodekX
 
PDF
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
PDF
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PDF
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
PDF
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
PDF
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
PDF
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
PDF
Optimiser vos workloads AI/ML sur Amazon EC2 et AWS Graviton
Julien SIMON
 
PDF
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
DOCX
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
Approach and Philosophy of On baking technology
30anthuong17
 
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
ACSFv1EN-58255 AWS Academy Cloud Security Foundations.pptx
23bcla24
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
MYSQL Presentation for SQL database connectivity
Swati270511
 
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
KodekX | Application Modernization Development
KodekX
 
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
Optimiser vos workloads AI/ML sur Amazon EC2 et AWS Graviton
Julien SIMON
 
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
The AUB Centre for AI in Media Proposal.docx
GAONE9
 

Data Plane Matters! A Deep Dive and Demo on NGINX Service Mesh

  • 1. NGINX Service Mesh (NSM) DATA PLANE MATTERS Alan Murphy, PM NGINX Service Mesh
  • 2. | ©2020 F52 NGINX Service Mesh:Agenda • What is a Service Mesh? • What does a Service Mesh solve? • NGINX Service Mesh Architecture • Demo Time! • Q&A
  • 3. | ©2020 F53 What’s In A Service Mesh! CONFIDENTIAL
  • 4. | ©2020 F54 L7 Logic (Ingress) L3-L4 Networking L3 – L7 Network Management == Service Mesh An Overly Simplified Picture
  • 5. | ©2020 F55 WHAT’S MISSING IN K8S AND WHAT DO YOU REALLY WANT AND NEED FROM A MESH? What Is A Service Mesh? Service mesh aims to improve application traffic control, observability and security for distributed systems. - The New Stack
  • 6. | ©2020 F56 WHAT’S MISSING IN K8S AND WHAT DO YOU REALLY WANT AND NEED FROM A MESH? What Is A Service Mesh? • A service mesh adds L7 traffic management & security: • sidecar deployment • policy management • application availability/health, • Service mesh isn’t just one “thing”, it’s a lot of managed and dependent components • Takes over where K8s networking stops (service/pod IP endpoints) • “Traffic management for containers”
  • 7. | ©2020 F57 What DoesA Service Mesh Do? Service Mesh controls communications between pods and external apps Secure Traffic End-to-end encryption (Mutual TLS / mTLS), ACLs Manage All Service Traffic Load Balance, Circuit breaker, B|G, Rate Limiting… Orchestration Injection and sidecar management, K8s API integration Measure Traffic Generate transaction traces and real-time monitoring
  • 8. | ©2020 F58 What Is A Sidecar? © 2017 F5 Networks A Sidecar is a containerized service that another containerized service depends on for some function: “Helper Containers” • Not just networking, can be used for any separationof process:API GW, logging, data mining, etc. In our world, a Sidecar would be a reverse proxy that sits beside an application service container (in the same pod) and provides all inbound and outbound network routing to that application container App Pod
  • 9. | ©2020 F59 HowAre Sidecars Deployed? © 2017 F5 Networks Separate Container In The App Pod • The separate container is attached to the app service container in a pod • Networking in the app container is altered via a policy from the mesh that tells the app “You can only talk to your sidecar for network access.” • Policy and architecture are defined and orchestrated via the control plane,managed with a combo of ConfigMap and control plane. • A Service Mesh takes care of auto-associating the sidecar with the app container in the same pod via Sidecar Injection App Pod
  • 10. | ©2020 F510 What DoesA Service Mesh Actually Do? © 2017 F5 Networks • Proxy • Orchestration • Policy Management • Policy Enforcement • Monitoring Data Plane Control Plane Management Plane Data Plane Data + Control Planes …[sidecar] proxies cache the state of the mesh but aren’t regarded as the source of truth for the state of the mesh. - Lee Calcote, O’Reilly
  • 11. | ©2020 F511 Service Mesh Policies © 2017 F5 Networks Network Policy • Serviceto servicerouting • Serviceavailability • Servicediscovery Access Policy • IP allow/deny • Allow/Deny • JWT Security Policy • SSL/mTLSTermination • DDoS • WAF E F THE MOST IMPORTANT (AND DIFFICULT) PART
  • 12. | ©2020 F512 I DON’T SAY THAT OFTEN, BUT SERIOUSLY: SECURITY It’s ReallyAll About Security: Data Plane Enforcement • Service Security • Identity Management • SSL Key Management • Injection Policies • Network Security • L3/L4 Networking Control • mTLS Between Services • Access Control • Auditing/Governance • Policy and Traffic Monitoring • Zero Trust • Cluster-wide L7 Networking Policies
  • 13. | ©2020 F513 NSM Service Mesh The “Data Plane” Service Mesh CONFIDENTIAL
  • 14. | ©2020 F514 Service Mesh Product Goals NGINX Service Mesh controls communications between pods and external apps Secure Traffic End-to-end encryption (Mutual TLS / mTLS), ACLs Manage All Service Traffic Load Balance, Circuit breaker, B|G, Rate Limiting… Orchestration Injection and sidecar management, K8s API integration Measure Traffic Generate transaction traces and real-time monitoring
  • 15. | ©2020 F515 Why NGINX Service Mesh? Data Plane Matters
  • 16. | ©2020 F516 Why NGINX Service Mesh? • Complete Microservices Traffic Management and Security • E/W (sidecar) and N/S (NGINX KIC) Ingress and Egress • Security policy definition, enforcement, and governance • Turn-key and Platform Agnostic • Everything you need is included, no need to piecemeal • Run in any K8s environment, anywhere • Data Plane Matters • Brings the world’s best software reverse proxy to container traffic management
  • 17. | ©2020 F517 What is the NGINX Service Mesh? Data Plane East/West traffic Control Plane Management Plane Infrastructure Kubernetes VMware AWS Bare Metal SVC SVCSVCSVCSVC SVC Conf DbKubernetes Service Registry Inventory VMware, AWS… Inventory
  • 18. | ©2020 F518 What is the NGINX Service Mesh? Data Plane East/West traffic Control Plane Management Plane Infrastructure Kubernetes VMware AWS Bare Metal Conf DbKubernetes Service Registry Inventory VMware, AWS… Inventory SVC SVCSVCSVCSVC SVC
  • 19. | ©2020 F519 What is the NGINX Service Mesh? Data Plane East/West traffic Control Plane Management Plane Infrastructure Kubernetes VMware AWS Bare Metal NGINX Service Mesh control plane SVC SVCSVCSVCSVC SVC Topology Policies Conf DbKubernetes Service Registry Inventory VMware, AWS… InventoryCLI / API $>_
  • 20. | ©2020 F520 What is the NGINX Service Mesh? Data Plane East/West traffic Control Plane Management Plane Infrastructure Kubernetes VMware AWS Bare Metal NGINX Service Mesh control plane Topology Policies Conf DbKubernetes Service Registry Inventory VMware, AWS… Inventory SPIRE SVC SVCSVCSVCSVC SVC CLI / API $>_
  • 21. | ©2020 F521 What is the NGINX Service Mesh? Data Plane East/West traffic Control Plane Management Plane Infrastructure Kubernetes VMware AWS Bare Metal NGINX Service Mesh control plane Topology Policies Conf DbKubernetes Service Registry Inventory VMware, AWS… Inventory SPIRE Grafana OpenTracing SVC SVCSVCSVCSVC SVC CLI / API $>_
  • 22. | ©2020 F522 What is the NGINX Service Mesh? Data Plane East/West traffic Control Plane Management Plane Infrastructure Kubernetes VMware AWS Bare Metal NGINX Service Mesh control plane Topology Policies Conf DbKubernetes Service Registry Inventory VMware, AWS… Inventory SPIRE Grafana OpenTracing SVC SVCSVCSVCSVC SVC CLI / API $>_ NGINX Ingress NGINX Egress
  • 23. | ©2020 F523 What is the NGINX Service Mesh? Data Plane East/West traffic Control Plane Management Plane Infrastructure Kubernetes VMware AWS Bare Metal NGINX Service Mesh control plane Topology Policies Conf DbKubernetes Service Registry Inventory VMware, AWS… Inventory SPIRE Grafana OpenTracing NGINX Controller Centralized management Service Mesh connector Integrations SVC SVCSVCSVCSVC SVC CLI / API $>_ NGINX Ingress NGINX Egress
  • 24. | ©2020 F524 NSM Components • NSM runs within a K8s cluster • Securely manages ingress/egress traffic to external services • Can be deployed in any K8s cluster platform
  • 25. | ©2020 F525 Data PlaneControl Plane
  • 26. | ©2020 F526 NSM Demo Time! CONFIDENTIAL
  • 27. | ©2020 F527 NSM Features CONFIDENTIAL
  • 28. | ©2020 F528 Security • Zero-trust model • mTLS enforcement • Service identity • Access control CRDs • Access control via mTLS • Config validation • Single source of truth for network (K8s) and identity (Spire) • Ingress mTLS • Egress opt-in allowlist • Iptables pod firewalling SVC
  • 29. | ©2020 F529 Integrated N/S Ingress/Egress • NGINX Plus for sidecars and KIC • Ingress traffic treated as S2S service traffic • Full integration with Spire identity and SSL key store • mTLS for ingress into NSM • Egress name service support • Egress opt-in allowlist • Sidecar ”default route” to KIC
  • 30. | ©2020 F530 Traffic Management • Full support for microservice traffic models − Circuit Breaker − Blue/Green − Canary − Weighted distribution • Rate shaping and QoS/priority queueing • Container-based load balancing • Dynamic service availability • SSL keepalive for performance SVC
  • 31. | ©2020 F531 Lightweight andAgile • Data Plane Matters • Control plane designed to optimize NGINX Plus data plane • Standards-based: SPIFFE, SMI- spec • Single CLI for management of all mesh services • CI/CD pipeline’able for orchestrated deployment and policy management
  • 32. | ©2020 F532 A reality check… Service Mesh technology addresses one specific set of problems It’s not a magic bullet that makes all applications ‘better’ There are many other, well-proven ways to address the same problems Service Mesh technology is very complex ever-evolving Cost of operating a mesh in production can be high, and there can be many risks
  • 33. | ©2020 F533 WhenAm I Ready For A Service Mesh? ✓ You have a mature, fully-automated CI/CD pipeline (GitOps-enabled) ✓ You are fully invested in microservices and using Kubernetes ✓ You are deploying frequently to production (at least once per day) ✓ You have a zero-trust production environment (so need mTLS) ✓ You need/want additional visibility of container traffic interaction
  • 34. | ©2020 F534 CONFIDENTIAL Where To Start? Define Your Microservice Mesh Needs GET AHEAD OF THE NEED • Why a mesh? • What goals are you trying to solve with a mesh? • Who will own/manage the mesh? • Where will the mesh be deployed? • Decide if you want to build your own components or use a complete mesh. • Plan. Plan. Test.
  • 35. | ©2020 F535 How To Get NSM • Download − downloads.f5.com • Docs − docs.nginx.com/nginx-service-mesh • Tools/Support − github.com/nginxinc/nginx-service-mesh SVC