Download to read offline
InfoQ_NGINX_Fundamentals_of_Microservices.pptx.pdf
- 1. Fundamentals of Microservices PRESENTED BY:DOMINIC LUCIA, PARTNER SOLUTIONS ENGINEER, NGINX MODERATED BY: WES REISZ, INFOQ EDITOR AUGUST 19TH , 2021
- 2. | ©2021 F5 2 Whatis your organization’s expertise with Microservices? 1. What’s a Microservice? That’s what I’m here to learn about! 2. We’re not using a Microservices architecture yet. 3. We are taking first steps to production Microservices. 4. We run both Microservices and Traditional architectures in production. 5. We are (almost) entirely a Microservices-first organization.
- 3. | ©2021 F5 3 Microservicesbegan in Venice Shipbuilding in Europe, c1500 Ships were built in-place, by hand, taking months to construct. The guild system provided craftsmen and maintained a monopoly of skills and training. It protected workers and created artifacts of great quality, but was slow and inefficient. Shipwrights building a brigantine, 1541
- 4. | ©2021 F5 4 Microservicesbegan in Venice Shipbuilding in Venice, c1500 The Venetian Arsenal was the most powerful and efficient shipbuilding enterprise in the world. It built a ship every day, with up to 100 galleys of various specification in the backlog. In 1574, King Henry of France watched the outfitting of an entire ship during his lunch… Venetian Arsenal, present day
- 5.
- 6.
- 7.
- 8. | ©2021 F5 8 Whathas this got to do with Microservices?
- 9.
- 10. | ©2021 F5 10 Microservicesarchitecture is an approach in which a single application is composed of many loosely coupled and independently deployable smaller services. • Highly maintainable and testable • Loosely coupled • Independently deployable • Organized around business capabilities • Owned by a small team
- 11. | ©2021 F5 11 What’syour biggest concern with microservices? 1. Training and Knowledge – the journey to production is difficult 2. In production – Logging, Visibility and Monitoring 3. In production – Security 4. In production – Scaling to large apps and multiple teams 5. None – “Leave me alone. I know what I’m doing.”
- 12. | ©2021 F5 12 ModernApps Require a Modern Architecture FROM MONOLITHIC ... ... to Dynamic Three-tier, J2EE-style architectures Complex protocols (HTML, SOAP) Persistent deployments Fixed, static Infrastructure Big-bang releases Silo’ed teams (Dev, Test, Ops) Microservices Lightweight (REST, JSON) Containers, VMs, Functions Infrastructure as Code Continuous delivery DevOps Culture From Monolithic ...
- 13. | ©2021 F5 13 A‘container’ takes the bare minimum needed for an application, and packages it up as a single artifact: • Runnable application code – compiled, or needing a framework • Runtime artifacts – libraries, frameworks, etc • Declaration of runtime requirements – network, storage etc SOFTWARE’S REPLACEABLE PART What is a Container? Develop Build Package Test Deploy Operate Code Container
- 14. | ©2021 F5 14 Kubernetesstiches together a number of servers (‘nodes’) to create a flat platform for running Containers: What is Kubernetes? Kubernetes Master API Server Scheduler Controller-Manag er etcd Kubernetes Node Kubelet Kubernetes Node Kubelet Kubernetes Node Kubelet Ingress Controller Internal Network KubeProxy KubeProxy KubeProxy External Load Balancer • BIG CIS • NGINX • Cloud LB Users
- 15. | ©2021 F5 15 Requirementsfor Production-Grade Kubernetes Develop ment Operati ons Infrastructure Dataplane Application Dataplane Application Runtime App Code Repo CI/CD pipeline Automation Pod ModSecurit y AppProtec t Auth Monitoring Logging WAF Users
- 16. | ©2021 F5 16 Operatinga distributed application is hard STATIC, PREDICTABLE MONOLITH: Dynamic, Distributed App: Fast, reliable function calls Local debugging Local profiling Calendared, big-bang upgrades ‘Integration hell’ contained in dev Slow, unreliable API calls Distributed fault finding Distributed tracing In-place dynamic updates ‘Continuous integration’ live in prod More things can go wrong, it’s harder to find the faults, everything happens live Static, Predictable Monolith:
- 17. | ©2021 F5 17 Requirementsfor Production-Grade Kubernetes Develop ment Operati ons Infrastructure Dataplane Application Dataplane Application Runtime App Code Repo CI/CD pipeline Automation Pod ModSecurit y AppProtec t Auth Monitoring Logging WAF Users
- 18. | ©2021 F5 18 Requirementsfor Production-Grade Kubernetes
- 19. | ©2021 F5 19 Beginwith the Ingress Controller…
- 20. | ©2021 F5 20 WhatIngress solution do you use? 1. Default Kubernetes Ingress Controller 2. Default OpenShift Router 3. NGINX’s Ingress Controller 4. F5 Container Ingress Services 5. Something else 6. Don’t know
- 21. | ©2021 F5 21 •Accepts traffic from outside the Kubernetes platform, and load-balances it to pods (containers) running inside the platform • Configured using the Kubernetes API, with objects called ‘Ingress Resources’ • Monitors the pods running in Kubernetes, and automatically updates the load balancing rules if, for example, pods are added or removed from a service The Ingress Controller Internal Network Users Ingress Controller A specialized load balancer for Kubernetes environments:
- 22. | ©2021 F5 22 TwoChallenges at Scale Multitenancy (Teams) How can multiple teams and applications share a Container environment safely and securely? Complex Applications How can you provide the advanced capabilities that complex applications require?
- 23. | ©2021 F5 23 Host TLS Upstreams Routes -Path Action Split Match Route ErrorPage pass redirect return proxy delegation optional Host TLS Upstreams Routes - Path Action Split Match Route ErrorPage pass redirect return proxy delegation optional NGINX Ingress Resources – Rich Capabilities Host TLS Policies Upstreams Routes - Path Policies Action Split Match Route ErrorPage pass redirect return proxy delegation VirtualServer pass redirect return proxy pass redirect return proxy Host Upstreams Subroutes - Path Policies Action Split Match ErrorPage pass redirect return proxy VirtualServerRoute NGINX server configuration NGINX http configuration Server and HTTP snippets NGINX location configuration Location snippets Policies Access Control Rate Limiting Auth (JWT, OIDC) MTLS (Ingress/Egress) App Protect WAF
- 24. | ©2021 F5 24 NGINXIngress Resources – Distributed Configuration
- 25. | ©2021 F5 25 NGINXIngress Resources – Distributed Configuration NetOps DevOps-FE DevOps-NG Identity DevSecOps
- 26. | ©2021 F5 26 ConditionalRouting Split Routing Error Pages Rate Limiting Authentication Web Application Firewall NGINX Snippets Multiple versions, multiple clients A|B Testing for safe production deployment Implement ‘Circuit Breakers’ to contain failures Protect vulnerable apps, limit greedy clients Offload identity checking from apps and centralize Protect from known and unknown vulnerabilities “to-the-metal” with NGINX configuration Spotlight on Use Cases
- 27. | ©2021 F5 27 …but many operational challenges happen within the application
- 28. | ©2021 F5 28 Doyou use a Service Mesh in production? 1. No, and I’m not planning to use one yet 2. No, but I’m actively evaluating 3. Yes – Istio in production 4. Yes – a different mesh in prod. (perhaps share in the comments) 5. Don’t know
- 29. | ©2021 F5 29 Wheredoes a Service Mesh fit in? Users Ingress Controller “North-South” traffic “East-West” traffic
- 30. | ©2021 F5 30 WhatIs A Service Mesh? WHAT’S MISSING IN K8S AND WHAT DO YOU REALLY WANT AND NEED FROM A MESH? Service mesh aims to improve application traffic control, observability and security for distributed systems. - The New Stack
- 31. | ©2021 F5 31 ServiceMesh controls communications between pods and external apps What Does A Service Mesh Do? Secure Traffic End-to-end encryption (Mutual TLS / mTLS), ACLs Manage All Service Traffic Load Balance, Circuit breaker, B|G, Rate Limiting… Orchestration Injection and sidecar management, K8s API integration Measure Traffic Generate transaction traces and real-time monitoring
- 32. | ©2021 F5 32 NGINXService Mesh Components • NGINX Service Mesh runs within a K8s cluster • Securely manages ingress/egress traffic to external services • Can be deployed in any K8s cluster platform
- 33. | ©2021 F5 33 MutualTLS Instrumentation Tracing Rate Limiting Traffic Splitting Access Control Egress Control Secure traffic in a zero-trust network Monitor performance, latency and availability Debug transactions and locate faults Protect vulnerable apps, limit greedy clients Implement A|B, Canary and Blue-Green upgrades Implement allow-lists to accurately govern traffic Manage and broker traffic to external services Spotlight on Use Cases
- 34. | ©2021 F5 34 ✔You have a mature, fully-automated CI/CD pipeline (GitOps-enabled) ✔ You are fully invested in microservices and using Kubernetes ✔ You are deploying frequently to production (at least once per day) ✔ You have a zero-trust production environment (so need mTLS) ✔ You need/want additional visibility of container traffic interaction When Am I Ready For A Service Mesh?
- 35.
- 36. | ©2021 F5 36 Whathave we learnt? Microservices is a journey, not a destination. Begin when the need to iterate and improve is high The technology choice will take you down the path of Containers and Kubernetes It’s a long journey, with separate paths for development and operations The key to a production-ready service is the ability to control the dataplane. To find out more, join NGINX on our Microservices March journey!
- 37. Q&A Contact Us: Dominic Lucia:d.lucia@f5.com NGINX: info@nginx.com InfoQ: webinars@infoq.com
- 38. | ©2021 F5 38 Whereto find out more? bit.ly/microservices-march
- 39. | ©2021 F5 39 AMERPoll Results
- 40.
- 41.
- 42.
- 43.