The document discusses building a secure and performant network fabric for microservices applications. It outlines some of the key challenges with microservices including service discovery, load balancing, and secure inter-service communication. It then presents several network architectures and how NGINX can help by providing solutions for service discovery, robust load balancing, fast encryption through persistent SSL connections, and circuit breaking functionality to address issues.

1. Building a Secure,
Performant Network Fabric
for Microservice
Applications
Paris, September 14th, 2017
Leif Beaton – Solutions Architect

2. MORE INFORMATION AT
NGINX.COM
Agenda
• The Big Shift
• The Networking Problem
• Service Discovery
• Load Balancing
• Secure & Fast Intercommunication
• Architectures
• Issues

3. The Big Shift
1

4. MORE INFORMATION AT
NGINX.COM
Architectural
Changes:
Monolith to
Microservices

5. MORE INFORMATION AT
NGINX.COM
Architectural
Changes:
Monolith to
Microservices

6. MORE INFORMATION AT
NGINX.COM
NGINX Microservices

7. MORE INFORMATION AT
NGINX.COM
The Networking
Problem

8. MORE INFORMATION AT
NGINX.COM
Service
Discovery
• Services needs to know
where other services are
• Service registries work in
many different ways
• Register and read service
information

9. MORE INFORMATION AT
NGINX.COM
Load-balancing
• High Quality Load
Balancing
• Developer Configurable

10. MORE INFORMATION AT
NGINX.COM
Secure & Fast
Communication
• Encryption at the
transmission layer is
becoming standard
• SSL communication is
slow
• Encryption is CPU
intensive

11. MORE INFORMATION AT
NGINX.COM
Solution
• Service discovery
• Robust load balancing
• Fast encryption

12. MORE INFORMATION AT
NGINX.COM
Network
Architectures

13. MORE INFORMATION AT
NGINX.COM
Proxy Model
• In bound traffic is
managed through a
reverse proxy/load
balancer
• Services are left to
themselves to connect to
each other.
• Often through round-robin
DNS

14. MORE INFORMATION AT
NGINX.COM
Router Mesh
Model
• In-bound routing through
reverse proxy
• Centralized load
balancing through a
separate load balancing
service

15. MORE INFORMATION AT
NGINX.COM
Inter-Process
Communication
• Routing is done at the
container level
• Services connect to each
other as needed
• NGINX Plus acts as the
forward and reverse
proxy for all requests

16. MORE INFORMATION AT
NGINX.COM
Normal Process
• DNS service discovery
• Relies on round robin
DNS
• Each request creates a
new SSL connection
which fully implemented
is 9 requests

17. MORE INFORMATION AT
NGINX.COM
Detail
• NGINX Plus runs in each
container
• Application code talks to
NGINX locally
• NGINX talks to NGINX
• NGINX queries the
service registry

18. MORE INFORMATION AT
NGINX.COM
Service
Discovery
• DNS is a clear way to
manage service discovery
• NGINX Plus
Asynchronous Resolver
• SRV records allow you to
effectively use your
resources

19. MORE INFORMATION AT
NGINX.COM
Load-balancing
• Proper request
distribution
• Flexibility based on the
backing service
• Different load-balancing
schemes

20. MORE INFORMATION AT
NGINX.COM
Persistent SSL
Connections
• Applications generate
thousands of connections
• 9 steps in SSL
negotiation
• Persistent SSL upstream
keepalive

21. MORE INFORMATION AT
NGINX.COM
Circuit Breaker
Plus
• Active health checks
• Retry
• Caching

22. MORE INFORMATION AT
NGINX.COM
The solution
• Service discovery
• Container-based load-
balancing
• Persistent SSL
connections
• Circuit-breaker
functionality
• Status data on both sides
of the equation

23. Merci Beaucoup!
23