Advanced Observability & Security

© OPITZ CONSULTING 2023 / Öffentlich
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 1
Brühl, 2023-06-20
Fabian Hardt
ADVANCED OBSERVABILITY & SECURITY
FOR YOUR KUBERNETES WITH A MODERN SERVICE MESH

WHY SERVICE MESH?
01
KUMA
02
CONCLUSION
04
DEMO
03

WHY SERVICE MESH?
01

TREND TOWARDS DISTRIBUTED APPLICATION ARCHITECTURES
Centralized
STATIC
ON-PREM
MONOLITH
VIRTUAL MACHINES
MANUAL CHANGE PROCESS
Decentralized
DYNAMIC
CLOUD / MULTI-CLOUD
MICROSERVICES / SERVERLESS
CONTAINERS, KUBERNETES
AUTOMATED CI/CD TOOL CHAIN
# Services & APIs
CONTROL AND VISIBILITY

INCREASED COMPLEXITY AND COGNITIVE LOAD ON DEVS
Security Security
Logging Logging
Security
Tracing
Metrics Routing
Metrics Tracing
Application
AuthN/
Z
Rate-Limiting
Routing
Caching
Organization
Application
AuthN/
Z
Versioning
Versioning
Rate-Limiting

WHAT’S A SERVICE MESH?
 Efficient implementation of cross-cutting
concerns with respect to service integration
challenges
 Everything is a service!
 Cloud-native apps deployed to Kubernetes
 Non Cloud-native workloads
 Should be independent of
 Architecture (e.g. Monolithic or µService)
 Platform (e.g. VMs, Containers, Kubernetes)
Dedicated infrastructure layer that makes
service-to-service communication more
reliable, secure and observable

E2E SERVICE CONNECTIVITY WITH GATEWAY AND MESH
 Increased Developer experience
 Consistent security
 Seamless observability
 Reliable connectivity
 Resilience
 Flexibility
GW DP
CLIENT
PUBLIC TRAFFIC
GW DP
MESH CP
MESH 1 MESH 2

SERVICE-MESH IMPLEMENTATIONS
 Kuma
 Istio
 Consul
 Linkerd
 GlooMesh

KUMA
02

KUMA INTRODUCTION
 Initially invented by Kong and donated to CNCF in 2020
 Provides a modern distributed Control Plane
 Completely Envoy-based Data Plane proxies
 Platform agnostic open-source control plane for Service Mesh
 Hence Kuma is
 Universal
 Simple
 Scalable
 Flexible deployment options
 Standalone deployment
 Multi-Zone deployment
Source: https://tinyurl.com/xb57bhx5

KUMA STANDALONE ARCHITECTURE

KUMA MULTI-CLUSTER ARCHITECTURE
 One mesh can be deployed over multiple clusters (=> Zone)
 All traffic enters cluster over zone ingress
 One Remote (Zone) Control Plane in each cluster

KUMA NETWORKING / INIT-CONTAINER
 Injected to Pod and started individually before Data Plane
 Configures iptables / network routing

KUMA NETWORKING / CNI
 Installed as DaemonSet on all Nodes
 Injects label on Pods - k8s.v1.cni.cncf.io/networks: kuma-cni
 CNI enables Transparent Proxying – redirects all traffic through Data Plane

SERVICE MESH DNS
 Local DNS resolution directly in Data Plane (Envoy)
 Names are not resolvable in complete cluster, just inside service mesh (Envoy)
 Resolves “.mesh“ address to pre-defined service mesh IP address
 IP in other zone / cluster is routed over Kuma Zone Ingress

ZONE EGRESS
 Special Data Plane instance – like Zone Ingress
 All outgoing traffic is routed through this instance
 Usage of External Services just possible with deployed Zone Egress in the future

INTEGRATION OF LEGACY WORKLOAD
 Integration of vm and bare metal workload
 Local Data Plane instance connecting to Control Plane
 Seamless and secure commuication between vm and Kubernetes workload

DEMO
03

ARCHITECTURE OVERVIEW

ANALYZING AND MONITORING THE DATA
Advanced Observability & Security for your Kubernetes with a modern Service Mesh
 Using Grafana Stack to create a 360-degree view
 Component usage:
 Visualization: Grafana
 Logging: Loki (Log Shipping: FluentD / FluentBit / Promtail)
 Metrics: Prometheus
 Tracing: Jaeger or Tempo
 Alerting: Prometheus Alert Manager
 Operating models
 Self-managed (e.g. on-prem)
 Grafana SaaS offering
25

ARCHITECTURE OBSERVABILITY

DEMO

ASPECTS COVERED
 Mesh Management (Kuma UI)
 Managing Apps within the Mesh
 Locality Awareness
 Advanced Routing
 Security
 Mesh observability
 Metrics
 Logs
 Traces

CONCLUSION
04

SERVICE MESH BENEFITS
 Zero-trust security
 mTLS, Traffic Permissions
 Increased Developers productivity
 Crosscutting concerns (AuthN & AuthZ, …)
 Self-service network management
 Multi-Tenancy over multiple clouds
 Reliable connectivity
 Circuit Breaker, Traffic Routes, …
 Observability
 Metrics, Tracing, Logs

KEY TAKEAWAYS
 Service Mesh is essential to build and managing multi-cloud apps efficiently
 Kuma as mesh implementation provides
 Agnostic approach (independent of architecture or platform)
 Modern, flexible architecture supporting hybrid, multi-cloud scenarios
 Multi-zone
 Multi-cluster
 Multi-mesh
 Seamless CI / CD integration (GitOps)
 Intuitive design
 Spanning a mesh over multiple clusters and clouds can be done easily

MATERIALS
 Demo Source: https://github.com/KongChampions/kuma-multi-zone-mesh
 Kuma docs: https://kuma.io/docs/2.2.x/
 Kuma Counter Demo: https://github.com/kumahq/kuma-counter-demo
 Kuma introduction – Meetup recording “Service integration made easy with OpenSource Kuma”:
https://www.youtube.com/watch?v=f3GeuKzYrsA&t=1s
 Demo “Service integration made easy with OpenSource Kuma”:
https://github.com/svenbernhardt/service-integration-made-easy
 Kong / Kuma and friends (k3d)– https://github.com/FabianHardt/k3d-bootstrap-cluster

Q & A
https://opitzcloud.canto.global/b/H0EMG

KONTAKT
Modern Data Stack - Einführung - TDWI Community Talk 34
Fabian Hardt
Solution Architect
Fabian.Hardt@opitz-consulting.com
https://twitter.com/fabian_hardt
https://www.xing.com/profile/Fabian_Hardt
https://www.linkedin.com/in/fabian-hardt

Advanced Observability & Security

More Related Content

Similar to Advanced Observability & Security

More from Fabian Hardt

Recently uploaded

Advanced Observability & Security

Editor's Notes