This document discusses API management and deployment patterns. It begins by explaining why APIs are important for breaking down silos, increasing collaboration, and generating new revenue streams. The document then discusses using an API gateway for functions like TLS termination, authentication, authorization, routing, and load balancing. It presents three common deployment patterns: edge gateway, two-tier gateway, and microgateway. The edge gateway handles all traffic at the edge. The two-tier gateway separates security and routing concerns. The microgateway is team-owned and focuses on a specific API. It concludes by noting the best pattern depends on an organization's environment and structure.

1. PAGE
1
DEVOPS INDONESIA
Bobby Limitra Laksmono
DevOps Community in Indonesia
Jakarta, 18 Desember 2019
API Management & Deployment Patterns

2. API Management &
Deployment Patterns
JAKARTA ● DECEMBER 18

3. 2 | ©2018 F5 NETWORKS
WhyAPIs and Why Manage
Them?

4. • Break down siloes and unlock data
(within and among organizations)
• Increase collaboration amongst
developers
Unlock
data
• Primary interface for
communication
amongst microservices.
Create a
foundation
• Generate revenue and build
partnerships with third-party
developers and ecosystem of
suppliers,distributors,resellers,and
even customers
• Expose APIs via Dev Portal
• “Digital marketplace” for an
enterprise
Find new digital revenue
stream
Why Develop APIs?
External APIsInternal APIs
4 | ©2019 F5

5. Source: https://www.programmableweb.com/news/research-shows-interest-providing-apis-still-high/research/2018/02/23
5 | ©2019 F5

6. API as a Source of Revenue
50% of Salesforce’s
revenues come from
APIs
90%of Expedia's
revenues come from
APIs
6 | ©2019 F5

7. API Solutions
API SECURITY / GATEWAY / MANAGEMENT
API ManagementAPI Gateway
• Define Policy
• Pushing Configurations
• Access Policy Management
and Consumption Visualization
• Developer Portal
• Lightweight
• Easily Distributed
• Easily Scaled
• Heavy Lifting…
• Request Processing
API Security
7 | ©2019 F5
• Allow Methods per URI
• JSON Parsing
• Parameter Enforcement
• Login Protection
• L7 DoS / BOT

8. 7 | ©72019 F5
API Gateway Essential Functions
TLS
termination
Client
authentication,
authorization
Fine-grained
access control
Request
routing
Rate limiting Load
balancing
Service
discovery of
backends
Request/
response
manipulation

9. API Definition &
Publication
9 | ©2019 F5
Monitoring and
Analytics
Onboarding and
Documentation
(Developer Portal)
Customizable
Dashboards
Alerting Extract Insights
(REST API + Logging)
Multi- Cloud Support
Protect Authentication &
Authorization
Characteristics to look out for…

10. API Gateway & API Security Architecture
10 | ©2019
F5

11. API Gateway Deployment
Patterns
10 | ©2018 F5 NETWORKS

12. API AAPI AAPI A
API BAPI BAPI B
API ACPI CAPI C
Edge Gateway
•
•
•
•
•
•
•
12 | ©2019 F5
TLS termination
Client authentication
Authorization
Request routing
Rate limiting
Load balancing
Request/response manipulation

13. Edge Gateway
API A
API B
API C
D
E
F
G
H
•
•
•
•
•
•
•
•
TLS termination
Client authentication
Authorization
Request routing
Rate limiting
Load balancing
Request/response manipulation
Façade routing
13 | ©2019 F5

14. Two-Tier Gateway
API B API C
D
API A
E
F G
H
Security Gateway
•
•
•
•
TLS termination
Client authentication
Centralized logging
Tracing injection
Routing Gateway
•
•
•
Authorization
Service discovery
Load balancing
14 | ©2019 F5

15. Microgateway
E
E
GE
F
F
HF
D
D
D
DevOps
Team-
owned
•
•
•
Load balancing
Service Discovery
Authentication perAPI
•
•
•
15 | ©2019 F5
TLS Termination
Routing
Rate limiting

16. Microgateway Characteristics
Gartner: Selecting the Right API Gateway to Protect Your APIs and Microservices
16 | ©2019 F5

17. Deployment Patterns Recap…
+ Monoliths with centralized governance
- Frequent changes, DevOps team-owned microservices
+ Flexibility, independent scaling of functions
- Distributed control
+ DevOps teams, high-frequency updates
- Hard to achieve consistency, authorization minefield
Edge Gateway
Two-Tier Gateway
Micro-Gateway
17 | ©2019 F5

18. Adapt to your environment
17
• TLS termination
• Client authentication
• Fine-grained access control
• Request routing
• Rate limiting
• Load balancing
• Service discovery of backends
• Request/response manipulation
Conway’s Law
“organizations which design
systems …are constrained
to produce designs which
are copies of the
communication structures of
these organizations.”

19. 18 | ©2018 F5 NETWORKS
DEMO

20. 19 | ©2019 F5

22. Stay Connected
@IDDevOps
http://www.devopsindonesia.com
@IDDevOps
DevOps Indonesia
@devopsindonesia

23. Alone We are smart, together We are brilliant
THANK YOU !
Quote by Steve Anderson