SpringOne Platform 2017 Angela Chin, Pivotal; David McClure, Pivotal "Have you ever wondered how your microservices communicate with one another on Cloud Foundry? Until recently, all traffic between applications had to go through the Cloud Foundry router. Now, with the addition of the new CF-Networking stack, users can create policies that allow applications to directly communicate with one another, enhancing application security and performance. In this talk, we will give an overview of the networking features in Cloud Foundry and highlight some of the challenges we faced while designing and developing CF-Networking. We will also showcase how CF-Networking integrates with service registries like Eureka and Spring Cloud Services through a live demonstration where we deploy microservices that can discover and communicate directly with each other."

1. Cloud Foundry Networking:
Enabling Direct Communication for Microservices
Angela Chin, Software Engineer @ Pivotal
Dave McClure, Software Engineer @ Pivotal
1

2. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Overview
2
● From Monolith to Microservices
● Communication Between Microservices (Old vs. New)
● Networking Deep Dive
● Container Networking + Spring Cloud Services
● Demo

3. So you had a monolith...

4. Monolith

5. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Monolith
5
● Single code base
● Deployed as a single unit
● No interprocess communication

6. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Monolith
6
● More difficult for multiple teams to collaborate
● Modules cannot be deployed separately
● Easy to introduce unwanted dependencies

7. Microservices

9. cf push
cf push
cf push
cf push cf push
cf push cf push
cf push
cf push

10. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Microservices
10
● Smaller, simpler and easier to test
● Develop, deploy and run independently
● Organization can scale to many teams

11. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Microservices
11
● Distributed systems are hard
● Cloud Foundry and Spring Cloud can help

12. How do these microservices
communicate?

13. backendfrontend

14. backendfrontend
The Internet
Private Cloud
load balancer

15. backendfrontend
The Internet
Private Cloud
Cloud Foundry
load balancer
CF Router

16. backendfrontend
The Internet
Private Cloud
Cloud Foundry
load balancer
CF Router

17. Is this still the state of the
world?

18. backendfrontend
The Internet
Private Cloud
Cloud Foundry
load balancer
CF Router

19. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Container to Container Networking
19
● Direct communication between microservices
● Lower latency
● Apps do not need public routes!

20. Networking Deep Dive

21. Connectivity

22. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
How does this Networking stuff actually work?
22
● VXLAN overlay network
● Each container gets a unique IP
● Entire overlay network is L3 (IP)
(No two containers have L2 connectivity with each other)

23. Policy

24. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
How does this Networking stuff actually work?
24
● Default deny
● Every application with a policy gets a tag
● Tag encoded in VXLAN GBP packet header
● Rules are enforced with iptables using the tag

25. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
How Traffic Flows
25

26. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
How Traffic Flows
26

27. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
How Traffic Flows
27

28. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
How Traffic Flows
28

29. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
How Traffic Flows
29

30. How do microservices discover
each other?

31. BA

32. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Bring your own service discovery
32
● Amalgam8
● Eureka
● Spring Cloud Services (SCS)

33. Spring Cloud Services!

34. “Spring Cloud provides tools for
developers to quickly build some of the
common patterns in distributed
systems.”
34
http://projects.spring.io/spring-cloud/

35. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
SCS + Container Networking
35
● Create service registry
● Bind to service registry service
● Add @EnableDiscoveryClient to your application
● Update configuration
spring.cloud.services.registrationMethod: direct

36. Demo Time!

37. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
But wait... the apps can’t talk
37

38. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Policies!
38
● All traffic default deny
● Policies based on app
● Configure through CF CLI or API

39. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Policies!
39
cf add-network-policy frontend-app
--destination-app backend-app
--port 7007
--protocol tcp

40. Let’s Try That Again!

41. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
41

42. Unless otherwise indicated, these slides are © 2013-2016 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Resources
42
● Cats and Docs SCS demo app
https://github.com/mcwumbly/cats-and-dogs-scs
● Spring Cloud
http://projects.spring.io/spring-cloud/
● CF Networking
https://github.com/cloudfoundry/cf-networking-release/
● Silk - a CNI plugin designed for Cloud Foundry
https://github.com/cloudfoundry/silk
● SCS + Container Networking
https://content.pivotal.io/blog/building-spring-microservices-with-cloud-foundrys-new-container-networking-stack
● Cloud Foundry Slack #container-networking
http://cloudfoundry.slack.com

43. Thanks!
Try it out on PCF 1.11+ or PWS. Feedback appreciated!
cloudfoundry.slack.com #container-networking
achin@pivotal.io dmcclure@pivotal.io
Other Sessions:
Cloud-Native Java with Spring Cloud Services (Next up! Tues @ 3:20 in Room 2007)
Cloud Foundry Networking with VMware and NSX (Wed @ 4:20 in Room 2004)
Connecting All Abstractions with Istio (Wed @ 5:40 in Room 2008)
43
#springone@s1p