INTERFACE, by apidays - APIs: the next 10 years June 8, 9 & 10 2022 The challenges of exposing and connecting microservices Denis Jannot, Director of Field Engineering at Solo.io ------------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/ Deep dive into the API industry with our reports: https://www.apidays.global/industry-reports/ Subscribe to our global newsletter: https://apidays.typeform.com/to/i1MPEW

1. The challenges of exposing and connecting
microservices
Denis Jannot
Director of Field Engineering - EMEA

2. 2022 SERIES OF EVENTS
New York
JULY
(HYBRID)
Australia
SEPTEMBER
(HYBRID)
Singapore
APRIL
(VIRTUAL)
Helsinki & North
MARCH
(VIRTUAL)
Paris
DECEMBER
(HYBRID)
London
OCTOBER
(HYBRID)
Hong Kong
AUGUST
(VIRTUAL)
JUNE (VIRTUAL)
India
MAY
(VIRTUAL)
APRIL (VIRTUAL)
Dubai & Middle East
JUNE
(VIRTUAL)
Check out our API Conferences
www.a pida ys .globa l
Want to talk at one of our conferences?
apidays.typeform.com/to/ILJeAaV8

3. 2 | Copyright © 2021
About me
@djannot
denis.jannot@solo.io
denisjannot
Denis Jannot
Director of Field Engineering - EMEA @ Solo.io

4. 3 | Copyright © 2021
From Monolith to Microservices
MONOLITH MICROSERVICES

5. 4 | Copyright © 2021
Kubernetes became the most popular platform
MONOLITH MICROSERVICES

6. 5 | Copyright © 2021
5 | Copyright © 2021
Exposing microservices

7. 6 | Copyright © 2021
How do you expose your apps ? The Ingress way
MICROSERVICES
Ingress
TLS
Basic routing
Kubernetes
Service
Pods

8. 7 | Copyright © 2021
Each team reinvents the wheel
MICROSERVICES
Ingress

9. 8 | Copyright © 2021
Some capabilities must be implemented downstream
MICROSERVICES
Ingress
API
GATEWAY
Rate limiting
WAF

10. 9 | Copyright © 2021
Common challenges
• Each team reinvents the wheel (setting up the same authentication)
• Implementation is different for each language
• Application teams should focus on the business logic instead
• The security team doesn’t have visibility on what’s configured for each application
• Other security mechanisms must be implemented outside of the Kubernetes cluster

11. 10 | Copyright © 2021
What about a Kubernete-native API Gateway ?
MICROSERVICES
API
GATEWAY
Rate limiting
WAF

12. 11 | Copyright © 2021
That can even expose services outside of Kubernetes
MICROSERVICES
API
GATEWAY
Rate limiting
WAF

13. 12 | Copyright © 2021
Benefits
• Authentication is performed at the API Gateway level
• Application teams can focus on the business logic
• Everything is configured through Kubernetes Custom Ressources, so it’s
Gitops-friendly
• Other security mechanisms are enforced by the same Gateway
• Visibility for the security team

14. 13 | Copyright © 2021
13 | Copyright © 2021
Connecting microservices

15. 14 | Copyright © 2021
No visibility
MICROSERVICES
API
GATEWAY
Rate limiting
WAF

16. 15 | Copyright © 2021
Common challenges
• No visibility
• No security (plain text requests, all communications allowed in the cluster, …)
• Limited traffic management
• Complex cross cluster communications

17. 16 | Copyright © 2021
Service to Service communication requirements
• Observability
• Identity Management
• Encryption
• Certificate Management
• Traffic Management
• Health check
• Access Control
• ...

18. 17 | Copyright © 2021
Kubernetes alone doesn’t provide much
Encryption
Telemetry
Traffic
management
Access
control
Identity
Management
Certificate
management
Health check
Kubernetes
Service
Third Party
Encryption

19. 18 | Copyright © 2021
An API gateway could solve some problems
MICROSERVICES
API
GATEWAY
Encryption
Telemetry
Traffic
management
Access
control
Health check
Identity
Management
Certificate
management
Third Party
Encryption

20. 19 | Copyright © 2021
But it would become a bottleneck
MICROSERVICES
API
GATEWAY
Encryption
Telemetry
Traffic
management
Access
control
Health check
Identity
Management
Certificate
management
Third Party
Encryption

21. 20 | Copyright © 2021
Welcome Service Mesh
SERVICE MESH
Control
Plane
Encryption
Telemetry
Traffic
management
Access
control
Identity
Management
Certificate
management
Health check
Data Plane

22. 21 | Copyright © 2021
Benefits
• Authentication and Authorization are performed at the Service Mesh level
• Encryption is performed at the Service Mesh level
• Advanced traffic management allows smarter deployments (canary, …)
• End to end observability
• Application teams can focus on the business logic

23. 22 | Copyright © 2021
Why Envoy Proxy
• Neutral Foundation (CNCF)
• Large, diverse, vibrant community
• Built ground up for dynamic services
environment
• Dynamic configuration, driven by API
• Highly extensible
• L7 filters (HTTP/1, HTTP/2, gRPC,
redis, mysql, Kafka, etc)
• Deep signals telemetry out of the box
• Versatile deployment options

24. 23 | Copyright © 2021
Istio is the dominant open-source leader
Source: CNCF Survey 2020 raw data

25. 24 | Copyright © 2021
Multi-cluster operations is more involved

26. 25 | Copyright © 2021
Istio architecture

27. 26 | Copyright © 2021
26 | Copyright © 2021
Why Solo ?

28. 27 | Copyright © 2021
Application networking

29. 28 | Copyright © 2021
Gloo Edge
MICROSERVICES
Rate limiting
WAF

30. 29 | Copyright © 2021
Gloo Mesh

31. 30 | Copyright © 2021
Enterprise Istio Production Support
• Upstream first
• Specialty builds available (FIPS, ARM, distroless, etc)
• Long Term Support (LTS) N-4
• Critical security patches
• Production break-fix
• One hour SLA Severity 1
• Install / upgrade
• Architecture and operational guidance,
best practices
Kubernetes Cluster
Istiod
Account
User

32. 31 | Copyright © 2021
First analyst report covering service mesh

33. 32 | Copyright © 2021
32 | Copyright © 2021

34. 33 | Copyright © 2021

35. 34 | Copyright © 2021
34 | Copyright © 2021
https://slack.solo.io/

36. 35 | Copyright © 2021
35 | Copyright © 2021
Thank you !

37. 36 | Copyright © 2021