This document discusses the challenges of managing traffic in Kubernetes and presents the NGINX Ingress Controller as a solution for advanced networking needs. It highlights the importance of security and scalability in Kubernetes environments while comparing various ingress controller options. The content also emphasizes the necessity for more sophisticated data protection measures against rising cybersecurity threats.

1. Production-Grade
Kubernetes with
NGINX Ingress
Controller
Amir Rawdat
Technical Marketing Engineer, NGINX

3. | ©2020 F5
3
Agenda
• Common challenges with managing traffic inside Kubernetes
• Taking control of Kubernetes edge networking with NGINX
• Choosing the NGINX ingress controller that fits your needs
• Staying relevant in Kubernetes when security is top priority
• Scaling Ingress Controller provisioning to multiple teams
• Q&A

4. | ©2020 F5
4
Kubernetes becoming platform
for developing, testing and
running applications
Applications are becoming ephemeral by
nature
This brings limitations to Layer 4 Kubernetes
Networking
NGINX provides L5-7 networking policies as
an alternative to IP addresses
Cybersecurity is an ever-
growing, ever-complicating field
Traditional firewalls and anti virus security is
irrelevant or obsolete.
Data breaches on the rise and will continue
to rise throughout 2021.
What we see in the market
KUBERNETES-CENTRIC PERSPECTIVE
SOURCE: INFORMATION EXAMPLE
Adoption of managed and
commercial Kubernetes platforms
We see rapid adoption of OpenShift and
Rancher in the private cloud space
EKS and GKE adoption in public cloud

5. | ©2020 F5
5
MY FAVORITE ARTICLE TITLES
But K8s Adoption Brings Complexity
“Let’s Use
Kubernetes!”N
ow You Have 8
Problems”
”Will
Complexity Kill
Kubernetes?”
“Has Kubernetes
Already Become
To Unnecessarily
Complex for
Enterprise IT?”
”Why Kubernetes Networking Is Hard –
And What You Can Do About It”

6. | ©2020 F5
6
WHAT’S MISSING IN K8S AND WHAT DO YOU REALLY WANT AND NEED FROM NGINX?
Networking: K8s, L4-L7
• K8s, and CNI, provides L4 servicing – IP endpoints
• Many, complex options
• https://kubernetes.io/docs/concepts/cluster-administration/networking/
• L7 Traffic Management is missing
• Service-level access control
• SSL/mTLS enforcement
• Canary releases, A/B Testing, and blue-green deployments
• Circuit breaking
• WAF protection
• Enter: KIC – Taking control of Kubernetes networking

7. | ©2020 F5
7
What is the NGINX Ingress
Controller ?

8. | ©2020 F5
8
Special load balancer for Kubernetes
environments:
• Bridging Kubernetes apps with external services
• Configured with the Kubernetes API
• Load balancing rules are updated when apps
scale up/down
CONFIDENTIAL
TOPOLOGY
What is the NGINX Ingress
Controller ?

9. | ©2020 F5
9
Problems with Ingress
Resources
• Kubernetes Ingress resources are limited to basic SSL/TLS and
HTTP load balancing
• Configuration can be further customized with Annotations,
ConfigMaps, and templates
• Global scoped and not fine grained
• Very error prone
• Not Secure

10. | ©2020 F5
10
NGINX Ingress
Resources
• Native Type-Safe Configuration
• Provides advanced app delivery features with native Kubernetes
workflow.
• Increased modularity and reusability
• Finer grained multi-tenancy with NGINX cross-namespacing

11. | ©2020 F5
11 Confidential – Do Not
Distribute

12. | ©2020 F5
12 Confidential – Do Not
Distribute

13. | ©2020 F5
13
Which NGINX Ingress
Controller Should I use ?

14. | ©2020 F5
14
The top ingress providers for
2020 are NGINX (62%), Envoy
(37%), and HAProxy (27%)
Top Ingress providers for 2020
CNCF

15. | ©2020 F5
15
Features Community Ingress
Controller
NGINX OSS Ingress
Controller
NGINX Plus Ingress
Controller
Authors K8s F5 F5
Feature stability Inconsistent Consistent Consistent
Performance (reloads) Great Good Excellent
Support Community Community F5
Multi-tenant focus Weak Excellent Excellent
NGINX Ingress Controller Options
https://www.nginx.com/blog/performance-testing-nginx-ingress-controllers-dynamic-kubernetes-cloud-
environment/

16. | ©2020 F5
16
Traffic Policies

17. | ©2020 F5
17
 Zero trust security at the edge – Mutual TLS authentication
 JWT/OIDC authentication (SSO)
 Rate limiting – Make your apps resilient to traffic overload
DEVOPS
Traffic Policies

18. | ©2020 F5
18
Protecting your Kubernetes
Apps from Vulnerabilities and
Attacks

19. | ©2020 F5
19
Blocking Threats with NGINX App Protect
SECURE PERIMETER FOR YOUR APPLICATIONS IN KUBERNETES

20. | ©2020 F5
20
 Consolidating the NGINX Ingress Controller with a battle tested WAF
 Configuration is fully managed by the Kubernetes API
 Leverage Kubernetes RBAC to securely delegate WAF configurations to a
dedicated DevSecOps team
 Block unrecognized threats with user defined signatures
WAF
Blocking Threats with NGINX App Protect

21. | ©2020 F5
21
 Get Started with the NGINX Ingress Controller --
https://github.com/nginxinc/kubernetes-ingress
 Get a free trial of NGINX Plus Ingress Controller -- https://www.nginx.com/free-trial-
request-nginx-ingress-controller/
 Download the Complete NGINX Cookbook -- https://go.f5.net/cookbook
Get Started Today !!

22. Q&A
Contact Us:
Amir Rawdat: a.rawdat@f5.com
NGINX: sales@nginx.com