Get the Most Out of Kubernetes with NGINX

Get the most out of Kubernetes with NGINX PRODUCTION-GRADE APPLICATION DELIVERY

| ©2020 F54 94% Experienced a security incident Kubernetes/container environments during the last year Trends and Challenges in Kubernetes AGILITY VS SECURITY 70% Will run containerized apps in production by 2023

| ©2020 F55 94% Experienced a security incident Kubernetes/container environments during the last year Trends and Challenges in Kubernetes AGILITY VS SECURITY 44% Delayed or halted containerized app deployment into production 70% Will run containerized apps in production by 2023

| ©2020 F56 You rely on a rich set of services to deliver an application Code Ingress Controller App / web server DNS DDoS CDNLoad balancer API gateway App Security Customer DEVOPS / APPLICATIONS NETOPS / OPERATIONS

| ©2020 F57 You rely on a rich set of services to deliver an application Code DNS DDoS CDNLoad balancer API gateway App Security Customer DEVOPS / APPLICATIONS NETOPS / OPERATIONS Ingress Controller pod pod pod pod pod Per-Pod proxy Per-Service proxy Service Mesh network

| ©2020 F58 You rely on a rich set of services to deliver an application Code Edge Multiple locations to deploy Application Services: • Edge: External load balancers and proxies • Ingress Controller: Entry- point into Kubernetes • Per-Service Proxy: Interior service proxy tier • Per-Pod Proxy: Proxy embedded in pod • Service Mesh network: L7 traffic processing Ingress Controller pod pod pod pod pod Per-Pod proxy Per-Service proxy Service Mesh network

| ©2020 F59 NGINX is a perfect fit for a Container Platform Source: Sysdig Container Usage Report 2019 The top 10 open source solutions running in containers Source: CNCF Survey 2019 Top Ingress Providers CNCF Survey

| ©2020 F510 We’re building bicycles on-demand Orders are checked, then come in through the factory gates They are handled by a fulfillment team: • Assembly: − Frame, Wheelset, Gears • Finishing • Packaging − QA CONFIDENTIAL An Analogy: A Microservices App is like a Factory

| ©2020 F511 CONFIDENTIAL An Analogy: A Microservices App is like a Factory Edge Ingress Edge Ingress Fulfillment Assembly Frame Wheels Rims Tires Gears Packing QA Finishing Assembly Fulfillment Finishing Packing QA Gears Wheels Frame Rims Tires

| ©2020 F512 Edge Ingress Assembly Fulfillment Finishing Packing QA Gears Wheels Frame Rims Tires CONFIDENTIAL What do we mean by ‘Application Delivery services’? Application Delivery in our Factory: • A ‘pod’ is a production room • A ‘service’ is a group of pods We might need additional App Delivery services: • Security and authentication • Load-balancing • Health checks • Traffic management (redirects, routing, canary, B|G, rate limiting, etc, etc) • Monitoring – L7 metrics • Tracing Per-Service Per-Pod

| ©2020 F514 • Single pod deployment, running in K8s as nodeport • Rich, app-oriented configuration using both Kubernetes and NGINX Ingress Resources • Supports DevOps use cases: routing, B/G, circuit breaker • Multi-tenant, secure RBAC NGINX Ingress Controller NGINX Ingress Controller Container Environments Visibility and Analytics Orchestration Dotted line = integration control plane Solid line = traffic data plane AppServicesAcrossNetwork Node 2Node 1 Openshift Tracing

| ©2020 F515 NGINX Ingress Controller Manage Complexity in Production WITH KUBERNETES & NGINX INGRESS CONTROLLER Apps Teams Basic Ingress Solutions 1 Many Many 1 Many Apps and Many Teams: • Multi-tenant Configuration • Supports both Kubernetes and NGINX Ingress Resources Native protocol support: • HTTP, HTTPS, HTTP/2, gRPC, • TLS passthrough, TCP and UDP Advanced Load Balancing: • Content-Based Routing • Rate Limiting • JWT Authentication Security: • Mutual TLS • App Protect WAF Operations: • Canary and Blue-Green Releases • A|B Testing • Health Checks • App-Specific Metrics

| ©2020 F516 NGINX Ingress Controller - Architecture apiVersion: extensions/v1beta1 kind: Ingress metadata: name: hello-ingress spec: tls: - hosts: - hello.example.com secretName: hello-secret rules: - host: hello.example.com http: paths: - path: / backend: serviceName: hello-svc servicePort: 80 Ingress Controller daemon Kubernetes API NGINX conf Rewrite nginx.conf NGINX Plus API NGINX or NGINX PlusExternal IP Kubernetes Ingress Resources Service information hello-svc NGINX Ingress Resources pod pod pod pod

| ©2020 F517 Kubernetes Ingress Resources apiVersion: extensions/v1beta1 kind: Ingress metadata: name: hello-ingress spec: tls: - hosts: - hello.example.com secretName: hello-secret rules: - host: hello.example.com http: paths: - path: / backend: serviceName: hello-svc servicePort: 80 annotations: kubernetes.io/ingress.class: "nginx" appprotect.f5.com/app-protect-policy: "default/dataguard-alarm" appprotect.f5.com/app-protect-enable: "True" appprotect.f5.com/app-protect-security-log-enable: "True" appprotect.f5.com/app-protect-security-log: "default/logconf" appprotect.f5.com/app-protect-security-log-destination: "syslog:server=10.27.2.34:514" App Protect security policy App Protect Log Configuration

| ©2020 F518 Host TLS Upstreams Routes - Path Action Split Match Route ErrorPage pass redirect return proxy delegation optional Host TLS Upstreams Routes - Path Action Split Match Route ErrorPage pass redirect return proxy delegation optional NGINX Ingress Resources Host TLS Policies Upstreams Routes - Path Policies Action Split Match Route ErrorPage pass redirect return proxy delegation VirtualServer Host Upstreams Subroutes - Path Action Split Match ErrorPage pass redirect return proxy Host Upstreams Subroutes - Path Action Split Match ErrorPage pass redirect return proxy Host Upstreams Subroutes - Path Policies Action Split Match ErrorPage pass redirect return proxy VirtualServerRoute Policies Access Control Rate Limiting Authentication (JWT) Ingress mTLS Egress mTLS Access Control Rate Limiting Authentication (JWT) Ingress mTLS Egress mTLS Access Control Rate Limiting Authentication (JWT) Ingress mTLS Egress mTLS NGINX server configuration NGINX http configuration Server and HTTP snippets NGINX location configuration Location snippets

Take Security as a case in point

| ©2020 F520 NetOps/SecOps: • Centralized Ops team • Set of stable applications • Top concern: governance, stability and predictability DevSecOps/DevOps: • Democratized, distributed teams • Multiple applications, many actively developed • Top concern: time-to-market, speed to innovate Consider two different WAF user profiles Edge Customer DEVOPS / APPLICATIONS NETOPS / OPERATIONS Ingress Controller pod pod pod pod pod Per-Pod proxy Per-Service proxy Service Mesh network

| ©2020 F521 CONFIDENTIAL Summary At Edge Ingress Controller Per-Service Proxy Per-Pod Proxy Within Mesh Audience SecOps SecOps/DevSecOps DevSecOps DevOps DevOps Scope Global Per service / URI Per service Per endpoint Fine-Grained Cost/Efficiency Good/Excellent (consolidation) Excellent (consolidation) Good Poor Unclear Configuration nginx.conf K8s API nginx.conf nginx.conf Mesh Control Plane User Demand High High Medium Low Unclear Edge Ingress Controller pod pod pod pod pod Per-Pod proxy Per-Service proxy Service Mesh network Future

| ©2020 F522 WAF Deployment at the Edge DEPLOY WAF POLICIES OUTSIDE KUBERNETES, ON LOCAL BIG-IP OR CLOUD-BASED WAF NetOps/SecOps-Centric Approach This is a prime use case for Edge load balancer i.e. outside K8s. NetOps/SecOps empower their App/DevOps brethren to consume F5 application services in an automated manner. Can also be provided using F5 aWAF. Appropriate for NetOps/SecOps-managed WAF Edge Ingress Controllerpod pod pod pod pod Per-Pod proxy Per-Service proxy Service Mesh network

| ©2020 F523 WAF Deployment on the Ingress Controller DEPLOY WAF POLICIES ON THE INGRESS CONTROLLER, CONFIGURED USING KUBERNETES API K8s SecOps/DevSecOps-Centric Approach Appropriate solution when WAF policies are under direction of NetOps or DevOps teams. Policies are defined and associated with services using Kubernetes API. NGINX Ingress Controller RBAC allows: • Admin users to enforce policies per listener • DevOps users to select policy per Ingress Resource Leverage Container Ingress Services to scale NGINX Ingress Controller and add other application services (LB, DNS, DDoS, IAM). Appropriate for Kubernetes-native SecOps or DevSecOps Edge Ingress Controllerpod pod pod pod pod Per-Pod proxy Per-Service proxy Service Mesh network

| ©2020 F524 WAF Deployment within Kubernetes, for a specific service DEPLOY WAF POLICIES FOR A SPECIFIC SERVICE USING A PROXY TIER IN FRONT OF THE SERVICE DevSecOps-Centric Approach Appropriate solution when WAF policies are under direction of the DevSecOps team, and specific to a small number of services. WAF is implemented using a front-end proxy service for the protected service(s). • Easy to deploy securely • WAF updates require re-deployment of per-service proxy tier Allows for greater resource control and reduces complexity of IC configuration. Appropriate for DevSecOps-managed WAF for specific service Edge Ingress Controllerpod pod pod pod pod Per-Pod proxy Per-Service proxy Service Mesh network

| ©2020 F525 WAF Deployment within Kubernetes, for a specific pod DEPLOY WAF POLICIES FOR A SPECIFIC POD/INSTANCE, EMBEDDING NGINX PLUS WITHIN THE POD AppOwner-Centric Approach Appropriate solution when App Owner has full control of WAF for their application. WAF is implemented using an embedded proxy for each application pod. • Implemented, tested and deployed using CI/CD pipeline • WAF updates require re-deployment of application pods Suitable for services that require very close control and testing of WAF configuration. Appropriate when AppOwner has full control over WAF policies Good use case: I have a large legacy application that I have packaged as a container. This application has vulnerabilities Edge Ingress Controllerpod pod pod pod pod Per-Pod proxy Per-Service proxy Service Mesh network

| ©2020 F527 ENTERPRISE-GRADE APPLICATION DELIVERY NGINX + Kubernetes Secure your apps • NGINX Ingress Controller Drive application traffic at scale • JWT Authentication: Validate authorized users via JWT Token verification • NGINX App Protect: Modern app-security solution built on F5’s market-leading WAF Customer DEVOPS / APPLICATIONS NETOPS / OPERATIONS Code Edge Ingress Controller pod pod pod pod pod Per-Pod proxy Per-Service proxy Service Mesh network

Get the Most Out of Kubernetes with NGINX

More Related Content

What's hot

Similar to Get the Most Out of Kubernetes with NGINX

More from NGINX, Inc.

Recently uploaded

Get the Most Out of Kubernetes with NGINX