Downloaded 22 times
Production-Grade Kubernetes With NGINX Ingress Controller
- 1. Production-Grade Kubernetes with NGINX Ingress Controller AmirRawdat Technical Marketing Engineer, NGINX
- 3. | ©2020 F5 3 Agenda •Common challenges with managing traffic inside Kubernetes • Taking control of Kubernetes edge networking with NGINX • Choosing the NGINX ingress controller that fits your needs • Staying relevant in Kubernetes when security is top priority • Scaling Ingress Controller provisioning to multiple teams • Q&A
- 4. | ©2020 F5 4 Kubernetesbecoming platform for developing, testing and running applications Applications are becoming ephemeral by nature This brings limitations to Layer 4 Kubernetes Networking NGINX provides L5-7 networking policies as an alternative to IP addresses Cybersecurity is an ever- growing, ever-complicating field Traditional firewalls and anti virus security is irrelevant or obsolete. Data breaches on the rise and will continue to rise throughout 2021. What we see in the market KUBERNETES-CENTRIC PERSPECTIVE SOURCE: INFORMATION EXAMPLE Adoption of managed and commercial Kubernetes platforms We see rapid adoption of OpenShift and Rancher in the private cloud space EKS and GKE adoption in public cloud
- 5. | ©2020 F5 5 MYFAVORITE ARTICLE TITLES But K8s Adoption Brings Complexity “Let’s Use Kubernetes!”N ow You Have 8 Problems” ”Will Complexity Kill Kubernetes?” “Has Kubernetes Already Become To Unnecessarily Complex for Enterprise IT?” ”Why Kubernetes Networking Is Hard – And What You Can Do About It”
- 6. | ©2020 F5 6 WHAT’SMISSING IN K8S AND WHAT DO YOU REALLY WANT AND NEED FROM NGINX? Networking: K8s, L4-L7 • K8s, and CNI, provides L4 servicing – IP endpoints • Many, complex options • https://kubernetes.io/docs/concepts/cluster-administration/networking/ • L7 Traffic Management is missing • Service-level access control • SSL/mTLS enforcement • Canary releases, A/B Testing, and blue-green deployments • Circuit breaking • WAF protection • Enter: KIC – Taking control of Kubernetes networking
- 7. | ©2020 F5 7 Whatis the NGINX Ingress Controller ?
- 8. | ©2020 F5 8 Specialload balancer for Kubernetes environments: • Bridging Kubernetes apps with external services • Configured with the Kubernetes API • Load balancing rules are updated when apps scale up/down CONFIDENTIAL TOPOLOGY What is the NGINX Ingress Controller ?
- 9. | ©2020 F5 9 Problemswith Ingress Resources • Kubernetes Ingress resources are limited to basic SSL/TLS and HTTP load balancing • Configuration can be further customized with Annotations, ConfigMaps, and templates • Global scoped and not fine grained • Very error prone • Not Secure
- 10. | ©2020 F5 10 NGINXIngress Resources • Native Type-Safe Configuration • Provides advanced app delivery features with native Kubernetes workflow. • Increased modularity and reusability • Finer grained multi-tenancy with NGINX cross-namespacing
- 11. | ©2020 F5 11Confidential – Do Not Distribute
- 12. | ©2020 F5 12Confidential – Do Not Distribute
- 13. | ©2020 F5 13 WhichNGINX Ingress Controller Should I use ?
- 14. | ©2020 F5 14 Thetop ingress providers for 2020 are NGINX (62%), Envoy (37%), and HAProxy (27%) Top Ingress providers for 2020 CNCF
- 15. | ©2020 F5 15 FeaturesCommunity Ingress Controller NGINX OSS Ingress Controller NGINX Plus Ingress Controller Authors K8s F5 F5 Feature stability Inconsistent Consistent Consistent Performance (reloads) Great Good Excellent Support Community Community F5 Multi-tenant focus Weak Excellent Excellent NGINX Ingress Controller Options https://www.nginx.com/blog/performance-testing-nginx-ingress-controllers-dynamic-kubernetes-cloud- environment/
- 16. | ©2020 F5 16 TrafficPolicies
- 17. | ©2020 F5 17 Zero trust security at the edge – Mutual TLS authentication JWT/OIDC authentication (SSO) Rate limiting – Make your apps resilient to traffic overload DEVOPS Traffic Policies
- 18. | ©2020 F5 18 Protectingyour Kubernetes Apps from Vulnerabilities and Attacks
- 19. | ©2020 F5 19 BlockingThreats with NGINX App Protect SECURE PERIMETER FOR YOUR APPLICATIONS IN KUBERNETES
- 20. | ©2020 F5 20 Consolidating the NGINX Ingress Controller with a battle tested WAF Configuration is fully managed by the Kubernetes API Leverage Kubernetes RBAC to securely delegate WAF configurations to a dedicated DevSecOps team Block unrecognized threats with user defined signatures WAF Blocking Threats with NGINX App Protect
- 21. | ©2020 F5 21 Get Started with the NGINX Ingress Controller -- https://github.com/nginxinc/kubernetes-ingress Get a free trial of NGINX Plus Ingress Controller -- https://www.nginx.com/free-trial- request-nginx-ingress-controller/ Download the Complete NGINX Cookbook -- https://go.f5.net/cookbook Get Started Today !!
- 22. Q&A Contact Us: Amir Rawdat:a.rawdat@f5.com NGINX: sales@nginx.com
Editor's Notes
- #2 A couple house keeping items: 1. All attendees for todays session will receive a $25 gift card from our marketing teams within 24-48 hours) 2. We're going to play a little trivia in a moment and we ask that you please type your responses in the chat window – the first person to answer correctly will win some NGINX Swag 3. I will be moderating the chat window so if you have questions as Amir is going through his discussion points, please enter them and we will be sure to answer those. If we don't get to them during the session today, we will certainly get the answers for you following todays call 4. I wanted to point out, that we are also doing more hands-on lab sessions around various NGINX solutions (KIC being one of them) so, please send me your email in a DM if you'd like to get registered for this or receive further information. These labs are usually 3-4 hours and Amir can share a little more detail on what they entail. Amir...
- #5 Cybersecurity is an ever-growing, ever-complicating field Authentication is enforced independent of IP addresses Both the client and server before connections are accepted. Broader shift away from perimeter focused, firewall-based security to where security is everywhere and is based on identity (such as identity of applications sharing or requesting information)
- #8 While we can’t solve all of the complexity that comes with K8s, we can offer up a simpler and more secure way to manage all service-to-service traffic.
- #13 Delegate security, and traffic control to each team. Configure the ingress networking for applications pods inside their respective namespace.
- #14 While we can’t solve all of the complexity that comes with K8s, we can offer up a simpler and more secure way to manage all service-to-service traffic.
- #16 Multi-tenant focus:
- #17 While we can’t solve all of the complexity that comes with K8s, we can offer up a simpler and more secure way to manage all service-to-service traffic.
- #19 While we can’t solve all of the complexity that comes with K8s, we can offer up a simpler and more secure way to manage all service-to-service traffic.