On-Demand Link: https://www.nginx.com/resources/webinars/fundamentals-microservices/ About the Webinar Despite powering some of the most popular apps on the planet, microservices – including containers and Kubernetes – are still a mystery to many. Microservices is both an approach to software architecture that builds a large, complex apps from multiple small components and the term for the small components themselves. In this “Microservices 101” webinar, you’ll get an introduction to microservices that will give you a working understanding of the technologies: Monolithic, microservices, and hybrid architectures Containers and Kubernetes Ingress controllers and service meshes

1. Fundamentals of
Microservices
OWEN GARRETT AND ALAN MURPHY
NGINX, F5
O.GARRETT@F5.COM / A.MURPHY@F5.COM

2. | ©2021 F5
2
What is your organization’s expertise with
Microservices?
1. What’s a Microservice? That’s what I’m here to learn about!
2. We’re not using a Microservices architecture yet.
3. We are taking first steps to production Microservices.
4. We run both Microservices and Traditional architectures in
production.
5. We are (almost) entirely a Microservices-first organization.

3. | ©2021 F5
3
Microservices began in Venice
Shipbuilding in Europe, c1500
Ships were built in-place, by hand, taking months
to construct.
The guild system provided craftsmen and
maintained a monopoly of skills and training. It
protected workers and created artifacts of great
quality, but was slow and inefficient.
Shipwrights building a brigantine, 1541

4. | ©2021 F5
4
Microservices began in Venice
Shipbuilding in Venice, c1500
The Venetian Arsenal was the most powerful and
efficient shipbuilding enterprise in the world.
It built a ship every day, with up to 100 galleys of
various specification in the backlog.
In 1574, King Henry of France watched the
outfitting of an entire ship during his lunch…
Venetian Arsenal, present day

5. | ©2021 F5
5
CONFI

6. | ©2021 F5
6
CONFI

7. | ©2021 F5
7

8. | ©2021 F5
8
What has this got to do with Microservices?

9. | ©2021 F5
9

10. | ©2021 F5
10
Microservices architecture is an approach
in which a single application is composed of
many loosely coupled and independently
deployable smaller services.
• Highly maintainable and testable
• Loosely coupled
• Independently deployable
• Organized around business capabilities
• Owned by a small team

11. | ©2021 F5
11
What’s your biggest concern with
microservices?
1. Training and Knowledge – the journey to production is difficult
2. In production – Logging, Visibility and Monitoring
3. In production – Security
4. In production – Scaling to large apps and multiple teams
5. None – I know what I’m doing, all is working

12. | ©2021 F5
12
Modern Apps Require a Modern Architecture
FROM MONOLITHIC ...
... to Dynamic
Three-tier, J2EE-style architectures
Complex protocols (HTML, SOAP)
Persistent deployments
Fixed, static Infrastructure
Big-bang releases
Silo’ed teams (Dev, Test, Ops)
Microservices
Lightweight (REST, JSON)
Containers, VMs, Functions
Infrastructure as Code
Continuous delivery
DevOps Culture
From Monolithic ...

13. | ©2021 F5
13
A ‘container’ takes the bare minimum needed for an application, and packages it up as a single artifact:
• Runnable application code – compiled, or needing a framework
• Runtime artifacts – libraries, frameworks, etc
• Declaration of runtime requirements – network, storage etc
What is a Container?
Develop Build Package Test Deploy Operate
Code Container

14. | ©2021 F5
14
Kubernetes stiches together a number of servers (‘nodes’) to create a flat platform for running Containers:
What is Kubernetes?
Kubernetes
Master
API Server
Scheduler
Controller-
Manager
etcd
Kubernetes
Node
Kubelet
Kubernetes
Node
Kubelet
Kubernetes
Node
Kubelet
Ingress
Controller
Internal
Network
KubeProxy
KubeProxy
KubeProxy
External Load
Balancer
• BIG CIS
• NGINX
• Cloud LB
Users

15. | ©2021 F5
15
Requirements for Production-Grade Kubernetes
Development
Operations
Infrastructure
Dataplane
Application
Dataplane
Application
Runtime
App
Code Repo CI/CD pipeline
Automation
Pod
ModSecurity AppProtect
Auth Monitoring Logging
WAF
Users

16. | ©2021 F5
16
Operating a distributed application is hard
STATIC, PREDICTABLE MONOLITH:
Dynamic, Distributed App:
Fast, reliable function calls
Local debugging
Local profiling
Calendared, big-bang upgrades
‘Integration hell’ contained in dev
Slow, unreliable API calls
Distributed fault finding
Distributed tracing
In-place dynamic updates
‘Continuous integration’ live in prod
More things can go wrong, it’s harder to find the faults, everything happens live
Static, Predictable Monolith:

17. | ©2021 F5
17
Requirements for Production-Grade Kubernetes
Development
Operations
Infrastructure
Dataplane
Application
Dataplane
Application
Runtime
App
Code Repo CI/CD pipeline
Automation
Pod
ModSecurity AppProtect
Auth Monitoring Logging
WAF
Users

18. | ©2021 F5
18
Requirements for Production-Grade Kubernetes

19. | ©2021 F5
19
Begin with the Ingress Controller…

20. | ©2021 F5
20
What Ingress solution do you use?
1. Default Kubernetes Ingress Controller
2. Default OpenShift Router
3. NGINX’s Ingress Controller
4. F5 Container Ingress Services
5. Something else
6. Don’t know

21. | ©2021 F5
21
• Accepts traffic from outside the Kubernetes
platform, and load-balances it to pods
(containers) running inside the platform
• Configured using the Kubernetes API, with
objects called ‘Ingress Resources’
• Monitors the pods running in Kubernetes, and
automatically updates the load balancing rules if,
for example, pods are added or removed from a
service
The Ingress Controller
Internal
Network
Users
Ingress
Controller
A specialized load balancer for Kubernetes environments:

22. | ©2021 F5
22
Two Challenges at Scale
Multitenancy (Teams)
How can multiple teams and
applications share a Container
environment safely and securely?
Complex Applications
How can you provide the
advanced capabilities that
complex applications require?

23. | ©2021 F5
23
Host
TLS
Upstreams
Routes
- Path
Action
Split
Match
Route
ErrorPage
pass
redirect
return
proxy
delegation
optional
Host
TLS
Upstreams
Routes
- Path
Action
Split
Match
Route
ErrorPage
pass
redirect
return
proxy
delegation
optional
NGINX Ingress Resources – Rich Capabilities
Host
TLS
Policies
Upstreams
Routes
- Path
Policies
Action
Split
Match
Route
ErrorPage
pass
redirect
return
proxy
delegation
VirtualServer
pass
redirect
return
proxy
pass
redirect
return
proxy
Host
Upstreams
Subroutes
- Path
Policies
Action
Split
Match
ErrorPage
pass
redirect
return
proxy
VirtualServerRoute
NGINX server configuration
NGINX http configuration
Server and HTTP snippets
NGINX location configuration
Location snippets
Policies
Access Control
Rate Limiting
Auth (JWT, OIDC)
MTLS (Ingress/Egress)
App Protect WAF

24. | ©2021 F5
24
Conditional Routing
Split Routing
Error Pages
Rate Limiting
Authentication
Web Application Firewall
NGINX Snippets
Multiple versions, multiple clients
A|B Testing for safe production deployment
Implement ‘Circuit Breakers’ to contain failures
Protect vulnerable apps, limit greedy clients
Offload identity checking from apps and centralize
Protect from known and unknown vulnerabilities
“to-the-metal” with NGINX configuration
Spotlight on Use Cases

25. | ©2021 F5
25
NGINX Ingress Resources – Distributed Configuration

26. | ©2021 F5
26
NGINX Ingress Resources – Distributed Configuration
NetOps DevOps-FE
DevOps-NG
Identity
DevSecOps

27. | ©2021 F5
27
… but many operational challenges
happen within the application

28. | ©2021 F5
28
Do you use a Service Mesh in production?
1. No, and I’m not planning to use one yet
2. No, but I’m actively evaluating
3. Yes – Istio in production
4. Yes – a different mesh in prod. (perhaps share in the comments)
5. Don’t know

29. | ©2021 F5
29
Where does a Service Mesh fit in?
Users
Ingress
Controller
“North-South” traffic
“East-West” traffic

30. | ©2021 F5
30
What Is A Service Mesh?
WHAT’S MISSING IN K8S AND WHAT DO YOU REALLY WANT AND NEED FROM A MESH?
Service mesh aims to improve application
traffic control, observability and security for
distributed systems.
- The New Stack

31. | ©2021 F5
31
Service Mesh controls communications between pods and external apps
What Does A Service Mesh Do?
Secure Traffic
End-to-end encryption (Mutual TLS / mTLS), ACLs
Manage All Service Traffic
Load Balance, Circuit breaker, B|G, Rate Limiting…
Orchestration
Injection and sidecar management, K8s API integration
Measure Traffic
Generate transaction traces and real-time monitoring

32. | ©2021 F5
32
NGINX Service Mesh Components
• NGINX Service Mesh runs within a K8s cluster
• Securely manages ingress/egress traffic to
external services
• Can be deployed in any K8s cluster platform

33. | ©2021 F5
33
Mutual TLS
Instrumentation
Tracing
Rate Limiting
Traffic Splitting
Access Control
Egress Control
Secure traffic in a zero-trust network
Monitor performance, latency and availability
Debug transactions and locate faults
Protect vulnerable apps, limit greedy clients
Implement A|B, Canary and Blue-Green upgrades
Implement allow-lists to accurately govern traffic
Manage and broker traffic to external services
Spotlight on Use Cases

34. | ©2021 F5
34
ü You have a mature, fully-automated CI/CD pipeline (GitOps-enabled)
ü You are fully invested in microservices and using Kubernetes
ü You are deploying frequently to production (at least once per day)
ü You have a zero-trust production environment (so need mTLS)
ü You need/want additional visibility of container traffic interaction
When Am I Ready For A Service Mesh?

35. | ©2021 F5
35
Review

36. | ©2021 F5
36
What have we learnt?
Microservices is a journey, not a destination.
Begin when the need to iterate and improve is high
The technology choice will take you down the path of Containers and Kubernetes
It’s a long journey, with separate paths for development and operations
The key to a production-ready service is the ability to control the dataplane.
To find out more, join NGINX on our Microservices March journey!

37. | ©2021 F5
37
Where to find out more?
bit.ly/microservices-march