In distributed system architectures, a service mesh can help to make service communication more secure, reliable, and traceable. Along with the service mesh concept we may often think of concepts like microservices, containers or Kubernetes. Moreover, a modern service mesh also offers to integrate legacy workloads, for example on VMs. Even more so, it is possible to define a service mesh in such a way that it spans across multiple clusters or networks, e.g. in a multi-cloud setup, or in a mix of on-premises and cloud. A service mesh, however, possesses even more capabilities such as observability and security. This session will focus on these areas and how in today's heterogeneous world a service mesh can help to address complex challenges here. Scenarios from real-world projects will be presented and individual aspects will be highlighted in a demo.

1. © OPITZ CONSULTING 2023 / Öffentlich
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 1
Berlin, 2023-06-13
Philipp Kürsten,
Fabian Hardt
ADVANCED OBSERVABILITY & SECURITY
FOR YOUR KUBERNETES WITH A MODERN SERVICE MESH

2. © OPITZ CONSULTING 2023 / Öffentlich
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 2
WHY SERVICE MESH?
01
KUMA
02
CONCLUSION
04
DEMO
03

3. © OPITZ CONSULTING 2023 / Öffentlich
OPITZ CONSULTING
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 3
„Wir erreichen Kundennähe vor Ort und
durch moderne Delivery-Modelle auch
auf Entfernung!“ Peter Menne, GF
Essen
Bad Homburg
Stuttgart
München
Nürnberg
Gummersbach
Berlin
Hamburg
Kraków

4. © OPITZ CONSULTING 2023 / Öffentlich
MODERN
IT-Modernisierung
„Nachhaltiges Business durch
flexible, dynamikrobuste Lösungen
für die digitale Welt von morgen“
#MEHRWERT
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 4
AUTO-
MATISIERT
SICHER
INTEGRIERT
Security
„Sichere IT-Lösungen und
Infrastrukturen als Basis für
Geschäftsmodelle in
dynamischen Märkten“
Systemintegration
„Eine integrierte IT-Landschaft
als Grundlage für ein
#ZUKUNFTSWIRKSAMES
Business“
Intelligent Automation
„Effizienterer Ressourceneinsatz
durch die Automatisierung von
Business-Prozessen mit dem
Einsatz von KI-Technologien“

5. © OPITZ CONSULTING 2023 / Öffentlich
#TECHNOLOGIE & KOMPETENZEN
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 5
CONSULTING
nachhaltig-langfristig-
erfolgreich
APPLICATIONS
innovativ-herausragend-
benutzerfreundlich
INTEGRATION
flexibel-automatisiert-
performt
ANALYTICS
smart-intelligent-
verlässlich
INFRASTRUCTURE
cloud-hybrid-
elastisch
CHANGE
nachhaltig-achtsam-
verbindlich
 Serverless Microservices
 DevOps
 Modernisierung
 Entkopplung
 API first
 Bi-Modal
 UX-Design
 Lifecycle
 Cloud Based Integration
 Sensor Data
 IoT / Industrie 4.0
 API-Management
 Integration Third Party Apps
 Process Integration
 Application Integration
 Data Lakes
 Big Data & Fast Data
 AI & Machine Learning
 Intelligent Automation
 Analytics für IoT
 Data Labs
 Data Governance
 Open Data
 Hybride Architekturen
 Infrastructure as Code
 Cloud Consumption
 Multi-Cloud Management
 Sicherheit der Cloud
 Shared Cloud Services
 Compliance
 Managed Services
 Vision & Sinn
 Rolle und Identität
 Werte & Glaubenssätze
 Umwelt
 Fähigkeiten und
Verhalten
 Culture Gardening
 Digital Awareness
 Digitalisierungsstrategie
 Digitale Transformation
 Innovation
 Digitale Roadmap
 Governance
 Lizenzberatung
DIGITALE PLATTFORM
basierend auf dynamikrobusten Architekturen der Digitalisierung
Künstliche Intelligenz mit dem Fokus auf Automatisierung & Entscheidungsvorbereitung

6. © OPITZ CONSULTING 2023 / Öffentlich
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 6
WHY SERVICE MESH?
01

7. © OPITZ CONSULTING 2023 / Öffentlich
TREND TOWARDS DISTRIBUTED APPLICATION ARCHITECTURES
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 7
Centralized
STATIC
ON-PREM
MONOLITH
VIRTUAL MACHINES
MANUAL CHANGE PROCESS
Decentralized
DYNAMIC
CLOUD / MULTI-CLOUD
MICROSERVICES / SERVERLESS
CONTAINERS, KUBERNETES
AUTOMATED CI/CD TOOL CHAIN
# Services & APIs
CONTROL AND VISIBILITY

8. © OPITZ CONSULTING 2023 / Öffentlich
INCREASED COMPLEXITY AND COGNITIVE LOAD ON DEVS
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 8
Security Security
Logging Logging
Security
Tracing
Metrics Routing
Metrics Tracing
Application
AuthN/
Z
Rate-Limiting
Routing
Caching
Organization
Application
AuthN/
Z
Versioning
Versioning
Rate-Limiting

9. © OPITZ CONSULTING 2023 / Öffentlich
WHAT’S A SERVICE MESH?
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 10
 Efficient implementation of cross-cutting
concerns with respect to service integration
challenges
 Everything is a service!
 Cloud-native apps deployed to Kubernetes
 Non Cloud-native workloads
 Should be independent of
 Architecture (e.g. Monolithic or µService)
 Platform (e.g. VMs, Containers, Kubernetes)
Dedicated infrastructure layer that makes
service-to-service communication more
reliable, secure and observable

10. © OPITZ CONSULTING 2023 / Öffentlich
E2E SERVICE CONNECTIVITY WITH GATEWAY AND MESH
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 12
 Increased Developer experience
 Consistent security
 Seamless observability
 Reliable connectivity
 Resilience
 Flexibility
GW DP
CLIENT
PUBLIC TRAFFIC
GW DP
MESH CP
MESH 1 MESH 2

11. © OPITZ CONSULTING 2023 / Öffentlich
SERVICE-MESH IMPLEMENTATIONS
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 13
 Kuma
 Istio
 Consul
 Linkerd
 GlooMesh

12. © OPITZ CONSULTING 2023 / Öffentlich
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 14
KUMA
02

13. © OPITZ CONSULTING 2023 / Öffentlich
KUMA INTRODUCTION
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 15
 Initially invented by Kong and donated to CNCF in 2020
 Provides a modern distributed Control Plane
 Completely Envoy-based Data Plane proxies
 Platform agnostic open-source control plane for Service Mesh
 Hence Kuma is
 Universal
 Simple
 Scalable
 Flexible deployment options
 Standalone deployment
 Multi-Zone deployment
Source: https://tinyurl.com/xb57bhx5

14. © OPITZ CONSULTING 2023 / Öffentlich
KUMA STANDALONE ARCHITECTURE
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 16

15. © OPITZ CONSULTING 2023 / Öffentlich
KUMA MULTI-CLUSTER ARCHITECTURE
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 17
 One mesh can be deployed over multiple clusters (=> Zone)
 All traffic enters cluster over zone ingress
 One Remote (Zone) Control Plane in each cluster

16. © OPITZ CONSULTING 2023 / Öffentlich
KUMA NETWORKING / CNI
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 18
 Installed as DaemonSet on all Nodes
 Injects label on Pods - k8s.v1.cni.cncf.io/networks: kuma-cni
 CNI enables Transparent Proxying – redirects all traffic through Data Plane

17. © OPITZ CONSULTING 2023 / Öffentlich
KUMA NETWORKING / INIT-CONTAINER
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 19
 Injected to Pod and started individually before Data Plane
 Configures iptables / network routing

18. © OPITZ CONSULTING 2023 / Öffentlich
SERVICE MESH DNS
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 20
 Local DNS resolution directly in Data Plane (Envoy)
 Names are not resolvable in complete cluster, just inside service mesh (Envoy)
 Resolves “.mesh“ address to pre-defined service mesh IP address
 IP in other zone / cluster is routed over Kuma Zone Ingress

19. © OPITZ CONSULTING 2023 / Öffentlich
ZONE EGRESS
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 21
 Special Data Plane instance – like Zone Ingress
 All outgoing traffic is routed through this instance
 Usage of External Services just possible with deployed Zone Egress in the future

20. © OPITZ CONSULTING 2023 / Öffentlich
INTEGRATION OF LEGACY WORKLOAD
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 22
 Integration of vm and bare metal workload
 Local Data Plane instance connecting to Control Plane
 Seamless and secure commuication between vm and Kubernetes workload

21. © OPITZ CONSULTING 2023 / Öffentlich
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 23
DEMO
03

22. © OPITZ CONSULTING 2023 / Öffentlich
ARCHITECTURE OVERVIEW
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 24

23. © OPITZ CONSULTING 2023 / Öffentlich
ANALYZING AND MONITORING THE DATA
Advanced Observability & Security for your Kubernetes with a modern Service Mesh
 Using Grafana Stack to create a 360-degree view
 Component usage:
 Visualization: Grafana
 Logging: Loki (Log Shipping: FluentD / FluentBit / Promtail)
 Metrics: Prometheus
 Tracing: Jaeger or Tempo
 Alerting: Prometheus Alert Manager
 Operating models
 Self-managed (e.g. on-prem)
 Grafana SaaS offering
25

24. © OPITZ CONSULTING 2023 / Öffentlich
ARCHITECTURE OBSERVABILITY
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 26

25. © OPITZ CONSULTING 2023 / Öffentlich
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 27
DEMO

26. © OPITZ CONSULTING 2023 / Öffentlich
ASPECTS COVERED
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 28
 Mesh Management (Kuma UI)
 Managing Apps within the Mesh
 Locality Awareness
 Advanced Routing
 Security
 Mesh observability
 Metrics
 Logs
 Traces

27. © OPITZ CONSULTING 2023 / Öffentlich
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 29
CONCLUSION
04

28. © OPITZ CONSULTING 2023 / Öffentlich
SERVICE MESH BENEFITS
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 30
 Zero-trust security
 mTLS, Traffic Permissions
 Increased Developers productivity
 Crosscutting concerns (AuthN & AuthZ, …)
 Self-service network management
 Multi-Tenancy over multiple clouds
 Reliable connectivity
 Circuit Breaker, Traffic Routes, …
 Observability
 Metrics, Tracing, Logs

29. © OPITZ CONSULTING 2023 / Öffentlich
KEY TAKEAWAYS
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 31
 Service Mesh is essential to build and managing multi-cloud apps efficiently
 Kuma as mesh implementation provides
 Agnostic approach (independent of architecture or platform)
 Modern, flexible architecture supporting hybrid, multi-cloud scenarios
 Multi-zone
 Multi-cluster
 Multi-mesh
 Seamless CI / CD integration (GitOps)
 Intuitive design
 Spanning a mesh over multiple clusters and clouds can be done easily

30. © OPITZ CONSULTING 2023 / Öffentlich
MATERIALS
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 32
 Demo Source: https://github.com/KongChampions/kuma-multi-zone-mesh
 Kuma docs: https://kuma.io/docs/2.2.x/
 Kuma Counter Demo: https://github.com/kumahq/kuma-counter-demo
 Kuma introduction – Meetup recording “Service integration made easy with OpenSource Kuma”:
https://www.youtube.com/watch?v=f3GeuKzYrsA&t=1s
 Demo “Service integration made easy with OpenSource Kuma”:
https://github.com/svenbernhardt/service-integration-made-easy
 Kong / Kuma and friends (k3d)– https://github.com/FabianHardt/k3d-bootstrap-cluster

31. © OPITZ CONSULTING 2023 / Öffentlich
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 33
Q & A
https://opitzcloud.canto.global/b/H0EMG

32. © OPITZ CONSULTING 2023 / Öffentlich
Advanced Observability & Security for your Kubernetes with a modern Service Mesh 34
www.opitz-consulting.com
KONTAKT
Philipp Kürsten
Senior Consultant
Philipp.Kürsten@opitz-consulting.com
+49 173 7279570
https://www.xing.com/profile/Philipp_Kuersten/
https://www.linkedin.com/in/philipp-kuersten/
Fabian Hardt
Solution Architect
Fabian.Hardt@opitz-consulting.com
https://twitter.com/fabian_hardt
https://www.xing.com/profile/Fabian_Hardt
https://www.linkedin.com/in/fabian-hardt/