On-Demand Recording https://www.nginx.com/resources/webinars/control-kubernetes-ingress-egress-together-nginx/ About the Webinar Join our resident Kubernetes and modern apps experts in a discussion of the challenges of Kubernetes traffic management in today’s technology landscape. While Kubernetes Ingress gets most of the attention, how you handle egress traffic is just as important. Egress isn’t just about traffic leaving a cluster, either, but also concerns traffic among managed and unmanaged services within the cluster. We demo a solution using NGINX Service Mesh and NGINX Ingress Controller to control egress from the cluster and between NGINX Service Mesh and unmanaged services. Whether you’re new to modern application architectures, or looking to improve your current microservices deployment, this webinar is for you. Speakers: Amir Rawdat Technical Marketing Engineer F5 Faisal Memon Software Engineer F5

1. Control Ingress
and Egress traffic
in Kubernetes with
NGINX
Amir Rawdat
Technical Marketing Engineer, NGINX
Faisal Memon
Software Engineer, NGINX

2. | ©2020 F5
2
Agenda
• Common challenges with managing traffic inside Kubernetes
• Controlling ingress/egrees traffic with a single configuration
• Choosing the right solution depending on your requirements
• Live demo
• Q&A

3. | ©2020 F5
3
Kubernetes becoming platform
for developing, testing and
running applications
Applications are becoming ephemeral by
nature
This brings limitations to Layer 4 Kubernetes
Networking
NGINX provides L5-7 networking policies as
an alternative to IP addresses
Cybersecurity is an ever-
growing, ever-complicating field
Traditional firewalls and anti virus security is
irrelevant or obsolete.
Data breaches on the rise and will continue
to rise throughout 2021.
What we see in the market
KUBERNETES-CENTRIC PERSPECTIVE
SOURCE: INFORMATION EXAMPLE
Adoption of managed and
commercial Kubernetes platforms
We see rapid adoption of OpenShift and
Rancher in the private cloud space
EKS and GKE adoption in public cloud

4. | ©2020 F5
4
MY FAVORITE ARTICLE TITLES
But K8s Adoption Brings Complexity
“Let’s Use
Kubernetes!”Now
You Have 8
Problems”
”Will Complexity
Kill Kubernetes?”
“Has Kubernetes
Already Become To
Unnecessarily
Complex for
Enterprise IT?”
”Why Kubernetes Networking Is Hard – And What
You Can Do About It”

5. | ©2020 F5
5
WHAT’S MISSING IN K8S AND WHAT DO YOU REALLY WANT AND NEED FROM A MESH?
Networking: K8s, L4-L7
• K8s, and CNI, provides L4 servicing – IP endpoints
• Many, complex options
• https://kubernetes.io/docs/concepts/cluster-administration/networking/
• L7 Traffic Management is missing
• Policy-based routing
• Service-level access control
• SSL/mTLS enforcement
• Integrated Ingress/Egress
• Enter: KIC + Service Mesh – Taking control of Kubernetes networking

6. | ©2020 F5
6
Controlling ingress/egress
traffic with NGINX KIC +
Service Mesh
CONFIDENTIAL

7. | ©2020 F5
7
Integrated N/S Ingress/Egress
• N/S as a core feature
• Ingress/egress traffic treated as S2S
service traffic
• Full integration with service IdP and
SSL key store
• mTLS for ingress/egress
• Egress name service support
• Egress opt-in allowlist
• Sidecar ”default route” to Ingress
Controller

8. | ©2020 F5
8
apiVersion: k8s.nginx.org/v1alpha1
kind: Policy
metadata:
name: egress-mtls-policy
spec:
egressMTLS:
tlsSecret: egress-mtls-secret
trustedCertSecret: egress-trusted-ca-secret
verifyServer: on
serverName: on
sslName: secure-app.example.com
apiVersion: k8s.nginx.org/v1alpha1
kind: Policy
metadata:
name: ingress-mtls-policy
spec:
ingressMTLS:
clientCertSecret: ingress-mtls-secret
verifyClient: "on"
verifyDepth: 1
Ingress/Egress mTLS (KIC)
POLICIES

9. | ©2020 F5
9
apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
name: app
spec:
host: app.example.com
...
policies:
-name: ingress-mtls-policy-cafe
-name: egress-mtls-policy-cafe
VIRTUALSERVER
Applying Ingress/Egress policies to the IC

10. | ©2020 F5
10
apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
name: app
spec:
host: app.example.com
upstreams:
- name: app
service: app-svc
port: 80
routes:
- path: /
action:
proxy:
upstream: app
requestHeaders:
pass: true
set:
- name: Content-Type
value: application/json
VIRTUALSERVER
Applying Ingress HTTP header manipulation

11. | ©2020 F5
11
apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
name: app
spec:
host: app.example.com
upstreams:
- name: app
service: app-svc
port: 80
routes:
- path: /
action:
proxy:
upstream: app
responseHeaders:
add:
- name: Access-Control-Allow-Origin
value: "*"
always: true
hide:
- x-internal-version
ignore:
- Expires
- Set-Cookie
VIRTUALSERVER
Applying Egress HTTP header manipulation

12. | ©2020 F5
12
Advanced App Centric Configuration
Confidential – Do Not
Distribute

13. | ©2020 F5
13
Data Plane
Control Plane

14. | ©2020 F5
14
Bookinfo demo
Confidential – Do Not
Distribute

15. | ©2020 F5
21
§ Download NGINX Service Mesh for free -- https://downloads.f5.com
§ Get Started with the NGINX Ingress Controller --
https://github.com/nginxinc/kubernetes-ingress
§ Get a free trial of NGINX Plus Ingress Controller -- https://www.nginx.com/free-trial-
request-nginx-ingress-controller/
Get Started Today !!

16. Q&A
Contact Us:
Amir Rawdat: a.rawdat@f5.com
NGINX: sales@nginx.com