Move Auth, Policy, and Resilience to the Platform

1 | Copyright © 2022
Reducing Developer Overload:
Moving Auth, Policy, and Resilience to the Platform

CHRISTIAN POSTA
VP, Global Field CTO, Solo.io
@christianposta
christian@solo.io
/in/ceposta

https://solo.io

Digital Experiences… Driven by APIs and Services

Silos - Conway’s Law

“Ticket Ops” to Drive Changes to APIs and Services

Platform Engineering
● Cross functional team
● Infrastructure integration
● Golden paths for delivery
● Internal Dev Portals
● Tenancy for teams
Platform engineering:
● Accelerate business value
● Improve efficiencies
● Increase compliance
● Reduce costs/lockin
Platform engineering outcomes:

You don’t start with pipes, electrical, doors
and locks, but eventually you need them.

Internal Developer Platforms are like a House

● Kubernetes / containers
● Microservices architecture
● Public cloud
● CI / CD / ArgoCD / GitOps
● Platform orchestration
● Metric collection
(CPU, Network, Memory)
Foundations

Platform Strategy

T-Mobile: 25% of time spent on non-functional reqs;
75% incidents caused by network misconfiguration

The platform is not ﬁnished.
We need to modernize networking.

Outdated Assumptions and Network Control

Policy Bit Rot

Inefficiencies and Bottlenecks

Build it into the Code!

JWT Unravels your API Gateway!

● Distributed implementation
● Declarative configuration
● Standard interfaces/integration
● Dynamic configuration
● Fine-grained, request-level auth/rate limit/policy
enforcement
● Traffic control, circuit breaking, routing
● Metrics, logging, distributed tracing
Modern Networking Needs for Internal Dev Platform

The House is not Finished!

Finishing the house

You need Plumbing, Electrical, Locks on Doors, etc

Modern Networking Solves Auth, Policy, Resilience
● Locks on doors
○ zero-trust, workload/request authentication,
authorization, policy enforcement
● Air conditioning / thermostat
○ load balancing, timeouts, retries, circuit breaking
● Electrical / Piping
○ traffic control, load balancing, routing
● CO, fire, smoke detectors, cameras
○ metrics, distributed tracing, logging

Application Networking

Istio Service Mesh
https://istio.io
● mTLS, mutual authentication,
encryption
● Network, L7 observability
● Traffic control, resilience, failover
● Blue-green, canary release
● Driven by declarative configuration

Improve
Performance
Simplify
Operations
Cost
Reduction
https://istio.io/latest/blog/2022/introducing-ambient-mesh/
Istio Ambient Mode
A sidecar-less implementation of Istio Service Mesh
Production ready as of Istio 1.22 (May 2024)

Demo

Istio Ambient Mode
Pure L4 mode only, no L7

Istio Ambient Mode

Istio Ambient Mode
L7 goes through “waypoint” proxy, in the network;
L7 policies (retry, traffic splitting, canary, fine-grained authz, etc) applied here.

Istio Ambient Mode
L7 goes through “waypoint” proxy (Envoy), in the network;
Deploy multiple replicas of proxy for traffic sizing, high availability, etc.

Service Mesh For Less!

Istio Ambient Mode
https://bit.ly/ambient-book

Auth, Policy, and Resilience

Location
Singapore
Revenue
Approaching $1B
Digital Banking
Industry
From Zero to 4th Largest Bank in
Singapore within 2 Years Requires Trust
CASE STUDY
A Joint Venture between a Top 3 Bank in the UK
(Operating in Asia) and Singapore Largest Loyalty
Program launched one of Singapore’s first Digital Native
Banks. The ambitious growth goals for the bank meant
there was no time to waste selecting the technologies
that would underpin the business.
Regulators in Singapore keep strong standards on
financial institutions, including the need to maintain a
99.95% uptime or greater as well as ensuring strong
security across the banks infrastructure.
With the help of Solo.io and Gloo, the bank was able to
onboard 100K customers in the first 10 days of operating
Business Goals
Key tenants of the modernization initiative:
● Unified Stack - From Identity to Mesh, to CNI
and GraphQL
● Multi-Cluster Orchestration
● GitOps deployments
● Event-Driven, Real Time Architecture
Region
APJ
Benchmark Scale
● 100% Containerized
● 9 EKS Clusters in
Production
● 400 to 600 Concurrent
Pods During Peak
Processing
● Mandate to meet 99.95%
Uptime
Customer Growth
100K
First 10
Days
450K
First 5
Months
1M+
Today
Differentiators
● Single Solution providing
significant cost savings
through consolidation of
disparate tools
● Multi-Cluster Mesh Enables
transparent failover and
ability to treat EKS clusters
as “cattle”
● Unified Stack allows Bank to
implement a trust “Defense
in Depth” model from
Identity to Network Policy
Competition

Workload Identity and Authentication

Secure Production Identity Framework (for Everyone)
• Intended to solve the “universal workload identity problem”
• Independent of application type, network, or platform/cloud
• Specified with URI strings
• Verified via signed credentials (x509, JWT, etc)
• API and workflow for attestation built into SPIFFE
implementations
• Intended to eliminate passwords, other secrets, etc

Who is Service A?

Identity for Workloads

Network Policy Based on Stable Workload Identity
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: allow-traffic-between-workloads
namespace: your-namespace
spec:
selector:
matchLabels:
app: your-app
action: ALLOW
rules:
- from:
- source:
principals:
["cluster.local/ns/your-namespace/sa/first-service-account"]
to:
- operation:
principals:
["spiffe://example.org/ns/your-namespace/sa/second-service-account"]

Demo

IstioCon (2023)

Traffic Control
Powerful load balancing
IN THE NETWORK
● Fine-grained, request-based load
balancing
● Region/Zone/Subset aware load
balancing
● Retry/Timeout/Circuit breaker
● % based trafﬁc splitting
● Header based trafﬁc splitting

Global Routing / Failover

Circuit Breaker - Degrade gracefully when services are
overwhelmed

Demo

Tying it all together

Offload Auth, Policy, and Resilience to the Platform!

● Get code into production, safely!
● Increasing the release safety and velocity with:
○ High availability
○ Global routing
○ Failover
○ Resiliency
■ either planned, unplanned
■ migrations, re-deployments
● Canary releasing, blue/green, A/B testing
● Reducing MTTR
○ Metrics, distributed tracing, logging
● Reduce change failure rate
Accelerating Business Value

● Declarative configuration fits IaC automation, tenancy
● Better resource utilization / scale
● Eliminate silos, reduce ticket ops, reduce UI click Ops
● Reduce dependencies on other teams (self service)
● Teams to focus on business logic not complexity of networking
● Integrations with standard interfaces
● Reduce reliance on large proprietary vendor stacks with heavy
license fees
● Smart traffic, networking control for zonal, region, data center
networking costs
Improve Efficiency, Reduce Costs

● Zero trust network
○ Encryption, authentication, authorization
○ Central requirements for PCI-DSS, HIPPA, GDPR, etc
● Eliminate bespoke code for security, routing, load balancing
○ Especially across multiple languages, frameworks, etc
○ Easier to audit and understand
● Eliminate centralized bottlenecks, UI clicking, and
● Drive everything through Git so it’s trackable and auditable
● Organizational policy enforcement based on durable workload ID
○ Not ephemeral IP addresses or network segments
Increase Compliance

Resources
● https://istio.io
● https://envoyproxy.io
● https://academy.solo.io
● See QR codes in slides!

Please Reach Out!
VP, Global Field CTO, Solo.io
@christianposta
christian@solo.io
/in/ceposta

Location
Singapore
Revenue
Approaching $1B
Digital Banking
Industry
From Zero to 4th Largest Bank in
Singapore within 2 Years Requires Trust
CASE STUDY
A Joint Venture between a Top 3 Bank in the UK
(Operating in Asia) and Singapore Largest Loyalty
Program launched one of Singapore’s first Digital Native
Banks. The ambitious growth goals for the bank meant
there was no time to waste selecting the technologies
that would underpin the business.
Regulators in Singapore keep strong standards on
financial institutions, including the need to maintain a
99.95% uptime or greater as well as ensuring strong
security across the banks infrastructure.
With the help of Solo.io and Gloo, the bank was able to
onboard 100K customers in the first 10 days of operating
Business Goals
Key tenants of the modernization initiative:
● Unified Stack - From Identity to Mesh, to CNI
and GraphQL
● Multi-Cluster Orchestration
● GitOps deployments
● Event-Driven, Real Time Architecture
Region
APJ
Benchmark Scale
● 100% Containerized
● 9 EKS Clusters in
Production
● 400 to 600 Concurrent
Pods During Peak
Processing
● Mandate to meet 99.95%
Uptime
Customer Growth
100K
First 10
Days
450K
First 5
Months
1M+
Today
Differentiators
● Single Solution providing
significant cost savings
through consolidation of
disparate tools
● Multi-Cluster Mesh Enables
transparent failover and
ability to treat EKS clusters
as “cattle”
● Unified Stack allows Bank to
implement a trust “Defense
in Depth” model from
Identity to Network Policy
Competition

API Management at Google

Massive outage

Optimize Proxy Placement

Move Auth, Policy, and Resilience to the Platform

Recommended

Recommended

More Related Content

Similar to Move Auth, Policy, and Resilience to the Platform

Similar to Move Auth, Policy, and Resilience to the Platform (20)

More from Christian Posta

More from Christian Posta (20)

Recently uploaded

Recently uploaded (20)

Move Auth, Policy, and Resilience to the Platform