Control Kubernetes Ingress and Egress Together with NGINX

On-Demand Recording
https://www.nginx.com/resources/webinars/control-kubernetes-ingress-egress-together-nginx/

About the Webinar
Join our resident Kubernetes and modern apps experts in a discussion of the challenges of Kubernetes traffic management in today’s technology landscape. While Kubernetes Ingress gets most of the attention, how you handle egress traffic is just as important. Egress isn’t just about traffic leaving a cluster, either, but also concerns traffic among managed and unmanaged services within the cluster. We demo a solution using NGINX Service Mesh and NGINX Ingress Controller to control egress from the cluster and between NGINX Service Mesh and unmanaged services. Whether you’re new to modern application architectures, or looking to improve your current microservices deployment, this webinar is for you.

Speakers:
Amir Rawdat
Technical Marketing Engineer
F5

Faisal Memon
Software Engineer
F5

1. Control Ingress and Egress traffic in Kubernetes with NGINX
Amir Rawdat
Technical Marketing Engineer, NGINX
Faisal Memon
Software Engineer, NGINX

2. | ©2020 F52
Agenda
•Common challenges with managing traffic inside Kubernetes
•Controlling ingress/egreestraffic with a single configuration
•Choosing the right solution depending on your requirements
•Live demo
•Q&A

3. | ©2020 F53
Kubernetes becoming platform
for developing, testing and
running applications
Applications are becoming ephemeral by
nature
This brings limitations to Layer 4 Kubernetes
Networking
NGINX provides L5-7 networking policies as
an alternative to IP addresses
Cybersecurity is an ever-
growing, ever-complicating field
Traditional firewalls and anti virus security is
irrelevant or obsolete.
Data breaches on the rise and will continue
to rise throughout 2021.
What we see in the market
KUBERNETES-CENTRIC PERSPECTIVE
SOURCE: INFORMATION EXAMPLE
Adoption of managed and
commercial Kubernetes platforms
We see rapid adoption of OpenShift and
Rancher in the private cloud space
EKS and GKE adoption in public cloud

4. | ©2020 F54
MY FAVORITE ARTICLE TITLESBut K8s Adoption Brings Complexity
“Let’s Use
Kubernetes!”Now
You Have 8
Problems”
”Will Complexity
Kill Kubernetes?”
“Has Kubernetes
Already Become To
Unnecessarily
Complex for
Enterprise IT?”
”Why Kubernetes Networking Is Hard –And What
You Can Do About It”

5. | ©2020 F55
WHAT’S MISSING IN K8S AND WHAT DO YOU REALLY WANT AND NEED FROM A MESH?Networking: K8s, L4-L7
•K8s, and CNI, provides L4 servicing –IP endpoints
•Many, complex options
•https://kubernetes.io/docs/concepts/cluster-administration/networking/
•L7 Traffic Management is missing
•Policy-based routing
•Service-level access control
•SSL/mTLSenforcement
•Integrated Ingress/Egress
•Enter: KIC + Service Mesh –Taking control of Kubernetes networking

6. | ©2020 F56
Controlling ingress/egress traffic with NGINX KIC + Service Mesh
CONFIDENTIAL

7. | ©2020 F57
Integrated N/S Ingress/Egress
•N/S as a core feature
•Ingress/egress traffic treated as S2S
service traffic
•Full integration with service IdPand
SSL key store
•mTLSfor ingress/egress
•Egress name service support
•Egress opt-in allowlist
•Sidecar ”default route” to Ingress
Controller

8. | ©2020 F58
apiVersion: k8s.nginx.org/v1alpha1
kind: Policy
metadata:
name: egress-mtls-policy
spec:
egressMTLS:
tlsSecret: egress-mtls-secret
trustedCertSecret: egress-trusted-ca-secret
verifyServer: on
serverName: on
sslName: secure-app.example.com
apiVersion: k8s.nginx.org/v1alpha1
kind: Policy
metadata:
name: ingress-mtls-policy
spec:
ingressMTLS:
clientCertSecret: ingress-mtls-secret
verifyClient: "on"
verifyDepth: 1
Ingress/Egress mTLS (KIC)
POLICIES

9. | ©2020 F59
apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
name: app
spec:
host: app.example.com
...
policies:
-name: ingress-mtls-policy-cafe
-name: egress-mtls-policy-cafe
VIRTUALSERVERApplying Ingress/Egress policies to the IC

10. | ©2020 F510
apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
name: app
spec:
host: app.example.com
upstreams:
-name: app
service: app-svc
port: 80
routes:
-path: /
action:
proxy:
upstream: app
requestHeaders:
pass: true
set:
-name: Content-Type
value: application/json
VIRTUALSERVERApplying Ingress HTTP header manipulation

11. | ©2020 F511
apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
name: app
spec:
host: app.example.com
upstreams:
-name: app
service: app-svc
port: 80
routes:
-path: /
action:
proxy:
upstream: app
responseHeaders:
add:
-name: Access-Control-Allow-Origin
value: "*"
always: true
hide:
-x-internal-version
ignore:
-Expires
-Set-Cookie
VIRTUALSERVERApplying Egress HTTP header manipulation

12. | ©2020 F512
Advanced App Centric Configuration
Confidential –Do Not
Distribute

13. | ©2020 F513
Data PlaneControl Plane

14. | ©2020 F514
Bookinfo demo
Confidential –Do Not
Distribute

15. | ©2020 F521
§Download NGINX Service Mesh for free --https://downloads.f5.com
§Get Started with the NGINX Ingress Controller --
https://github.com/nginxinc/kubernetes-ingress
§Get a free trial of NGINX Plus Ingress Controller --https://www.nginx.com/free-trial-
request-nginx-ingress-controller/
Get Started Today !!

16. Q&A
Contact Us:
Amir Rawdat: [email protected]
NGINX: [email protected]