Control Kubernetes Ingress and Egress Together with NGINX

Join our resident Kubernetes and modern apps experts in a discussion of the challenges of Kubernetes traffic management in today’s technology landscape. While Kubernetes Ingress gets most of the attention, how you handle egress traffic is just as important. Egress isn’t just about traffic leaving a cluster, either, but also concerns traffic among managed and unmanaged services within the cluster. We demo a solution using NGINX Service Mesh and NGINX Ingress Controller to control egress from the cluster and between NGINX Service Mesh and unmanaged services. Whether you’re new to modern application architectures, or looking to improve your current microservices deployment, this webinar is for you.

Join this webinar to learn:

* Solutions to common challenges when managing traffic in Kubernetes
* How to control both ingress and egress in a single configuration
* Which solutions from NGINX can best serve your needs, depending on your requirements
* About NGINX Service Mesh and NGINX Ingress Controller with live demos

1. Control Ingress and Egress traffic in Kubernetes with NGINX Amir Rawdat Technical Marketing Engineer, NGINX

2. Agenda Common challenges with managing traffic inside Kubernetes Moving away from annotations with NGINX Ingress Resources Enhancing troubleshooting and logging Controlling ingress/ egrees traffic with a single configuration Enabling agile deployments and maintaining uptime Going even further with NGINX Service Mesh Q&A

3. Kubernetes becoming platform for developing, testing and running applications  Applications are becoming ephemeral by nature This brings limitations to Layer 4 Kubernetes Networking NGINX provides L5-7 networking policies as an alternative to IP addresses  Cybersecurity is an ever-growing, ever-complicating field Traditional firewalls and anti virus security is irrelevant or obsolete. Data breaches on the rise and will continue to rise throughout 2021. What we see in the market Kubernetes-centric perspective Source: information Example Adoption of managed and commercial Kubernetes platforms We see rapid adoption of OpenShift and Rancher in the private cloud space EKS and GKE adoption in public cloud

4. My Favorite Article Titles But K8s Adoption Brings Complexity “ Let’s Use Kubernetes!”Now You Have 8 Problems” ”Will Complexity Kill Kubernetes?” “Has Kubernetes Already Become To Unnecessarily Complex for Enterprise IT?” ”Why Kubernetes Networking Is Hard – And What You Can Do About It”

5. What’s missing in K8s and What do you really want and need from a mesh? Networking: K8s, L4-L7 K8s, and CNI, provides L4 servicing – IP endpoints Many, complex options https://kubernetes.io/docs/concepts/cluster-administration/networking/ L7 Traffic Management is missing Policy-based routing Service-level access control SSL/ mTLS enforcement Integrated Ingress/Egress Enter: KIC + Service Mesh – Taking control of Kubernetes networking

6. Controlling ingress/egress traffic with NGINX KIC CONFIDENTIAL

7. Problems with Ingress Resources Confidential – Do Not Distribute Kubernetes Ingress resources are limited to basic SSL/TLS and HTTP load balancing Configuration can be further customized with Annotations, ConfigMaps , and templates Global scoped and not fine grained Very error prone Difficult to pint point validation errors

8. NGINX Ingress Resources Confidential – Do Not Distribute Native Type-Safe Configuration Provides advanced app delivery features with native Kubernetes workflow. Increased modularity and reusability Finer grained multi-tenancy with NGINX cross- namespacing

9. apiVersion : k8s.nginx.org/v1alpha1 kind: Policy metadata:   name: egress- mtls -policy spec:   egressMTLS :     tlsSecret : egress- mtls -secret     trustedCertSecret : egress-trusted-ca-secret     verifyServer : on     serverName : on     sslName : secure-app.example.com        apiVersion : k8s.nginx.org/v1alpha1 kind: Policy metadata:   name: ingress- mtls -policy spec:   ingressMTLS :     clientCertSecret : ingress- mtls -secret     verifyClient : "on"     verifyDepth : 1 Ingress/Egress mTLS (KIC) Policies

10. apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: app
spec:
  host: app.example.com
  ... 
  policies:
    -name: ingress-mtls-policy-cafe
    -name: egress-mtls-policy-cafe      apiVersion : k8s.nginx.org/v1 kind: VirtualServerRoute metadata:   name: app spec:   host: app.example.com   subroutes   -  path: /admin/portal/console      policies:      -  name: ingress- mtls -policy-cafe      -  name: egress- mtls -policy-cafe Applying Ingress/Egress policies to the IC Virtualserver & VirtualServerRoute

11. apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: app
spec:
  host: app.example.com
  upstreams:
  - name: app
    service: app-svc
    port: 80 
  routes:
  - path: /
    action:
      proxy:
        upstream: app
        requestHeaders:
          pass: true
          set:
          - name: Content-Type
            value: application/json  Virtualserver Applying Ingress HTTP header manipulation

12. apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: app
spec:
  host: app.example.com
  upstreams:
  - name: app
    service: app-svc
    port: 80 
  routes:
  - path: /
    action:
      proxy:
        upstream: app 
        responseHeaders:
          add:
          - name: Access-Control-Allow-Origin
            value: "*"
            always: true
          hide:
          - x-internal-version
          ignore:
          - Expires
          - Set-Cookie  Virtualserver Applying Egress HTTP header manipulation

13. Agile Deployments using Sophisticated Routing CONFIDENTIAL

14. CONFIDENTIAL Agile deployments using Advanced Routing Topology

15. kind: VirtualServer metadata:   name: cafe spec:   host: cafe.example.com   upstreams:   - name: app-edge     service: app-edge-svc     port: 80   - name: app-stable     service: app-stable-svc     port: 80   routes:   - path: /     matches:     - conditions:       - cookie: session         value: suxxis-12hs6dds-dhfgry-ssss       action:         pass: app-edge     action:       pass: app-stable CONFIDENTIAL Debug Routing Virtualserver

16. kind: VirtualServer metadata:   name: cafe spec:   host: app.example.com   upstreams:   - name: products-v2     service: products-v2-svc     port: 80   - name: products-v1     service: products-v1-svc     port: 80   routes:   - path: /products     splits:     - weight: 90       action:         pass: products-v1     - weight: 10       action:         pass: products-v2 CONFIDENTIAL A/B testing and Blue-Green Deployments Virtualserver

17. Protecting your Kubernetes Apps from Vulnerabilities and Attacks CONFIDENTIAL

18. Consolidating the NGINX Ingress Controller with a battle tested WAF  Configuration is fully managed by the Kubernetes API Leverage Kubernetes RBAC to securely delegate WAF configurations to a dedicated DevSecOps team  Block unrecognized threats with user defined signatures WAF CONFIDENTIAL Blocking Threats with NGINX App Protect

19. CONFIDENTIAL Blocking Threats with NGINX App Protect Secure perimeter for your applications in Kubernetes

20. Advanced App Centric Configuration Confidential – Do Not Distribute

21. Going Even Further with NGINX Service Mesh CONFIDENTIAL

22. Data Plane Control Plane

23. Bookinfo demo Confidential – Do Not Distribute

24. What Does A Service Mesh Do? Service Mesh controls communications between pods and external apps Secure Traffic End-to-end encryption (Mutual TLS / mTLS ), ACLs Manage All Service Traffic Load Balance, Circuit breaker, B|G, Rate Limiting… Orchestration Injection and sidecar management, K8s API integration Measure Traffic Generate transaction traces and real-time monitoring

25. When Am I Ready For A Service Mesh? You have a mature, fully-automated CI/CD pipeline ( GitOps -enabled) You are fully invested in Kubernetes You are deploying frequently to production (at least once per day) You have a zero-trust production environment (so need mTLS ) You need/want additional visibility of container traffic interaction

26. Get Started with the NGINX Ingress Controller --  https://github.com/nginxinc/kubernetes-ingress Get a free trial of NGINX Plus Ingress Controller --  https://www.nginx.com/free-trial-request-nginx-ingress-controller/ OPEN TALK: Securing and Managing K8s Apps with Ease: NGINX Service Mesh Download NGINX Service Mesh for free -- https://downloads.f5.com Get Started Today !!

27. Q&A Contact Us: Amir Rawdat : [email protected] NGINX: [email protected]