Move Auth, Policy, and Resilience to the Platform

Developer's time is the most crucial resource in an enterprise IT organization. Too much time is spent on undifferentiated heavy lifting and in the world of APIs and microservices much of that is spent on non-functional, cross-cutting networking requirements like security, observability, and resilience.

As organizations reconcile their DevOps practices into Platform Engineering, tools like Istio help alleviate developer pain. In this talk we dig into what that pain looks like, how much it costs, and how Istio has solved these concerns by examining three real-life use cases. As this space continues to emerge, and innovation has not slowed, we will also discuss the recently announced Istio sidecar-less mode which significantly reduces the hurdles to adopt Istio within Kubernetes or outside Kubernetes.

1. 1 | Copyright © 2022
Reducing Developer Overload:
Moving Auth, Policy, and Resilience to the Platform

2. 2 | Copyright © 2022
CHRISTIAN POSTA
VP, Global Field CTO, Solo.io
@christianposta
[email protected]
/in/ceposta

3. 3 | Copyright © 2022
https://solo.io

4. 4 | Copyright © 2022
Digital Experiences… Driven by APIs and Services

5. 5 | Copyright © 2022
Silos - Conway’s Law

6. 6 | Copyright © 2022
“Ticket Ops” to Drive Changes to APIs and Services

7. 7 | Copyright © 2022
Platform Engineering
●Cross functional team
●Infrastructure integration
●Golden paths for delivery
●Internal Dev Portals
●Tenancy for teams
Platform engineering:
●Accelerate business value
●Improve efficiencies
●Increase compliance
●Reduce costs/lockin
Platform engineering outcomes:

8. 8 | Copyright © 2022
You don’t start with pipes, electrical, doors
and locks, but eventually you need them.

9. 9 | Copyright © 2022
Internal Developer Platforms are like a House

10. 10 | Copyright © 2022
●Kubernetes / containers
●Microservices architecture
●Public cloud
●CI / CD / ArgoCD / GitOps
●Platform orchestration
●Metric collection
(CPU, Network, Memory)
Foundations

11. 11 | Copyright © 2022
Platform Strategy

12. 12 | Copyright © 2022
T-Mobile: 25% of time spent on non-functional reqs;
75% incidents caused by network misconfiguration

13. 13 | Copyright © 2022
The platform is not finished.
We need to modernize networking.

14. 14 | Copyright © 2022
Outdated Assumptions and Network Control

15. 15 | Copyright © 2022
Policy Bit Rot

16. 16 | Copyright © 2022
Policy Bit Rot

17. 17 | Copyright © 2022

18. 18 | Copyright © 2022
Inefficiencies and Bottlenecks

19. 19 | Copyright © 2022
Build it into the Code!

20. 20 | Copyright © 2022
JWT Unravels your API Gateway!

21. 21 | Copyright © 2022
●Distributed implementation
●Declarative configuration
●Standard interfaces/integration
●Dynamic configuration
●Fine-grained, request-level auth/rate limit/policy
enforcement
●Traffic control, circuit breaking, routing
●Metrics, logging, distributed tracing
Modern Networking Needs for Internal Dev Platform

22. 22 | Copyright © 2022
The House is not Finished!

23. 23 | Copyright © 2022
Finishing the house

24. 24 | Copyright © 2022
You need Plumbing, Electrical, Locks on Doors, etc

25. 25 | Copyright © 2022
Modern Networking Solves Auth, Policy, Resilience
●Locks on doors
○zero-trust, workload/request authentication,
authorization, policy enforcement
●Air conditioning / thermostat
○load balancing, timeouts, retries, circuit breaking
●Electrical / Piping
○traffic control, load balancing, routing
●CO, fire, smoke detectors, cameras
○metrics, distributed tracing, logging

26. 26 | Copyright © 2022
Application Networking

27. 27 | Copyright © 2022
Istio Service Mesh
https://istio.io


●mTLS, mutual authentication,
encryption
●Network, L7 observability
●Traffic control, resilience, failover
●Blue-green, canary release
●Driven by declarative configuration

28. 28 | Copyright © 2022
Improve
Performance
Simplify
Operations
Cost
Reduction
https://istio.io/latest/blog/2022/introducing-ambient-mesh/

Istio Ambient Mode
A sidecar-less implementation of Istio Service Mesh
Production ready as of Istio 1.22 (May 2024)

29. 29 | Copyright © 2022
Demo

30. 30 | Copyright © 2022
Istio Ambient Mode
Pure L4 mode only, no L7

31. 31 | Copyright © 2022
Istio Ambient Mode

32. 32 | Copyright © 2022
Istio Ambient Mode
L7 goes through “waypoint” proxy, in the network;
L7 policies (retry, traffic splitting, canary, fine-grained authz, etc) applied here.

33. 33 | Copyright © 2022
Istio Ambient Mode
L7 goes through “waypoint” proxy (Envoy), in the network;
Deploy multiple replicas of proxy for traffic sizing, high availability, etc.

34. 34 | Copyright © 2022
Service Mesh For Less!

35. 35 | Copyright © 2022
Istio Ambient Mode
https://bit.ly/ambient-book

36. 36 | Copyright © 2022
Auth, Policy, and Resilience

37. 37 | Copyright © 2022
Location
Singapore
Revenue
Approaching $1BDigital Banking
Industry
From Zero to 4th Largest Bank in
Singapore within 2 Years Requires Trust
CASE STUDY
A Joint Venture between a Top 3 Bank in the UK
(Operating in Asia) and Singapore Largest Loyalty
Program launched one of Singapore’s first Digital Native
Banks. The ambitious growth goals for the bank meant
there was no time to waste selecting the technologies
that would underpin the business.

Regulators in Singapore keep strong standards on
financial institutions, including the need to maintain a
99.95% uptime or greater as well as ensuring strong
security across the banks infrastructure.

With the help of Solo.io and Gloo, the bank was able to
onboard 100K customers in the first 10 days of operating
Business Goals
Key tenants of the modernization initiative:
● Unified Stack - From Identity to Mesh, to CNI
and GraphQL
● Multi-Cluster Orchestration
● GitOps deployments
● Event-Driven, Real Time Architecture
Region
APJ
Benchmark Scale
● 100% Containerized
● 9 EKS Clusters in
Production
● 400 to 600 Concurrent
Pods During Peak
Processing
● Mandate to meet 99.95%
Uptime
Customer Growth
100K
First 10
Days
450K
First 5
Months
1M+
Today
Differentiators
● Single Solution providing
significant cost savings
through consolidation of
disparate tools
● Multi-Cluster Mesh Enables
transparent failover and
ability to treat EKS clusters
as “cattle”
● Unified Stack allows Bank to
implement a trust “Defense
in Depth” model from
Identity to Network Policy
Competition

38. 38 | Copyright © 2022
Workload Identity and Authentication

39. 39 | Copyright © 2022
Secure Production Identity Framework (for Everyone)
•Intended to solve the “universal workload identity problem”
•Independent of application type, network, or platform/cloud
•Specified with URI strings
•Verified via signed credentials (x509, JWT, etc)
•API and workflow for attestation built into SPIFFE
implementations
•Intended to eliminate passwords, other secrets, etc

40. 40 | Copyright © 2022
Who is Service A?

41. 41 | Copyright © 2022
Identity for Workloads

42. 42 | Copyright © 2022
Network Policy Based on Stable Workload Identity
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: allow-traffic-between-workloads
namespace: your-namespace
spec:
selector:
matchLabels:
app: your-app
action: ALLOW
rules:
- from:
- source:
principals:
["cluster.local/ns/your-namespace/sa/first-service-account" ]
to:
- operation:
principals:
["spiffe://example.org/ns/your-namespace/sa/second-service-account" ]

43. 43 | Copyright © 2022
Demo

44. 44 | Copyright © 2022
IstioCon (2023)

45. 45 | Copyright © 2022
Traffic Control
Powerful load balancing
IN THE NETWORK
●Fine-grained, request-based load
balancing
●Region/Zone/Subset aware load
balancing
●Retry/Timeout/Circuit breaker
●% based traffic splitting
●Header based traffic splitting

46. 46 | Copyright © 2022
Global Routing / Failover

47. 47 | Copyright © 2022
Circuit Breaker - Degrade gracefully when services are
overwhelmed

48. 48 | Copyright © 2022
Demo

49. 49 | Copyright © 2022
Tying it all together

50. 50 | Copyright © 2022
Offload Auth, Policy, and Resilience to the Platform!

51. 51 | Copyright © 2022
●Get code into production, safely!
●Increasing the release safety and velocity with:
○High availability
○Global routing
○Failover
○Resiliency
■either planned, unplanned
■migrations, re-deployments
●Canary releasing, blue/green, A/B testing
●Reducing MTTR
○Metrics, distributed tracing, logging
●Reduce change failure rate
Accelerating Business Value

52. 52 | Copyright © 2022
●Declarative configuration fits IaC automation, tenancy
●Better resource utilization / scale
●Eliminate silos, reduce ticket ops, reduce UI click Ops
●Reduce dependencies on other teams (self service)
●Teams to focus on business logic not complexity of networking
●Integrations with standard interfaces
●Reduce reliance on large proprietary vendor stacks with heavy
license fees
●Smart traffic, networking control for zonal, region, data center
networking costs



Improve Efficiency, Reduce Costs

53. 53 | Copyright © 2022
●Zero trust network
○Encryption, authentication, authorization
○Central requirements for PCI-DSS, HIPPA, GDPR, etc
●Eliminate bespoke code for security, routing, load balancing
○Especially across multiple languages, frameworks, etc
○Easier to audit and understand
●Eliminate centralized bottlenecks, UI clicking, and
●Drive everything through Git so it’s trackable and auditable
●Organizational policy enforcement based on durable workload ID
○Not ephemeral IP addresses or network segments

Increase Compliance

54. 54 | Copyright © 2022
Resources
●https://istio.io
●https://envoyproxy.io
●https://academy.solo.io
●See QR codes in slides!

55. 55 | Copyright © 2022
Please Reach Out!
VP, Global Field CTO, Solo.io
@christianposta
[email protected]
/in/ceposta

56. Thank You!

57. 57 | Copyright © 2022
Location
Singapore
Revenue
Approaching $1BDigital Banking
Industry
From Zero to 4th Largest Bank in
Singapore within 2 Years Requires Trust
CASE STUDY
A Joint Venture between a Top 3 Bank in the UK
(Operating in Asia) and Singapore Largest Loyalty
Program launched one of Singapore’s first Digital Native
Banks. The ambitious growth goals for the bank meant
there was no time to waste selecting the technologies
that would underpin the business.

Regulators in Singapore keep strong standards on
financial institutions, including the need to maintain a
99.95% uptime or greater as well as ensuring strong
security across the banks infrastructure.

With the help of Solo.io and Gloo, the bank was able to
onboard 100K customers in the first 10 days of operating
Business Goals
Key tenants of the modernization initiative:
● Unified Stack - From Identity to Mesh, to CNI
and GraphQL
● Multi-Cluster Orchestration
● GitOps deployments
● Event-Driven, Real Time Architecture
Region
APJ
Benchmark Scale
● 100% Containerized
● 9 EKS Clusters in
Production
● 400 to 600 Concurrent
Pods During Peak
Processing
● Mandate to meet 99.95%
Uptime
Customer Growth
100K
First 10
Days
450K
First 5
Months
1M+
Today
Differentiators
● Single Solution providing
significant cost savings
through consolidation of
disparate tools
● Multi-Cluster Mesh Enables
transparent failover and
ability to treat EKS clusters
as “cattle”
● Unified Stack allows Bank to
implement a trust “Defense
in Depth” model from
Identity to Network Policy
Competition

58. 58 | Copyright © 2022

59. 59 | Copyright © 2022
API Management at Google

60. 60 | Copyright © 2022
Massive outage

61. 61 | Copyright © 2022
Optimize Proxy Placement