Role of edge gateways in relation to service mesh adoption

1 | Copyright © 2019
API Gateways are going through an
identity crisis
@christianposta

2 | Copyright © 2019 @christianposta
CHRISTIAN POSTA
• Field CTO @ Solo.io
• Author of a few books
• Contributor to many open-source projects
• Architect, blogger, speaker, mentor, leader
@christianposta
christian@solo.io
https://blog.christianposta.com
https://slideshare.net/ceposta

WROTE THE FIRST BOOK ON ISTIO…

WRITING ISTIO BOOK FOR MANNING
https://bit.ly/istio-in-action

5 | Copyright © 20195 | Copyright © 2019
Identity Crisis

INSPIRED BY A BLOG…
http://bit.ly/gateway-identity-crisis

• API Management solutions
• Kubernetes/cluster ingress
• Service Mesh proxies, gateways
• Application-built gateways
Identity crisis?

“I am just going to
use service mesh,
doesn’t that make
gateways obsolete?”
IDENTITY CRISIS?

Alternative talk title:
Role of edge gateways in relation to service
mesh adoption

• Problem statement, challenges, tradeoffs
• Useful patterns to set context
• Envoy proxy as the foundation
• Architecture patterns to consider
• Demo
• Wrap up
What to expect from rest of this talk:

• Augment, complement, replace existing API infrastructure
• Support a microservices, cloud environment
• Need better traffic control and observability
• As little disruption as possible, target multiple compute
• Improve security posture
Goals we see

THE PROBLEM
HOW DO YOU
OBSERVE?
HOW DO YOU
MANAGE APIS?
HOW CAN ENFORCE
SECURITY?
MONOLITH MICROSERVICES

• Traffic control
• Traffic routing
• Secure communications
• Application-level network observability
• Policy enforcement
Solving challenges between services within the organization

LARGE, CENTRALIZED, LOW-TRUST, SHARED ENVIRONMENTS

CENTRALIZED VS DECENTRALIZED

CENTRALIZED VS DECENTRALIZED WITHOUT GAPS

How to get there?

• Start with one proxy, grow to more
• Pick a subset of traffic applications
• Get demonstrable value from it
• Data plane matters
• Leverage high-value patterns for application traffic
Start with a gateway approach

Three important gateway patterns

“Edge” concerns, North-South vs East-West

Capability Service Mesh Edge
Traffic Control ✔ ✔
Traffic Routing ✔ ✔
TLS/mTLS ✔ ✔
Network Observability ✔ ✔
Policy Enforcement ✔ ✔

Capability Service Mesh Edge
OAuth/OIDC ✘ ✔
Web Application Firewall ✘ ✔
Message transformation ✘ ✔
Request/response caching ✘ ✔
Domain-specific rate limit ✘ ✔
HMAC, request path security ✘ ✔
Understand API surface,
intended decoupling ✘ ✔

API Gateway Pattern
“A service that’s the entry point into the microservices-
based application … is responsible for request routing,
API composition, protocol translation …
and edge functions like authentication,
authorization, rate limiting, caching, et. al.”
See also:
https://microservices.io/patterns/apigateway.html
https://www.manning.com/books/microservices-patterns

API Gateway Pattern: what it does
• Tailored API for different kinds of clients
• Abstracts backend services, protocols, message shapes, etc
• Powerful matching/routing, discovery, transformation,
aggregation, protocol translation
• Backends for front-ends
• A developer-first construct
• Intended to be decentralized and change at the pace of your
applications
• Network-level functions including rate-limiting,
authentication/authorization, caching, metrics collection

Mediator pattern
http://en.wikipedia.org/wiki/Design_Patterns
Credit: https://springframework.guru/gang-of-four-design-patterns/mediator-pattern/

Envoy proxy as a gateway

Meet Envoy Proxy
http://envoyproxy.io

Envoy Proxy implements:
• zone aware, least request load balancing
• circuit breaking
• outlier detection
• retries, retry policies
• timeout (including budgets)
• traffic shadowing
• rate limiting
• access logging, statistics collection
• Many other features!

Edge Gateway built on Envoy
https://github.com/solo-io/gloo

What is Gloo?
● Enterprise Envoy Proxy
● API-level routing, decoupling
● Complements any service mesh
● Traffic control, canary releases
● OAuth flows
● TLS termination, passthrough, mTLS
● Rate limiting, Caching
● Request/Response transformation
● Kubernetes CRDs (when deployed to Kubernetes)
https://gloo.solo.io

Edge Gateway built on Envoy

Gloo companion project: Sqoop
Query
Monolith Microservice
s
Cloud Functions
Result
https://sqoop.solo.io

Demo!

Gateway adoption patterns
(waypoint architecture) on the journey
to service mesh

Start with single proxy

Bring in decoupling points (multi-tier gateway)

Gateway per product/domain/bounded context

Push gateways down as you grow,
avoid death star architecture!

• Crawl, walk, run approach
• Leverage shared gateways, path for decentralization
• Envoy/Gloo proven open-source projects, successful adoption
• Reduce risk, target multi-platform compute, move at your own
pace
Final thoughts

Check out Solo.io!

Sneak peak, https://servicemeshhub.io

CHRISTIAN POSTA
@christianposta
christian@solo.io
https://blog.christianposta.com
https://slideshare.net/ceposta

@soloio_inc

Role of edge gateways in relation to service mesh adoption

More Related Content

What's hot (20)

Similar to Role of edge gateways in relation to service mesh adoption (20)

More from Christian Posta (13)

Recently uploaded (20)

Role of edge gateways in relation to service mesh adoption