►
Description
Don’t miss out! Join us at our upcoming events: EnvoyCon Virtual on October 15 and KubeCon + CloudNativeCon North America 2020 Virtual from November 17-20. Learn more at https://kubecon.io. The conferences feature presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Panel: Are Cloud Native 5G Core Network Functions (NFs) Truly Manageable & Secure? - Ramki Krishnan, VMware; Srini Addepalli, Intel; Heather Kirksey, The Linux Foundation; Tom Kivlin, Vodafone; & Balaji Ethirajulu, Ericsson
In the transition towards Cloud Native, 5G Core NFs has an interesting architectural mix of HTTP 2.0 and other network I/Fs. In this panel, we first examine the various manageability/security/visibility challenges of the 5G Core NFs in K8S with 1) Multiple network I/Fs for high performance data plane NFs and for isolation for all NFs 2) Chaining of NFs that are distributed across K8S clusters. While multi-cluster L7 Service Mesh (Istio, Linkerd etc.) seems to be a reasonable solution choice especially for HTTP-based functions, there are unique challenges posed by other NFs operation with other protocols and at lower layers. We will explore options such as an integrated Layer 2-7 service mesh approach leveraging open source efforts such as Open Virtual Network (OVN) to address these challenges - e.g. inter node/cluster secure communication using for Layer 7 TLS or Layer 2-4 IPSEC.
https://sched.co/Zeq9
A
I
am
heather
kirksey,
I
am
the
vp
of
community
and
ecosystem
for
the
set
of
networking
and
telecom
oriented
projects
within
the
linux
foundation.
I
will
be
moderating
your
panel
today
and
just
as
a
reminder,
we
do
have
the
chat
window
open.
We
will
be
monitoring
it.
So
if
you
have
any
questions
that
come
up
as
you
hear,
our
speakers
go
into
detail
or
if
you
have
something
related
to
the
topic
we
are,
we
will
be
monitoring
it
and
we
hope
that
we
can
answer
you
in
real
time.
A
So
welcome
to
our
cloud
native
5g
core
network
panel,
we're
going
to
be
talking
a
little
bit
about
sort
of
the
requirements
around
5g
and
deploying
them
and
how
we
believe
that
cloud
native
technologies
really
support
that
on
the
part
of
mobile
operators
worldwide
right.
So
I
am
looking
for
the
advanced
button
on
the
slides
here.
A
So
what
that
means
practically
is
that
there
are
going
to
be
lots
of
very
small,
very
close
to
the
end
subscriber
nodes
and
then,
as
you
go
further
and
further
back
towards
the
core
network,
where
different
mobile
functions
happen.
You've
got
your
low
thousands
of
edge
data
centers
your
hundreds
of
local
dc's,
tens
of
regional
and
then
a
few
sort
of
public
cloud
instances.
A
I
could
get
a
little
bit
of
help
out
there
we
go,
so
this
is
more
of
a
logical
view
of
the
network
and
starts
to
talk
about
how
the
various
control
plane
and
data
plane
functions
within
a
5g
network.
Look
and
some
of
the
technologies
that
we
believe
cncf
and
the
cloud
native
ecosystem
bring
to
bear.
So
one
of
them
obviously
is
service
mesh.
I
mentioned
the
networking
complexities
that
this
tiered
architecture
brings,
as
well
as
a
networking
complexity
around
delivering
a
number
of
services
with
different
latency
and
bandwidth
requirements.
A
Security
is
also
obviously
very
important.
No
telcom
telco
in
the
world
really
wants
to
find
themselves
in
the
headlines
because
they
have
not
provided
a
secure
service
to
their
and
consumers,
and
there
are
both
sort
of
you
know
very
important
control,
plane
things
like
signaling
setting
up
a
call
that
really
have
inelastic
requirements
as
well
as
wanting
to
deliver
high
quality,
high
quality
video,
as
well
as
the
cool
things
like
vr
ar
connected
cars.
A
Things
like
that,
and
so
we
really
believe
that
there
are
a
number
of
technologies
that
can
come
into
play
and
really
help
us
deliver
these
services
and
that's
what
the
main
meat
of
this
panel
is
going
to
dig
in
today.
So
with
that,
I
want
to
introduce
our
panelists
and
I
will
do
it
in
alphabetical
order.
A
So,
first
up
we
have
srini
adepali,
so
shrini
give
a
wave.
He
is
a
long-term
expert
in
networking
and
security.
Having
worked
in
the
industry
for
more
than
23
years,
he's
a
principal
architect
and
technical
strategist
at
intel,
where
he
focuses
on
cloud
native
and
edge
computing,
with
the
special
focus
in
his
core
areas
of
expertise,
networking
and
security.
A
Next
up,
we
also
have
balaji
era
at
the
rajaloo,
who
is
a
senior
director
senior
director
of
product
management
at
erickson.
I
have
known
biology
for
a
very
long
time.
He
has
been
a
long-term
contributor
to
product
management,
marketing
and
business
impact
into
the
open
source
community
and
has
given
much
to
sdn
nfv
cloud
native
over
the
years
and
he's
a
long-term
open
source
advocate
as
well
as
a
subject
matter
expert
in
5g
services
and
telecom
services
across
the
entirety
of
the
networking
stack.
A
A
B
B
They
they
will
each
have
kind
of
useful
periods
of
time
to
which
cloud
native
is
is
going
to
become
useful
to
them.
So,
for
example,
you
know
the
mobile
core
5g
mobile
core
is
like
you
know.
I
would
expect
that
to
be
containerized
and
cloud
native
before
we
see
huge
changes
in,
for
example,
the
radio
network
or
or
perhaps
npn.
B
D
D
Let
me
give
an
example.
For
example,
5g
core
is
really
based
on
microservices
based
architecture,
and
many
operators
are
doing
trials
and
parks,
so
they
are
sort
of
in
the
network
and
that's
a
that's
the
biggest
piece
that
is
actually
micro
services
based.
But
the
key
here
is,
let's
step
back
a
bit
here.
Telecom
networks
are
highly
complex
right
compared
to
the
enterprise
networks.
They
really
demand
a
very
stringent
requirements
right,
for
example,
reliability,
high
availability,
security
and
much
more
and
also
important.
It's
all.
It's
always
real
time
right.
D
That's
one
aspect,
the
second
big
aspect
for
telecom,
guys
for
the
telecom
deployments
most
of
our
network.
You
know
they
are
grown.
You
know
more
than
several
decades
right,
they're
all
brownfield
today.
So
that
means,
when
you
bring
in
a
cloud
native
architecture,
they
got
into
work
with
all
the
legacy
systems
that
has
already
been
put
place
right,
billions
of
billions
of
dollars
invested
already
and
vice
versa.
D
Both
the
legacy
need
to
work
with
the
modern
infrastructure
and
the
modern
infrastructure
need
to
work
with
legacy,
because
the
services
will
flow
across
these
different
platforms
right.
So
that
means
to
realize
the
full
benefit
of
cloud
native
right
cloud
native
brings
a
lot
of
benefits
right,
operational
efficiency,
the
flexibility
faster
time
to
market
an
enormous
scale
that
it
provides.
But
how
do
you?
How
can
we
realize
that
right,
not
just
having
yeah?
D
I
have
actually
migrated
my
network
function
to
cloud
native
architecture
right
from
rand
from
the
transport
ram
in
the
radio
network,
right,
radio
network,
the
transport
and
the
core,
but
that's
not
enough
to
do
the
real
to
to
realize
the
full
benefit.
You
need
to
have
a
modern,
next
generation
orchestration
management
system
on
the
top.
The
problem
there
is
today
most
of
the
systems
operators,
I.t
system.
I
think
tom
can
vouch
for
that
they're
sort
of
legacy.
It's
it's!
It's
a
really
really
cumbersome
right.
D
A
Very
cool
yeah
thanks
for
adding
color
there
bellagi
and
actually
before
we
move
off
this
question,
we
had
something
coming
from
the
on
the
chat
from
jeff
at
comcast,
and
this
is
directed
back
towards
utah,
which
is
you
know,
going
back
to
the
our
telecoms
ready
to
embrace
this.
How
are
you
internally
handling
that
technology,
skill
set
and
paradigm
shift?
You
know
across
multiple
groups,
you
know:
are
you
sort
of
doing
reorgs?
Are
you
know?
How
are
you
handling?
A
B
Yeah
sure
so,
without
kind
of
going
into
the
detail
of
vodafone's,
you
know
org
structure
and
operating
model.
Specifically,
I
think
that
the
key
the
key
parts
to
this
are,
as
jeff
mentioned,
about
skill
set.
So
there's
there's
been
a
global
training
initiative
to
introduce
cloud
native
concepts
and
technologies
to
all
technology
functions,
whether
it's
development
operations,
networks
et
cetera.
B
That
approach
of
you
know
allowing
our
network
across
all
the
market
that
we
operate
primarily
in
europe
now
and
across
africa
to
be
accessed
and
managed
and
consumed
as
platforms
and
and
that
kind
of
cloud
native
concept
of
you
consume
it
via
api.
There's
a
there's
a
there's,
a
set
contract
in
place
that
it
might
be
the
oss
is
consuming,
it
might
be,
the
bss
is
consuming,
it
might
be,
the
consumer
is
consuming.
B
You
know,
if
you,
if
you
have
that
concept
and
that
culture
in
mind,
regardless
of
which
layer
of
the
system
you're
dealing
with
it,
could
be.
You
know,
physical
hardware,
you
know
if
you're
still
supplying
that
providing
it
as
a
platform.
Then
then
you
know
that
layered
approach
to
build
up
a
service
is
going
to
be,
is
going
to
mean
we're
kind
of
decoupling
things
and
able
to
build
our
our
offerings
more
in
a
more
agile
way.
Small
a
so
hopefully
that
answers
the
question
jeff.
A
So
so
thanks
for
that,
I
mean,
I
think
it's
really
good
to
sort
of
start
off
with
kind
of
the
the
cultural
and
org
processes
that
that
taking
in
a
new
technology
to
support
new
services
means
you
know,
sort
of
going
back
to
some
of
the
the
technical
complexity.
You
know.
One
of
the
things
we
mentioned
is
you
know
with
all
of
these.
Tens
of
thousands
of
nodes
and
sort
of
the
the
nerve
architecture
from
you
know
very
close
to
the
end
through
edge
regional
back
to
the
core.
A
You
know
there's,
obviously
both
from
the
types
of
services
that
telecoms
offer,
as
well
as
all
of
the
interconnectivity
of
all
of
the
tens
of
thousands
of
end
nodes.
You
know
networking,
obviously,
is
a
big
challenge
for
this,
and
I
know
that
lots
of
discussion
around
service
mesh
to
meet
these
telecom
needs
has
been
going
on
in
the
industry.
So
maybe
srini
I'll
throw
this
to
you.
How
are
you
viewing
service
mesh?
C
Yeah
thanks
again,
yeah
service
mesh
is
kind
of
a
quite
being
becoming
popular
in
the
enterprise
right
and
the
reason
the
service
measures
were
created
is
for
micro
service
architecture.
So,
as
you
said,
there
are
multiple
micro
services
for
a
given
application
and
if
they
need
to
communicate
with
each
other,
they
need
to
have
load
balancing
themselves.
They
need
to
have
some
mutual
tls
end
points
themselves
and
they
need
to
provide
some
kind
of
observability.
C
So
that
is
a
challenge
for
any
application
developer
right.
What
service
mesh
is
doing?
It
is
taking
away
those
mundane
activities
that
needed
that
are
needed
for
micro
services
into
a
central
place
called
service
mesh,
so
it
has
its
own
side
car
for
every
micro
service,
and
there
is
a
hto
control,
pin,
for
example,
one
of
the
popular
statistics
technologies
today,
and
it
could
take
care
of
the
mutual
dls.
You
know
traffic
management
and
any
observer,
but
but
but
how
do
we
translate
that
into
5g?
C
But
fortunately,
the
way
3gbp
defined,
5g
core
functions
and
their
interactions
actually
kind
of
falls
into
micro
service
architecture
right
and
they
they
are
going
with
all
http
the
json
policy
based
communication
and
it's
similar
to
entropy.
So
we
believe
that
service
mesh
technologies
like
hto
on
the
ony
would
benefit
even
the
5g.
C
But,
as
you
mentioned
right
that
one
aspect
of
service
measures
that
if
all
the
micro
services
are
sitting
in
the
same
kubernetes
customer,
for
example,
they
can
work
fantastically
right.
But,
as
you
mentioned,
5g
in
general
is
disaggregated
like
the
different
components
or
different
microservices
or
different
network
functions,
sit
in
various
kubernetes
clusters
across
geographic
locations.
C
So
you
require
communication
among
the
micro
services
in
different
locations.
That's
where
the
manageability
or
the
central,
orchestrator
or
multi-cluster
service
mesh
is
very
important.
So
that
is
one
one
aspect
in
my
mind
would
be
needed
in
in
the
leveraging
service
mesh
in
the
financial.
So
there
are
some
open
source
activities
going
on
like
in
in
in
I,
I
am
in
the
elephant,
one
app
community
and
we
started
to
think
about
how
do
we
basically
have
this
multicultural
service
mesh?
C
Where
we
automate
control
plane
for
hto
control
in
every
cooperative
cluster
to
enable
communication
among
the
micro
services,
sometimes
a
micro
service
need
to
be
exposed
to
the
outside
world
and
sometimes
the
microscope
go
to
the
outside.
So
how
do
you
do
all
these
three
kinds
of
things
in
an
automated
fashion,
based
on
how
micro
services
are
required
in
various
locations?
Yeah,
though
that
is
somewhat
going
up
there.
A
Obviously,
automation
for
all
of
this
is
going
to
be
going
to
be
key.
You
know
in
in
terms
of
how
to
do
that.
I
think
balaji
mentioned
that
earlier
we
have
a
follow-up
question
specifically
on
service
mesh
and
its
use
in
5g,
which
is,
do
you
see
any
conflict
or
overlap
between
the
nrf,
a
3gb,
3gpp
defined
nrf
and
typical
service
discovery
approach
in
kubernetes?
So,
for
example,
querying
the
nrf
for
nf
addresses
using
labels
and
does
that
impact
the
service
mesh
sidecar
model?
A
A
C
That's
certainly
some
overlap
on
that
aspect
with
respect
to
service
switches
right,
but
at
the
same
time
we
believe
that
service
mesh
technology
can
work
with
the
service
discovery
and
registration
mechanism
that
is
already
available
in
the
5g,
so
it
will
feed
the
nrf
as
any
other
micro
service.
I
guess
from
the
service
point
of
view,
but
at
the
same
time
there
is
a
opportunity
right.
This
is
something
which
we
have,
which
we
are
discussing
in
the
community.
C
Also
there's
an
opportunity
to
see
whether
the
hto
plugins
can
be
developed
to
take
care
of
mrf
functionality,
internet
right
within
hd
right
now.
That
way
you
can
avoid
maybe
multiple
lookups
service
location,
but
certainly
what
are
the
reason
why
it
cannot?
We
cannot
use
istio,
as
is
in
in
place
of
nrf.
Is
that
enough
is
used.
You
know
the
selection
happens
beyond
beyond
traditional
url
or
dns
kind
of
realities.
It
happens
based
on
other
5g
specific
criteria.
A
Cool
daniel,
if,
if
you
have
any
sort
of
follow-up
or
that
didn't
answer,
your
question
feel
free
to
chime
back
in
and
then
another
question
from
jeff
specifically
around.
Yet
another
sort
of
you
know:
mobile
core
function,
the
folks
on
the
call
believe
that
the
upf
is
ready
to
be
cloud
nativized
with
the
disparity
and
solving
data
plane
challenges.
B
It
yeah
it's
a
very
interesting
question.
There
are
certainly
challenges
and
there
are
a
ton
of
different
projects
and
initiatives.
Looking
at
how
to
solve
those,
I
think
in
reality,
there's
there's
probably
another
few
months
before
we
as
an
industry
and
certainly
as
a
company
settle
on.
This
is
the
right
answer
for
us
and
it
results.
It
revolves
around
a
bunch
of
different
activities
around
how
networking
is
presented
to
containers.
B
You
know
how
the
upf
applications
are
containerized,
how
hardware
acceleration
is
presented
to
those
to
that
software
and
there's
there's
tons
of
companies.
You
know
all
of
the
companies
on
this
on
this
panel
and
others
they're
all
involved
in
activities
around
that.
But
you
know
I
don't
think,
there's
a
single
and
simple
answer
today,
but
there's
certainly
lots
going
on.
B
C
Yeah
just
to
activate
right
in
one
minute,
you
know
there's
a
lot
of
stuff
happening
in
kubernetes
to
make
the
data
plane
or
user
plane
kind
of
a
packet
crossing
kind
of
work
in
a
high
throughput,
deterministic
fashion.
With
logic
such
as
you
know,
you
might
have
seen
efforts
such
as
cpu
infinity,
isolating
the
cpu
cores
for
a
given
microservice
and
then
huge
table
support
new
awareness.
C
A
Cool
all
right,
so
yeah,
we've
talked
a
lot
about
networking
and
how
service
can
address
those
challenges.
I
wanted
to
move
into
sort
of
the
other
big
topic
on
our
panel,
which
is
around
security,
so
obviously
security
is
very
important.
You
know,
if
you
think
about
the
things
that
you
are
doing
on
your
devices
and
will
continue
to
do
in
5g.
You
know
it's
it's
an
issue
for
subscribers.
A
It's
sometimes
a
regulatory
issue
and
you
know
sort
of
securing
all
these
services
when
it
is
this
big
public
mobile
network,
as
opposed
to
maybe
a
cloud,
that's
just
being
used,
you
know
within
an
enterprise,
certainly
brings
challenges
and
so
romke.
I
wanted
to
throw
this
question
to
you.
I
know
this
is
a
particular
area
of
expertise
and
passion
for
you.
So
could
you
talk
a
little
bit
about?
You
know
how
some
of
the
work
that
you're
doing
around
bringing
security
concerns
into
the
mobile
network?
That
is,
you
know
cloud.
A
Are
we
having
some
technical
difficulty
with
romki?
I
think
it's
saying
we
might
have
some
connectivity
issues.
I
love
that
we're
here
doing
a
telecom
networking
panel
and
sort
of
experiencing
some
connectivity
problems
in
real
time.
It
sort
of
goes
to
show.
You
know
the
challenges
really
are
real
and
we
all
experience
them
every
day.
Rompey
are
you?
Are
you
back
yet.
A
C
Yeah
so,
of
course,
service
security,
point
of
view
service
must
just
take
care
of
mutual
tls
authentication
authorization.
Those
aspects
right,
that's
why
that
the
challenge
is
taken
care
by
service
technologies,
but
there
are
few
more
security
aspects
that
need
to
be
considered,
especially,
we
are
talking
about
5g
functions
coming
on
edge
locations
which
may
not
be
physically
secured
very
well
right.
There
will
not
be
physical
guards,
you
know
to
land
the
location
state,
those
cases
the
infrastructure
security
becomes
very,
very
important.
So
how
does
one
ensure
that
the
the
system
is
not
compromised
right?
C
The
platform
attestation
is
very
important,
so
how
does
one
ensure
that
whatever
secrets
passwords
privacies
that
are
basically
shipped
to
the
are
configured
in
the
network
functions
running
in
the
edges?
How
do
you
know
that
they
are
not
complex?
How
do
you
know
they
are
not
stored,
so
key
protection
and
platform
application?
C
They
become
very
important
to
figure
out
something
something
bad
happened.
So
that
is
one
aspect
second
aspect
which
I
hope
for
based
around
the
blockchain
around
people.
You
know,
especially
when
you
have
multiple
operators.
You
know
sharing
from
building
data
from
commercial
data.
How
do
they
ensure
that
those
are
not
compromised?
So
that's
what
company
was
talking
about.
You
know.
A
Well,
we
are
getting
close
to
time
and
I
want
to
throw
out
one
final
question
to
all
of
our
panelists,
which
is
you
know.
We've
talked
about
some
questions
were
raised.
You
know,
for
example,
around
the
upf
and
how
to
cloud
nativize
that,
and
you
know
tom
was
indicating
that
there's
still
some
work
to
be
done
in
terms
of
coming
up
with
the
right
solution.
A
You
know
if
there
is
one
high
priority
item
to
work
on.
You
know,
within
the
context
of
their
projects,
that
they
should
take
back
to
their
developer
groups
in
order
to
enable
cloud
native
technologies
to
provide
the
underlying
platform.
For
you
know
the
next
generation
of
global
communications
infrastructure.
A
What
would
that
be?
And
we'll
sort
of
I
can
start
with
tom,
but
I'd
love
to
hear
from
each
of
the
panelists
what
you
would
like
to
see
happening
there?
So
one
high
priority
item
for
developers
on
the
call
to
take
back
to
their
developer
communities
to
work
on
to
enable
the
mobile
network
cloud
native
cloud
nativization.
B
Fly
I'm
going
to
say
we
need
to
agree
on
what
what
is
that
word?
One
thing
is
really
difficult.
I
think
I
think
the
one
thing
I
would
would
suggest
is
getting
involved
with
the
the
tug,
so
the
telecom
music
group
it
was
the
set.
There
was
a
session
before
this
panel,
which
will
be
available
on
demand,
and
there
are
a
few
projects
kind
of
being
corralled
within
that
user
group,
and
I
think
one
particular
note
is
the
network
service
mesh.
B
D
I
can
add
something:
hi
yeah
heather
yeah,
so
that
key
takeaway
for
the
developers
and
in
fact
the
overall
cloud
native
architecture
in
the
community
is
for
me,
as
I
explained
at
the
beginning
of
this,
you
know
panel
cloud
native
architecture.
Yes,
we
are
bringing
in
into
the
network
in
a
brownfield
network.
That's
already
been
built,
so
it's
not
an
isolated
thing
in
a
sitting
in
an
enterprise
on-prem
or
in
a
project
or
a
public
cloud
right
it
is.
It
has
to
interwork
with
the
existing
network
number
one
number
two.
D
When
you
create
a
kubernetes
cluster
one
or
two
three
clusters.
There
is
an
orchestration
and
management
system,
that's
deploying
the
service
or
the
pnf.
That
means
physical
network
function.
That
is
legacy.
Then
there
is
a
vnf
virtual
network
function
and
there
is
cnf
what
we
call
a
cloud
native
network
function.
The
services
will
flow
across
all
of
this,
so
that
means
the
kubernetes
cluster.
We
need
to
ensure
all
the
apis
and
interfaces
will
manage
with
the
higher
level
orchestration
system,
whether
it
is
legacy
or
a
next
generation
orchestration
system.
C
I
also
feel
that
you
know
the
problem
statement
today.
Is
that,
because
of
a
disaggregated
nature
of
5g
and
because
of
large
number
of
locations,
cobalt
is
clusters.
The
automation
becomes
very
important
whether
it
is
a
multi-cluster
service,
mesh
or
multi-cluster
security
or
multi-cluster
networking.
All
that
part
of
that
automation
becomes
very
important.
So
that
is
my
take
away
that
you
know.
That's,
that's.
The
community
needs
to
kind
of
focus
on.
A
A
C
A
All
right,
I
say
I
think
romki
had
to
sadly
drop
again.
I'm
very
bummed
romke
has
a
lot
of
really
great
insight
and,
in
fact,
was
sort
of
the
driving
force
between
pulling
this
panel
together.
But
with
folks
questions
you
know
we
were
only
able
to
scratch
the
surface
of
this.
We
will,
as
speakers
be
going
to
the
slack
channel
so
that
we
can
continue
the
discussion.
A
So
if
people
want
follow-up
questions,
I
would
encourage
everybody
to
ask
rompey
about
some
of
his
insights
into
security
in
the
5g
network
using
cloud
native
technologies
as
well.
As
you
know,
any
other
topics
around
this,
we
will
be
in
the.
Let
me
make
sure
that
I
am
getting
this
correct,
that
we
will
be
in
the
number
two
kubecon
service
mess
service
mesh
channel
within
slack,
and
so
we
will,
as
a
panelists
and
speakers,
I'll
make
sure
that
we're
there
so
that
we
can
continue.