Cloud Native Computing Foundation KubeCon + CloudNativeCon North America 2017 (Austin), 15 Dec 2017

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kuberneters in Hybrid Environments Using Cloud Interconnect [A] - Marc Chisinevski, F5 Networks

Description

Kuberneters in Hybrid Environments Using Cloud Interconnect [A] - Marc Chisinevski, F5 Networks

Solutions to enable customers to apply consistent traffic management and security policies regardless of whether their applications are running on-premises, in a Public Cloud or in a managed Kubernetes environment.

The demos (please below) use Equinix as the cloud interconnection; however, the solution would work very similarly with other colo/interconnect providers.

The demos are using Google Container Engine but this would work very similarly in AWS, Azure and Oracle Baremetal Cloud.

Demo
------------
How it works
---------------------
The F5 Container Connector configures the F5 BIG-IPs to expose applications in a Kubernetes cluster as virtual servers, serving North-South traffic.

Components
---------------------
F5 Container Connector (http://clouddocs.f5.com/containers/v1/kubernetes/)
running in Google Container Engine (GKE).

F5 BIG-IPs running in Equinix and doing IPSec VPN to Google Cloud Platform (using Google Compute Engine VPN gateway).
The F5 BIG-IP routes traffic to the container networks via the IPSec tunnel.

About
Marc Chisinevski
Solution Architect (worldwide), F5 Networks
https://www.linkedin.com/in/chisinevski
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.

A

All right, thank you for coming. I hope you can I. Think you can hear me loud and clear.

A

So today is about today's talk is about kubernetes in hybrid environments and we we do have quite an ambitious plan, ambitious plan, because we want to walk you through a few open-source projects that we are working on for kubernetes and sto and I feel very brave today. So I'm also planning to do a live demo. So we'll see how that goes. So, let's, let's, let's get started before we start.

A

Can we have a quick show of hands to see how many of you are familiar with f5 networks and the five big IP, just a quick show of hands? Wow, okay! So pretty much pretty much everybody, that's good!

A

So multi-cloud what people mean different things when when they talk about multi cloud solution- and we have huge percentage of customers interested in that and developing multi-cloud strategies most of the time people refer to multiple public clouds, but many times as well. People include private cloud environments and also SAS solutions. So for today's purposes, we'll probably go with that. Second definition:.

A

So there are many different reasons you you would choose each kind of environment for for, for example, with private cloud on promoting colocation typical reasons would be enhance security or as an either customer can have for layer, 2 and layer. 3. Networking controls is kind of sync. As an example, and again as I mentioned, it does seem that huge percentage, so 85% of companies have a cloud, a multiple cloud strategy and and containers, of course, help a lot with that because they are portable across these kind of environments. So most public and private cloud environments.

A

And you do have quite a large variety of different development, environments and platform-as-a-service environment, which we are briefly going to cover, including openshift and Cloud Foundry, but mostly today is about about kubernetes and some of our projects in that space. So what are drivers for multi cloud adoption?

A

It can be a buyer leveraged for four different departments and and teams it can be increased availability and disaster. Recovery can be many things and it turns out that it varies quite a bit depending on company size.

A

So, as you can see from this graph, looking at the red part, so optimizing SLA is a big thing for smaller companies under hundred, but they are a bit less concerned with buyer leverage and it's quite the opposite for large companies, ten thousand or more. They are very concerned about buyer leverage and maybe a bit less in proportion about optimizing. Sls.

A

So challenging so we are, we are going to show a bit some some of the common deployments that we see with customers today and when they move workloads to various clouds and running kubernetes in the in offer, such as Google container services and Azure container services or in Amazon. One of one of the common problems is that the public cloud providers came with all kinds of different feature set and different different services.

A

So the investments you make into into this kind of integration is not really portable across across environments, and you also you end up very often with inconsistent policies between between these different environments and that, of course, can create security vulnerabilities.

A

So one of the typical deployment that we see is our with our devices being deployed in a colocation facility, because you have good latency and access to tons of different clouds to to Google and Twitter and to Amazon to Oracle as well, so that that something we see more and more and this kind of deployment allows you as well to centralize your your security policies. So it allows you to to replicate your app services across environments, so maker workload really portable and ensure that you apply the same. The same security policies to to them.

A

So some of some of the benefits- I I just I just mentioned- are right there as well, so.

A

So again, what what it would look like is a five sitting on on a color or interconnect. Location can be Equinix or something similar or in the data center, and this kind of deployment allows you to centralize your traffic management, but also your security policies and specifically related to kubernetes and one of the open source project that we are going to talk about today. That is called the f5 container.

A

Connector allows you if you deploy your kubernetes workloads, regardless of whether you deploy kubernetes on prayer or in amazon or in google cloud or agile container services.

A

We have a a project, so this is a five container connector that runs natively in kubernetes and we'll monitor actively the different services that are running and create automatically create as a necessary configuration on the five devices sitting, for example, in a color location or in your data center. So that allows you to dynamically populate everything on the devices. So so you can make sure that, even though you can you have kubernetes who are close deployed in different clouds, you always have the exact same traffic management or security or DDoS policy apply.

A

Regards to them, regardless off of that, so in terms of in terms of more more technical terms about about how this works, basically, the f5 container connect or runs as it's a it's an ingress controller and the f5 big IP. This deployment will be easy as ingress Cubert, its ingress points and.

A

Something-Something, so these addresses, so this solution addresses.

A

The ingress into kubernetes environment, however, we also want to address traffic traffic between the different micro services themselves. So this is another project that I'm going to to mention right now and I'm going to to do a quick demo as well.

A

Is it's basically so it's called a Spanish. It's basically a f5 supported dashboard with sto at its core.

A

So on top of everything that Easter is offering you so agra fauna and the agar to look at your application traces, and we are going to see that in the demo we have another component that is part of our a sperm, a solution, and that is called sto vet. It's an open source project and it basically allows you to identify miss configuration beacon between user deployments in sto and and Easter components themselves.

A

So you can identify all kinds of virtual mismatches and it can do as well predictive analysis based on what happens with other deployments and other customers. So basically it allows you to make it. It helps you to avoid making mistakes that can prove costly.

A

So are you ready for a quick demo of Avastin great? So my kubernetes clusters are are deployed in Google container region but, as we said it shouldn't really matter for the solution, so right now I'm going to switch.

A

Hopefully you can see my screen.

A

So so this is, this is what it looks like. I have deployed the very basic apps a book in for application in in East EO, and you can see right now. This is my my Spanish dashboard I can see the various components of my app, but I do not have any requests so I'm going to go ahead and generate some some traffic to that that booking for application, and we will see in a second here- you can see I already start to get some requests in there.

A

So if I go now and I go to look at graph Allah, for example,.

A

A

All right, so you can see global success rate habit, 100%, no, no 500 errors, and you can you get all all the kind all kinds of indicators about how the deployment is is going I'm, sending traffic specifically to the product page. So I can see what what exactly is happening. There I only get 200 responses, so that's all nice and good and I can I can do more more more than that. Of course, I can also also from the aspinmaster dashboard.

A

I can go to to yogur and I can look at at the actual traces from my app. Hopefully, internet is working, it is so the service I selected here is the product page, because that's what I sent traffic for. So you can see that it's actually working I get all kinds of useful information, so I can go and and explore exactly what what happens in my environment. So again, this is this is the app we we just sent traffic to so very basic, very basic app, but helps make the point.

A

Hopefully, any so I think we we have our entire product development team, so we can I think we can open for for questions a bit early and we'll be happy to talk to you afterwards if these projects are are of interest and also I included at the end of the slides, I included links to all these towards this project that I mentioned so sto that we would very much welcome contributions to to this. You can right now there is a number of I will call them vetters, so all kinds of, for example, mesh version.

A

This is one that can detect mismatches between versions of your user deployments and and still component. There are quite a few others that that are interesting and, of course, you can contribute, contribute yours as well, so I think we can. We can open for for questions if you'd like.

B

A

Yeah yeah so and again we have the entire entire hemisphere they can, they can add more to it. So basically it works by monitoring the kubernetes services and creating the entire configurations of real our servers and pull on the f5 device correct correct. So the container connector talks using REST API is too big, eyepiece sitting somewhere again it can be Equinix or it can be. Your data center can be five big IP sitting somewhere in a cloud provided that the container connector can talk to the management interface using REST API s.

A

So it creates all these dynamically and it can work in two ways. Very often we just we just end up having the pool on the big IP being created with node port, but you can also work with it. A lot of testing, for example, with calico, and you can have bgp peering if you use calico bgp, for example, will appearing between five big IP devices and the kubernetes node.

A

So, therefore, in in that scenario, your pool on the f5 device will actually contain actual pot IP addresses, so you get kind of more more visibility on on this.

A

Exactly exactly exactly and and we rely on the kubernetes health monitors, so you never are in the situation where the pod is not actually healthy and ready to receive traffic, but it's considered good by the f5. So you don't have that problem did I answer your question.

B

A

So you mean by the Container connector yeah. So so, if you, if you go, for example with Equinix, let's say you have two options, so you can have direct connectivity to the different cloud and that we tested that that works right so to have Google. You have Oracle you have as where you have Amazon, so you can use that, but you don't really have to, for example, for your development workloads or test workloads. Nothing stops you from.

A

Even if you have your bigotry, Equinix from establishing IPSec, VPN and just route, some of your traffic to save some money over IPSec VPN to to so you to to Google Cloud or to add your Amazon.

A

There is a lot of automation to establish VPN tunnels. There are a few good projects showing how to do that on on github I can are you interested in which, which public cloud provider are you interested in yeah, okay, so I'm going to show you right away, it's very easy to actually Google for it. So if you look at so that there is, there is quite a bit of automation that that you have available there.

A

Five IPSec, so this one is, is pretty good, a pretty good example, and it really, it really does everything for you, including high availability for the big IPS, so I would encourage you to use that rather than doing it manually. Of course you can do that, but does it doesn't answer your question.

B

A

So so so the role is so big. Ip will be the ingress point into into regardless of whether your apps are deployed on Prem or in kubernetes running in a managed, kubernetes, environment or anywhere else. It allows you to get so. Traffic to these environments goes through the big IPs. Therefore, you can apply all kinds of traffic management and optimization and DDoS protection or web application firewall protection.

A

So you can use any of five features that you are interested in, regardless of whether your app is running or your workload is running in a public cloud, kubernetes on prayer or kubernetes in a managed environment such as google container engine. It just allows you to to consolidate your your policies in this way and use whichever five feature is of interest to you and again it can be web application, firewall or DDoS protection or any kind of feature you. You are interested in.

A

No, so so it depends if you, if you are, if you are using the record activity, for example, from Equinix you will, you will have layer to connectivity directly to the cloud. If not you can, you can use IPSec VPN to to establish connectivity between big IP and I.

A

Don't know, Google VPN gateway, something like that or.

A

Other questions.

A

Okay, I think, thank you very much and don't forget to talk to us and.