►
Description
Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Designing a Service Mesh for Global Scale At SAP- Fei Yao, SAP
SAP has embarked on a journey to design and implement multi-cluster “Service Mesh as a Service” for its BTP platform.They did not stop there though, they aim to connect these meshes together in a “mesh of meshes” architecture. Fei Yao, Chief Architect at SAP will talk about the challenges and design patterns (with help from Nick Nellis at Solo.io) that are helping enable SAP to connect and manage service meshes for 40,000 engineers and over 10,000 clusters.
A
My
name
is
fey
yao.
I
am
chief
architect
for
sap.
I
have
been
working
on
cloud
and
cloud
data
for
a
long
time,
really
passionate
about
using
cloud
native
technology
to
build
highly
available
highly
scalable
and
secure
applications
for
enterprise.
Today
with
mr
nick
nick,
you
want
to
introduce
yourself.
B
My
name
is
nick
nels,
I'm
a
field
engineer
at
solo.
I
o
and
we've
partnered
with
sap
to
help
them
design
and
implement
their
service
mesh
strategy.
Organization-Wide
I'm
going
to
head
it
back
over
to
faye
to
talk
about
what
they're
doing
with
service
mesh
today
and
what
they're
going
to
be
doing
in
the
future.
A
Yeah
sap,
as
a
technology
company,
includes
a
wide
range
of
verticals
from
iot
to
machine
learning,
artificial
intelligence
from
blockchain
to
big
data
from
cloud
computing
to
intelligent
cloud.
They
cover
a
wide
range
of
applications
and
services
which
includes
erp,
finance
and
crms,
spend
management,
people,
management,
supply,
chain
management
and
many
many
more.
A
A
A
All
of
those
services
and
application
rounds
on
top
of
business
technology.
Platforms
short
for
btp
really
is
a
try
to
bring
about
intelligent
applications
with
database
and
data
management,
analytics
integration,
extension
capabilities
into
one
platforms
that
one
platform,
but
for
both
cloud
and
hybrid
environment.
It's
truly
make
us
the
best
business
cloud
in
the
world.
A
There
are
many
live
business.
Currently
user
has
been
using
service
mesh
already
or
in
a
journey
of
adopting
a
source
mesh
such
as
concur.
Concur
has
been
using
service
mesh
way
before
you
steal,
concur
using
envoy-based
proxy
to
manage
their
all
the
workloads.
Ariba
is
our
e-procurement
source-to-pay
and
a
supply
chain
cloud
solution.
A
A
A
For
example,
so
search
fact,
success
factor
is
one
of
one
of
the
forerunners
to
try
the
technologies.
Try
to
bring
this
technology
to
the
bigger
organizations
currently
successful
factors.
This
is
the
only
small
part
of
it,
the
one
of
their
services
microservices
running
in
the
hyperscaler
and
another
part
of
it.
Machine
learning
service
runs
in
the
virtual
machines
in
our
converged
cloud
environment.
So
this
is
truly
hybrid,
hybrid
cloud
solutions.
A
A
B
Great,
thank
you.
I
think
some
of
the,
like
you
showed
off
some
of
the
lines
of
business
here
at
sap
they're
using
service
mesh
but
they're,
using
a
wide
variety
of
technologies
to
achieve
that
service,
mesh
solution
that
they
want.
Okay,
you
talk
about
how
business
technology
platform
is
getting
involved
with
these
lines
of
business
in
terms
of
like
service
mesh,
yeah
and
adoption.
A
Yeah,
so
you
can,
you
can
tell
various
line
fitness
and
a
different
stage
of
either
using
or
adopting
service
mesh
as
a
company.
We
really
want
to
step
back
think
about
how
should
we
standardize
service
mesh
with
various
capabilities,
including
routing
and
security,
etc,
and
really
remove
the
burden
for
each
line
of
business
and
to
build
a
service
mesh
as
a
service.
B
Great
thanks,
you
mentioned
security,
I'm
sure,
as
most
of
our
audience
has
seen
and
read
this
this
article
from
the
nsa
about
adopting
a
zero
trust
security
model.
I'm
assuming
sap
has
a
top
of
mind
when
adopt
you
know
and
probably
a
reason
why
you're
adopting
service
mesh
is
to
to
solve
some
of
those
problems.
Can
you
go
into
more
detail
about
like
what
is
what
sap
is
thinking
about
in
terms
of
security
and
what
you
think
about
the
zero
trust
security
model
on
the
next
slide?
B
A
A
Following
you
know,
devsecops
and
shift
left
security
principles.
Service
mesh
allows
us
to
to
build
security
from
the
gecko
without
the
heavy
lifting
from
product
engineering
teams.
Of
course
you
know
securities
always
there
should
always
be
later
approach
that
there
are
other
aspects
of
secure
app,
such
as
application
security
data
security
has
been
taken.
Care
of
should
be
taken
care
of
outside
service
mesh.
So
for
sap
at
a
minimum,
we
want
to
use
a
service
mesh
to
enforce
zero
trust
policies.
A
For
example,
service
to
service
communication
must
enable
mutual
qs
and
end
user.
Authentications
must
must
be
enforced
before
getting
to
network,
and
all
workloads
must
implement
non-passable
policy
enforcement
points
to
to
deploy
fine
grain
access
control
policies.
Any
steel
words
such
as
authorization
policies
has
to
be
in
place
in
all
workloads.
A
A
A
Yeah,
I
think
that
most
of
secure
bridges
are
at
exploitation
of
the
older
trust
model
and
without
identity
there
there
will
be
no
trust,
identity
has
to
be
given,
and
you
know
all
verified
and
authorized
and
also
tracked.
Hence,
there's
authentication
authorization
and
auditing
and
tools
such
as
you
know,
spires
can
help
issuing
universal
identities
and
build
a
trust
and
to
scale.
B
A
A
All
workloads
will
have
full
abilities,
building
to
track
to
have
metrics,
logins
and
metrics,
and
policy
can
be
either
enforced
through
steel
authorization
policy
or
through
external
authorization
such
as
opa's,
and
we
will
use
our
existing
pca
infrastructure
to
to
issue
certificates.
So
this
is
a
building
block
for
cert.
You
know
measures
and
services
from
this
building
block.
We
have
multiple
layers
and
meshes
right
from
the
very
left
you
can.
A
We
can
consider
it
as
a
single
cluster
mesh,
then
move
up
to
the
right
depends
on
the
organization
structures
and
the
team
structures
or
responsibilities.
There's
a
need
to
have
multi-cluster
meshes
and
then
move
to
the
layer.
2
cleaners
see
that
even
bigger
lbs
has
geographically
distributed
for
multi-clustered
environments
such
as
ariba
arriba
runs
in
the
you
know,
gcp
also
on
adabas
as
well.
We
need
to
provide
the
capability
to
to
use
a
service
mesh
to
bring
those
together
and
last
but
not
least,
we
want
to.
A
We
want
to
view
this
view
the
traffic
from
north
to
south
from
east
to
west,
as
as
a
one
network
fabrics,
in
other
words
traffic.
Typically,
before
for
one
lobbyist,
we
have
to
go
egress
outbound
internet
come
back
to
another
online
business.
Not
only
has
security
challenges
into
the
compliance,
but
also
increased
latencies.
We
want
to
use
service
mesh
to
be
able
to
bypass
that
allow
mutual
tears
among
life
business
without
going
outbound
during
the
day
to
come
back.