Securing micro-services, with Kubernetes, Mesos and Calico

Slides from my talk at the London Mesos User Group meetup on September 24th 2015.

Many thanks and credit to my colleague, Spike Curtis, for much of the material!

Transcript

1. @projectcalico Project Calico is sponsored by Sponsored by Securing micro-services with Kubernetes, Mesos and Calico Ed Harrison @eepyaich 24th September 2015
2. @projectcalico Project Calico is sponsored by Remember 3-tier architectures?
3. @projectcalico Project Calico is sponsored by Getting Medieval
4. @projectcalico Project Calico is sponsored by Fast forward to the present
5. @projectcalico Project Calico is sponsored by Increased complexity
6. @projectcalico Project Calico is sponsored by Resource Fungibility
7. @projectcalico Project Calico is sponsored by Tear down the walls?
8. @projectcalico Project Calico is sponsored by The opportunity?
9. @projectcalico Project Calico is sponsored by The opportunity?
10. @projectcalico Project Calico is sponsored by The Distributed Firewall Network Fabric eth0 eth0 eth0 192.168.1.2 Routing Routing eth0 192.168.1.3 eth0 192.168.1.4 eth0 192.168.1.7 eth0 192.168.1.6 eth0 192.168.1.5 10.0.0.1 10.0.0.2
11. @projectcalico Project Calico is sponsored by Project Calico architecture eth0 192.168.1.2 eth0 192.168.1.4 eth0 192.168.1.7 Felix Routes iptables Route Reflector Kernel BGP Client
12. @projectcalico Project Calico is sponsored by Firewall Rules { "id": "WEB", "inbound_rules": [ {"action": "allow", "protocol": "tcp", "dst_ports": [80, 443]}, {"action": "allow", "protocol": "icmp"}, {"action": "deny"} ], "outbound_rules": [ {"action": "allow", "protocol": "tcp", "dst_tag": "syslog", "dst_ports": [514]}, {"action": "deny"} ] }
13. @projectcalico Project Calico is sponsored by Network Intent
14. @projectcalico Project Calico is sponsored by Where are we now? ... metadata: annotations: projectcalico.org/policy: "allow tcp from label role=backend" ... { "id": "probe-c", "uris": ["file:///star/star-probe"], "cmd": "./star-probe", "cpus": 0.1, "mem": 64.0, "ports": [], "labels": { "network_isolator.netgroups": "star-2" } }, • Calico network plugin • “Policy only” mode • Namespace isolation • Early demo of network plugin • Calico IPAM • Network isolation via netgroups
15. @projectcalico Project Calico is sponsored by Where is this heading?
16. @projectcalico Project Calico is sponsored by  Demos and info on our blog www.projectcalico.org/blog  Github  https://github.com/projectcalico  /calico  /calico-kubernetes  https://github.com/mesosphere/net- modules  Download & try it out  We welcome your feedback and contributions  Follow us @projectcalico  Follow me @eepyaich More information