Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Building a Bank with Kubernetes – Kubecon 2016

Avatar for Oliver Beattie Oliver Beattie
November 09, 2016
Technology
610
1

Building a Bank with Kubernetes – Kubecon 2016

Avatar for Oliver Beattie

Oliver Beattie

November 09, 2016

More Decks by Oliver Beattie

See All by Oliver Beattie
Anatomy of a Production Kubernetes Outage – Kubecon EU 2018
Avatar for Oliver Beattie obeattie
4
4.7k
DevOps Exchange London – Network Security at Monzo
Avatar for Oliver Beattie obeattie
0
270
Building a Bank with Kubernetes – Kubernetes London Meetup, Autumn 2016
Avatar for Oliver Beattie obeattie
10
47k

Other Decks in Technology

See All in Technology
AIが自社のTableauを操作する世界へ：Tableau MCP超入門
Avatar for Yukako Tabata tbtykk
0
120
トヨタ⽣産⽅式(TPS)⼊⾨
Avatar for Recruit recruitengineers
PRO
2
610
바이브풀 라이프
Avatar for Arawn Park arawn
0
100
ボトムアップ文化が強い組織で セキュリティをどう根付かせていくかの現在進行形の話 / Making Security Stick in a Bottom-Up Organization
Avatar for Takashi Yamaguchi yamaguchitk333
0
200
もう一度考える SRE チームの作り方・育て方 / Rethinking SRE #1: Building and Growing SRE Teams
Avatar for rrreeeyyy rrreeeyyy
6
1k
[ChatGPT Work LT]事務作業が苦手な人のための バックオフィスの「半」自動化
Avatar for chimaki chimaki_iot
0
240
ホームラボ紹介
Avatar for 世良泰明 y_sera15
0
110
組織にどうSREを根付かせるか？〜IVRyの場合〜
Avatar for abnoumaru abnoumaru
0
330
20分でわかるセキュアAPI
Avatar for nwiizo nwiizo
0
180
OSPN.JPバージョンアップ作業進捗のご報告 / 20260801-osc26kyoto
Avatar for Akira Ouchi akkiesoft
0
350
侵入は突然に 〜 IoTマルウェアと悪用される家庭の機器 ～ / When Intrusion Strikes: IoT Malware and the Abuse of Home Devices
Avatar for NTT docomo Business nttcom
0
1.5k
Pavlokで始める電撃駆動開発
Avatar for 佐藤陽威 sgrsn
0
170

Featured

See All Featured
HTML-Aware ERB: The Path to Reactive Rendering @ RubyCon 2026, Rimini, Italy
Avatar for Marco Roth marcoroth
3
410
GraphQLの誤解/rethinking-graphql
Avatar for sonatard sonatard
75
12k
How to build an LLM SEO readiness audit: a practical framework
Avatar for Nick Samuel nmsamuel
1
840
Code Review Best Practice
Avatar for Trisha Gee trishagee
74
20k
How to train your dragon (web standard)
Avatar for Monica Dinculescu notwaldorf
97
6.7k
Easily Structure & Communicate Ideas using Wireframe
Avatar for Afnizar Nur Ghifari afnizarnur
194
17k
Principles of Awesome APIs and How to Build Them.
Avatar for Keavy McMinn keavy
128
18k
HDC tutorial
Avatar for Michiel Stock michielstock
2
780
The B2B funnel & how to create a winning content strategy
Avatar for Katarina Dahlin katarinadahlin
PRO
1
460
Deep Space Network (abreviated)
Avatar for Tony Rice tonyrice
0
250
The #1 spot is gone: here's how to win anyway
Avatar for Tamara Novitovic tamaranovitovic
3
1.1k
YesSQL, Process and Tooling at Scale
Avatar for Rocio Delgado rocio
174
15k

Transcript

  1. Building a Bank with Kubernetes

  2. Oliver Beattie @obeattie Head of Engineering, Monzo

  3. None
  4. None
  5. None
  6. None
  7. None
  8. None
  9. None
  10. None

  11. Pre-application 9 months Application 6 months Mobilisation 4–8 months

  12. Extensible Efficient Resilient Secure

  13. Extensible Efficient Resilient Secure

  14. Application Database

  15. Application Database Cache

  16. Application Database Cache Load balancer Cache Cache Application Application

  17. Database Cache Load balancer Database Database Cache Cache Application Application

    Application

  18. Database Cache Load balancer Database Database Cache Cache Application Application

    Application

  19. Application Database Cache Load balancer Application Application Database Database Cache

    Cache
  20. None
  21. None
  22. None

  23. Extensible Efficient Resilient Secure

  24. None

  25. app

  26. app

  27. core app

  28. None
  29. None

  30. Extensible Efficient Resilient Secure

  31. None
  32. None

  33. Load balancing Tracing Circuit breakers Retries Canarying Load shedding Error

    tracking Metrics Service discovery Logging Timeouts Expirations Security policies Back-offs Retry budgets Dynamic routing

  34. Minimise latency ⏱ Maximise success

  35. linkerd Finagle

  36. HOST A service. CONTAINER 10.224.15.2 service.cruft CONTAINER 10.224.15.1 LINKERD 10.102.32.198

    10.224.15.3 HOST B service. CONTAINER 10.224.16.2 service.cruft CONTAINER 10.224.16.1 LINKERD 10.102.34.192 10.224.16.3 HOST C service. CONTAINER 10.224.17.2 service.cruft CONTAINER 10.224.17.1 LINKERD 10.102.36.187 10.224.17.3

  37. HOST A service. CONTAINER 10.224.15.2 service.cruft CONTAINER 10.224.15.1 LINKERD 10.102.32.198

    10.224.15.3 GET / HTTP/1.1 Host: service. HOST B service. CONTAINER 10.224.16.2 service.cruft CONTAINER 10.224.16.1 LINKERD 10.102.34.192 10.224.16.3 HOST C service. CONTAINER 10.224.17.2 service.cruft CONTAINER 10.224.17.1 LINKERD 10.102.36.187 10.224.17.3

  38. HOST A service. CONTAINER 10.224.15.2 service.cruft CONTAINER 10.224.15.1 LINKERD 10.102.32.198

    10.224.15.3 GET / HTTP/1.1 Host: service. HOST B service. CONTAINER 10.224.16.2 service.cruft CONTAINER 10.224.16.1 LINKERD 10.102.34.192 10.224.16.3 HOST C service. CONTAINER 10.224.17.2 service.cruft CONTAINER 10.224.17.1 LINKERD 10.102.36.187 10.224.17.3

  39. HOST A service. CONTAINER 10.224.15.2 service.cruft CONTAINER 10.224.15.1 LINKERD 10.102.32.198

    10.224.15.3 Host: service. → 10.224.17.3 GET / HTTP/1.1 Host: service. HOST B service. CONTAINER 10.224.16.2 service.cruft CONTAINER 10.224.16.1 LINKERD 10.102.34.192 10.224.16.3 HOST C service. CONTAINER 10.224.17.2 service.cruft CONTAINER 10.224.17.1 LINKERD 10.102.36.187 10.224.17.3 Host: service. → 10.224.17.2

  40. HOST A service. CONTAINER 10.224.15.2 service.cruft CONTAINER 10.224.15.1 10.224.15.3 Host:

    service. GET / HTTP/1.1 Host: service. HOST B service. CONTAINER 10.224.16.2 service.cruft CONTAINER 10.224.16.1 10.224.16.3 HOST n edge CONTAINER 10.224.18.2 service.cruft CONTAINER 10.224.18.1 LINKERD 10.102.36.110 10.224.18.3 HOST n edge CONTAINER 10.224.16.2 service.cruft CONTAINER 10.224.16.1 LINKERD 10.102.32.192 10.224.16.3 GET / HTTP/1.1 → service. ELB

  41. AWS eu-west-1

  42. AWS eu-west-1

  43. None

  44. Co-location uk-1 Co-location uk-2 AWS eu-west-1

  45. Co-location uk-1 Co-location uk-2 AWS eu-west-1 ⚡

  46. Co-location uk-1 Co-location uk-2 AWS eu-west-1 ⚡

  47. Co-location uk-1 Co-location uk-2 AWS eu-west-1 BGP BGP BGP BGP

  48. Co-location uk-1 Co-location uk-2 AWS eu-west-1 BGP BGP BGP BGP

    ⚡ ⚡

  49. Co-location uk-1 Co-location uk-2 AWS eu-west-1 BGP BGP ⚡ ⚡

  50. “Connectivity” Pod BGP IPSec BGP BGP StrongSwan (IPSec) GNU Zebra


    (BGP) Hardware VPN device Services Services Services AWS Co-location Third parties

  51. Extensible Efficient Resilient Secure

  52. Device isolation Process isolation Data encryption Filesystem isolation Privilege isolation

    Network isolation Resource isolation Principle of least privilege Log monitoring Secret management

  53. Device isolation Process isolation Data encryption Filesystem isolation Privilege isolation

    Network isolation Resource isolation Principle of least privilege Log monitoring Secret management

  54. k8s-master Availability Zone A Availability Zone B Availability Zone C

    admin user data k8s-worker dmz

  55. k8s-master Availability Zone A Availability Zone B Availability Zone C

    k8s-worker dmz

  56. Calico + network policy

  57. zone: super-secure

  58. apiVersion: extensions/v1beta1 kind: NetworkPolicy metadata: name: super-secure-zone spec: podSelector: matchLabels:

    zone: super-secure ingress: - from: - podSelector: matchLabels: zone: super-secure ports: - protocol: tcp

  59. Extensible Efficient Resilient Secure

  60. monzo.com/careers

  61. Q&A .

  62. @obeattie