Building Ingress: From Concept to Connection (#JOTB23)

This is a talk given at J on the Beach 2023 in Malaga, Spain.

Talk abstract: At first glance, ingress is an easy concept: you route traffic from the wider world into your cluster. As you layer on SSL and load balancing, the principles stay the same and everything works with minimal thought and effort. But as your infrastructure grows, your clusters grow, the interactions get more complex, and your security requirements explode. In this session, I’ll walk you through how we designed and built an Ingress Controller and have converted our clusters to use it in production to support millions of requests. It wasn’t easy but running it as an open source effort from the start encouraged our team and customers to review, explore, and consider situations outside our original plans.

Transcript

1. Building Ingress From Concept to Connection Scott McAllister Principal Developer Advocate
2. © ngrok. All rights reserved. Confidential Information of ngrok
3. © ngrok. All rights reserved. Confidential Information of ngrok
5. Trade-offs
6. Your service
7. Your service Your customer Before ngrok
8. Your service Your customer Before ngrok Internet NAT 202.45.1.1 192.168.1 SW NAT
9. Your service Your customer Before ngrok Internet NAT 202.45.1.1 192.168.1 SW NAT Internet Router VPN Router VPNs Firewalls Internet Public firewall DMZ Internal firewall email
10. After ngrok Your service Your customer
11. > ngrok CLI ngrok http 80 —domain=“jotb-2023.ngrok.dev" Session Status online Account Scott McAllister (Plan: Pro) Version 3.2.2 Region Europe (eu) Latency 235ms Web Interface http://127.0.0.1:4040 Forwarding https://jotb-2023.ngrok.dev
12. © ngrok. All rights reserved. Confidential Information of ngrok © ngrok. All rights reserved. Confidential Information of ngrok “Developers are still being forced to work with the assembly language of networking” — Alan Shreve, ngrok founder
13. © ngrok. All rights reserved. Confidential Information of ngrok Application Code & Dependencies
14. © ngrok. All rights reserved. Confidential Information of ngrok Container Application Code & Dependencies
15. © ngrok. All rights reserved. Confidential Information of ngrok Pod Container Application Code & Dependencies
16. © ngrok. All rights reserved. Confidential Information of ngrok Pod
17. © ngrok. All rights reserved. Confidential Information of ngrok Pod Pod Pod
18. © ngrok. All rights reserved. Confidential Information of ngrok Pod Pod Pod Service
19. © ngrok. All rights reserved. Confidential Information of ngrok Pod Pod Pod Service Ingress
20. Typical Ingress Set Up with Nginx Source: https://www.checkmateq.com/blog/ingress-controller/
21. ngrok’s Journey
22. Trade-off Monolith or Microservices
23. Lego Monolith Media Metrics Web Auth API https://inconshreveable.com/10-07-2015/the-neomonolith/
24. ngrok as a Service in Kubernetes Source: https://www.checkmateq.com/blog/ingress-controller/ Source: https://abhishek1987.medium.com/expose-kubernetes-services-with-ngrok-65280142dab4
26. Architecture Seamless Kubernetes integration Idiomatic API
27. Trusted Infrastructure Webhook Validation Auth Load Balancing Encryption Auth Webhook Verification
31. Typical Ingress Set Up with Nginx Source: https://www.checkmateq.com/blog/ingress-controller/
32. ngrok Ingress Controller: our journey
33. Development Kubebuilder Framework for building Kubernetes APIs using custom resource definitions (CRDs) Controller Runtime Set of standard Go libraries for building Kubernetes Controllers
34. Trade-offs Ingress Controller vs Gateway API Spec Widely used specification It’s what we use internally Most Gateway implementations still in Alpha Gateway specs still in flux Supports more than just HTTP/S Standard going forward Community already knows how to use “Everything Ingress is…but better”
35. Current Status Project Status: Beta Using Internally on Infrastructure Cluster For CI Processes
36. Current Status Seeking Feedback!
37. What’s Next Support Gateway API Spec Publicly Release v.1
38. © ngrok. All rights reserved. Confidential Information of ngrok Resources Controller Runtime https://github.com/kubernetes-sigs/controller-runtime Kubebuilder https://book.kubebuilder.io/ ngrok Ingress Controller for Kubernetes https://github.com/ngrok/kubernetes-ingress-controller Kubernetes Ingress Controller https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/ Kubernetes API Gateway https://gateway-api.sigs.k8s.io/
39. Scott McAllister Speaker, Writer, Coder @stmcallister stmcallister.github.io @stmcallister.bsky.social techhub.social/@stmcallister
40. Thank you