Dedicated Infrastructure in a Multitenant World
summary
Adobe Experience Manager runs 18+ multi-tenant Kubernetes clusters and implements per-tenant VNet and dedicated egress IPs by provisioning a VM scale set per tenant with Envoy VMs and Envoy sidecars in pods, connected by an encrypted HTTP/2 tunnel with mTLS with short-lived certs (Vault agents, SDS file reloads). Provisioning uses Terraform and K8s operators. Production issues include TLS errors only visible at debug level and the need to tune max stream duration, idle timeouts, and LB timeouts for long-lived connections.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:36Brief introduction about Adobe Experience Manager
- 2:12Adobe Experience Manager on Kubernetes
- 10:03Envoy VM configuration
- 12:44Certificate rotation
- 13:53Employee debugging
- 15:31Envoy setup
- 16:28Connection pools
- 18:26Resources
- 18:58Conclusion
related talks
05mLightning Talk: What Makes a Good Multi-tenant Kubernetes Solution?
28mDesigning and Securing a Multi-Tenant Runtime Environment at the New York Times
39mDesigning & Securing Multi-Tenant Runtime Environment at the New York Times
28mAdvanced Networking with Adobe Experience Manager as a Cloud Service
31munlighted, but what about Security and Multi tenancy?
29mManaging a Multi-Tenanted Kubernetes Cluster in Production
01h 00mArchitecting multi-tenant PaaS offerings
28mWhat We Learned Designing & Securing a Multi-Tenant Developer Platform at The New York Times