Secure your cluster-to-cluster traffic, the agnostic way
Talkat KubeCon + CloudNativeCon North America 2021 · on Friday, 2021-10-15· at 11:00· Concourse Hall 151 + Online·
summary
Workday proves cluster-to-cluster routing that avoids public gateways by deploying a private Istio gateway for intra-cluster routing and a Consul mesh for DC-to-DC hops, using Istio+Envoy inside clusters and Consul mesh outside. Teams deliver routes via Helm-delivered config and a Golang AWS PrivateLink operator that implements two CRDs and provisions AWS resources. Operators automate create/update/teardown and the setup moves from AWS PrivateLink toward a cloud-agnostic mesh that works across datacenters and clouds.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:51Why clustertocluster communication
- 3:31Legacy communication
- 4:52Why istio
- 9:01Secure your traffic the agnostic way
- 13:22Multicloud strategy
- 14:08Console networking
- 15:15Why Console
- 16:45Advantages
- 18:02Notes about Console
- 19:51Console use case
- 20:22Communication
- 21:48Communication works
- 23:01Summary
related talks
21mWorkday's Multi-Cloud Network Fabric With Consul & Vault
32mService Networking Within Air-Gapped Environments: Deployment Strategies and Operat...
05mBest Practices on Setting up Multi Cluster Service Mesh in AWS
31mEffective building blocks for securing...
27mSecure Multicluster Istio Configuration Using GitOps...
26mService Mesh Journey - Building Security and Reliability One Si...
27mBridging Trust Between Multi-Cluster Meshes
42mAmbient Mesh: new sidecar less & faster Istio for zero trust