A service mesh helps to make service communication in distributed system architectures more secure, reliable, and traceable. In this context, one often thinks of terms like microservices, containers, or Kubernetes; the whole thing, of course, is mostly cloud-based. However, the reality is not quite so simple: IT system landscapes today are very heterogeneous and workloads are distributed on-premises as well as across one or more public cloud providers. This brings up a whole new set of questions, such as how to securely merge multiple clouds or how applications that cannot be containerized can benefit from the advantages of a mesh.

1. © OPITZ CONSULTING 2023 / Öffentlich
Build and Manage Multi-Cloud Applications With Kuma 1
Mainz, 2023-05-09
Fabian Hardt,
Sven Bernhardt
BUILD AND MANAGE MULTI-CLOUD
APPS WITH KUMA

2. © OPITZ CONSULTING 2023 / Öffentlich
Build and Manage Multi-Cloud Applications With Kuma 2
WHY SERVICE MESH?
01
KUMA
02
CONCLUSION
04
DEMO
03

3. © OPITZ CONSULTING 2023 / Öffentlich
Build and Manage Multi-Cloud Applications With Kuma 3
WHY SERVICE MESH?
01

4. © OPITZ CONSULTING 2023 / Öffentlich
TREND TOWARDS DISTRIBUTED APPLICATION ARCHITECTURES
Build and Manage Multi-Cloud Applications With Kuma 4
Centralized
STATIC
ON-PREM
MONOLITH
VIRTUAL MACHINES
MANUAL CHANGE PROCESS
Decentralized
DYNAMIC
CLOUD / MULTI-CLOUD
MICROSERVICES / SERVERLESS
CONTAINERS, KUBERNETES
AUTOMATED CI/CD TOOL CHAIN
# Services & APIs
CONTROL AND VISIBILITY

5. © OPITZ CONSULTING 2023 / Öffentlich
INCREASED COMPLEXITY AND COGNITIVE LOAD ON DEVS
Build and Manage Multi-Cloud Applications With Kuma 5
Security Security
Logging Logging
Security
Tracing
Metrics Routing
Metrics Tracing
Application
AuthN/Z
Rate-Limiting
Routing
Caching
Organization
Application
AuthN/Z
Versioning
Versioning
Rate-Limiting

6. © OPITZ CONSULTING 2023 / Öffentlich
IN THE END, IT’S ALL ABOUT SERVICE CONNECTIVITY
Build and Manage Multi-Cloud Applications With Kuma 6
¢ Between applications
¢ Within applications
¢ At the edge
EDGE
Monolithic back
end service
Microservices
based app
Microservices exposed at edge
for external consumption

7. © OPITZ CONSULTING 2023 / Öffentlich
WHAT’S A SERVICE MESH?
Build and Manage Multi-Cloud Applications With Kuma 7
¢ Efficient implementation of cross-cutting
concerns with respect to service
integration challenges
¢ Everything is a service!
¢ Cloud-native apps deployed to Kubernetes
¢ Non Cloud-native workloads
¢ Should be independent of
¢ Architecture (e.g. Monolithic or µService)
¢ Platform (e.g. VMs, Containers, Kubernetes)
Dedicated infrastructure layer that
makes service-to-service communication
more reliable, secure and observable

8. © OPITZ CONSULTING 2023 / Öffentlich
Build and Manage Multi-Cloud Applications With Kuma 8

9. © OPITZ CONSULTING 2023 / Öffentlich
E2E SERVICE CONNECTIVITY WITH GATEWAY AND MESH
Build and Manage Multi-Cloud Applications With Kuma 9
¢ Increased Developer experience
¢ Consistent security
¢ Seamless observability
¢ Reliable connectivity
¢ Resilience
¢ Flexibility
GW DP
CLIENT
PUBLIC TRAFFIC
GW DP
MESH CP
MESH 1 MESH 2

10. © OPITZ CONSULTING 2023 / Öffentlich
Build and Manage Multi-Cloud Applications With Kuma 10
KUMA
02

11. © OPITZ CONSULTING 2023 / Öffentlich
KUMA INTRODUCTION
Build and Manage Multi-Cloud Applications With Kuma 11
¢ Initially invented by Kong and donated to CNCF in 2020
¢ Provides a modern distributed Control Plane
¢ Completely Envoy-based Data Plane proxies
¢ Platform agnostic open-source control plane for Service Mesh
¢ Hence Kuma is
¢ Universal
¢ Simple
¢ Scalable
¢ Flexible deployment options
¢ Standalone deployment
¢ Multi-Zone deployment
Source: https://tinyurl.com/xb57bhx5

12. © OPITZ CONSULTING 2023 / Öffentlich
KUMA STANDALONE ARCHITECTURE
Build and Manage Multi-Cloud Applications With Kuma 12

13. © OPITZ CONSULTING 2023 / Öffentlich
KUMA MULTI-CLUSTER ARCHITECTURE
Build and Manage Multi-Cloud Applications With Kuma 13
¢ One mesh can be deployed over multiple clusters (=> Zone)
¢ All traffic enters cluster over zone ingress
¢ One Remote (Zone) Control Plane in each cluster

14. © OPITZ CONSULTING 2023 / Öffentlich
KUMA NETWORKING / CNI
Build and Manage Multi-Cloud Applications With Kuma 14
¢ Installed as DaemonSet on all Nodes
¢ Injects label on Pods - k8s.v1.cni.cncf.io/networks: kuma-cni
¢ CNI enables Transparent Proxying – redirects all traffic through Data Plane

15. © OPITZ CONSULTING 2023 / Öffentlich
KUMA NETWORKING / INIT-CONTAINER
Build and Manage Multi-Cloud Applications With Kuma 15
¢ Injected to Pod and started individually before Data Plane
¢ Configures iptables / network routing

16. © OPITZ CONSULTING 2023 / Öffentlich
SERVICE MESH DNS
Build and Manage Multi-Cloud Applications With Kuma 16
¢ Local DNS resolution directly in Data Plane (Envoy)
¢ Names are not resolvable in complete cluster, just inside service mesh (Envoy)
¢ Resolves “.mesh“ address to pre-defined service mesh IP address
¢ IP in other zone / cluster is routed over Kuma Zone Ingress

17. © OPITZ CONSULTING 2023 / Öffentlich
ZONE EGRESS
Build and Manage Multi-Cloud Applications With Kuma 17
¢ Special Data Plane instance – like Zone Ingress
¢ All outgoing traffic is routed through this instance
¢ Usage of External Services just possible with deployed Zone Egress in the future

18. © OPITZ CONSULTING 2023 / Öffentlich
Build and Manage Multi-Cloud Applications With Kuma 18
DEMO
03

19. © OPITZ CONSULTING 2023 / Öffentlich
ARCHITECTURE OVERVIEW
Build and Manage Multi-Cloud Applications With Kuma 19

20. © OPITZ CONSULTING 2023 / Öffentlich
ASPECTS COVERED
Build and Manage Multi-Cloud Applications With Kuma 20
¢ Mesh Management (Kuma UI)
¢ Simplicity of Kuma Zone Registration
¢ Managing Apps within the Mesh
¢ Locality Awareness
¢ Advanced Routing
¢ Security
¢ Mesh observability

21. © OPITZ CONSULTING 2023 / Öffentlich
Build and Manage Multi-Cloud Applications With Kuma 21
CONCLUSION
04

22. © OPITZ CONSULTING 2023 / Öffentlich
SERVICE MESH BENEFITS
Build and Manage Multi-Cloud Applications With Kuma 22
¢ Increased Developers productivity
¢ Self-service network management
¢ Reliable connectivity
¢ Zero-trust security
¢ Service Discovery
¢ Observability

23. © OPITZ CONSULTING 2023 / Öffentlich
KEY TAKEAWAYS
Build and Manage Multi-Cloud Applications With Kuma 23
¢ Service Mesh is essential to build and managing multi-cloud apps efficiently
¢ Kuma as mesh implementation provides
¢ Agnostic approach (independent of architecture or platform)
¢ Modern, flexible architecture supporting hybrid, multi-cloud scenarios
¢ Multi-zone
¢ Multi-cluster
¢ Multi-mesh
¢ Seamless CI / CD integration (GitOps)
¢ Intuitive design
¢ Spanning a mesh over multiple clusters and clouds can be done easily

24. © OPITZ CONSULTING 2023 / Öffentlich
MATERIALS
Build and Manage Multi-Cloud Applications With Kuma 24
¢ Demo Source: https://github.com/KongChampions/kuma-multi-zone-mesh
¢ Kuma docs: https://kuma.io/docs/2.2.x/
¢ Kuma Counter Demo: https://github.com/kumahq/kuma-counter-demo
¢ Kuma introduction – Meetup recording “Service integration made easy with OpenSource
Kuma”: https://www.youtube.com/watch?v=f3GeuKzYrsA&t=1s
¢ Demo “Service integration made easy with OpenSource Kuma”:
https://github.com/svenbernhardt/service-integration-made-easy
¢ Kong / Kuma and friends (k3d)– https://github.com/FabianHardt/k3d-bootstrap-cluster

25. © OPITZ CONSULTING 2023 / Öffentlich
TEASER: HANDS-ON WORKSHOP SERVICE MESH FOR JAVA DEVS
Build and Manage Multi-Cloud Applications With Kuma 25
Besucht uns am
Stand!

26. © OPITZ CONSULTING 2023 / Öffentlich
Build and Manage Multi-Cloud Applications With Kuma 26
Q & A
https://opitzcloud.canto.global/b/H0EMG

27. © OPITZ CONSULTING 2023 / Öffentlich
Build and Manage Multi-Cloud Applications With Kuma 27
www.opitz-consulting.com
KONTAKT
Sven Bernhardt
Chief Architect
Sven.Bernhardt@opitz-consulting.com
+49 172 2193529
https://www.xing.com/profile/Sven_Bernhardt/
https://www.linkedin.com/in/sven-bernhardt-0570b823/
Fabian Hardt
Solution Architect
Fabian.Hardt@opitz-consulting.com
https://twitter.com/fabian_hardt
https://www.xing.com/profile/Fabian_Hardt
https://www.linkedin.com/in/fabian-hardt-0956b1b1