Folien zum Webcast am 11. Mai 2021

1. © OPITZ CONSULTING 2021 / Öffentlich
Dienstag, 11.5.2021, 16:00 Uhr
ARCHITECTURE
ROOM STUTTGART
Architecture Room Stuttgart 1

2. © OPITZ CONSULTING 2021 / Öffentlich
Architecture Room Stuttgart
Neue Technologien Interessante
Architekturen
Best Practices Methoden
ARCHITECTURE ROOM?
Seite 2

3. © OPITZ CONSULTING 2021 / Öffentlich
BITTE BEACHTEN SIE…
Wir werden Ihnen
die Aufzeichnung
dieses Webinars
sowie die
Vortragsfolien in
den nächsten
Tagen zusenden.
Alle Teilnehmer
sind
stummgeschaltet.
Nur so können wir
ein störungsfreies
Webinar bei großer
Personenzahl
gewährleisten.
Bitte melden Sie
sich bei
technischen
Störungen
während des
Webinars über die
Frage-Funktion an
die Organisatoren.
Ihre inhaltlichen
Fragen stellen Sie
bitte auch über die
Frage-Funktion.
Wir beantworten
diese gerne zum
Ende des Webinars.
Architecture Room Stuttgart Seite 3

4. © OPITZ CONSULTING 2021 / Öffentlich
Architecture Room Stuttgart 4
Stuttgart, 11.05.2021
Sven Bernhardt
CLOUD-NATIVE IS JUST PART
OF THE GAME

5. © OPITZ CONSULTING 2021 / Öffentlich
THAT‘S ME
Architecture Room Stuttgart 5
Sven Bernhardt
Cloud-Native enthusiast, API & integration geek. Always curious how new
technologies and concepts can help to make things more valuable and efficient.
¢ Chief Architect / Integration Evangelist@OPITZ CONSULTING Deutschland GmbH
¢ Oracle ACE Director
@sbernhardt
https://svenbernhardt.wordpress.com/

6. © OPITZ CONSULTING 2021 / Öffentlich
AGENDA
Architecture Room Stuttgart 6
CLOUD-NATIVE
01
CHALLENGES
02
SERVICE MESH
04
API GATEWAY
03
API GATEWAY & SERVICE
MESH
05
SUMMARY
06

7. © OPITZ CONSULTING 2021 / Öffentlich
CLOUD-NATIVE :
PARADIGM TO BUILT APPS FOR
THE CLOUD!
Architecture Room Stuttgart 7

8. © OPITZ CONSULTING 2021 / Öffentlich
WHAT DOES CLOUD-NATIVE MEAN?
Architecture Room Stuttgart 8
¢ Apps follow the 12-factor app methodology for delivering software as a service (or product)
¢ Definition (published by Cloud Native Computing Foundation (CNCF)):
¢ Independent of deployment scenario:
¢ On-prem, hybrid or hybrid multi-cloud Source: https://pivotal.io/cloud-native
Cloud native technologies empower organizations to build and run
scalable applications in modern, dynamic environments such as
public, private, and hybrid clouds.
Containers, service meshes, microservices, immutable infrastructure,
and declarative APIs exemplify this approach.
These techniques enable loosely coupled systems that are resilient,
manageable, and observable. Combined with robust automation,
they allow engineers to make high-impact changes frequently and
predictably with minimal toil.

9. © OPITZ CONSULTING 2021 / Öffentlich
LOOSE COUPLING OFTEN MEANS MORE DISTRIBUTION
Architecture Room Stuttgart 9
¢ Single Deployment unit
¢ Single execution process
¢ Shared database
¢ Local, app-internal communication only
¢ Multiple Deployment units
¢ Exclusive execution process per service
¢ Database per Service (usually)
¢ Remote, inter-service communication
UI
Business
Logic
Persistence
Monolithic app architecture Cloud-native app architecture

10. © OPITZ CONSULTING 2021 / Öffentlich
SERVICE DISTRIBUTION COMES
AT A PRICE
Architecture Room Stuttgart 10
• Amount of traffic
• Number of services
• Teams autonomity
Reliability
¢ Traffic connectivity & reliability
¢ Zero-trust security
¢ Observability
¢ Log aggregation
¢ Metrics management
¢ Service tracing
Challenges

11. © OPITZ CONSULTING 2021 / Öffentlich
INCREASED COMPLEXITY AND CHALLENGES WITH RESPECT TO
DEVELOPMENT CONSISTENCY
Architecture Room Stuttgart 11
Security Security
Logging Logging
Security
Tracing
Metrics Routing
Metrics Tracing
Application
AuthN/Z
Rate-Limiting
Routing
Caching
Organization
Application
AuthN/Z
Versioning
Versioning
Rate-Limiting

12. © OPITZ CONSULTING 2021 / Öffentlich
RELIABLE CONNECTIVITY IS A MULTIDIMENSIONAL PROBLEM
Architecture Room Stuttgart 12
App App App
App
Edge Cross-App In-App
Monolith Services Microservices Serverless …

13. © OPITZ CONSULTING 2021 / Öffentlich
Architecture Room Stuttgart 13
… BUT: WE’RE USUALLY NOT STARTING ON A GREENFIELD!
https://opitzcloud.canto.global/b/GI7R1

14. © OPITZ CONSULTING 2021 / Öffentlich
Architecture Room Stuttgart 14
API GATEWAY
https://www.flickr.com/photos/matmatmat/20153807915/sizes/l/

15. © OPITZ CONSULTING 2021 / Öffentlich
API GATEWAY CHARACTERISTICS
Architecture Room Stuttgart 15
¢ Single entry point for clients to access Services
¢ No matter the implementation technology
¢ No matter the architecture (Monolithic or µService)
¢ Provides a consistent governance model
¢ Decouples Client and Service implementation
¢ Is deployed separately in its own instance
¢ Deployment models:
¢ Bundled data and control plane
¢ Independent data and control plane
Source: https://tinyurl.com/yxbds3cd

16. © OPITZ CONSULTING 2021 / Öffentlich
ARCHITECTURE CONSIDERATIONS
Architecture Room Stuttgart 16
¢ Supports API Design-first
¢ Allows seamless DevOps (CI / CD) integration
¢ Runs on every infrastructure (Containers, VMs, etc.)
¢ Support for different types of APIs (SOAP, REST,
GraphQL, gRPC)
¢ Hybrid architecture
¢ Centralized Control plane (Management)
¢ Distributed Data planes (Workers)
Source: https://tinyurl.com/y67tlr77

17. © OPITZ CONSULTING 2021 / Öffentlich
USE CASES
Architecture Room Stuttgart 17
¢ API as products
¢ API products needs to be accessible from outside and inside
¢ API Gateway as an abstraction layer
¢ Service Connectivity
¢ Enforce networking policies to connect, secure, encrypt, protect and observe communication
¢ Decoupling
¢ Client to API Gateway
¢ API Gateway to upstream service
¢ Capabilities to cover: Edge / Boundary Routing, Security, Versioning, API Monetization, API
Analytics

18. © OPITZ CONSULTING 2021 / Öffentlich
Architecture Room Stuttgart 18
API life cycle as proposed by Luis Weir
(@luisw19) in his book „Enterprise API
Management“
API products
need proper
governance!

19. © OPITZ CONSULTING 2021 / Öffentlich
WHAT CAN API GATEWAY HELP YOU WITH?
Architecture Room Stuttgart 19

20. © OPITZ CONSULTING 2021 / Öffentlich
Architecture Room Stuttgart 20
SERVICE MESH
https://www.flickr.com/photos/26020895@N04/15695786155/sizes/l/

21. © OPITZ CONSULTING 2021 / Öffentlich
SERVICE MESH CHARACTERISTICS
Architecture Room Stuttgart 21
¢ Platform that makes service-to-service communication more reliable, secure and observable
¢ Helps to implement cross-cutting concerns with respect to service integration challenges
more efficient
¢ Is deployed co-located with the corresponding service
¢ Deployment model: Distributed Data planes with central Control plane
¢ Can be applied on any
¢ Architecture (e.g. Monolithic or µService)
¢ Platform (e.g. VMs, Containers, Kubernetes) Service
(Business logic)
Sidecar
(Supporting
functionality like
Logging,
Configuration,
etc.)
Host / VM / Pod

22. © OPITZ CONSULTING 2021 / Öffentlich
USE CASES
Architecture Room Stuttgart 22
¢ Network management and reliable connectivity
¢ No longer Developer’s responsibility (Increased developer productivity)
¢ Consistent, declarative management at infrastructure level
¢ Zero-trust security
¢ Define traffic permissions (Who with whom?)
¢ Secure communication via mTLS
¢ Automated certificate management
¢ Capabilities to cover: Security (mTLS), Traffic routing, Observability, Resiliency

23. © OPITZ CONSULTING 2021 / Öffentlich
ARCHITECTURE CONSIDERATIONS
Architecture Room Stuttgart 23
¢ Runs on every infrastructure (Containers, VMs, etc.)
¢ Everything is a service!
¢ Cloud-native apps deployed to Kubernetes
¢ Non Cloud-native workloads
¢ Allows for multi-zone, hybrid Mesh deployment
¢ Span multiple Kubernetes Clusters
¢ Span multiple Clouds
¢ Span on-prem workloads

24. © OPITZ CONSULTING 2021 / Öffentlich
WHAT CAN SERVICE MESH HELP YOU WITH?
Architecture Room Stuttgart 24

25. © OPITZ CONSULTING 2021 / Öffentlich
Architecture Room Stuttgart 25
API GATEWAY AND SERVICE MESH
https://opitzcloud.canto.global/b/Q93DV

26. © OPITZ CONSULTING 2021 / Öffentlich
SIMILARITIES AND DIFFERENCES
Architecture Room Stuttgart 26
API Gateway
¢ Handles external edge / boundary traffic
¢ Controls in and out data flow
¢ Bridges security trust domains (hybrid)
¢ Focus on exposing business functionality
Service Mesh
¢ Handles internal traffic
¢ Controls service-2-service communication
¢ Ensures internal trust between services
¢ Operates at the infrastructure level
Service Mesh
Security
Observability
Traffic Routing
Resilency
API Gateway
Security / Access Control
API Contracts. & limits
Developer portal & docs
API Monetization
Rate Limits

27. © OPITZ CONSULTING 2021 / Öffentlich
CONSISTENCE FROM THE EDGE TO THE TARGET SERVICE
Architecture Room Stuttgart 27
¢ External Clients access an organization’s services
through the API Gateway (Single Point of entry)
¢ API Gateways are integrated in the Mesh
¢ Just another service from the Mesh’s perspective
¢ Also get own Service Mesh Proxy (SMP)
¢ Internal traffic routing is handeled by the Mesh
¢ Benefits:
¢ Consistent security
¢ Proper insights / Observability
¢ Increased Developer’s productivity

28. © OPITZ CONSULTING 2021 / Öffentlich
API GATEWAY AND SERVICE MESH IN ACTION
Architecture Room Stuttgart 28
¢ Demo shows the Kuma demo application
¢ Service Mesh: Kuma Mesh (originary invented by Kong, but now donated to CNCF)
¢ API Gateway: Kong OSS API Gateway
Frontend
App
Kubernetes Cluster
Backend
App
Backend
App
Backend
App
Client

29. © OPITZ CONSULTING 2021 / Öffentlich
WHY KONG API GATEWAY?
Architecture Room Stuttgart 29
¢ Kong Microservice API Gateway
¢ Lightweight
¢ Scalable
¢ Modular
¢ Infrastructure-agnostic
¢ Deployed on top of reliable technologies
¢ Extensible using Plugins and other Open Source
compnents (Lua, Go and JavaScript)
¢ API-driven: Fully configurable using a REST API
¢ Smooth integration in existing CI/CD Pipelines
Flexible Deployment approach
Classic deployment
K8s Microgateway deployment K8s Ingress deployment
Hybrid deployment

30. © OPITZ CONSULTING 2021 / Öffentlich
WHY KUMA MESH?
Architecture Room Stuttgart 30
¢ Provides a modern distributed Control Plane and uses Envoy for depiciting the Data Plane
¢ Platform agnostic open-source control plane for Service Mesh
¢ Hence Kuma is
¢ Universal
¢ Simple
¢ Scalable
¢ Envoy-based
¢ Supports different deployment models
¢ Standalone deployment
¢ Multi-Zone deployment
Source: https://tinyurl.com/rbp4t8m3

31. © OPITZ CONSULTING 2021 / Öffentlich
KUMA DEPLOYMENT MODES
Architecture Room Stuttgart 31
Standalone
Multi-Zone
Source: https://tinyurl.com/khradpjk Source: https://tinyurl.com/4jktvunk

32. © OPITZ CONSULTING 2021 / Öffentlich
API GATEWAY ALTERNATIVES TO KONG
Architecture Room Stuttgart 32
Source: Smartbear “State of API 2020”
Source: Magic Quadrant for Full Life Cycle API Management, Sept. 2020
Source: CNCF Cloud Naitve Landscape (Category: API Gateway)

33. © OPITZ CONSULTING 2021 / Öffentlich
SERVICE MESH ALTERNATIVES TO KUMA MESH
Architecture Room Stuttgart 33
Source: CNCF Survey Report 2020
Source: CNCF Cloud Naitve Landscape (Category: Service Mesh)
Source: https://servicemesh.es

34. © OPITZ CONSULTING 2021 / Öffentlich
Architecture Room Stuttgart 34
SUMMARY
https://opitzcloud.canto.global/b/RPPN0

35. © OPITZ CONSULTING 2021 / Öffentlich
CLOUD-NATIVE BECOMES MORE AND MORE IMPORTANT
Architecture Room Stuttgart 35
¢ The future is Cloud-native
¢ Hybrid, Multi-Cloud architectures will be the norm
Source: CNCF Survey Report 2020
Data center usage Cloud-native benefits

36. © OPITZ CONSULTING 2021 / Öffentlich
RELEVANCY OF API GATEWAYS AND SERVICE
MESH
Architecture Room Stuttgart 36
Service Mesh usage
Source: CNCF Survey Report 2020
Source: Smartbear “State of API 2020”
Source: Smartbear “State of API 2020”

37. © OPITZ CONSULTING 2021 / Öffentlich
KEY TAKEAWAYS
Architecture Room Stuttgart 37
¢ API Gateway and Service mesh can be combined (depending on the use case)
¢ Both Patterns help to increase developers efficiency
¢ Devs can focus on business code, while things like connectivity challenges are solved on an
infrastructure level (by a mesh)
¢ Central management
¢ BUT: Could also be seen critical by developers, since it also decreases a team’s autonomy!
¢ Using either API Gateway or Serivce mesh does not depend on the direction, but on the use
case (North-South vs. East-West)

38. © OPITZ CONSULTING 2021 / Öffentlich
Architecture Room Stuttgart 38
Q & A
https://opitzcloud.canto.global/b/H0EMG

39. © OPITZ CONSULTING 2021 / Öffentlich
USEFUL LINKS / RESOURCES
Architecture Room Stuttgart 39
¢ Blog Christian Posta: Do I Need an API Gateway if I Use a Service Mesh?
¢ CNCF: Cloud-native Trail Map
¢ CNCF: CNCF Cloud-native landscape
¢ Smartbear: The State of API 2020 Report
¢ INNOQ: Service Mesh Comparison
¢ Github: Kuma Demo Application
¢ Kuma Mesh
¢ Kong OSS Gateway

40. © OPITZ CONSULTING 2021 / Öffentlich
IN CASE OF ANY QUESTIONS…
Architecture Room Stuttgart 40
Sven Bernhardt
Chief Architect / Integration Evangelist |
Oracle ACE Director
OPITZ CONSULTING Deutschland GmbH
Kirchstrasse 6, 51647 Gummersbach, Germany
Phone: +49 172 2193529
Mail: sven.bernhardt@opitz-consulting.com
Twitter: @sbernhardt
Blog: https://svenbernhardt.wordpress.com

41. © OPITZ CONSULTING 2021 / Öffentlich
VIRTUELLES FEIERABENDBIER
Architecture Room Stuttgart Seite 41