Solving Network Challenges at Monzo, a Banking App
25
Oliver Beattie @obeattie Head of Engineering, Monzo
-
Upload
outlyer -
Category
Technology
-
view
1.006 -
download
0
Transcript of Solving Network Challenges at Monzo, a Banking App
Pre-application 9 months
Application 6 months
Mobilisation 4–8 months
Isolation
Authentication
Isolation
Authentication
k8s-master
Availability Zone A Availability Zone B Availability Zone C
admin
user
data
k8s-worker
🌍
dmz
k8s-master
Availability Zone A Availability Zone B Availability Zone C
k8s-worker
🌍
dmz
+
apiVersion: extensions/v1beta1 kind: NetworkPolicy metadata: name: com.monzo.mastercard.proxy spec: podSelector: matchLabels: stage: prod routing-name: com.monzo.mastercard.proxy ingress: - from: - podSelector: matchLabels: stage: prod routing-name: com.monzo.mastercard.processor ports: - protocol: tcp port: 80
👍 “Cluster-aware”
👍 netfilter/iptables under the hood
👍 Filtering at “both ends”
👎 No control over egress
👎 Only understands TCP/UDP
👎 Proxies
Isolation
Authentication
Host A Host B
Service A linkerd Service Blinkerd
Host A Host B
Service A linkerd Service Blinkerd🎖 🎖
Host A Host B
Service A linkerd Service Blinkerd🎖 🎖
CA CA
CA
Vault
Secret management
Message signing
Transaction authorisation
Secure build
Audit logging
WAN tunnels
🔒 IPSec
🎖 StrongSwan (IPSec)
Hardware VPN device
ServicesServicesServices
AWS Co-location Third parties
& Questions 🙋
