p10jkle

11 ms·

91.
by p10jkle 7y ago
The idea is that this uses a little more 'vanilla' Kubernetes because you control the access to the endpoint using NetworkPolicies and not any new kind of policy specification. That's what I like about it, it uses the control
92.
Show HN: egress-operator, a simple way to control Kubernetes egress traffic(github.com)
4 points by p10jkle 7y ago|2 comments
93.
We migrated Vault's storage with no downtime(monzo.com)
2 points by p10jkle 7y ago|0 comments
94.
We secured thousands of Cassandra clients to keep Monzo's data safe(monzo.com)
4 points by p10jkle 7y ago|0 comments
95.
by p10jkle 7y ago
We don't have one. I think you may have misinterpreted my comments above. Its all code analysis
96.
by p10jkle 7y ago
Networks are fast https://twitter.com/obeattie/status/1190676549395025921
97.
by p10jkle 7y ago
That's what we're doing, basically
98.
by p10jkle 7y ago
It's slightly more complicated than that because you can import protos to use a constant or to consume an event from another service. But that is the gist
99.
by p10jkle 7y ago
This is probably our next project, although we might solve this problem with mutual tls instead of JWTs
100.
by p10jkle 7y ago
Yeah we're aware of the cost particularly. We're looking into preferring inter-AZ routing with envoy
101.
by p10jkle 7y ago
Completely agree
102.
by p10jkle 7y ago
Not really
103.
by p10jkle 7y ago
The network in an AWS VPC is insanely fast. It's not a big deal. If they add a new national holiday, now you have to deploy all your services. I guess microservices self perpetuate themselves in that sense
104.
by p10jkle 7y ago
1. We have a lot of code paths, there isn't an integration test for everything. And for runtime, just because something is rarely called doesn't mean it never called; a bank can have yearly processes 2. We'll do service mesh
105.
by p10jkle 7y ago
I don't really mind it
106.
by p10jkle 7y ago
I feel like we could do all of that by consuming the GitHub API. We essentially have directed graph stored as files
107.
by p10jkle 7y ago
Monitoring can only access metrics, it's scoped to port. We'd like endpoint level controls and that's the next step
108.
by p10jkle 7y ago
I think we do effectively have a graph, but its not stored in a centralised way. If it was, then we'd have to somehow gatekeep that state, which when you consider that we do hundreds of deployments a day, becomes tricky
109.
by p10jkle 7y ago
The common idea is that if you have to regularly roll out all your services, then you still basically have a monolith. So if you have a lot of shared code in libaries, there are no benefits to microservices. In our case, maybe we do have co
110.
by p10jkle 7y ago
Yeah, our (mostly) ban on shared code is a major reason we end up with a lot of services; there's even service.business-day which tells you if a day is a working day
111.
We built network isolation for 1500 services(monzo.com)
135 points by p10jkle 7y ago|86 comments
112.
by p10jkle 7y ago
Vault is a lot more fully featured and generally has more granular access control than equivalent AWS products, but is tricky to run in a way that is available and secure. Obviously outsourcing that has huge value
113.
by p10jkle 7y ago
This is on our radar and I think they can now be used directly with the kubernetes Auth plugin, although I've not heard much about it. This is a very recent change. We could have possibly got the same functionality with the jwt plugin,
114.
by p10jkle 7y ago
We are using your database credential generation features! With thousands of clients, too. Very cool, we'll write a blog post soon. The root credential rotation is genius.
115.
by p10jkle 7y ago
Fair enough, Vault has a ton of features I guess most don't need. It's been cool for us, we are now using it for secrets, database credentials, and certificate management (more blog posts coming!). Next up is hopefully AWS creds m
116.
by p10jkle 7y ago
I'm a little confused; the system mentioned in this article allows services to retrieve secrets in plaintext; they're just stored encrypted at rest. You can do what you like with the retrieved secret.
117.
by p10jkle 7y ago
Microservices generally have 0-10 RPC handlers (we use https://github.com/monzo/typhon ). We have a lot of different object types at Monzo, it goes way beyond 'transaction' or 'user' and each object
118.
by p10jkle 7y ago
This sounds interesting. I think with bound service account tokens ( https://github.com/kubernetes/community/pull/1460 ) things may improve; pods will be able to prove their identity without it being equivalent
119.
by p10jkle 7y ago
I don't think its particularly common for a company of our size. They are mostly very small and handle very specific things. It's one approach, with some benefits, although it makes projects that affect all services quite tricky!
120.
by p10jkle 7y ago
This exact link is mentioned in the article! We use it!

More ›