20181120-Cloud Native Forum Citrix 何浩祥

1. © 2018 Citrix | Confidential
.
@
.
NOVEMBER 23, 2018

2. 2 © 2018 Citrix | Confidential
Cloud-Native
A

3. 3 © 2018 Citrix | Confidential
-
Microservices
APIs
Performance
Resilience
Security Visibility
Continuous
Delivery
AutoScale
Circuit
Breaker
Load
Balancing
Throttling
Discovery
Audit Segmentation
E2E
Encryption
Routing
Chaos
Monkey
Distributed
Debug
Back-off
Lifecycle
Management
Auth

4. 4 © 2018 Citrix | Confidential
LB
W W W
A A A A
D D
LB
3
From 3-tier to microservices, container orchestrations, service mesh
3-tier app architecture Service Mesh architectureHairpin architecture L7 Hairpin with L4 Mesh
architecture
M
M
M M
M
M
M
M
M
M
LB
M
M
M M
M
M
M
M
M
M
LB
M
M
M M
M
M
M
M
M
M
N-S traffic
E-W traffic

5. 5 © 2018 Citrix | Confidential
D
CD
=
/
Citrix ADM
REST
REST

6. 6 © 2018 Citrix | Confidential
Server
Linux OS
Docker Engine
AppA
bin/libs
App B
bin/libs
App C
bin/libs
C
P
X
bin/libs
• 1 S RU L. .
• BA :A A
• :ECBA :D
• : D:
• : D :
• . B A
• B
• / B 7 A A
• N 14 BD: P -) X a
• O D ( 1 CD:EE
CE D B CDB G E D
C : CD:EE

7. 7 © 2018 Citrix | Confidential
G
N1
N D
N1
N D
6 A
S
E I I I
S U
P U
D D
M
N AP
I I
S7CT I I
H I I

8. 8 © 2018 Citrix | Confidential
CPX
Microservice D
Microservice A
Microservice B
Microservice C
)( )

9. 9 © 2018 Citrix | Confidential
CPX
Microservice A
Microservice B
Microservice D
Microservice D
7

10. 10 © 2018 Citrix | Confidential
• C A
• D
• D

11. 11 © 2018 Citrix | Confidential
•
•
•
•

12. 12 © 2018 Citrix | Confidential
w
i whrD
hx l
• c w notdr
• i w h D G
• GN m yu l
• e f e
• l a C
i l
es l S

13. 13 © 2018 Citrix | Confidential
Microservice
IoT Client B
IoT Client C
IoT Client A
NetScaler MQTT
7
HiveMQ
Server1
HiveMQ
Server2
HiveMQ
Server3
MQTT.Lua

14. 14 © 2018 Citrix | Confidential
CPX CPX
App
AppApp
North - South East - West
IDP
Oauth – OIDCTLS
WAF
Local Auth:
App SSL cert proper name + URL path
Mutual TLS
App
X

15. 15 © 2018 Citrix | Confidential
α1
β1
HostH1
β2
α2
HostH2
α3
α4
HostH3
Ingress LB
α5
α6
HostH4
ClusterManager
LB
Controller
Cluster API
Container
Events Reconfigu
ration
Container
State
Container
State Query

16. 16 © 2018 Citrix | Confidential
Overview Diagram for Kubernetes Use Case
Kubernetes NodeKubernetes NodeKubernetes NodeKubernetes NodeKubernetes Node
CPX CPX CPX
CPX
CPX
Log Stream
Log Stream
Kubernetes
Cluster
Manager
&
API Server
Citrix Application
Delivery
Management
Use Case 4: CPX is each pod
taking over role of Kube Proxy
VPX or CPX
Citrix ADC as
ingress load
balancer for
Kubernetes
clusters
Log Stream
Kube Proxy Kube Proxy Kube Proxy Kube Proxy Kube Proxy
Kubernetes
Ingress
Controller
ConfigChanges

17. 17 © 2018 Citrix | Confidential
Node-3
Pod-5
M1
Pod-6
M2
Node-2
Pod-3
M1
Pod-4
M2
MPX
Node-1
Pod-1
M1
Pod-2
M2
M1 to M2 via CPX
PodPod
Pod
CPX
Citrix K8s
Controller
CPX
Citrix K8s
Controller
CPX
Citrix K8s
Agent
Citrix K8s
Agent
Prometheus
Splunk
Infoblox
IPAM
K8s API
Server
K8s DNS
Citrix K8s
Controller
Calico/Flannel
Control Plane
Pod
Citrix
Ingress
Controller
(self-
contained)
Pod
Logging
AppGraph
Analytics
Licensing
Inventory
Front-End
(UI)
Pod Pod
PG-SQL
Redis
Node-4
Config Engine
(StyleBooks)
Citrix K8s Controller
Deployment Architecture: Proxy per Node
N-S traffic
E-W traffic
Add on (optional)
3rd
Party
Open source
K8S
Controller
(Integrated)

18. 18 © 2018 Citrix | Confidential
Node-3
Pod-5
M1
Pod-6
M2
Node-2
Pod-3
M1
Pod-4
M2
MPX
Node-1
Pod-1
M1
Pod-2
M2
M1 to M2 via CPX
Deployment Architecture: Service Mesh (Proxy per Pod)
CPX
Citrix K8s
Controller
CPX
Citrix K8s
Controller
CPX
Citrix K8s
Controller
CPX
Citrix K8s
Controller
CPX
Citrix K8s
Controller
CPX
Citrix K8s
Controller
Pod
Logging
AppGraph
Analytics
Licensing
Inventory
Front-End
(UI)
Pod Pod
PG-SQL
Redis
Node-4
Config Engine
(StyleBooks)
Citrix K8s Controller
Infoblox
IPAM
K8s API
Server
K8s DNS
Citrix K8s
Controller
Calico/Flannel
Control Plane
N-S traffic
E-W traffic
Add on (optional)
3rd
Party
Open sourceIstio
Prometheus
Splunk
Citrix K8s
Agent
K8S
Controller
(Integrated)
Pod
Citrix
Ingress
Controller
(self-
contained)

19. 19 © 2018 Citrix | Confidential
• To enable external traffic to enter the OpenShift Nodes, Openshift is moving to the Kubernetes Ingress Load Balancer API stack.
• CPX uses IP address of host / POD and that is exposed to external traffic
• Here the Kubernetes Ingress Controller receives service location information from the Kubernetes API server and programs the
CPX through Citrix Application Delivery Management (not shown) in response to changes.
Paas with OpenShift
MASTER
API Authentication
Data Store
Scheduler
Mgmt/Replication
Kubernetes API Server
Kubernetes Ingress
Controller
Docker
Kubelet and Kube Proxy
Citrix ADC CPX
(host)
External traffic
Docker
Kubelet and Kube Proxy
Infrastructure Node App Node
Apps
Apps
OpenShift SDN
Citrix ADC CPX

20. 20 © 2018 Citrix | Confidential
•
• A
•
• E
•
•
•

21. 21 © 2018 Citrix | Confidential
Infrastructure as a Code
L
S
V:
A

22. 22 © 2018 Citrix | Confidential

23. 23 © 2018 Citrix | Confidential
Citrix ADM

24. 24 © 2018 Citrix | Confidential
Citrix Application Delivery Management Turns Citrix ADC’s into a
Pool – Control One to Thousands
Citrix Application
Delivery Management
CPX VPX MPX
Container
Management:
Mesos & Marathon
Kubernetes
Cloud Manager/
Orchestrators:
OpenStack
VMWare NSX
Service
Discovery
Orchestrator: Self Service
Portal
Citrix Application Delivery
Management Functions
App-centric Life
Cycle
Configuration at
Scale
Visibility and
Insights

25. 25 © 2018 Citrix | Confidential
Metadata from Citrix ADC is Powerful Information
Citrix ADC
Total DNS request Total invalid DNS requests
Total server time to first byte
Transaction logs
Total server hits
Surge Queue count
Client / user
# Users using SSL v3
# Users using ECDHE
# Users using ECDSA
SSL Chip utilization

26. 26 © 2018 Citrix | Confidential
App Health Score Tied to Citrix ADC Metadata
User Experience
Caused by
Latency
Availability
Anomalies
Errors
ADC Health: CPU,
Memory
Server Latency and
availability
Security Attacks:
Threat Index, DNS DDoS
App
HealthScore
Citrix ADC Metadata
Anomalies: Surge
Queue, Uneven LB
HTTP Errors

27. 27 © 2018 Citrix | Confidential
?
?
?
?
?
?
.
.
.

28. 28 © 2018 Citrix | Confidential

29. 29 © 2018 Citrix | Confidential
Top Parameters & Trends
• Which are the top vservers
causing low health score?
• What is the key app usage
metric variation?
• What is the total event
variation trend for this
app?
Top 5 vservers with lowest
health score
How are the total events
trending over the time?
How are the total events
trending over the time?
Deep-dive with the application activity investigator

30. 30 © 2018 Citrix | Confidential
Which are the top Apps with high
threat index?
Who are the top Clients with high
number of violations association?
Which locations attacks are
originated from?
What is the total attack variation
across all apps?
New Threat Detection added
Application security threat exposure assessment

31. 31 © 2018 Citrix | Confidential
North – South
• Leverage Citrix ADCs as
ingress devices
• MPX/SDX/VPX
• CPX inside cluster
• Expose L7 features in
Kubernetes through
CRDs, annotations
East-West
• CPX for visibility and
security
• CPX per node
• CPX per pod
• Lightweight CPX
Security and Analytics
• Tie security capabilities
to solve new problems
• API security
• App-to-app security
• Service graph
• Prometheus exporter
Scale
• From hundreds to
thousands of nodes per
cluster
CICD
• Integrate with cloud
native DevOps tooling

32. 32 © 2018 Citrix | Confidential
S AI
M
) D
**(/ C
C ITSM ITC
SDN
NetScaler API’s
Citrix ADM
T PaaS

34. 34 © 2018 Citrix | Confidential