Containers - Deployment model

Proxy layer. The proxy layer consists of Istio – a service mesh that layers transparently onto existing distributed applications. It is responsible for traffic management, policy enforcement, and telemetry collection. Istio is a platform to connect, manage, and secure microservices. Istio provides a straightforward way to create a network of deployed services with load balancing, service-to-service authentication, monitoring, and more, without requiring any changes in service code. Istio supports managing traffic flows between microservices, enforcing access policies, and aggregating telemetry data. Istio’s control plane provides an abstract layer over the underlying cluster management platform, such as Kubernetes.

Security scanning. The security scanning service is deployed on our Kubernetes services to monitor CVE and other configuration security issues. The CVE detection service is a simple and comprehensive vulnerability scanner for containers and other artifacts, suitable for CI. It detects vulnerabilities of OS packages (Alpine, RHEL, CentOS, etc.) and application dependencies (Maven, npm, yarn, etc.).

Scaling service. The scaling service consists of KEDA which is a Kubernetes-based event-driven autoscaling component. It provides event-driven scale for any container running in Kubernetes. KEDA can monitor event sources like Kafka, RabbitMQ, Azure Queue Storage, and many more, and then scale the related deployments and jobs. KEDA is a community-driven project, and it is maintained by Microsoft and Red Hat.

Certificate manager. Certificate manager or better known as cert-manager is a Kubernetes add-on to automate the management and issuance of TLS certificates from various issuing sources. It will ensure certificates are valid and up to date periodically and attempt to renew certificates at an appropriate time before expiry. It will also manage the creation and renewal of ACME certificates that are stored in a Kubernetes secret resource.