Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Building a Bank with Kubernetes – Kubecon 2016

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Oliver Beattie Oliver Beattie
November 09, 2016
Technology
610
1

Building a Bank with Kubernetes – Kubecon 2016

Avatar for Oliver Beattie

Oliver Beattie

November 09, 2016

More Decks by Oliver Beattie

See All by Oliver Beattie
Anatomy of a Production Kubernetes Outage – Kubecon EU 2018
Avatar for Oliver Beattie obeattie
4
4.7k
DevOps Exchange London – Network Security at Monzo
Avatar for Oliver Beattie obeattie
0
270
Building a Bank with Kubernetes – Kubernetes London Meetup, Autumn 2016
Avatar for Oliver Beattie obeattie
10
47k

Other Decks in Technology

See All in Technology
最高のシステムプロンプトを作るためにフィードバック機能を導入した話
Avatar for Ryotaro Harada alchemy1115
1
260
人手不足への挑戦:車両保全を支えるIoTとクラウド内製化の道【SORACOM Discovery 2026】
Avatar for SORACOM（ソラコム） soracom
PRO
0
170
Claude Mythos、Fable...フロンティアAIの最新動向と企業のセキュリティ対策
Avatar for GMO Flatt Security flatt_security
0
180
Amazon Bedrock Managed Knowledge Base Dive Deep
Avatar for Renya Kujirada ren8k
0
310
20260801_スクフェス大阪
Avatar for hikari kgnkhkr
0
150
書籍セキュアAPIについて
Avatar for RiiiM(りむ) riiimparm
0
400
システム監視を 「システムを監視するだけ」で 終わらせないために
Avatar for sei_ud seiud
0
160
DevOps Agentで運用判断をチーム資産にする ~Agent InstructionsとAgent Skillを継続的に育てる~
Avatar for fujioka-a fujioka6789
0
180
ここは地獄！つらい朝会を体験することで、チームとしてのより良い振る舞いに気づくワークショップ / The stand-up meeting from hell in the game industry
Avatar for scrummasudar scrummasudar
0
490
PLaMoを毎日の開発で使い育てていく
Avatar for Preferred Networks pfn
PRO
0
160
クラウドセキュリティ入門　～安全なクラウド利用のための基礎知識～
Avatar for LHazy lhazy
7
4.4k
PLaMo 3.0 Primeの構造化出力サポート
Avatar for Preferred Networks pfn
PRO
0
150

Featured

See All Featured
Dealing with People You Can't Stand - Big Design 2015
Avatar for Cassini Nazir cassininazir
367
27k
Claude Code どこまでも/ Claude Code Everywhere
Avatar for nwiizo nwiizo
65
57k
Building an army of robots
Avatar for Kyle Neath kneath
306
46k
The Mindset for Success: Future Career Progression
Avatar for Greg Gifford greggifford
PRO
0
430
Design and Strategy: How to Deal with People Who Don’t "Get" Design
Avatar for Morgane Peng morganepeng
133
19k
The #1 spot is gone: here's how to win anyway
Avatar for Tamara Novitovic tamaranovitovic
3
1.1k
Winning Ecommerce Organic Search in an AI Era - #searchnstuff2025
Avatar for Aleyda Solis aleyda
1
2.1k
The Illustrated Children's Guide to Kubernetes
Avatar for Chris Short chrisshort
51
53k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
Avatar for Sam Stephenson sstephenson
162
16k
A designer walks into a library…
Avatar for Paul Jervis Heath pauljervisheath
211
24k
Why Mistakes Are the Best Teachers: Turning Failure into a Pathway for Growth
Avatar for Umar Saidu Auna auna
0
190
The Curse of the Amulet
Avatar for Matthew Lei leimatthew05
2
13k

Transcript

  1. Building a Bank with Kubernetes

  2. Oliver Beattie @obeattie Head of Engineering, Monzo

  3. None
  4. None
  5. None
  6. None
  7. None
  8. None
  9. None
  10. None

  11. Pre-application 9 months Application 6 months Mobilisation 4–8 months

  12. Extensible Efficient Resilient Secure

  13. Extensible Efficient Resilient Secure

  14. Application Database

  15. Application Database Cache

  16. Application Database Cache Load balancer Cache Cache Application Application

  17. Database Cache Load balancer Database Database Cache Cache Application Application

    Application

  18. Database Cache Load balancer Database Database Cache Cache Application Application

    Application

  19. Application Database Cache Load balancer Application Application Database Database Cache

    Cache
  20. None
  21. None
  22. None

  23. Extensible Efficient Resilient Secure

  24. None

  25. app

  26. app

  27. core app

  28. None
  29. None

  30. Extensible Efficient Resilient Secure

  31. None
  32. None

  33. Load balancing Tracing Circuit breakers Retries Canarying Load shedding Error

    tracking Metrics Service discovery Logging Timeouts Expirations Security policies Back-offs Retry budgets Dynamic routing

  34. Minimise latency ⏱ Maximise success

  35. linkerd Finagle

  36. HOST A service. CONTAINER 10.224.15.2 service.cruft CONTAINER 10.224.15.1 LINKERD 10.102.32.198

    10.224.15.3 HOST B service. CONTAINER 10.224.16.2 service.cruft CONTAINER 10.224.16.1 LINKERD 10.102.34.192 10.224.16.3 HOST C service. CONTAINER 10.224.17.2 service.cruft CONTAINER 10.224.17.1 LINKERD 10.102.36.187 10.224.17.3

  37. HOST A service. CONTAINER 10.224.15.2 service.cruft CONTAINER 10.224.15.1 LINKERD 10.102.32.198

    10.224.15.3 GET / HTTP/1.1 Host: service. HOST B service. CONTAINER 10.224.16.2 service.cruft CONTAINER 10.224.16.1 LINKERD 10.102.34.192 10.224.16.3 HOST C service. CONTAINER 10.224.17.2 service.cruft CONTAINER 10.224.17.1 LINKERD 10.102.36.187 10.224.17.3

  38. HOST A service. CONTAINER 10.224.15.2 service.cruft CONTAINER 10.224.15.1 LINKERD 10.102.32.198

    10.224.15.3 GET / HTTP/1.1 Host: service. HOST B service. CONTAINER 10.224.16.2 service.cruft CONTAINER 10.224.16.1 LINKERD 10.102.34.192 10.224.16.3 HOST C service. CONTAINER 10.224.17.2 service.cruft CONTAINER 10.224.17.1 LINKERD 10.102.36.187 10.224.17.3

  39. HOST A service. CONTAINER 10.224.15.2 service.cruft CONTAINER 10.224.15.1 LINKERD 10.102.32.198

    10.224.15.3 Host: service. → 10.224.17.3 GET / HTTP/1.1 Host: service. HOST B service. CONTAINER 10.224.16.2 service.cruft CONTAINER 10.224.16.1 LINKERD 10.102.34.192 10.224.16.3 HOST C service. CONTAINER 10.224.17.2 service.cruft CONTAINER 10.224.17.1 LINKERD 10.102.36.187 10.224.17.3 Host: service. → 10.224.17.2

  40. HOST A service. CONTAINER 10.224.15.2 service.cruft CONTAINER 10.224.15.1 10.224.15.3 Host:

    service. GET / HTTP/1.1 Host: service. HOST B service. CONTAINER 10.224.16.2 service.cruft CONTAINER 10.224.16.1 10.224.16.3 HOST n edge CONTAINER 10.224.18.2 service.cruft CONTAINER 10.224.18.1 LINKERD 10.102.36.110 10.224.18.3 HOST n edge CONTAINER 10.224.16.2 service.cruft CONTAINER 10.224.16.1 LINKERD 10.102.32.192 10.224.16.3 GET / HTTP/1.1 → service. ELB

  41. AWS eu-west-1

  42. AWS eu-west-1

  43. None

  44. Co-location uk-1 Co-location uk-2 AWS eu-west-1

  45. Co-location uk-1 Co-location uk-2 AWS eu-west-1 ⚡

  46. Co-location uk-1 Co-location uk-2 AWS eu-west-1 ⚡

  47. Co-location uk-1 Co-location uk-2 AWS eu-west-1 BGP BGP BGP BGP

  48. Co-location uk-1 Co-location uk-2 AWS eu-west-1 BGP BGP BGP BGP

    ⚡ ⚡

  49. Co-location uk-1 Co-location uk-2 AWS eu-west-1 BGP BGP ⚡ ⚡

  50. “Connectivity” Pod BGP IPSec BGP BGP StrongSwan (IPSec) GNU Zebra


    (BGP) Hardware VPN device Services Services Services AWS Co-location Third parties

  51. Extensible Efficient Resilient Secure

  52. Device isolation Process isolation Data encryption Filesystem isolation Privilege isolation

    Network isolation Resource isolation Principle of least privilege Log monitoring Secret management

  53. Device isolation Process isolation Data encryption Filesystem isolation Privilege isolation

    Network isolation Resource isolation Principle of least privilege Log monitoring Secret management

  54. k8s-master Availability Zone A Availability Zone B Availability Zone C

    admin user data k8s-worker dmz

  55. k8s-master Availability Zone A Availability Zone B Availability Zone C

    k8s-worker dmz

  56. Calico + network policy

  57. zone: super-secure

  58. apiVersion: extensions/v1beta1 kind: NetworkPolicy metadata: name: super-secure-zone spec: podSelector: matchLabels:

    zone: super-secure ingress: - from: - podSelector: matchLabels: zone: super-secure ports: - protocol: tcp

  59. Extensible Efficient Resilient Secure

  60. monzo.com/careers

  61. Q&A .

  62. @obeattie