Upgrade to Pro — share decks privately, control downloads, hide ads and more …

DevOps Exchange London – Network Security at Monzo

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Oliver Beattie Oliver Beattie
January 26, 2017
Technology
0
260

DevOps Exchange London – Network Security at Monzo

Avatar for Oliver Beattie

Oliver Beattie

January 26, 2017
Tweet

More Decks by Oliver Beattie

See All by Oliver Beattie
Anatomy of a Production Kubernetes Outage – Kubecon EU 2018
Avatar for Oliver Beattie obeattie
4
4.6k
Building a Bank with Kubernetes – Kubecon 2016
Avatar for Oliver Beattie obeattie
1
590
Building a Bank with Kubernetes – Kubernetes London Meetup, Autumn 2016
Avatar for Oliver Beattie obeattie
10
47k

Other Decks in Technology

See All in Technology
Phase11_戦略的AI経営
Avatar for overflow ,Inc overflowinc
0
1.7k
開発チームとQAエンジニアの新しい協業モデル -年末調整開発チームで実践する【QAリード施策】-
Avatar for kaomi kaomi_wombat
0
250
【社内勉強会】新年度からコーディングエージェントを使いこなす - 構造と制約で引き出すClaude Codeの実践知
Avatar for nwiizo nwiizo
24
12k
スピンアウト講座04_ルーティン処理
Avatar for overflow ,Inc overflowinc
0
1.3k
AWS Systems Managerのハイブリッドアクティベーションを使用したガバメントクラウド環境の統合管理
Avatar for Toru_Kubota toru_kubota
0
170
20260323_データ分析基盤でGeminiを使う話
Avatar for yuichi 1210yuichi0
0
180
RGBに陥らないために -プロダクトの価値を届けるまで-
Avatar for RightTouch righttouch
PRO
0
120
「活動」は激変する。「ベース」は変わらない ～ 4つの軸で捉える_AI時代ソフトウェア開発マネジメント
Avatar for 辻裕士/sentokun sentokun
0
110
スピンアウト講座05_実践活用事例
Avatar for overflow ,Inc overflowinc
0
1.3k
AIエージェント時代に必要な オペレーションマネージャーのロールとは
Avatar for KentaroFujii kentarofujii
0
140
「通るまでRe-run」から卒業！落ちないテストを書く勘所
Avatar for asumikam asumikam
2
750
Bref でサービスを運用している話
Avatar for Sugar Sato sgash708
0
200

Featured

See All Featured
What the history of the web can teach us about the future of AI
Avatar for Ines Montani inesmontani
PRO
1
490
Understanding Cognitive Biases in Performance Measurement
Avatar for Philip Tellis bluesmoon
32
2.8k
Hiding What from Whom? A Critical Review of the History of Programming languages for Music
Avatar for Tomoya Matsuura tomoyanonymous
2
590
How Software Deployment tools have changed in the past 20 years
Avatar for Geshan Manandhar geshan
0
33k
Money Talks: Using Revenue to Get Sh*t Done
Avatar for Nikki Halliwell nikkihalliwell
0
190
What’s in a name? Adding method to the madness
Avatar for The Alliance productmarketing
PRO
24
4k
Designing Powerful Visuals for Engaging Learning
Avatar for Mike Taylor tmiket
0
300
Effective software design: The role of men in debugging patriarchy in IT @ Voxxed Days AMS
Avatar for Kenny Baas-Schwegler baasie
0
270
How to Grow Your eCommerce with AI & Automation
Avatar for Katarina Dahlin katarinadahlin
PRO
1
160
Exploring the relationship between traditional SERPs and Gen AI search
Avatar for Ray Grieselhuber raygrieselhuber
PRO
2
3.7k
Code Reviewing Like a Champion
Avatar for maltzj maltzj
528
40k
B2B Lead Gen: Tactics, Traps & Triumph
Avatar for Sophie Logan marketingsoph
0
86

Transcript

  1. Oliver Beattie @obeattie Head of Engineering, Monzo

  2. None
  3. None
  4. None
  5. None
  6. None

  7. Pre-application 9 months Application 6 months Mobilisation 4–8 months

  8. Isolation Authentication

  9. Isolation Authentication

  10. k8s-master Availability Zone A Availability Zone B Availability Zone C

    admin user data k8s-worker dmz

  11. k8s-master Availability Zone A Availability Zone B Availability Zone C

    k8s-worker dmz
  12. None
  13. None

  14. +

  15. apiVersion: extensions/v1beta1 kind: NetworkPolicy metadata: name: com.monzo.mastercard.proxy spec: podSelector: matchLabels:

    stage: prod routing-name: com.monzo.mastercard.proxy ingress: - from: - podSelector: matchLabels: stage: prod routing-name: com.monzo.mastercard.processor ports: - protocol: tcp port: 80

  16. “Cluster-aware” netfilter/iptables under the hood Filtering at “both ends” No

    control over egress Only understands TCP/UDP Proxies

  17. Isolation Authentication

  18. Host A Host B Service A linkerd Service B linkerd

  19. Host A Host B Service A linkerd Service B linkerd

  20. Host A Host B Service A linkerd Service B linkerd

    CA CA CA Vault

  21. Secret management Message signing Transaction authorisation Secure build Audit logging

    WAN tunnels

  22. IPSec StrongSwan (IPSec) Hardware VPN device Services Services Services AWS

    Co-location Third parties

  23. monzo.com/careers

  24. & Questions

  25. @obeattie