Building a Bank with Kubernetes [slides] • Hacker News Board

Re: Building a Bank with Kubernetes [slides]

#41

Post by aidos » Mon, Oct 24, 2016, 9:52 AM UTC

KirinDave wrote: post #14

obeattie wrote: post #10

Author of the talk here. Happy to answer any questions anyone has. This post also contains more info on how we build our systems: https://monzo.com/blog/2016/09/19/building-a-modern-bank-bac... And as an aside, I'll also be giving a longer talk at Kubecon going into more detail on some of this stuff :-)

Not that I don't appreciate the subject matter, I wave the flag for K8S all the time and I've shipped bank product presentation stuff on it... But... The fundamental challenges of building a bank are almost entirely orthogonal to things like distributed system uptime and resiliency (unless, I suppose, you could lose consistency during the types service loss Kubernetes makes easy to ameliorate). Evidence for this abou…

As a Monzo customer I have to say that the product Monzo offers and the features that traditional banks want me to use are also somewhat orthogonal :-)

So long as they can satisfy the regulatory requirements, I'd rather they were using whatever else it took to build a great product.

Re: Building a Bank with Kubernetes [slides]

#42

Post by trastentrasten » Mon, Oct 24, 2016, 9:56 AM UTC

What you using for persistence of user data?

Re: Building a Bank with Kubernetes [slides]

#43

Post by raesene6 » Mon, Oct 24, 2016, 9:59 AM UTC

ben_hall wrote: post #40

raesene6 wrote: post #37

Earlier quoted context omitted.

Hi, I'd be very interested to hear if you've come across any good documentation on hardening Kubernetes? From what I've seen so far there's very limited documentation on that when compared to other components like Docker, and the defaults can sometimes not be suitable for a high security environment (e.g. https://raesene.github.io/blog/2016/10/08/Kubernetes-From-Co... )

There is a solution to this coming in v1.5 - https://github.com/kubernetes/kubernetes/pull/32518

yeah I've got that noted in the blog post :) but it was really just an example. One of the things thats struck me about docker/Kubernetes etc is that they tend to be tuned for a general use case in terms of security and configuration. Choices that might improve security and restrict usefulness of services are not usually defaults.

As such there needs to be a level of hardening done from an out of the box perspective where they're being used in a high-security environment (e.g. banking).

For Docker we have resources like docker_bench and the CIS guide which provide a list of possible hardening steps, but I've not managed to find anything like that for Kubernetes, which is why I'm interested in how Monzo are addressing that issue.

Re: Building a Bank with Kubernetes [slides]

#44

Post by caniszczyk » Mon, Oct 24, 2016, 9:59 AM UTC

gdubya wrote: post #27

sandGorgon wrote: post #24

Earlier quoted context omitted.

this is awesome! how do you do this? a new header with a unique id... generated by something like lua+nginx. but then how do you pass this request from one service to another?

There are quite a few monitoring products being built to solve this problem. Many of them are based around Zipkin ( http://zipkin.io/ )

I strongly suggest people look at the OpenTracing work too: http://opentracing.io/

Re: Building a Bank with Kubernetes [slides]

#45

Post by [deleted] » Mon, Oct 24, 2016, 10:20 AM UTC

KirinDave wrote: post #14

obeattie wrote: post #10

Author of the talk here. Happy to answer any questions anyone has. This post also contains more info on how we build our systems: https://monzo.com/blog/2016/09/19/building-a-modern-bank-bac... And as an aside, I'll also be giving a longer talk at Kubecon going into more detail on some of this stuff :-)

Not that I don't appreciate the subject matter, I wave the flag for K8S all the time and I've shipped bank product presentation stuff on it... But... The fundamental challenges of building a bank are almost entirely orthogonal to things like distributed system uptime and resiliency (unless, I suppose, you could lose consistency during the types service loss Kubernetes makes easy to ameliorate). Evidence for this abou…

[deleted]

Re: Building a Bank with Kubernetes [slides]

#46

Post by lgieron » Mon, Oct 24, 2016, 10:41 AM UTC

webscaleizfun wrote: post #35

tluyben2 wrote: post #23

Earlier quoted context omitted.

> I just want to say that I think there is a huge amount of FUD about how you can and cannot build your technology as a regulated entity – and in particular as a bank. In reality, close to 100% of requirements from a regulator will tell you _what_ you must build, not _how_ you must build it. Even then, especially in terms of resilience and security, they are almost always a subset of our own requirements. Having work…

It seems common knowledge these days among the slightly but not too technically inclined that any new major project should use a LAMP stack as its base. People see Facebook, Amazon, and many others running PHP & MySQL on Linux at scale and they know it works reliably, so while it may not have the support of Cisco or Oracle, it is pretty close on the 'no one ever got fired for choosing' X scale, since you can point to…

I'd say the reliability the bank is looking for is much higher than what's acceptable for web companies (i.e. web companies are fine with eventual consistency, which would is obviously unacceptable in a banking system outside of trivial non-core features).

Re: Building a Bank with Kubernetes [slides]

#47

Post by tormeh » Mon, Oct 24, 2016, 10:51 AM UTC

tluyben2 wrote: post #23

obeattie wrote: post #19

Earlier quoted context omitted.

>what really limits most financial institutions from embracing a lot more modern tech is their core systems of record AND the acceptance of said systems by their governing agencies. I just want to say that I think there is a huge amount of FUD about how you can and cannot build your technology as a regulated entity – and in particular as a bank. In reality, close to 100% of requirements from a regulator will tell you…

> I just want to say that I think there is a huge amount of FUD about how you can and cannot build your technology as a regulated entity – and in particular as a bank. In reality, close to 100% of requirements from a regulator will tell you _what_ you must build, not _how_ you must build it. Even then, especially in terms of resilience and security, they are almost always a subset of our own requirements. Having work…

PHP in banking? That's scary. Pretending to be Facebook and being able to handle PHP development looks like a bad judgment call from where I'm standing.

PHP seems like it is made for everything banks are not. I have the impression PHP is hard to do securely, invites bugs but let you get going quickly. This sounds like Lockheed deciding to use C++ for the F35.

Re: Building a Bank with Kubernetes [slides]

#48

Post by dimastopel » Mon, Oct 24, 2016, 11:03 AM UTC

raesene6 wrote: post #43

ben_hall wrote: post #40

Earlier quoted context omitted.

There is a solution to this coming in v1.5 - https://github.com/kubernetes/kubernetes/pull/32518

yeah I've got that noted in the blog post :) but it was really just an example. One of the things thats struck me about docker/Kubernetes etc is that they tend to be tuned for a general use case in terms of security and configuration. Choices that might improve security and restrict usefulness of services are not usually defaults. As such there needs to be a level of hardening done from an out of the box perspective…

Not sure if you are looking for a commercial solution, but we (Twistlock [1]) develop a security suite for enterprises working with Docker and / or Kubernetes. In fact, we are officially recommended by Google for working with GKE which is very much based on Kubernetes [2]. I'd be glad to elaborate if relevant.

[1] https://www.twistlock.com/

[2] https://cloudplatform.googleblog.com/2015/11/enhancements-to...

Re: Building a Bank with Kubernetes [slides]

#49

Post by obeattie » Mon, Oct 24, 2016, 11:07 AM UTC

tormeh wrote: post #47

tluyben2 wrote: post #23

Earlier quoted context omitted.

> I just want to say that I think there is a huge amount of FUD about how you can and cannot build your technology as a regulated entity – and in particular as a bank. In reality, close to 100% of requirements from a regulator will tell you _what_ you must build, not _how_ you must build it. Even then, especially in terms of resilience and security, they are almost always a subset of our own requirements. Having work…

PHP in banking? That's scary. Pretending to be Facebook and being able to handle PHP development looks like a bad judgment call from where I'm standing. PHP seems like it is made for everything banks are not. I have the impression PHP is hard to do securely, invites bugs but let you get going quickly. This sounds like Lockheed deciding to use C++ for the F35.

To be clear, we (Monzo) are not writing banking software in PHP, or using MySQL.

Re: Building a Bank with Kubernetes [slides]

#50

Post by isostatic » Mon, Oct 24, 2016, 11:32 AM UTC

Do you completely rely on AWS? I.e. if amazon goes bust your company also dies? Or are you just using AWS as a provider of VMs, and could move to rackspace or linode.