Pushing the Limits: Cloud Foundry Runtime and Routing at SAP...
summary
SAP runs 30 production Cloud Foundry landscapes with up to 120k app instances and reports concrete fixes: a allow list for route-service domains to mitigate a CVE, making Gorouter retries configurable retry count and tracing TLS/HTTP state to avoid stale-route errors between Gorouter, Envoy and Diego, splitting Diego cells across subnets via static IP distribution to bypass hyperscaler NAT limits, and tackling an iptables rule explosion and security-group ID overflow that stalled Garden container creation and BBS updates.
AI-written summary · about
chapters (8)
- 0:00Introduction and context
- 2:15Route service and GoRouter
- 6:10Root integrity and retries
- 9:01Improving Envoy interactions
- 10:02Netgateways and dynamic ages
- 13:19Security groups and iptables
- 17:52Mitigating database limits
- 20:02Q&A and closing
related talks
29mConsiderations of a Practical Migration to Cloud Foundry
20mCompletely Isolate your App's Traffic: Isolation Segments at the Routing Tier
31mBoF: Security Best Practices in Cloud Foundry
32mSecure Your Cloud with the IPsec BOSH Release - Stefan Lay, SAP
30mCloud Foundry: The Gaps
12mCF Application Runtime Demo: Weighted Routing (Istio/Envoy), Multiple Custom App Ports...
26mKeynote: A Platform for the Enterprise: Where Maturity and Innovation Intersect
30mAdding Sidecars to Cloud Foundry - Gabriel Rosenhouse & Angela Chin