Workday's Multi-Cloud Network Fabric With Consul & Vault
summary
Workday implements a global network fabric using Consul and Vault to connect multiple clouds and on‑prem datacenters, replacing the Consul ingress reference with a custom Envoy-based gateway that adds Envoy SNI multiplexing and custom TLS termination backed by Vault certificates. A self‑service API plus a Kubernetes operator automates gateway creation, service registration and intentions; the prototype handles hundreds of services in weeks and moves toward production, while legacy clients require DNS overrides or stunnel and early scaling issues prompt iterative fixes.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:54Multi-cloud challenges
- 3:21Service mesh approach
- 5:49Consul Connect mesh
- 7:54Custom ingress gateway
- 9:38Vault for identity
- 11:24Traffic flow and security
- 13:15SNI and DNS handling
- 14:59Platform team integration
- 16:46Canary deployment success
- 19:56Team collaboration key
related talks
24mSecure your cluster-to-cluster traffic, the agnostic way
58mConsul + Vault Learn Lab: Consul API Gateway
41mAutomating Multi-Cloud, Multi-Region Vault for Teams and Landing Zones
01h 05mTutorial: Demystifying and Enabling Workload Identity Across the Cloud Native Ecosystem
45mSecure Together: Consul + Vault
38mModern Service Networking With Consul Connect, Envoy and Kubernetes
45mMulti-Runtime Service Mesh With Consul
23mHashiCorp Vault and Getting Day 2 Operations Right