External API Protection Architecture

External API Protection Architecture An architecture diagram generated by Archify. Application Pod · calls external API · Kubernetes Cluster Application Pod calls external API Envoy Proxy · Outlier Detection · Kubernetes Cluster Envoy Proxy Outlier Detection External API Instance 1 · Healthy · External Services External API Instance 1 Healthy External API Instance 2 · Errors · External Services External API Instance 2 Errors External API Instance 3 · Healthy · External Services External API Instance 3 Healthy Send traffic Ejected Send traffic Kubernetes Cluster External Services Legend Application pod Envoy Proxy (Outlier Detection) External API instances (ServiceEntry)

ServiceEntry

  • • Registers the external API under hosts (resolution: DNS)
  • • location: MESH_EXTERNAL marks it as outside the mesh

DestinationRule outlierDetection

  • • consecutiveErrors: 3 — detect external API failures quickly
  • • interval: 10s / baseEjectionTime: 30s
  • • maxEjectionPercent: 50 — eject at most half the instances