On the one hand, Monzo’s backend is composed of hundreds of microservices running in Kubernetes. On the other, banks need to interconnect to hordes of legacy systems, often involving physical kit and leased lines. This presents an interesting networking challenge. Oliver goes into detail about how Monzo has designed its network architecture, how they secure it, and lots of lessons learned along the way.

1. Oliver Beattie
@obeattie
Head of Engineering, Monzo

7. Pre-application
9 months
Application
6 months
Mobilisation
4–8 months

8. Isolation
Authentication

9. Isolation
Authentication

10. k8s-master
Availability Zone A Availability Zone B Availability Zone C
admin
user
data
k8s-worker
🌍
dmz

11. k8s-master
Availability Zone A Availability Zone B Availability Zone C
k8s-worker
🌍
dmz

14. +

15. apiVersion: extensions/v1beta1
kind: NetworkPolicy
metadata:
name: com.monzo.mastercard.proxy
spec:
podSelector:
matchLabels:
stage: prod
routing-name: com.monzo.mastercard.proxy
ingress:
- from:
- podSelector:
matchLabels:
stage: prod
routing-name: com.monzo.mastercard.processor
ports:
- protocol: tcp
port: 80

16. 👍 “Cluster-aware”
👍 netfilter/iptables under the hood
👍 Filtering at “both ends”
👎 No control over egress
👎 Only understands TCP/UDP
👎 Proxies

17. Isolation
Authentication

18. Host A Host B
Service A linkerd Service Blinkerd

19. Host A Host B
Service A linkerd Service Blinkerd
🎖 🎖

20. Host A Host B
Service A linkerd Service Blinkerd
🎖 🎖
CA CA
CA
Vault

21. Secret management
Message signing
Transaction authorisation
Secure build
Audit logging
WAN tunnels

22. 🔒 IPSec
🎖 StrongSwan
(IPSec)
Hardware VPN
device
ServicesServicesServices
AWS Co-location Third parties

23. monzo.com/careers

24. & Questions 🙋

25. 🐤 @obeattie