Service Mesh or API Management
Service Mesh or API Management
API management?
Deploy a comprehensive service architecture for your organization
See what’s inside
Chapter 1
Understand APIs and microservices
Chapter 2
Identify traffic direction and domain boundaries
Chapter 3
Deploy API management and service mesh solutions
Chapter 4
Build a complete service architecture with Red Hat
Chapter 5
Discover success across industries
Our increasingly digital world requires organizations to adapt their business and IT strategies, including application development and
deployment. Application programming interfaces (APIs) and microservices can help your organization modernize your applications to
improve speed, agility, and efficiency. In fact, 58% of organizations are adding a layer of APIs to modernize their applications.1 Mean-
while, 61% of organizations have used microservices for more than one year, and 28% have used them for more than three years.2
Even so, building a service management architecture that optimizes use of APIs and microservices can be confusing. Many organiza-
tions consider either API management or service mesh solutions but may not realize that these two technologies work best together.
This e-book provides essential knowledge and expert guidance for building an effective service management architecture that encom-
passes both API management and service mesh solutions.
Accelerate new service and Speed application launch Deliver real-time, data-based
API development by 2x.3 and update cycles.4 services to users.5
Many organizations want to move to API-centric and microservices-based IT architectures to improve speed, agility, and efficiency.
In fact, many organizations already use APIs to interact with their customers, partners, and other external users. Consistent, effective
management of these interfaces and services is critical for successful deployment and use.
However, determining which approaches and tools to use within your organization can be confusing. Most organizations look for either
an API management or a service mesh solution to accomplish this. These solutions have many things in common, but also many differ-
ences. While many organizations approach this as an either-or decision, these two technologies are actually complementary and work
together to deliver a complete service management architecture.
The following chapters discuss the similarities and differences between API management and service mesh approaches, when to
choose one over the other, and how to set up a comprehensive service management architecture using both solutions together.
Rate limits
API contracts Observability
Monetization Resiliency
Policies
Chaos testing
Partner ecosystem
Security
APIs Microservices
APIs provide an interface into your business capabilities, Microservices deliver specific sets of functions and
allowing consumers to access services in a controlled responsibilities as part of a larger application or business
manner. They consist of tools, definitions, and protocols process. They are an architectural approach to building
for integrating application software and services. APIs applications. As a deployment pattern, microservices
let your products and services communicate with other can be combined and orchestrated to create complete
products and services without needing to build new con- applications and processes. They are distributed and
nectivity infrastructure. They can be created for internal, loosely coupled, so changes to one microservice will not
partner, or even public use, allowing others to develop affect other microservices or break the entire application.
applications that incorporate your services and providing Additionally, each microservice has its own life cycle
additional revenue streams. As a business-focused con- and can be managed and scaled independently. Finally,
struct, APIs serve as contracts between service providers microservices can be delivered either through a service
and service consumers. mesh or via an API.
► Monetization
► Product development
API management
► Authorization. Authorize access and use via your existing ID management systems.
► Traffic management. Throttle and rate limit API use to protect your interfaces and services from abuse by consumers and some
denial of service (DoS) attacks.
► Developer portals.
► Analytics.
Comprehensive API management solutions simplify discovery and documentation of your interfaces and assets, provide flexible access
controls for different users, and deliver straightforward consumption billing and invoicing.
Service meshes route requests from one service to the next, optimizing how all the moving parts work together. Within cloud-native
application development approaches, they allow you to assemble large numbers of discrete services into functional applications.
Service meshes also simplify development to increase productivity, speed, and quality:
► Distributed request tracing provides visibility into service connections, streamlining issue discovery and troubleshooting.
► Automatic request rerouting can avoid failed services, making applications more resilient.
► Performance metrics help you optimize communication in your runtime environments and improve your user experience.
Service mesh implementation is transparent to developers, allowing them to focus on creating valuable applications and features rather
than rebuilding or connecting standard underlying services like security and routing.
Service mesh
Microservice Sidecar
Requests are routed between microservices through these proxies. For this reason, the individual proxies that make up a service mesh
are sometimes called sidecars, since they run alongside each service rather than within them. Taken together, these proxies — decoupled
from each service — form a mesh network. As a result, they can be updated and changed independently of the services they support and
connect. Common proxy policies and functions include:
► Authentication.
► Authorization.
► Encryption.
► Security.
► Traffic management.
Service mesh infrastructure layers use control planes and data planes to manage services. The control plane allows you to define rules
and policies to govern your services. The data plane contains the actual proxies and applies the appropriate rules and policies to your
services at runtime.
Identifying the direction of traffic between your services and interfaces is the first step in deciding whether to deploy an API manage-
ment or service mesh solution.
► Involves connections to service consumers beyond ► Involves multistage routing to orchestrate services
your enterprise boundary. within your enterprise boundary.
► Requires security, policy enforcement, access control, ► Requires mutual security and authorization controls
and analytics capabilities. and tracing and observability functions.
► Is governed by formal contracts between service ► Is governed by informal contracts between service
providers and service consumers. providers and service consumers, if needed.
Enterprise boundary
Enterprise boundary
Service Service Service
Based on these key characteristics, north-south traffic patterns align well with the capabilities of API management solutions,
while east-west traffic patterns correspond more closely with service mesh solutions.
Domain boundaries can help you divide your organization into smaller, more manageable areas. Much as your enterprise boundary
denotes the perimeter of your overall organization, domain boundaries designate the perimeters of groups within your organization.
Enterprise boundary
Service Service
API management and service meshes can be used together to create a comprehensive
service management architecture within your organization. Get help from Red Hat
Red Hat can help you assess your
Use API management for north-south traffic patterns that
infrastructure and create a plan for
cross domain or enterprise boundaries and service meshes for moving forward. Our experts work
east-west traffic patterns that stay within those boundaries. with your organization to achieve
your goals using an integrated
This advice can help you choose the most efficient path forward in most circumstances.
approach that brings together people,
Even so, there are exceptions to this guidance. For example, your organization may
process, and technology.
already use platforms, technologies, or runtimes that are incompatible with service
mesh solutions, making it significantly easier to deploy API management for some east-
west traffic patterns.
Learn more
Be sure to consider your existing infrastructure, business goals, and available time
frame when planning your API management and service mesh solution strategy.
API consumers
Enterprise boundary
API product
Application Application
► Developer portal options. Developer portals typically ► Developer support. Developers are most productive
provide API documentation and onboarding processes. when they have the right tools for their job. Offer
Help developers find and use your APIs more easily. multiple development languages, runtimes, and
databases to help your developers innovate faster.
► API life-cycle management. Like all IT assets,
APIs undergo multiple life-cycle stages. Simplify ► Cross-infrastructure support. Hybrid infrastructures
management of your APIs from initial design, through are becoming the norm for innovative organizations.
implementation, to retirement. Deploy your microservices across physical, virtualized,
and all types of cloud infrastructure to optimize
► Analytics. Analytics help you understand what’s going microservice performance, security, and costs.
on with your APIs. Learn which consumers or apps are
calling which APIs and how often, and gain insight into ► Microservice life-cycle management. Microservice
how many APIs have failed and why. management is critical to ensure cloud-native
applications run predictably and reliably. Independently
► Policies. Policies help you ensure your APIs are used scale microservices, control configurations, enforce
and secured appropriately. Define and enforce policies routing and security rules, and understand how traffic
for traffic management, security, and use to keep your flows between your services in near-real time.
API program operating in compliance.
Red Hat offers integrated API management, service mesh, and infrastructure platform products to help you build a comprehensive
service management architecture. This architecture is divided into functional areas, providing targeted capabilities for multiple stake-
holders. We build each product in the architecture with these stakeholders in mind to deliver an efficient, user-friendly experience.
Application
developer Red Hat OpenShift
Service Mesh
DevOps
Security Observability Traffic control Resiliency team
Deploy a consistent foundation Continue using your preferred Start where you are today
for all of your microservices. tools, languages, and runtimes. and expand at your own pace.
The Red Hat 3scale Istio plugin, included with Red Hat OpenShift Service Mesh, connects the control plane to Red Hat 3scale API Man-
agement. During operation, policy and rule checks run from the data plane, through the control plane and plugin, to Red Hat 3scale API
Management to authorize API requests and report use. API policies are configured through Red Hat 3scale API Management and applied
via the plugin and service mesh control plane. This integration allows you to efficiently set up an API with a service mesh backend.
Service A Service A
Envoy Envoy
To accomplish these objectives, we will set up an API that provides access to a core product microservice, which can connect to other
services to provide product details, reviews, and ratings information.
Service mesh
Reviews Ratings
service service
Product Product
API service
Details
service
This page shows a more detailed configuration for this service example. The product, review, and rating services are implemented as
microservices within Red Hat OpenShift Service Mesh. These services interact with each other within the same domain boundary. The
details service uses existing, traditional application architecture.
All of these services sit behind the product API, which is independent of the service implementation. The API is set up via Red Hat
3scale API Management, allowing formal rules and policies to be applied to its use.
Requests enter the service mesh through standard Istio ingress processes. At each ingress point, the request is checked against the
predefined policies via Envoy proxies and the Red Hat 3scale Istio plugin. If the request complies with all policies, it is routed forward
to the product service. The product service can then interact with the details, reviews, and ratings services. These interactions are also
governed by predefined policies applied via Envoy proxies. Finally outbound traffic is routed back to the requester via Envoy proxies and
the Red Hat 3scale Istio plugin.
This configuration provides managed access to product information for internal and external developers while preventing direct access
to the services themselves and maintaining detailed control over the back-end service implementation.
Service mesh
Reviews Ratings
API service service
API requests
consumers Istio Product Product
ingress API service
Details
service
Developer
applications Istio control plane
1. Enable the Red Hat 3scale Istio plugin. 1. Enable the Red Hat 3scale Istio plugin.
2. Activate Red Hat 3scale API Management 2. Activate Red Hat 3scale API Management
authorization for the services you wish to move authorization for the services you wish to
to your service mesh. administer as APIs.
3. Once the desired services are added to your 3. Configure API management policies and access
service mesh, deactivate authorization for controls through Red Hat 3scale API Management
them through Red Hat 3scale API Management for the nodes and services you wish to expose
APIcast gateways. as APIs.
Your existing API-based access controls operate Your existing service mesh operates without change.
without change. You can continue to use your current You can continue to develop, connect, and manage
rules and policies via Red Hat 3scale API Management microservices using Red Hat OpenShift Service Mesh
while moving the back-end service implementation while implementing certain microservices as APIs
to a service mesh. This configuration ensures traffic without no duplication in traffic control gateways.
control gateways are not duplicated.
Read the Read Hat OpenShift Container Platform documentation to learn more about using the Red Hat 3scale Istio plugin.
With the new platform, Schiphol can more quickly add new services. Connecting its
on-premise environment to Red Hat OpenShift lets the airport easily exchange data
between its main systems and cloud APIs. In addition, by using its Airport Service Bus
platform to infuse data into its API services in Red Hat OpenShift, the airport’s IT teams
can develop new APIs 50% faster. Overall, the new Red Hat environment supports
Schiphol’s vision of agile, self-service processes and vendor flexibility that help its IT
teams quickly and efficiently develop and deploy new customer-facing services.
Launched a production Cut new service and API Deployed self-service capabilities
cloud platform in 10 days development time by 50% for increased agility
Emirates NBD provides retail, wholesale, and corporate Lufthansa Technik, the world’s largest independent provider
financial services across the UAE and international markets. of airline maintenance, repair, and overhaul (MRO) services,
To increase the speed and flexibility of IT delivery while con- sought to create a digital platform for the aviation industry.
trolling costs, it began an ambitious multimillion-dollar initiative The solution, AVIATAR, would help material planners, engineers,
to transform its end-to-end technology infrastructure and and other end users better predict events and, as a result, save
practices. With a centralized private cloud platform built with time and money. To support its development and operation,
Red Hat container, integration, and API technologies, Emir- the company created a hybrid cloud infrastructure based on
ates NBD simplified collaboration with third-party partners, enterprise open source software from Red Hat. The AVIATAR
cut software development cycles by months, and launched team can now use agile DevOps approaches, automation,
innovative digital engagement capabilities to compete with internal and third-party integration, and self-service capabili-
cloud-native companies. Now, it can take advantage of emerg- ties to quickly iterate based on data and feedback. As a result,
ing technology to offer the services modern consumers in key Lufthansa Technik provides an innovative digital platform that
markets demand. helps the world’s airlines optimize their operations.
To support a population of 1.5 million people, the municipal Weathernews Inc., one of the world’s largest private weather
government of the City of Montevideo, Uruguay, employs information service companies, wanted to speed application
8,000 public administration officers. The city sought to and service development to meet an increase in demand
develop an IT platform that would integrate the municipality’s for weather information across industries and markets. The
infrastructure, services, and data to improve citizen satisfac- company sought to integrate various internal and external
tion. It used Red Hat OpenShift to create a microservices- and systems using standardized, centrally managed APIs. Weath-
Kubernetes container-based platform to integrate internal and ernews also needed to ensure its API environment was secure
third-party services and data. It also built a city service API and and reliable. By building its API management platform with
state web portal, MontevideoAPI, using Red Hat 3scale API Red Hat 3scale API Management, Weathernews has not only
Management to deliver valuable information — based on real- expanded internal use of APIs for more efficient development
time transportation data — to citizens and partner organizations. and faster service delivery to its customers but also gained
The city can now deliver improved traffic services to citizens. new, robust provisioning security capabilities.
“It was a great benefit of Red Hat 3scale API Management that we could
readily start on a small scale. The license provisioning, which had been
the biggest challenge, is now done quickly and safely with access control.”
Masaki Fukuda
Service Menu Development Group Leader, Weathernews
Learn more about deploying a service management architecture with Red Hat:
red.ht/service-mesh-api-mgt
Copyright © 2021 Red Hat, Inc. Red Hat, the Red Hat logo, and OpenShift are trademarks or registered trademarks of Red Hat, Inc.
or its subsidiaries in the United States and other countries.
F28474_0421_KVM