PostFinance is one of Switzerland's leading financial institutions Serving more than 5 million customers, Post Finance is a reliable partner for private and business customers wishing to manage their own finances. PostFinance is a diversified, innovation-driven financial services company that provides customers with first-class solutions and smart innovations for the management of their finances. PostFinance relies on future-oriented tools and technologies that have been specially developed or adapted for the Swiss market. Key figures 25 Clusters 74 Applications 562 Nodes x12k Faster Pod Startup 5M Customers 4M Customer transactions/day Situation and challenge Electronic payments are becoming increasingly popular, and thus availability and scalability requirements for systems processing those payments are more important than ever. By changing their applications to run in containers and using Kubernetes to orchestrate them, PostFinance was able to solve many of their original pain points. At the time of the Study, PostFinance's environment accounted for around 70 different applications, each with one or many microservice(s), running in one of their over 500 nodes. In the real world, such changes always have some drawbacks. As PostFinance moved to remedy its scale and availability pain points with Kubernetes, new challenges appeared. In particular, gaining networking insights with traditional, iptables-based CNI plugins became difficult. Post Finance's growing infrastructure also led to latency issues and problems for the CNI plugin in maintaining a consistent state of iptables rules across all cluster nodes. In terms of observability in Kubernetes, it was quite tricky to know exactly where the packets were flowing and what could be blocking them. Basic Linux networking tools, like tcpdump, lack the context of cluster topology and it quickly becomes complicated with dynamic pod IPs. Observing these network flows is quite simple to do now with Hubble including analyzing the flows, filtering, etc. — Clément Nussbaumer, Systems Engineer Solution By replacing their previously used CNI with Cilium (including the kube-proxy replacement) PostFinance was able to solve their challenges regarding scale, observability and latency. PostFinance measured and compared pod startup latencies, and quickly saw that Cilium was widely outperforming their iptables based CNI. Being built on eBPF, performance-wise Cilium is great. With Cilium, you also have access to quite some in-depth debugging capabilities if you want, or if you are curious about how it’s implemented. And having worked with kube-proxy and iptables, I prefer that we don’t use them anymore. — Clément Nussbaumer, Systems Engineer Key measurements Value By using Cilium, networking became visible to PostFinance: Increased observability helped PostFinance quickly identify and fix problems, which can be crucial for their customers who are paying with PostFinance's systems. PostFinance was able to use network events to generate security alerts, perform forensic analysis and transparently encrypt network traffic "in-flight". PostFinance was able to solve the scale issues of their previous CNI plugin while simplifying their Kubernetes setup by eliminating the need for kube-proxy. Cilium and Isovalent helped our team to build a scalable Kubernetes platform which meets our demanding requirements to run mission-critical banking software in production! — Thomas Gosteli, Linux Systems Specialist