chapter five

5 Engaging throttling, monitoring, and access control

This chapter covers

How throttling works and why we need to apply throttling to our microservices
Different dimensions of throttling and their impact
Setting up Zuul as an API gateway for throttling
An introduction to observability and its importance in a microservices deployment
Using Prometheus and Grafana to monitor our microservices
Applying access control policies via Zuul and Open Policy Agent (OPA)

In chapter 3 we introduced the API Gateway architectural pattern and discussed its applicability in a microservices deployment. Zuul is an open source API gateway developed by Netflix to front all it’s microservices. Zuul provides dynamic routing, monitoring, resiliency, security and more. It acts as the front door to Netflix’s server infrastructure, handling traffic from Netflix users around the globe. In chapter 3 we discussed how to enforce security based on OAuth 2.0 for your microservices using Zuul as the API gateway. In this chapter we extend those samples to use Zuul to handle throttling, apply access control policies and we also discuss the monitoring aspects in a microservices deployment.

5.1 Throttling at the API gateway with Zuul

5.1.1 Quota based throttling for applications

5.1.2 Fair usage policy for users

5.1.3 Running the sample to apply quota based throttling

5.1.4 Maximum handling capacity of a microservice

5.1.5 Operation level throttling

5.1.6 Throttling the OAuth 2.0 token and authorize endpoints

5.1.7 Privilege based throttling

5.2 Monitoring and analytics with Prometheus and Grafana

5.2.1 Monitoring the Order Processing microservice

5.2.2 Behind the scenes of using Prometheus for monitoring

5.3 Enforcing access control policies at the API gateway with Open Policy Agent (OPA)