This document discusses securing communication in cloud native applications. It covers traditional network security approaches and challenges with modern application development. It emphasizes applying defense in depth through hardening infrastructure, scanning code and dependencies, encrypting data at rest and in transit, and using the principle of least privilege. The document explores the different requirements for securing communication at the edge with an API gateway compared to within a service mesh. It recommends that all security practices have good user experience and be integrated into regular development workflows.

1. Copyright © 2019 HashiCorp
Securing Cloud Native
Communication:
From End User to Service
Daniel Bryant
Product Architect, Datawire

2. Traditional IT approach to
network security

3. Application modernisation: Gift and curse

4. Security: Defence in depth is vital
▪ Harden and scan infrastructure
▪ Scan code, dependencies, packages
▪ Encrypt data at rest
▪ Encrypt data in transit
▪ Principle of least privilege

5. ▪ Harden and scan infrastructure
▪ Scan code, dependencies, packages
▪ Encrypt data at rest
▪ Encrypt data in transit
▪ Principle of least privilege
Security: Defence in depth is vital

6. Exploring end-to-end communication

7. Exploring end-to-end communication

8. bit.ly/2xGeFZ0

9. Exploring end-to-end communication

10. API Gateway: Edge proxy, ingress, ADC...
▪ Exposes internal services to end-users (via multiple domains)
▪ Encapsulates backends: k8s, VMs, bare metal etc
▪ TLS termination: enforcing minimum TLS version
▪ End-user authentication/authorization (add token/JWT for propagation)
▪ Rate limiting: DDoS protection, etc

11. Ambassador config

12. Exploring end-to-end communication

13. Service Mesh: Proxy mesh, Fabric model...
▪ Exposes internal services to internal consumers
▪ Encapsulates service infra: across k8s, VMs, bare metal etc
▪ mTLS: service identity and traffic encryption
▪ ACLs and intentions: infra/service identity-based access
▪ Enforce metadata (but apps need to propagate headers/tokens)

14. Exploring end-to-end communication

15. Consul config

16. © 2019 HashiCorp 16
Principle of least privilege: service segmentation

17. Consul config

18. tl;dr
▪ Security is everyone’s responsibility
▪ Application modernisation leads to heterogeneous infra/networks
▪ Defence in depth is vital
▪ Edge and service-to-service use cases have different requirements
▪ All security must have good UX / DevEx (make it part of regular workflow)
https://www.getambassador.io/resources/strategies-incremental-migration/
@danielbryantuk

19. References
▪ Context:
– https://www.infoq.com/articles/api-gateway-service-mesh-app-modernisation/
▪ Reference:
– https://www.getambassador.io/user-guide/consul-connect-ambassador/
– https://www.getambassador.io/user-guide/consul/
– https://www.consul.io/docs/platform/k8s/ambassador.html
– https://www.hashicorp.com/blog/hashicorp-consul-supports-microsoft-s-new-service-mesh-framework
Experiment in an Instruqt sandbox: https://instruqt.com/hashicorp/tracks/sock-shop-tutorial
Code examples: https://github.com/emojify-app

20. Copyright © 2019 HashiCorp
Thanks!
@sheriffjackson | @danielbryantuk