Solving trust issues at scale
•Download as PPTX, PDF•
0 likes•194 views
Micro-services are social beings: they can’t function without talking with other services. Every microservice has its own domain, and it usually relies on other micro-services to function properly. But this also raises an interesting question: do we trust all of our micro-services? The truth is that not all micro-services are the same: some micro-services are more sensitive - for example, services that handle user data. Others are user-facing and therefore riskier. We cannot treat all services as equal. We need a good and robust mechanism to describe who can talk with who. At Soluto, we are dealing with this challenge for a while. In this talk, I’ll share the journey we went through until we found a solution we’re happy with: a simple and declarative system that allows services to define who can access them. Any dev can request access to any service, and the service owner can review it. In talk, I’ll share how we build this solution, using open source tools like Open Policy Agent, so you can easily build something similar.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Solving trust issues at scale
Similar to Solving trust issues at scale (20)
More from Soluto
More from Soluto (20)
Recently uploaded
Recently uploaded (20)
Solving trust issues at scale
- 1. Solving Trust Issues At Scale Building an Authorization System that Devs Don’t Hate @omerlh
- 2. @omerlh
- 3. @omerlh
- 5. Lesson Learned • Automatic Detection (GitGurdian) • Harden Authorization System • Better audit logs • Who used this token? • Who created it and why? @omerlh
- 8. @omerlh
- 13. One horse can take down our fort... @omerlh
- 14. Let’s talk about blast radius • One vulnerable service affects all the other • Ensuring all services are trust worthy is impossible • We must narrow the blast radius @omerlh
- 17. The Ideal System Least Privilege • Just the permissions required Secure by Default • Zero permissions by default Self Service • Minimize the impact on development speed Scale • Hundred of micro-services to manage @omerlh
- 18. @omerlh
- 20. High Level Overview AppIncoming request Collect decision logs Get bundlesPublish bundle Is Authorized? @omerlh
- 22. Envoy Proxy • A CNCF project • Authentication and Authorization filters • Run as side car on the pod • No code changes required @omerlh
- 23. @omerlh
- 24. @omerlh
- 25. @omerlh
- 26. @omerlh
- 27. Meet Open Policy Agent • An open source policy system • Author policies using Rego DSL • Built-in Envoy integration • A CNCF project @omerlh
- 30. Envoy + OPA = KISS @omerlh
- 31. @omerlh
- 32. @omerlh
- 33. @omerlh
- 34. @omerlh
- 35. @omerlh
- 36. Done? Least Privilege • Just the permissions required Secure by Default • Zero permissions by default Self Service • Minimize the impact on development speed Scale • Hundred of micro-services to manage @omerlh
- 37. Wait, all devs need to learn Rego? @omerlh
- 38. Using data for abstraction • Policies can load data from JSON/YAML • Author generic policies • Devs just needs to fill the input @omerlh
- 39. @omerlh
- 40. @omerlh
- 41. @omerlh
- 42. Building our policies • A common policy, maintained by the security team • Including unit tests! • Each service has it’s own data file • Permission request is just a PR • Built in audit and review features @omerlh
- 45. Done? Least Privilege • Just the permissions required Secure by Default • Zero permissions by default Self Service • Minimize the impact on development speed Scale • Hundred of micro-services to manage @omerlh
- 46. Loading Policies • Bundles are policies archive • Hot bundle loading • Dynamic bundle discovery @omerlh
- 47. @omerlh
- 48. @omerlh
- 49. @omerlh
- 50. @omerlh
- 51. @omerlh
- 52. @omerlh
- 53. @omerlh
- 54. @omerlh
- 55. What about logging? • OPA log each decision into decision logs • Can be used for debug and audit purposes • Support redacting for sensitive input • Collect with fluentd/Loki @omerlh
- 56. @omerlh
- 57. Putting it all together AppIncoming request Collect decision logs Get bundlesPublish bundle Is Authorized? @omerlh
- 58. Done? Least Privilege • Just the permissions required Secure by Default • Zero permissions by default Self Service Minimize the impact on development speed Scale • Hundred of micro-services to manage @omerlh
- 59. Everything come with a price… • OPA/Envoy running as side-car • Resource usage costs per pod • A bug in OPA/Envoy has serious implication @omerlh
- 60. How can I build it? • Fork the GitHub repo - https://github.com/omerlh/opa-demo • Follow the readme • Reach out with questions @omerlh
- 63. Going Forward • Improved Visibility • More Complex Policies • Expend adoption @omerlh
- 64. Lesson Learned • Automatic Detection (GitGurdian) • Harden Authorization System • Better audit logs • Who used this token? • Who created it and why? @omerlh
- 67. @omerlh Enable Devs to Move Faster and Safer
- 69. Resources • OPA-Envoy integration • Envoy JWT authentication • GitHub demo repo @omerlh
Editor's Notes
- I’m a builder, this is what I love doing and doing it from a really early age Doing it professionally for the last 8 years I’m from Israel, married etc Who else is a builder? This talk is for you!
- Today I’m working at Soluto, our missing is to help people with their technology My job is DevSecOps, or as I see it - helping the entire team to build a more secure software I’m achieving it via many approaches, including education, reviewing and threat modeling – but what I love the most is threat modeling