Best Practices: Security Concerns with Microservices

Microservices architecture is more dispersed in nature hence, there will be a larger surface area for attacks and vulnerabilities. But because of this dispersion where services being independent at one another, this architecture allows for a more granular restrictions. 

• At the infrastructure, the concern is coming from multiple network entry-points, rate limits and traffic throttling configuration, need for multiple firewalls, defense in depth, network structures and keys and tokens management.
• Ensure regular updates taking note of the following:
• updates must not break the system
• updates should not interrupt the application
• updates must not require full deployments
  

• Keep control 
• never assume infinite scalability 
• rate limits protect from DDoS 
• always test your load
  

• Keep your guard up 
• multiple firewalls 
• minimum exposure (expose only what is needed)
• keep sensitive services private
  

• Keep/protect your keys 
• do not store in the servers 
• encrypt everything 
• use internal and changeable tokens like OAuth
  

• Application concerns
• repeatable deployments 
• encryption algorithms 
• protection methods depending on data types 
• security configuration 
• testing (white, black and penetration)

• Data concerns
• input validation 
• output encoding 
• not obvious ID's 
• end-to-end encryption 
• authentication and authorization even among services

• To mitigate both application and data concerns
• don't make the data structures obvious
• keep IDs out of API endpoints
• it is recommended to use OAuth for authentication and authorization
• usually done in API gateway which enables service discovery
• enables: role based access, access control and signed requests 
• helps with orchestration 
• provides caching layer
  

Reference: Packt's Hands-On Microservices with Python by Peter Fisher

Read More

CKAD Learning Series 01: Installing minikube

1. Enable CPU virtualization support which can be done through the BIOS of your laptop/PC. To check, run the command:
grep vmx /proc/cpuinfo


2. Add Kubernetes to your repository
create this file: /etc/yum.repos.d/kubernetes.repo
to contain the snippet below:
[kubernetes]
name=Kubernetes
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg

3. It is adviced to install kubectl first so that minikube will detect it and automatically attach itself with its configuration.
sudo dnf install -y kubectl

4. Install VirtualBox or KVM (KVM in this example)
sudo dnf clean all
sudo dnf -y upgrade
sudo dnf install @virtualization -y 

Then start the libvirtd service and add your user to the libvirt group
sudo systemctl enable --now libvirtd
sudo usermod -aG libvirt $USER
 
5. Installing minikube
Download minikube:
curl -Lo minikube https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64
Set it as an executable and move it to bin right away
chmod +x minikube
mv minikube /usr/local/bin
 
6. Reboot the machine

7. After reboot, but before running minikube, you may have to add the user that you'll be using with to run minikube to the libvirt group
usermod -aG libvirt $USER

Run minikube
minikube start --memory 4096 --vm-driver=kvm2
followed by: 'kubectl cluster-info' and 'kubectl get nodes'

minikube ssh

Read More