Protected Coordination of Service Mesh for Container-Based 3-Tier Service Traffic

Abstract

With the rapid expansion of cloud-native computing paradigm, a growing number of applications are adopting container-based microservices architecture (MSA). The resulting container-based MSA functions are required to be tightly stitched together and therefore the stitching interconnections need persistent monitor/control coordination. Recent service mesh approaches are trying to solve this maintenance problem in a transparent manner. However, with the popular Istio-based service mesh realization, the monitor/control traffic for coordination is exposed to application tenants, which could be a potential security concern. Typically, containers are limited with a single network interface and thus it is not possible to isolate control / monitor traffic from application data traffic. Thus, in this paper, we propose a protected coordination scheme for service mesh as a work-around solution. For this protected coordination of service mesh, the monitor/control traffic for coordination is separated and encrypted while data traffic is treated in the same way with the existing service mesh approach.