The Negatives to a Per-Host Service Mesh, the Sidecar Model Being a More Ideal Solut... Chad Crowell
Channel: CNCF [Cloud Native Computing Foundation]
Date: 02/05/2023

The Negatives to a Per-Host Service Mesh, the Sidecar Model Being a More Ideal Solution for Providing a More Robust Security Boundary - Chad Crowell, Raft

In our quest to improve the security of our service mesh, eBPF seems like a logical solution. In particular, a per-host proxy which would eliminate the need for a sidecar as a part of our service mesh implementation. But, there are security implications that we need to consider which would leave us more vulnerable if this decision was carelessly made. The sidecar proxy is actually an integral part of providing a reliable and scalable service, whilst providing necessary security constraints. Eliminating the sidecar proxy in favor of a per-host proxy is a bad idea and in this talk you'll discover why. In this talk, we'll discuss the footprint of a proxy at low traffic levels, the existing mechanisms that you can leverage already built-in to Kubernetes, the blast radius of a sidecar proxy, and most importantly, the controlled security boundary. The alternative per-host proxy introduces complexities and unpredictability into your cluster, as the blast radius is large and ever-changing. The security landscape is now more complex, and introduces an increased attack vector.