Complete Guide to Microservices Security Patterns and Zero Trust Architecture#

1
graph TB
2
    A[User/Service Request] --> B{Identity Verification}
3
    B -->|Verified| C{Device Trust Assessment}
4
    B -->|Not Verified| X[Access Denied]
5
    C -->|Trusted| D{Resource Authorization}
6
    C -->|Not Trusted| Y[Additional Authentication]
7
    D -->|Authorized| E[Least Privilege Access]
8
    D -->|Not Authorized| Z[Access Denied]
9
    E --> F[Continuous Monitoring]
10
    F --> G[Risk-Based Adaptation]
11
    G --> H[Access Granted]
12

13
    style A fill:#e1f5fe
14
    style H fill:#c8e6c9
15
    style X fill:#ffcdd2
16
    style Y fill:#fff3e0
17
    style Z fill:#ffcdd2

1
# Zero Trust Policy Configuration
2
apiVersion: security.istio.io/v1beta1
3
kind: AuthorizationPolicy
4
metadata:
5
  name: zero-trust-policy
6
  namespace: production
7
spec:
8
  rules:
9
    - from:
10
        - source:
11
            principals: ["cluster.local/ns/production/sa/user-service"]
12
      to:
13
        - operation:
14
            methods: ["GET", "POST"]
15
            paths: ["/api/users/*"]
16
      when:
17
        - key: request.headers[authorization]
18
          values: ["Bearer *"]

1
graph TB
2
    subgraph "External Layer"
3
        Client[Client Application]
4
        API_GW[API Gateway]
5
    end
6

7
    subgraph "Security Layer"
8
        IAM[Identity & Access Management]
9
        Policy[Policy Engine - OPA]
10
        Monitor[Security Monitoring]
11
    end
12

13
    subgraph "Service Mesh"
14
        Proxy1[Envoy Proxy]
15
        Proxy2[Envoy Proxy]
16
        Proxy3[Envoy Proxy]
17
    end
18

19
    subgraph "Microservices"
20
        Service1[User Service]
21
        Service2[Order Service]
22
        Service3[Payment Service]
23
    end
24

25
    Client --> API_GW
26
    API_GW --> IAM
27
    API_GW --> Policy
28
    API_GW --> Proxy1
29

30
    Proxy1 <--> Service1
31
    Proxy2 <--> Service2
32
    Proxy3 <--> Service3
33

34
    Service1 --> Proxy2
35
    Service2 --> Proxy3
36

37
    Monitor --> Proxy1
38
    Monitor --> Proxy2
39
    Monitor --> Proxy3
40

41
    style IAM fill:#4fc3f7
42
    style Policy fill:#81c784
43
    style Monitor fill:#ffb74d
44
    style API_GW fill:#ba68c8

1
sequenceDiagram
2
    participant Client as Client App
3
    participant Browser as User Browser
4
    participant AuthServer as Authorization Server
5
    participant API as Protected API
6
    participant Resource as Resource Server
7

8
    Client->>Browser: Redirect to Authorization Server
9
    Browser->>AuthServer: Authorization Request
10
    AuthServer->>Browser: Login Page
11
    Browser->>AuthServer: User Credentials
12
    AuthServer->>Browser: Authorization Code
13
    Browser->>Client: Authorization Code
14
    Client->>AuthServer: Exchange Code for Token
15
    AuthServer->>Client: Access Token + ID Token
16
    Client->>API: API Request + Access Token
17
    API->>Resource: Forward Request
18
    Resource->>API: Resource Data
19
    API->>Client: API Response

1
# Kong Gateway OAuth2 Configuration
2
apiVersion: configuration.konghq.com/v1
3
kind: KongPlugin
4
metadata:
5
  name: oauth2-plugin
6
plugin: oauth2
7
config:
8
  enable_authorization_code: true
9
  enable_client_credentials: true
10
  enable_implicit_grant: false
11
  enable_password_grant: false
12
  token_expiration: 3600
13
  auth_header_name: "authorization"
14
  global_credentials: true
15
  anonymous: ""
16
  hide_credentials: true
17
  accept_http_if_already_terminated: true

1
// JWT Token Validation Middleware (Node.js)
2
const jwt = require("jsonwebtoken");
3
const jwksClient = require("jwks-rsa");
4

5
const client = jwksClient({
6
  jwksUri: "https://your-auth-server.com/.well-known/jwks.json",
7
  cache: true,
8
  cacheMaxEntries: 5,
9
  cacheMaxAge: 600000, // 10 minutes
10
});
11

12
function getKey(header, callback) {
13
  client.getSigningKey(header.kid, (err, key) => {
14
    const signingKey = key.publicKey || key.rsaPublicKey;
15
    callback(null, signingKey);
16
  });
17
}
18

19
const verifyToken = (req, res, next) => {
20
  const token = req.headers.authorization?.replace("Bearer ", "");
21

22
  if (!token) {
23
    return res.status(401).json({ error: "No token provided" });
24
  }
25

26
  jwt.verify(
27
    token,
28
    getKey,
29
    {
30
      audience: process.env.JWT_AUDIENCE,
31
      issuer: process.env.JWT_ISSUER,
32
      algorithms: ["RS256"],
33
    },
34
    (err, decoded) => {
35
      if (err) {
36
        return res.status(401).json({ error: "Invalid token" });
37
      }
38

39
      req.user = decoded;
40
      next();
41
    }
42
  );
43
};
44

45
module.exports = verifyToken;

1
graph LR
2
    A[Token Request] --> B[Generate Access Token<br/>15 min expiry]
3
    B --> C[Generate Refresh Token<br/>7 days expiry]
4
    C --> D[Store in HttpOnly Cookie]
5
    D --> E[Client Uses Access Token]
6
    E --> F{Token Expired?}
7
    F -->|No| G[Continue API Calls]
8
    F -->|Yes| H[Use Refresh Token]
9
    H --> I[Generate New Tokens]
10
    I --> J[Rotate Refresh Token]
11
    J --> B
12

13
    style A fill:#e3f2fd
14
    style B fill:#fff3e0
15
    style C fill:#f3e5f5
16
    style D fill:#e8f5e8
17
    style I fill:#fff3e0
18
    style J fill:#f3e5f5

1
// Go JWT Implementation with Refresh Token Rotation
2
package auth
3

4
import (
5
    "crypto/rand"
6
    "encoding/base64"
7
    "time"
8

9
    "github.com/golang-jwt/jwt/v5"
10
    "github.com/google/uuid"
11
)
12

13
type TokenManager struct {
14
    accessSecret  string
15
    refreshSecret string
16
    accessTTL     time.Duration
17
    refreshTTL    time.Duration
18
    denylist      map[string]time.Time
19
}
20

21
type TokenPair struct {
22
    AccessToken  string `json:"access_token"`
23
    RefreshToken string `json:"refresh_token"`
24
    ExpiresIn    int64  `json:"expires_in"`
25
    TokenType    string `json:"token_type"`
26
}
27

28
func NewTokenManager(accessSecret, refreshSecret string) *TokenManager {
29
    return &TokenManager{
30
        accessSecret:  accessSecret,
31
        refreshSecret: refreshSecret,
32
        accessTTL:     15 * time.Minute,
33
        refreshTTL:    7 * 24 * time.Hour,
34
        denylist:      make(map[string]time.Time),
35
    }
36
}
37

38
func (tm *TokenManager) GenerateTokenPair(userID string, roles []string) (*TokenPair, error) {
39
    // Generate JTI for tracking
40
    jti := uuid.New().String()
41

42
    // Access Token Claims
43
    accessClaims := jwt.MapClaims{
44
        "sub":   userID,
45
        "roles": roles,
46
        "exp":   time.Now().Add(tm.accessTTL).Unix(),
47
        "iat":   time.Now().Unix(),
48
        "nbf":   time.Now().Unix(),
49
        "jti":   jti,
50
        "aud":   "api-service",
51
        "iss":   "auth-service",
52
    }
53

54
    accessToken := jwt.NewWithClaims(jwt.SigningMethodHS256, accessClaims)
55
    accessTokenString, err := accessToken.SignedString([]byte(tm.accessSecret))
56
    if err != nil {
57
        return nil, err
58
    }
59

60
    // Refresh Token
61
    refreshTokenBytes := make([]byte, 32)
62
    rand.Read(refreshTokenBytes)
63
    refreshToken := base64.URLEncoding.EncodeToString(refreshTokenBytes)
64

65
    return &TokenPair{
66
        AccessToken:  accessTokenString,
67
        RefreshToken: refreshToken,
68
        ExpiresIn:    int64(tm.accessTTL.Seconds()),
69
        TokenType:    "Bearer",
70
    }, nil
71
}
72

73
func (tm *TokenManager) ValidateToken(tokenString string) (*jwt.MapClaims, error) {
74
    token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
75
        return []byte(tm.accessSecret), nil
76
    })
77

78
    if err != nil {
79
        return nil, err
80
    }
81

82
    if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
83
        // Check denylist
84
        if jti, ok := claims["jti"].(string); ok {
85
            if _, denied := tm.denylist[jti]; denied {
86
                return nil, jwt.ErrTokenNotValidYet
87
            }
88
        }
89
        return &claims, nil
90
    }
91

92
    return nil, jwt.ErrTokenNotValidYet
93
}
94

95
func (tm *TokenManager) RevokeToken(jti string) {
96
    tm.denylist[jti] = time.Now().Add(tm.accessTTL)
97
}

1
# Kubernetes Secret for JWT Keys
2
apiVersion: v1
3
kind: Secret
4
metadata:
5
  name: jwt-secrets
6
  namespace: auth-system
7
type: Opaque
8
data:
9
  access-secret: <base64-encoded-secret>
10
  refresh-secret: <base64-encoded-secret>
11
---
12
apiVersion: apps/v1
13
kind: Deployment
14
metadata:
15
  name: auth-service
16
spec:
17
  template:
18
    spec:
19
      containers:
20
        - name: auth-service
21
          env:
22
            - name: JWT_ACCESS_SECRET
23
              valueFrom:
24
                secretKeyRef:
25
                  name: jwt-secrets
26
                  key: access-secret
27
            - name: JWT_REFRESH_SECRET
28
              valueFrom:
29
                secretKeyRef:
30
                  name: jwt-secrets
31
                  key: refresh-secret

1
sequenceDiagram
2
    participant Client as Client Service
3
    participant Server as Server Service
4
    participant CA as Certificate Authority
5

6
    Note over Client, Server: Initial Connection
7
    Client->>Server: ClientHello + Client Certificate
8
    Server->>CA: Verify Client Certificate
9
    CA->>Server: Certificate Valid
10
    Server->>Client: ServerHello + Server Certificate
11
    Client->>CA: Verify Server Certificate
12
    CA->>Client: Certificate Valid
13

14
    Note over Client, Server: Key Exchange
15
    Client->>Server: Client Key Exchange
16
    Server->>Client: Server Key Exchange
17

18
    Note over Client, Server: Authentication
19
    Client->>Server: Certificate Verify + Finished
20
    Server->>Client: Finished
21

22
    Note over Client, Server: Encrypted Communication
23
    Client->>Server: Encrypted Application Data
24
    Server->>Client: Encrypted Application Data

1
# Strict mTLS Policy for Production Namespace
2
apiVersion: security.istio.io/v1beta1
3
kind: PeerAuthentication
4
metadata:
5
  name: strict-mtls
6
  namespace: production
7
spec:
8
  mtls:
9
    mode: STRICT
10
---
11
# Destination Rule for mTLS
12
apiVersion: networking.istio.io/v1beta1
13
kind: DestinationRule
14
metadata:
15
  name: mtls-destination
16
  namespace: production
17
spec:
18
  host: "*.production.svc.cluster.local"
19
  trafficPolicy:
20
    tls:
21
      mode: ISTIO_MUTUAL
22
  exportTo:
23
    - "."
24
---
25
# Authorization Policy with mTLS
26
apiVersion: security.istio.io/v1beta1
27
kind: AuthorizationPolicy
28
metadata:
29
  name: mtls-authz
30
  namespace: production
31
spec:
32
  rules:
33
    - from:
34
        - source:
35
            principals: ["cluster.local/ns/production/sa/*"]
36
    - to:
37
        - operation:
38
            methods: ["GET", "POST", "PUT", "DELETE"]

1
#!/bin/bash
2
# Automated Certificate Rotation Script
3

4
NAMESPACE="production"
5
CA_SECRET="istio-ca-secret"
6
VALIDITY_DAYS=90
7
ROTATION_THRESHOLD=30
8

9
# Check certificate expiry
10
check_cert_expiry() {
11
    local cert_file=$1
12
    local expiry_date=$(openssl x509 -in "$cert_file" -noout -enddate | cut -d= -f2)
13
    local expiry_epoch=$(date -d "$expiry_date" +%s)
14
    local current_epoch=$(date +%s)
15
    local days_until_expiry=$(( (expiry_epoch - current_epoch) / 86400 ))
16

17
    echo $days_until_expiry
18
}
19

20
# Rotate certificates if needed
21
rotate_certificates() {
22
    local days_left=$(check_cert_expiry /etc/ssl/certs/tls.crt)
23

24
    if [ $days_left -lt $ROTATION_THRESHOLD ]; then
25
        echo "Certificate expires in $days_left days. Rotating..."
26

27
        # Generate new certificate
28
        kubectl create secret tls new-tls-secret \
29
            --cert=new-cert.pem \
30
            --key=new-key.pem \
31
            -n $NAMESPACE
32

33
        # Update deployment to use new certificate
34
        kubectl patch deployment app-deployment \
35
            -n $NAMESPACE \
36
            -p '{"spec":{"template":{"spec":{"volumes":[{"name":"tls-certs","secret":{"secretName":"new-tls-secret"}}]}}}}'
37

38
        # Wait for rollout
39
        kubectl rollout status deployment/app-deployment -n $NAMESPACE
40

41
        # Delete old certificate
42
        kubectl delete secret old-tls-secret -n $NAMESPACE
43

44
        echo "Certificate rotation completed"
45
    else
46
        echo "Certificate valid for $days_left days"
47
    fi
48
}
49

50
rotate_certificates

1
graph TB
2
    subgraph "Client Layer"
3
        Mobile[Mobile App]
4
        Web[Web App]
5
        API_Client[API Client]
6
    end
7

8
    subgraph "API Gateway Security Layers"
9
        Layer1[Rate Limiting & DDoS Protection]
10
        Layer2[Authentication & Authorization]
11
        Layer3[Input Validation & Sanitization]
12
        Layer4[CORS & Security Headers]
13
        Layer5[Request/Response Transformation]
14
        Layer6[Monitoring & Logging]
15
    end
16

17
    subgraph "Backend Services"
18
        UserSvc[User Service]
19
        OrderSvc[Order Service]
20
        PaymentSvc[Payment Service]
21
    end
22

23
    Mobile --> Layer1
24
    Web --> Layer1
25
    API_Client --> Layer1
26

27
    Layer1 --> Layer2
28
    Layer2 --> Layer3
29
    Layer3 --> Layer4
30
    Layer4 --> Layer5
31
    Layer5 --> Layer6
32

33
    Layer6 --> UserSvc
34
    Layer6 --> OrderSvc
35
    Layer6 --> PaymentSvc
36

37
    style Layer1 fill:#ffcdd2
38
    style Layer2 fill:#f8bbd9
39
    style Layer3 fill:#e1bee7
40
    style Layer4 fill:#c5cae9
41
    style Layer5 fill:#bbdefb
42
    style Layer6 fill:#b2dfdb

1
# Kong Rate Limiting Plugin
2
apiVersion: configuration.konghq.com/v1
3
kind: KongPlugin
4
metadata:
5
  name: rate-limiting-plugin
6
plugin: rate-limiting
7
config:
8
  minute: 100
9
  hour: 1000
10
  day: 10000
11
  month: 100000
12
  limit_by: consumer
13
  policy: redis
14
  redis_host: redis-cluster.default.svc.cluster.local
15
  redis_port: 6379
16
  redis_timeout: 2000
17
  redis_password: "secure-password"
18
  redis_database: 0
19
  fault_tolerant: true
20
  hide_client_headers: false
21
---
22
# Apply to API Routes
23
apiVersion: networking.k8s.io/v1
24
kind: Ingress
25
metadata:
26
  name: api-ingress
27
  annotations:
28
    konghq.com/plugins: rate-limiting-plugin
29
spec:
30
  rules:
31
    - host: api.example.com
32
      http:
33
        paths:
34
          - path: /api/v1
35
            pathType: Prefix
36
            backend:
37
              service:
38
                name: api-service
39
                port:
40
                  number: 80

1
# Python Flask API with Comprehensive Validation
2
from flask import Flask, request, jsonify
3
from marshmallow import Schema, fields, validate, ValidationError
4
from flask_limiter import Limiter
5
from flask_limiter.util import get_remote_address
6
import re
7
import bleach
8

9
app = Flask(__name__)
10

11
# Rate Limiting Setup
12
limiter = Limiter(
13
    app,
14
    key_func=get_remote_address,
15
    default_limits=["200 per day", "50 per hour"]
16
)
17

18
# Input Validation Schemas
19
class UserCreateSchema(Schema):
20
    username = fields.Str(
21
        required=True,
22
        validate=[
23
            validate.Length(min=3, max=50),
24
            validate.Regexp(r'^[a-zA-Z0-9_-]+$', error="Invalid characters in username")
25
        ]
26
    )
27
    email = fields.Email(required=True)
28
    password = fields.Str(
29
        required=True,
30
        validate=[
31
            validate.Length(min=8, max=128),
32
            validate.Regexp(
33
                r'^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]',
34
                error="Password must contain uppercase, lowercase, digit, and special character"
35
            )
36
        ]
37
    )
38
    bio = fields.Str(validate=validate.Length(max=500))
39

40
class UserUpdateSchema(Schema):
41
    username = fields.Str(
42
        validate=[
43
            validate.Length(min=3, max=50),
44
            validate.Regexp(r'^[a-zA-Z0-9_-]+$')
45
        ]
46
    )
47
    email = fields.Email()
48
    bio = fields.Str(validate=validate.Length(max=500))
49

50
# Security Middleware
51
def sanitize_input(data):
52
    """Sanitize string inputs to prevent XSS and injection attacks"""
53
    if isinstance(data, dict):
54
        return {key: sanitize_input(value) for key, value in data.items()}
55
    elif isinstance(data, list):
56
        return [sanitize_input(item) for item in data]
57
    elif isinstance(data, str):
58
        # Remove potentially dangerous HTML tags and attributes
59
        return bleach.clean(data, tags=[], attributes={}, strip=True)
60
    return data
61

62
def validate_content_type():
63
    """Ensure proper content type for API requests"""
64
    if request.method in ['POST', 'PUT', 'PATCH']:
65
        if not request.is_json:
66
            return jsonify({'error': 'Content-Type must be application/json'}), 400
67
    return None
68

69
# API Endpoints with Security
70
@app.route('/api/v1/users', methods=['POST'])
71
@limiter.limit("10 per minute")
72
def create_user():
73
    # Content type validation
74
    content_type_error = validate_content_type()
75
    if content_type_error:
76
        return content_type_error
77

78
    try:
79
        # Input validation
80
        schema = UserCreateSchema()
81
        user_data = schema.load(request.json)
82

83
        # Input sanitization
84
        user_data = sanitize_input(user_data)
85

86
        # Additional business logic validation
87
        if User.query.filter_by(username=user_data['username']).first():
88
            return jsonify({'error': 'Username already exists'}), 409
89

90
        if User.query.filter_by(email=user_data['email']).first():
91
            return jsonify({'error': 'Email already exists'}), 409
92

93
        # Create user (password hashing handled in model)
94
        user = User(**user_data)
95
        db.session.add(user)
96
        db.session.commit()
97

98
        return jsonify({
99
            'id': user.id,
100
            'username': user.username,
101
            'email': user.email,
102
            'created_at': user.created_at.isoformat()
103
        }), 201
104

105
    except ValidationError as err:
106
        return jsonify({'errors': err.messages}), 400
107
    except Exception as e:
108
        app.logger.error(f"User creation error: {str(e)}")
109
        return jsonify({'error': 'Internal server error'}), 500
110

111
@app.errorhandler(429)
112
def ratelimit_handler(e):
113
    return jsonify({'error': 'Rate limit exceeded', 'retry_after': e.retry_after}), 429
114

115
# Security Headers Middleware
116
@app.after_request
117
def after_request(response):
118
    response.headers['X-Content-Type-Options'] = 'nosniff'
119
    response.headers['X-Frame-Options'] = 'DENY'
120
    response.headers['X-XSS-Protection'] = '1; mode=block'
121
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
122
    response.headers['Content-Security-Policy'] = "default-src 'self'"
123
    return response

1
// Express.js CORS Security Configuration
2
const express = require("express");
3
const cors = require("cors");
4
const helmet = require("helmet");
5

6
const app = express();
7

8
// Security middleware
9
app.use(
10
  helmet({
11
    contentSecurityPolicy: {
12
      directives: {
13
        defaultSrc: ["'self'"],
14
        styleSrc: ["'self'", "'unsafe-inline'"],
15
        scriptSrc: ["'self'"],
16
        imgSrc: ["'self'", "data:", "https:"],
17
        connectSrc: ["'self'"],
18
        fontSrc: ["'self'"],
19
        objectSrc: ["'none'"],
20
        mediaSrc: ["'self'"],
21
        frameSrc: ["'none'"],
22
      },
23
    },
24
    crossOriginEmbedderPolicy: false,
25
  })
26
);
27

28
// CORS configuration with environment-based origins
29
const corsOptions = {
30
  origin: function (origin, callback) {
31
    const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(",") || [
32
      "https://app.example.com",
33
      "https://admin.example.com",
34
    ];
35

36
    // Allow requests with no origin (mobile apps, etc.)
37
    if (!origin) return callback(null, true);
38

39
    if (allowedOrigins.indexOf(origin) !== -1) {
40
      callback(null, true);
41
    } else {
42
      callback(new Error("Not allowed by CORS"));
43
    }
44
  },
45
  methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
46
  allowedHeaders: [
47
    "Origin",
48
    "X-Requested-With",
49
    "Content-Type",
50
    "Accept",
51
    "Authorization",
52
    "X-API-Key",
53
  ],
54
  credentials: true,
55
  maxAge: 86400, // 24 hours
56
};
57

58
app.use(cors(corsOptions));
59

60
// API routes
61
app.use("/api/v1", require("./routes/api"));
62

63
module.exports = app;

1
graph TB
2
    subgraph "Secret Sources"
3
        Vault[HashiCorp Vault]
4
        AWS[AWS Secrets Manager]
5
        Azure[Azure Key Vault]
6
        K8s[Kubernetes Secrets]
7
    end
8

9
    subgraph "Secret Management Layer"
10
        CSI[Secrets Store CSI Driver]
11
        ESO[External Secrets Operator]
12
        Reloader[Reloader]
13
    end
14

15
    subgraph "Application Layer"
16
        App1[User Service]
17
        App2[Order Service]
18
        App3[Payment Service]
19
    end
20

21
    subgraph "Infrastructure"
22
        DB[(Database)]
23
        Cache[(Redis)]
24
        Queue[Message Queue]
25
    end
26

27
    Vault --> CSI
28
    AWS --> ESO
29
    Azure --> ESO
30
    K8s --> CSI
31

32
    CSI --> App1
33
    ESO --> App2
34
    ESO --> App3
35

36
    App1 --> DB
37
    App2 --> Cache
38
    App3 --> Queue
39

40
    Reloader --> App1
41
    Reloader --> App2
42
    Reloader --> App3
43

44
    style Vault fill:#7c4dff
45
    style AWS fill:#ff9800
46
    style Azure fill:#2196f3
47
    style CSI fill:#4caf50
48
    style ESO fill:#795548

1
# Vault Database Secrets Engine Configuration
2
path "database/config/postgresql" {
3
  capabilities = ["create", "read", "update", "delete"]
4
}
5

6
# Database connection configuration
7
resource "vault_database_secret_backend_connection" "postgresql" {
8
  backend       = vault_mount.database.path
9
  name          = "postgresql"
10
  allowed_roles = ["user-service-role", "order-service-role"]
11

12
  postgresql {
13
    connection_url = "postgresql://{{username}}:{{password}}@postgres:5432/myapp?sslmode=require"
14
    username       = var.vault_db_username
15
    password       = var.vault_db_password
16
  }
17
}
18

19
# Dynamic role for user service
20
resource "vault_database_secret_backend_role" "user_service" {
21
  backend     = vault_mount.database.path
22
  name        = "user-service-role"
23
  db_name     = vault_database_secret_backend_connection.postgresql.name
24

25
  creation_statements = [
26
    "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';",
27
    "GRANT SELECT, INSERT, UPDATE ON users TO \"{{name}}\";"
28
  ]
29

30
  revocation_statements = [
31
    "DROP ROLE IF EXISTS \"{{name}}\";"
32
  ]
33

34
  default_ttl = 1800  # 30 minutes
35
  max_ttl     = 3600  # 1 hour
36
}
37

38
# Policy for user service
39
resource "vault_policy" "user_service" {
40
  name = "user-service-policy"
41

42
  policy = <<EOT
43
# Allow reading database credentials
44
path "database/creds/user-service-role" {
45
  capabilities = ["read"]
46
}
47

48
# Allow renewing the lease
49
path "sys/leases/renew" {
50
  capabilities = ["update"]
51
}
52

53
# Allow revoking the lease
54
path "sys/leases/revoke" {
55
  capabilities = ["update"]
56
}
57
EOT
58
}

1
# External Secrets Operator - AWS Secrets Manager
2
apiVersion: external-secrets.io/v1beta1
3
kind: SecretStore
4
metadata:
5
  name: aws-secrets-store
6
  namespace: production
7
spec:
8
  provider:
9
    aws:
10
      service: SecretsManager
11
      region: us-west-2
12
      auth:
13
        jwt:
14
          serviceAccountRef:
15
            name: external-secrets-sa
16
---
17
apiVersion: external-secrets.io/v1beta1
18
kind: ExternalSecret
19
metadata:
20
  name: database-credentials
21
  namespace: production
22
spec:
23
  refreshInterval: 300s # 5 minutes
24
  secretStoreRef:
25
    name: aws-secrets-store
26
    kind: SecretStore
27
  target:
28
    name: db-credentials
29
    creationPolicy: Owner
30
    template:
31
      type: Opaque
32
      data:
33
        username: "{{ .username }}"
34
        password: "{{ .password }}"
35
        connection-string: "postgresql://{{ .username }}:{{ .password }}@postgres:5432/myapp"
36
  data:
37
    - secretKey: username
38
      remoteRef:
39
        key: prod/database/credentials
40
        property: username
41
    - secretKey: password
42
      remoteRef:
43
        key: prod/database/credentials
44
        property: password
45
---
46
# Automatic secret rotation with Reloader
47
apiVersion: apps/v1
48
kind: Deployment
49
metadata:
50
  name: user-service
51
  annotations:
52
    reloader.stakater.com/auto: "true"
53
spec:
54
  template:
55
    spec:
56
      containers:
57
        - name: user-service
58
          env:
59
            - name: DB_USERNAME
60
              valueFrom:
61
                secretKeyRef:
62
                  name: db-credentials
63
                  key: username
64
            - name: DB_PASSWORD
65
              valueFrom:
66
                secretKeyRef:
67
                  name: db-credentials
68
                  key: password
69
            - name: DB_CONNECTION_STRING
70
              valueFrom:
71
                secretKeyRef:
72
                  name: db-credentials
73
                  key: connection-string

1
# Vault Agent Sidecar for Dynamic Secret Injection
2
apiVersion: apps/v1
3
kind: Deployment
4
metadata:
5
  name: payment-service
6
spec:
7
  template:
8
    metadata:
9
      annotations:
10
        vault.hashicorp.com/agent-inject: "true"
11
        vault.hashicorp.com/role: "payment-service"
12
        vault.hashicorp.com/agent-inject-secret-db-config: "database/creds/payment-role"
13
        vault.hashicorp.com/agent-inject-template-db-config: |
14
          {{- with secret "database/creds/payment-role" -}}
15
          export DB_USERNAME="{{ .Data.username }}"
16
          export DB_PASSWORD="{{ .Data.password }}"
17
          export DB_CONNECTION="postgresql://{{ .Data.username }}:{{ .Data.password }}@postgres:5432/payments"
18
          {{- end -}}
19
        vault.hashicorp.com/secret-volume-path: "/vault/secrets"
20
    spec:
21
      serviceAccountName: payment-service
22
      containers:
23
        - name: payment-service
24
          image: payment-service:latest
25
          command: ["/bin/sh"]
26
          args:
27
            ["-c", "source /vault/secrets/db-config && exec ./payment-service"]
28
          volumeMounts:
29
            - name: vault-secrets
30
              mountPath: /vault/secrets
31
              readOnly: true

1
graph TB
2
    subgraph "SOC 2 Type II"
3
        SOC_Security[Security]
4
        SOC_Availability[Availability]
5
        SOC_Processing[Processing Integrity]
6
        SOC_Confidentiality[Confidentiality]
7
        SOC_Privacy[Privacy]
8
    end
9

10
    subgraph "PCI-DSS"
11
        PCI_Network[Secure Network]
12
        PCI_Data[Protect Cardholder Data]
13
        PCI_Vulnerability[Vulnerability Management]
14
        PCI_Access[Access Control]
15
        PCI_Monitoring[Monitoring & Testing]
16
        PCI_Policy[Information Security Policy]
17
    end
18

19
    subgraph "GDPR"
20
        GDPR_Consent[Lawful Basis & Consent]
21
        GDPR_Rights[Individual Rights]
22
        GDPR_Protection[Data Protection by Design]
23
        GDPR_Breach[Breach Notification]
24
        GDPR_Transfer[Data Transfer]
25
    end
26

27
    subgraph "Shared Controls"
28
        Encryption[Encryption at Rest & Transit]
29
        Access_Control[Role-Based Access Control]
30
        Monitoring[Security Monitoring & Logging]
31
        Incident_Response[Incident Response Plan]
32
        Vendor_Management[Third-Party Risk Management]
33
        Documentation[Policy Documentation]
34
    end
35

36
    SOC_Security --> Encryption
37
    SOC_Confidentiality --> Access_Control
38
    SOC_Security --> Monitoring
39

40
    PCI_Data --> Encryption
41
    PCI_Access --> Access_Control
42
    PCI_Monitoring --> Monitoring
43
    PCI_Network --> Access_Control
44

45
    GDPR_Protection --> Encryption
46
    GDPR_Rights --> Access_Control
47
    GDPR_Breach --> Monitoring
48

49
    Encryption --> Incident_Response
50
    Access_Control --> Vendor_Management
51
    Monitoring --> Documentation
52

53
    style Encryption fill:#4caf50
54
    style Access_Control fill:#2196f3
55
    style Monitoring fill:#ff9800
56
    style Incident_Response fill:#9c27b0

1
# OPA Policy for PCI-DSS Compliance
2
apiVersion: v1
3
kind: ConfigMap
4
metadata:
5
  name: pci-compliance-policies
6
  namespace: compliance
7
data:
8
  pci-dss-policies.rego: |
9
    package pci.dss
10

11
    import future.keywords.if
12
    import future.keywords.in
13

14
    # PCI-DSS Requirement 1: Install and maintain a firewall configuration
15
    deny[msg] if {
16
        input.kind == "NetworkPolicy"
17
        not input.spec.ingress
18
        msg := "NetworkPolicy must define ingress rules (PCI-DSS 1.1)"
19
    }
20

21
    # PCI-DSS Requirement 2: Do not use vendor-supplied defaults
22
    deny[msg] if {
23
        input.kind == "Deployment"
24
        container := input.spec.template.spec.containers[_]
25
        not container.securityContext.runAsNonRoot
26
        msg := sprintf("Container %s must not run as root (PCI-DSS 2.2)", [container.name])
27
    }
28

29
    # PCI-DSS Requirement 3: Protect stored cardholder data
30
    deny[msg] if {
31
        input.kind == "Secret"
32
        input.metadata.labels["data-classification"] == "cardholder-data"
33
        not input.type == "kubernetes.io/tls"
34
        not input.metadata.annotations["encrypted-at-rest"]
35
        msg := "Cardholder data secrets must be encrypted at rest (PCI-DSS 3.4)"
36
    }
37

38
    # PCI-DSS Requirement 4: Encrypt transmission of cardholder data
39
    deny[msg] if {
40
        input.kind == "Service"
41
        input.metadata.labels["handles-cardholder-data"] == "true"
42
        port := input.spec.ports[_]
43
        port.port == 80
44
        msg := "Services handling cardholder data must use HTTPS (PCI-DSS 4.1)"
45
    }
46

47
    # PCI-DSS Requirement 7: Restrict access by business need-to-know
48
    deny[msg] if {
49
        input.kind == "RoleBinding"
50
        input.subjects[_].kind == "User"
51
        input.roleRef.name == "cluster-admin"
52
        msg := "Cluster-admin access violates least privilege principle (PCI-DSS 7.1)"
53
    }
54
---
55
# Gatekeeper Constraint Template
56
apiVersion: templates.gatekeeper.sh/v1beta1
57
kind: ConstraintTemplate
58
metadata:
59
  name: pcicompliance
60
spec:
61
  crd:
62
    spec:
63
      names:
64
        kind: PCICompliance
65
      validation:
66
        openAPIV3Schema:
67
          type: object
68
          properties:
69
            requireEncryption:
70
              type: boolean
71
            allowedPorts:
72
              type: array
73
              items:
74
                type: integer
75
  targets:
76
    - target: admission.k8s.gatekeeper.sh
77
      rego: |
78
        package pcicompliance
79

80
        violation[{"msg": msg}] {
81
            input.review.kind.kind == "Service"
82
            input.review.object.metadata.labels["pci-scope"] == "true"
83
            port := input.review.object.spec.ports[_]
84
            not port.port in input.parameters.allowedPorts
85
            msg := sprintf("PCI-scoped service using non-compliant port: %v", [port.port])
86
        }
87
---
88
# Apply PCI Compliance Constraint
89
apiVersion: constraints.gatekeeper.sh/v1beta1
90
kind: PCICompliance
91
metadata:
92
  name: pci-port-restrictions
93
spec:
94
  match:
95
    kinds:
96
      - apiGroups: [""]
97
        kinds: ["Service"]
98
  parameters:
99
    allowedPorts: [443, 8443, 9443]