Microservice DNS Metadata for External Visibility and Policy Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The migration of enterprise services from monolithic applications to microservice-based cloud native architectures complicates the identification and application of network and security policies due to unreliable IP addresses, shared TCP ports, and encrypted traffic, making it difficult for downstream devices to leverage existing tools like AVC for L7 inspection.
Innovation Solution
The addition of metadata to microservices within the cluster, managed by a DNS service, provides identification and visibility of these services externally, allowing for microservice-level granularity in network and security policies through tools like SD-AVC, even in encrypted and dynamic environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If microservices are deployed with dynamic IP addresses and shared TCP ports, then service flexibility and resource utilization are improved, but network visibility and policy application capability deteriorate
Solution Approach 1:
The patent introduces an intermediary system comprising a DNS service and metadata repository that acts as a mediator between microservices and network devices. The DNS service receives lookup requests from network devices, queries the metadata repository for microservice information, and returns the retrieved metadata including service names, versions, and other identification information. This intermediary mechanism enables network devices to identify and apply policies to microservices without relying on stable IP addresses or ports.
2Reliability
If microservices communicate using encrypted traffic, then security is improved, but the ability to perform L7 inspection and apply AVC tools deteriorates
Solution Approach 1:
The patent applies preliminary action by having microservices register their metadata information with the DNS service before actual communication occurs. The metadata repository stores service identification information including names, versions, and other attributes in advance. When encrypted traffic flows between microservices, network devices can perform lookups using the pre-registered metadata to identify the services involved, enabling policy application and inspection without needing to decrypt the traffic.
3Adaptability or versatility
If enterprise services are transformed from monolithic applications to microservice architectures, then service granularity and deployability are improved, but the complexity of network policy management increases
Solution Approach 1:
The patent implements self-service by enabling microservices to automatically register their own metadata information with the DNS service. Each microservice can autonomously publish its identification details, service attributes, and other relevant information to the metadata repository. This self-registration mechanism eliminates the need for manual configuration of network policies for each microservice, reducing management complexity while maintaining fine-grained service granularity.
Data Source
AI summary
Methods are provided in which a domain name system (DNS) service obtains a lookup request for information about a source of a traffic flow being transmitted to a network resource external of a service cluster and performs, based on the lookup request, a lookup operation for a microservice that is the source of the traffic flow, among a plurality of microservices of the service cluster registered with the DNS service. The methods further include providing information about the microservice based on the lookup operation. The information includes at least a name of the microservice for visibility of the microservice external of the service cluster.