Cloud Native Data Security with OAuth

Chapter 10. Workload Identities

Once you complete your API authorization and deploy your APIs to Kubernetes, you are likely to have some further API security requirements, since OAuth alone does not solve all API security problems. Some security best practices, like hardening of containers and authorizing access to Kubernetes cluster resources, are outside the scope of this book. Instead, we want to highlight some characteristics of cloud native environments that can help to meet the following OAuth-related requirements:

• Malicious parties must be unable to read confidential internal API traffic.

• Only trusted clients must be able to reach the target APIs.

• Malicious parties must be unable to impersonate your APIs by using its secrets.

• Malicious parties must be unable to gain API access with a stolen token.

Cloud native infrastructure security provides additional building blocks that allow you to harden your API’s security by leveraging workload identities. A workload is a piece of software such as a microservice running in Kubernetes. A workload identity is a set of attributes including a workload identifier that describe a workload. Workloads can prove their identity via a cryptographically verifiable credential.

In Kubernetes, you commonly deploy workloads as a Deployment containing a ReplicaSet with one or more pods. Each pod contains the application container and zero or more sidecar containers. Platform components can provide each workload a cryptographically verifiable ...