3 ms·
Do you also provide within-organization inter-app ACLs?
by aaronblohowiak 6y ago
Do you also provide within-organization inter-app ACLs?
- tptacek 6y agoWe could! What would you want to do with them?
- aaronblohowiak 6y agoWell 6PN’s are effectively VPCs and within-org ACLs could be analogous to security groups - not every app within an org needs to be able to talk to every other app, though there are not clear “islands” of communication within the graph so using separate orgs for distinct communities of apps isnt a tenable strategy. Segmenting the bottom 48 bits into app Id / app instance Id and then doing more shenanigans at the wg routing layer would provide you with some of this functionality. This is something I am thinking about for my employer (Netflix) which does not offer a public PaaS, but is also trying to scale and secure a big flat network. I do believe that the dual goals of network identity and scalability are difficult to solve for simultaneously (in the old world, we relied on subnets, but this is the opposite of multi-tenant container hosts..) so i think we want to have simple physical networks with routing and then some other means of trusted network identity, which leads you to crypto-derived solutions (really, it seems like wg and IPSec are the biggest contenders here and both have pros and cons) Anyway, seeing your post was validating about this line of reasoning and I am curious to follow along to see how you are thinking about it more.