Blast radius

As explained in Platform Engineering on Kubernetes

Blast radius is the extent of systems, resources, or users that can be affected by a failure or security compromise.

Blast radius measures how many services may be affected when a security breach occurs. In distributed systems, unrestricted service-to-service invocation can expose the entire system. section 7.1.2

Reduce blast radius by enforcing system-level interaction rules:

• Assign service identities. section 7.1.2
• Allow only explicitly permitted service-to-service calls. section 7.1.2
• Restrict the protocols and ports used for communication. section 7.1.2
• Delegate rule validation to an external mechanism rather than duplicating it inside every service. section 7.1.2

Service A and Service B

If Service A is allowed to call only Service B, a compromised surrounding service cannot freely invoke every service, limiting the breach’s reach. section 7.1.2

Figure 7.5 Reducing the blast radius by defining system-level rules

Shows how system-level interaction rules reduce the number of services exposed by a compromise. section 7.1.2

How Platform Engineering on Kubernetes covers it

How deep it goes

Defines the metric and explains identity, allowed calls, protocols, ports, and external rule enforcement, without implementation details.

Examples

Uses Service A and Service B, unrestricted invocation, compromised services, and system-level interaction rules.

What it assumes

Assumes familiarity with services communicating across a distributed application.

What you can do after

Apply service identities and interaction rules to restrict calls and reduce the services affected by a compromise.

How it connects

Connects blast radius with service identity, service-to-service communication, authorization, protocols, ports, and distributed applications.

liveBookmanning.com

Read Platform Engineering on Kubernetes on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Infrastructure as Code, Patterns and Practices: With examples in Python and TerraformThe blast radius is the extent of system impact caused by a failed change, measured by the number or criticality of affected components.
• 

  liveBookmanning.com
  Google Anthos in ActionBlast radius is the scope of components, users, or functionality affected by a failure or operational change.
• 

  liveBookmanning.com
  Troubleshooting Java, Second EditionBlast radius is the scope of components, records, or systems affected by a failure or data problem.

Compare how 4 books explain blast radius →

Related concepts

• canary deploymentaddressed by · A canary deployment is a release strategy that exposes a change to a limited portion of users, traffic, or infrastructure before expanding it more broadly.
• rolling updateaddressed by · A rolling update is a deployment or upgrade technique that updates or replaces instances or resources incrementally rather than all at once, allowing the rest of the system to continue operating during the change.
• isolationaddressed by · Isolation is the separation of components, processes, resources, or contexts to limit interaction, interference, or the propagation of effects between them.
• couplingused by · Coupling is the degree of dependency between software components, including how their behavior, availability, or changes affect one another.
• sandboxingaddressed by · Sandboxing is the isolation of software execution in a restricted environment that limits its access to resources and its effects on surrounding systems.

This explainer was generated by Manning's knowledge graph from the text of Platform Engineering on Kubernetes. The section links point to the parts of the book it draws on.