Service identity

As explained in Platform Engineering on Kubernetes

A service identity is an identifiable principal representing an application service for authentication and authorization decisions.

Service identity gives each application service an identifiable principal for authentication and authorization decisions. It lets platform rules determine which services may communicate, rather than leaving service-to-service access unrestricted. section 7.1.2

Use service identity to enforce boundaries across distributed application interactions:

• Allow Service A to call Service B while restricting other service-to-service invocations. section 7.1.2
• Specify which protocols and ports services may use for communication. section 7.1.2
• Reduce the blast radius of a compromised service by enforcing system-level interaction rules. section 7.1.2
• Control which services can connect to a message broker and read or write messages. section 7.1.4

Restricting service and broker access

A platform can identify Service A and permit it to call Service B on approved protocols and ports. The same identity rules can allow one service to publish messages while limiting another service to approved reads. section 7.1.2 section 7.1.4

Figure 7.5 Reducing the blast radius by defining system-level rules

Use the diagram to trace how explicit service interaction rules reduce the blast radius of a security breach. section 7.1.2

How Platform Engineering on Kubernetes covers it

How deep it goes

Defines permitted services, protocols, ports, and broker operations, but defers the implementation mechanism to external platform controls.

Examples

Uses Service A and Service B, approved protocols and ports, and broker connection, read, and write permissions.

What you can do after

Configure service identities and access rules that limit calls, protocols, ports, and message-broker operations.

How it connects

Connects authentication, authorization, service-to-service communication, asynchronous messaging, message brokers, and blast-radius reduction.

liveBookmanning.com

Read Platform Engineering on Kubernetes on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersService identity is the identity of a service that makes a request on behalf of a user or another initiating entity.

Compare how 2 books explain service identity →

Related concepts

• identitycontrasts with · Identity is the property or representation by which an entity is distinguished and recognized as that particular entity.
• message brokerconfigures · A message broker is intermediary software that receives, routes, and delivers messages between communicating producers and consumers.
• mutual TLSaddressed by · Mutual TLS is a Transport Layer Security configuration in which both communicating endpoints authenticate each other using digital certificates.
• API keyaddressed by · An API key is a credential used to identify or authorize a client accessing an application programming interface.
• scope of identityhas part · Scope of identity is the degree of specificity with which an identity is assigned to a service, instance, or container.
• blast radiusaddresses · Blast radius is the scope of systems, components, data, users, or functionality that may be affected by a failure, change, or other disruptive event.

This explainer was generated by Manning's knowledge graph from the text of Platform Engineering on Kubernetes. The section links point to the parts of the book it draws on.