Micro-firewalls in a microservice mesh environment

1. A method comprising:

at a server in communication with a plurality of microservices in a microservices mesh which is managed by a mesh orchestrator, obtaining data about inbound communications to a first microservice and outbound communications from the first microservice of the plurality of microservices, the data being obtained from and captured by a first sidecar function attached to a container for the first microservice and including application behavioral data and metadata of the first microservice;

analyzing, by the server, the data to learn an operational behavior of the first microservice, based on comparing the application behavioral data and the metadata of the first microservice with stored information about microservices in order to find a match associated with the operational behavior, and to determine a firewall rule set associated with the first microservice based on the operational behavior learned for the first microservice; and

instructing, by the server, the mesh orchestrator to instantiate a micro-firewall for the first microservice, the micro-firewall configured to apply the firewall rule set to inbound communications to the first microservice and outbound communications from the first microservice.

2. The method of claim 1 , wherein the inbound communications are from a second microservice to the first microservice, and the outbound communications are from the first microservice to the second microservice.

3. The method of claim 1 , wherein the inbound communications are from an entity outside the microservices mesh to the first microservice, and the outbound communications are from the first microservice to the entity outside the microservices mesh.

4. The method of claim 1 , wherein analyzing to learn the operational behavior of the first microservice comprises determining a type of application running in the first microservice.

5. The method of claim 4 , wherein analyzing includes determining the firewall rule set according to rules associated with normal behavior of a microservice that performs the type of application running in the first microservice.

6. The method of claim 1 , wherein the server is in communication with the mesh orchestrator for a namespace in which the plurality of microservices are deployed.

7. The method of claim 1 , wherein each one of the plurality of microservices has a respective container to which a respective sidecar function is attached for capturing respective application behavior data and metadata of a respective microservice, the method further comprising:

obtaining, from the respective sidecar function, the respective application and behavior data and metadata of the respective microservice to enhance a respective firewall rule set of a respective micro-firewall for the respective microservice.

8. The method of claim 1 , wherein instructing the mesh orchestrator to instantiate the micro-firewall comprises instructing the mesh orchestrator to instantiate the micro-firewall between the first microservice and a second microservice in communication with the first microservice.

9. The method of claim 8 , wherein instructing the mesh orchestrator to instantiate the micro-firewall causes the mesh orchestrator to program the first sidecar function and a second sidecar function associated with the second microservice to redirect all traffic between them, on behalf of the first microservice and second microservice, respectively, to the micro-firewall.

10. The method of claim 1 , wherein the firewall rule set is a limited set of rules based on communications expected for the first microservice.

11. The method of claim 1 , further comprising repeating the obtaining, the analyzing, the determining, and the instructing, for causing micro-firewalls to be created and removed as microservice containers are dynamically created and removed.

12. The method of claim 11 , further comprising:

when a new microservice container is created that includes a microservice that is similar to the first microservice, instructing the mesh orchestrator to instantiate a new micro-firewall for the new microservice container according to the micro-firewall for the first microservice without performing the analyzing for the new microservice container.

13. An apparatus comprising:

a communication interface configured to enable network communications including communications with a plurality of microservices in a microservices mesh which is managed by a mesh orchestrator;

a memory for storing program instructions; and

a processor coupled to the communication interface, wherein the processor is configured to execute the program instructions to perform operations including:

obtaining data about inbound communications to a first microservice and outbound communications from the first microservice of the plurality of microservices, the data being obtained from and captured by a first sidecar function attached to a container for the first microservice and including application behavioral data and metadata of the first microservice;

analyzing the data to learn an operational behavior of the first microservice, based on comparing the application behavioral data and the metadata of the first microservice with stored information about microservices in order to find a match associated with the operational behavior, and to determine a firewall rule set associated with the first microservice based on the operational behavior learned for the first microservice; and

instructing the mesh orchestrator to instantiate a micro-firewall for the first microservice, the micro-firewall configured to apply the firewall rule set to inbound communications to the first microservice and outbound communications from the first microservice.

14. The apparatus of claim 13 , wherein the inbound communications are from a second microservice to the first microservice, and the outbound communications are from the first microservice to the second microservice; or the inbound communications are from an entity outside the microservices mesh to the first microservice, and the outbound communications are from the first microservice to the entity outside the microservices mesh.

15. The apparatus of claim 13 , wherein the processor is configured to execute the program instructions to perform the analyzing to learn the operational behavior of the first microservice by determining a type of application running in the first microservice and determining the firewall rule set according to rules associated with normal behavior of a microservice that performs the type of application running in the first microservice.

16. The apparatus of claim 15 , wherein each one of the plurality of microservices has a respective container to which a respective sidecar function is attached for capturing respective application behavior data and metadata of a respective microservice, and the processor is further configured to obtain, from the respective sidecar function, the respective application and behavior data and metadata of the respective microservice to enhance a respective firewall rule set of a respective micro-firewall for the respective microservice.

17. The apparatus of claim 13 , wherein the processor is configured to execute the program instructions to repeat the obtaining, the analyzing, the determining, and the instructing, for causing micro-firewalls to be created and removed as microservice containers are dynamically created and removed.

18. One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor of a server in communication with a plurality of microservices in a microservices mesh which is managed by a mesh orchestrator, cause the server to perform operations including:

obtaining data about inbound communications to a first microservice and outbound communications from the first microservice of the plurality of microservices, the data being obtained from and captured by a first sidecar function attached to a container for the first microservice and including application behavioral data and metadata of the first microservice;

analyzing the data to learn an operational behavior of the first microservice, based on comparing the application behavioral data and the metadata of the first microservice with stored information about microservices in order to find a match associated with the operational behavior, and to determine a firewall rule set to be applied associated with the first microservice based on the operational behavior learned for the first microservice; and

instructing the mesh orchestrator to instantiate a micro-firewall for the first microservice, the micro-firewall configured to apply the firewall rule set to inbound communications to the first microservice and outbound communications from the first microservice.

19. The computer readable storage media of claim 18 , wherein the instructions to perform the analyzing include instructions to learn the operational behavior of the first microservice by determining a type of application running in the first microservice and determine the firewall rule set according to rules associated with normal behavior of a microservice that performs the type of application running in the first microservice.

20. The computer readable storage media of claim 18 , wherein the instructions are further operable for, when a new microservice container is created that includes a microservice that is similar to the first microservice, instructing the mesh orchestrator to instantiate a new micro-firewall for the new microservice container according to the micro-firewall for the first microservice without performing the analyzing for the new microservice container.