Dynamic access control in service mesh with service broker
One example method includes performing dynamic access control in a computing network. A computing environment is configured such that an application can access a service without specifying secrets. The secrets needed to access the service are obtained and stored in a credential store. The secrets can be obtained using the service mesh in a manner that isolates the application from the secrets.
1. A method comprising:
provisioning a service in a computing environment that includes a service mesh;
storing credentials to access the service in a credential store;
binding the service to an application in the service mesh;
connecting a service broker and a service mesh controller to add policies to the service mesh, wherein the policies of the service mesh are defined and maintained by the service mesh controller;
deploying the application to the computing environment, wherein a first sidecar is associated to the application and a second side car is associated to the service;
sending a request to the service using the service mesh without including the credentials, wherein the request for the service is received by the first sidecar and transmitted to the second sidecar in accordance with the policies of the service mesh;
when an access token in not available, obtaining, by the service broker, the access token using the credentials stored in the credential store and providing the access token to the second sidecar; and
forwarding the request to the service by the second sidecar along with the access token.
2. The method of claim 1 , further comprising sending an token request to the service broker.
3. The method of claim 1 , further sending the request, from the application, by specifying a name of the service.
4. The method of claim 1 , wherein the application is isolated from the credential store and is not configured to directly access the service other than generate the request.
5. The method of claim 1 , wherein the second sidecar is configured differently from the first sidecar and is configured to obtain the access token, wherein the service broker is further configured as an endpoint for authentication.
6. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations of claim 1 .