Dynamic permissions management for cloud workloads
Applications supporting operations of an autonomous vehicle fleet can be implemented on and supported by cluster infrastructure. These applications have endpoints where data traffic runs in and out of these applications. Securing access to these endpoints can prevent unauthenticated and unauthorized access to these endpoints and the protected resources accessible through these endpoints. Securing access to these endpoints, managing entitlements and security policies, and maintaining security systems that can enforce the security policies are not trivial tasks. One solution addresses some of these challenges by offering a simple frontend for users to define the entitlements and security policies, leveraging an open source security solution, and ensuring backwards compatibility to other security solutions in the cluster infrastructure.
1. A computer-implemented method for security policy management, comprising:
deploying a security policy agent sidecar application alongside an application deployed on cluster infrastructure;
receiving, from an application developer, a set of entitlements assigned to one or more of: users, groups, or services;
receiving, from the application developer, a route-based authorization policy for the application comprising one or more routes and entitlements to access the one or more routes;
generating a security policy bundle for the application by converting the set of entitlements and the route-based authorization policy into a format compatible with the security policy agent sidecar application; and
writing the security policy bundle for the application onto security policy bundle storage.
2. The computer-implemented method of claim 1 , wherein the set of entitlements and the route-based authorization policy are received through a user interface of a frontend application of an authorization manager.
3. The computer-implemented method of claim 1 , wherein the route-based authorization policy is received as a JavaScript Object Notation (JSON) file.
4. The computer-implemented method of claim 1 , further comprising:
transmitting a post request to send the route-based authorization policy to a backend application of a policy manager.
5. The computer-implemented method of claim 1 , further comprising:
validating and parsing, by a backend application of a policy manager, the route-based authorization policy; and
saving data parsed from the route-based authorization policy into a database.
6. The computer-implemented method of claim 1 , further comprising:
regularly checking a database storing security policies for one or more of: a new security policy, and a change to an existing security policy.
7. The computer-implemented method of claim 1 , wherein converting the set of entitlements and the route-based authorization policy comprises:
augmenting and formatting the entitlements and the route-based authorization policy into a JavaScript Object Notation (JSON) file and a policy code file; and
packaging the JSON file and the policy code file into an archive file, wherein the archive file is the security policy bundle for the application.
8. The computer-implemented method of claim 7 , wherein the JSON file includes the entitlements.
9. The computer-implemented method of claim 7 , wherein the JSON file includes entitlements directly assigned to users of a group.