Policy controlled cryptography

1. A method, comprising:

receiving one or more data packets from a workload, wherein the workload is running on a server;

determining, at a proxy associated with the server, a policy group associated with the workload;

encrypting, by the proxy associated with the server, the one or more data packets with a certificate associated with the determined policy group, wherein the certificate associated with the determined policy group is installed at the proxy, wherein the certificate is generated by an agent and signed by a certificate authority specific to the policy group; and

sending the encrypted one or more data packets to an endpoint.

2. The method of claim 1 , further comprising determining the certificate associated with the policy group from a set of certificates associated with one or more other policy groups.

3. The method of claim 1 , wherein the policy group associated with the workload is determined based on metadata attached to the workload.

4. The method of claim 3 , wherein the policy group is comprised of one or more policies associated with metadata attached to the workload.

5. The method of claim 1 , wherein the certificate authority specific to the policy group is an intermediate certificate authority associated with the policy group.

6. The method of claim 5 , wherein the intermediate certificate authority is generated by an orchestrator.

7. The method of claim 6 , wherein the intermediate certificate authority is generated by an orchestrator in response to creating the policy group.

8. The method of claim 1 , further comprising:

receiving one or more data packets from an endpoint;

determining whether the one or more data packets received from the endpoint are encrypted; and

forwarding the one or more data packets received from the endpoint to the workload.

9. The method of claim 8 , wherein the one or more data packets received from the endpoint are determined to be encrypted based on the one or more data packets being encrypted with a certificate that is directly signed by an intermediate certificate authority associated with the policy group.

10. The method of claim 8 , wherein the one or more data packets received from the endpoint are determined to be encrypted based on the one or more data packets being encrypted with a certificate that is indirectly signed by an intermediate certificate authority associated with the policy group.

11. A system, comprising:

a processor configured to:

receive one or more data packets from a workload, wherein the workload is running on a server;

determine, at a proxy associated with the server, a policy group associated with the workload; and

encrypt, by the proxy associated with the server, the one or more data packets with a certificate associated with the determined policy group, wherein the certificate associated with the determined policy group is installed at the proxy, wherein the certificate is generated by an agent and signed by a certificate authority specific to the policy group; and

a communications interface coupled to the processor and configured to send the encrypted one or more data packets to an endpoint.

12. The system of claim 11 , wherein the policy group associated with the workload is determined based on metadata attached to the workload.

13. The system of claim 12 , wherein the policy group is comprised of one or more policies associated with the metadata attached to the workload.

14. The system of claim 11 , wherein the certificate authority specific to the policy group is an intermediate certificate authority associated with the policy group.

15. The system of claim 11 , wherein the communication interface is further configured to:

receive one or more data packets from an endpoint; and

forward the one or more data packets received from the endpoint to the workload, and wherein the processor is further configured to determine whether the one or more data packets received from the endpoint are encrypted.

16. The system of claim 15 , wherein the one or more data packets received from the endpoint are determined to be encrypted based on the one or more data packets being encrypted with a certificate that is directly or indirectly signed by an intermediate certificate authority associated with the policy group.

17. A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

receiving one or more data packets from a workload, wherein the workload is running on a server;

determining a policy group associated with the workload;

encrypting the one or more data packets with a certificate associated with the determined policy group, wherein the certificate associated with the determined policy group is installed at the proxy, wherein the certificate is generated by an agent and signed by a certificate authority specific to the policy group; and

sending the encrypted one or more data packets to an endpoint.