Sidecar architecture for stateless proxying to databases
A mechanism for providing connection to a database is described. A connection to the database is intercepted. The connection is assigned to an instance of the database. A sidecar is configured to proxy the connection to the database. The sidecar is stateless and passes all communications for the connection to the instance of the database.
1. A method, comprising:
intercepting a connection to a database, wherein the connection is for a client;
assigning the connection to an instance of the database;
authenticating the client; and
configuring a sidecar to proxy the connection to the instance of the database, wherein the sidecar is stateless and passes all communications for the connection for the instance of the database from the sidecar only if the client is authorized, wherein during the intercepting of the connection, the sidecar is in a step mode and stores the communications, and wherein after the client is authorized, the sidecar is placed in a stream mode and forwards the stored communications to the instance of the database.
2. The method of claim 1 , wherein the sidecar has a form factor selected from Docker, Kubernetes, cloud lambda, Debian and RPM.
3. The method of claim 1 , further comprising:
encrypting at least a portion of the communications for the connection before passing the at least the portion of the communications to the instance of the database.
4. The method of claim 1 ,
wherein the passing further includes:
recalling the communications before processing by the instance of the database if the client is not authorized to access the database.
5. The method of claim 1 , wherein the sidecar includes an open systems interconnection (OSI) Layer 4 dispatcher.
6. The method of claim 5 , further comprising:
providing at least a portion of the communications to the instance of the database and to at least one OSI Layer 7 service.
7. The method of claim 6 , further comprising:
analyzing the at least the portion of the communications by the at least one OSI Layer 7 service; and
enforcing at least one policy using the OSI Layer 7 service.
8. A system, comprising:
a processor configured to:
intercept a connection to a database, wherein the connection is for a client;
assign the connection to an instance of the database;
authenticate the client; and
configure a sidecar to proxy the connection to the instance of the database, wherein the sidecar is stateless and passes all communications for the connection for the instance of the database from the sidecar only if the client is authorized, wherein during the intercepting of the connection, the sidecar is in a step mode and stores the communications, and wherein after the client is authorized, the sidecar is placed in a stream mode and forwards the stored communications to the instance of the database; and
a memory coupled to the processor and configured to provide the processor with instructions.
9. The system of claim 8 , wherein the sidecar has a form factor selected from Docker, Kubernetes, cloud lambda, Debian and RPM.
10. The system of claim 8 , wherein the processor is further configured to:
encrypt at least a portion of the communications for the connection before passing the at least the portion of the communications.
11. The system of claim 8 , wherein the sidecar includes an open systems interconnection (OSI) Layer 4 dispatcher.
12. The system of claim 11 , wherein the processor is further configured to:
provide at least a portion of the communications to the instance of the database and to at least one OSI Layer 7 service.
13. The system of claim 12 , wherein the processor is further configured to:
analyze the at least the portion of the communications by the at least one OSI Layer 7 service; and
enforce at least one policy using the OSI Layer 7 service.
14. A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:
intercepting a connection to a database, wherein the connection is for a client;
assigning the connection to an instance of the database;
authenticating the client; and
configuring a sidecar to proxy the connection to the instance of the database, wherein the sidecar is stateless and passes all communications for the connection for the instance of the database from the sidecar only if the client is authorized, wherein during the intercepting of the connection, the sidecar is in a step mode and stores the communications, and wherein after the client is authorized, the sidecar is placed in a stream mode and forwards the stored communications to the instance of the database.
15. The computer program product of claim 14 , wherein the sidecar has a form factor selected from Docker, Kubernetes, cloud lambda, Debian and RPM.
16. The computer program product of claim 14 , wherein the computer instructions further include computer instructions for:
encrypting at least a portion of the communications for the connection before passing the at least the portion of the communications.
17. The computer program product of claim 14 , wherein the sidecar includes an open systems interconnection (OSI) Layer 4 dispatcher.
18. The computer program product of claim 16 , wherein the computer instructions further include instructions for:
providing at least a portion of the communications to the instance of the database and to at least one OSI Layer 7 service.
19. The computer program product of claim 17 , wherein the computer instructions further include instructions for:
analyzing the at least the portion of the communications by the at least one OSI Layer 7 service; and
enforcing at least one policy using the OSI Layer 7 service.