Distributed authentication and authorization for rapid scaling of containerized services
The disclosed technology provides solutions for performing rapid authentication and authorization for distributed containerized microservices. In some aspects, a process of the technology can include steps for: associating a service type with a set of microservices or service pods, detecting deployment of a first microservice on a first host, and receiving an authentication and authorization state from a first virtual network edge (VNE) of the first host. In some aspects, the process can further include steps for distributing the authentication state to a second VNE on a second host, wherein the authentication state is configured to facilitate authentication of one or more subsequent microservices instantiated on the second host by the second VNE. Systems and machine readable media are also provided.
1. A system for authenticating services, the system comprising:
one or more processors;
a memory storing instructions, which when executed by the one or more processors, causes the one or more processors to:
associate a first service type with at least one microservice;
detect a first service associated with the first service type on a first host;
receive an authentication state from a first network edge of the first host; and
distribute the authentication state to a second network edge of a second host, wherein the authentication state is configured to facilitate authentication of one or more microservices on the second host.
2. The system of claim 1 , wherein the authentication state is configured to cause the second network edge to permit authentication when the one or more microservices on the second host are associated with the first service type.
3. The system of claim 1 , wherein the authentication state is configured to cause the second network edge to perform authentication when the one or more microservices on the second host are not associated with the first service type.
4. The system of claim 1 , wherein the at least one microservice is part of a microservice pod and the first service type is associated with the microservice pod.
5. The system of claim 1 , wherein the authentication state is distributed to a plurality of network edges to facilitate authentication of one or more microservices on a plurality of hosts.
6. The system of claim 1 , further comprising instructions, which when executed by the one or more processors, causes the one or more processors to:
reauthenticate one or more microservices deployed before the authentication state was received.
7. The system of claim 1 , wherein either the first network edge and second network edge, or both, are physical devices.
8. At least one non-transitory computer readable medium storing instructions, which when executed by the one or more processors, causes the one or more processors to:
associate a first service type with at least one microservice;
detect a first service associated with the first service type on a first host;
receive an authentication state from a first network edge of the first host; and
distribute the authentication state to a second network edge of a second host, wherein the authentication state is configured to facilitate authentication of one or more microservices on the second host.
9. The at least one non-transitory computer readable medium of claim 8 , wherein the authentication state is configured to cause the second network edge to permit authentication when the one or more microservices on the second host are associated with the first service type.
10. The at least one non-transitory computer readable medium of claim 8 , wherein the authentication state is configured to cause the second network edge to perform authentication when the one or more microservices on the second host are not associated with the first service type.
11. The at least one non-transitory computer readable medium of claim 8 , wherein the at least one microservice is part of a microservice pod and the first service type is associated with the microservice pod.
12. The at least one non-transitory computer readable medium of claim 8 , wherein the authentication state is distributed to a plurality of network edges to facilitate authentication of one or more microservices on a plurality of hosts.
13. The at least one non-transitory computer readable medium of claim 8 , further comprising instructions, which when executed by the one or more processors, causes the one or more processors to:
reauthenticate one or more microservices deployed before the authentication state was received.
14. The at least one non-transitory computer readable medium of claim 8 , wherein either the first network edge and second network edge, or both, are physical devices.
15. A method comprising:
associating a first service type with at least one microservice;
detecting a first service associated with the first service type on a first host;
receiving an authentication state from a first network edge of the first host; and
distributing the authentication state to a second network edge of a second host, wherein the authentication state is configured to facilitate authentication of one or more microservices on the second host.
16. The method of claim 15 , wherein the authentication state is configured to cause the second network edge to permit authentication when the one or more microservices on the second host are associated with the first service type.
17. The method of claim 15 , wherein the authentication state is configured to cause the second network edge to perform authentication when the one or more microservices on the second host are not associated with the first service type.
18. The method of claim 15 , wherein the at least one microservice is part of a microservice pod and the first service type is associated with the microservice pod.
19. The method of claim 15 , further comprising reauthenticating one or more microservices deployed before the authentication state was received.
20. The method of claim 15 , wherein either the first network edge and second network edge, or both, are physical devices.