Belajar Security Architect - Cloud-Native & Platform Security
Mempelajari Kubernetes security architecture, service mesh security, supply chain security, dan cloud-native security design patterns
#Pendahuluan
Setelah di episode 16 kita mempelajari security operations architecture, pada episode ini kita dalami cloud-native & platform security — bagaimana mengamankan Kubernetes, service mesh, dan supply chain. Cloud-native mengubah security secara fundamental: programmable, ephemeral, dan distributed.
Mengapa cloud-native security penting? Karena container dan Kubernetes menjadi standar deployment baru. Security yang tidak dirancang untuk cloud-native akan menciptakan blind spots di tempat yang paling kritis.
#Kubernetes Security
#K8s Security Layers
| Layer | Controls |
|---|---|
| Cluster | RBAC, network policies, audit logging |
| Node | OS hardening, minimal footprint |
| Pod | Security context, admission controllers |
| Container | Image scanning, non-root user |
| Application | Code security, secrets management |
#Pod Security Standards
| Level | Description |
|---|---|
| Privileged | Unrestricted (avoid) |
| Baseline | Minimally restrictive |
| Restricted | Heavily restricted |
apiVersion: v1
kind: Pod
metadata:
name: secure-pod
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 2000
containers:
- name: app
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL#Service Mesh Security
#Mesh Security Features
| Feature | Fungsi |
|---|---|
| mTLS | Encrypt all service-to-service traffic |
| Authorization policies | Control who can talk to whom |
| Traffic policies | Rate limiting, circuit breaking |
| Observability | Full visibility into mesh traffic |
#Mesh Options
| Mesh | Keunggulan |
|---|---|
| Istio | Most feature-rich |
| Linkerd | Simple, lightweight |
| Consul | Multi-platform |
Tip
Service mesh mengamankan communication antar service tanpa mengubah kode aplikasi. Mulai dari mTLS (encrypt semua traffic), lalu berkembang ke authorization policies.
#Supply Chain Security
#Supply Chain Threats
| Threat | Contoh |
|---|---|
| Dependency confusion | Typosquatting packages |
| Compromised build | Malicious CI/CD |
| Container image tampering | Modified base images |
| Open-source backdoors | Injected malicious code |
#Supply Chain Controls
| Control | Tool |
|---|---|
| Dependency scanning | Snyk, Dependabot |
| Container scanning | Trivy, Grype |
| SBOM (Software Bill of Materials) | Syft, SPDX |
| Sigstore/Cosign | Image signing |
| SLSA framework | Build integrity |
Warning
Supply chain attacks (SolarWinds, Log4Shell) menunjukkan bahwa keamanan harus mencakup seluruh chain — bukan hanya kode yang kita tulis. SBOM dan image signing adalah must-have di 2026.
#Cloud-Native Security Design
| Principle | Implementasi |
|---|---|
| Immutable infrastructure | No SSH, no manual changes |
| Least privilege | RBAC, service accounts |
| Defense in depth | Multiple security layers |
| Automation | Policy-as-code |
#Penutup
Inti yang harus dibawa pulang:
- K8s security: cluster → node → pod → container → application.
- Service mesh: mTLS + authorization policies.
- Supply chain: SBOM, dependency scanning, image signing.
- Cloud-native: immutable, least privilege, automated.
Di episode 18 selanjutnya kita akan membahas zero trust implementation design — implementation roadmap, identity/data/workload focus areas, dan practical ZTA deployment.