Consider better coordination between network based security and identity based security about tag-security HOT 3 CLOSED

@dshaw wanted us to define the area of concern and asses how deep we want to go in this working group.

from tag-security.

Just my loud thoughts probably echoing your issues:
IP based identity authentication may not render well in the virtualized environment:
• When the pods/containers fail, the substitute or standby container must assume (re-assignment aka reconfiguration) the same IP address in order to keep the authentication check transparent – not an easily scalable approach.
• This may become further complex if a single container app package gets migrated to microservice or serverless scattered over multiple containers or even Pods. Likely, the original IP based authentication needs to be reconfigured with multiple IP addresses. Though less frequent, avoiding such authentication reconfiguration would certainly be desirable since from user perspective application operation would remain the same while underneath virtual entities may have been changed. Similar issues come to mind if the load balancer needs to trigger additional Pods/containers.

1. Is not the service identity tied to service account (not necessarily IP based)?
   3, 4: Service identity (K8s service account) seems to be an improvement over IP identity scheme. Automation and mediation broker come to mind to perhaps help admin and scale the IP and service account mapping scheme

from tag-security.

Closed due to inactivity.

from tag-security.