East-west visibility and automated policy for Mesh7’s microservices platform

The challenge

Applications were getting more complex, and so were the security worries. Workloads were short-lived, mixed and spread out. They leaned on cloud and third-party services, and passed sensitive data at Layer 7.

Mesh7 wanted to close four blind spots in one platform, on top of the infrastructure the customer already had.

The four blind spots:

• How workloads and services talked, in real time.
• Where sensitive data went.
• Odd behavior and unapproved changes.
• Threats moving sideways at run time.

What we did

• Co-designed and delivered the service mesh platform carrying both security and observability.
• Built the policy generation mechanisms, using the proxy as the insertion point.
• Developed the data enrichment mechanisms and the plugins for the proxy.
• Built plugins for the observability ecosystem, including the service mesh itself.
• Built the control plane in Go, running as a Kubernetes operator.
• Created the DDoS protection mechanism as part of the network security work.
• Built the user-centered frontend for security teams, around a service graph and analytics.
• Created a performance measurement toolkit, then optimized attack response, data aggregation and memory usage.
• Created and maintained the CI/CD project.

How we built it

The platform ran on top of the customer’s existing infrastructure. It watched communication between workloads at Layer 7.

1. Policy at the proxy We delivered the policy generation mechanisms around Envoy Proxy as the insertion point. They covered API discovery, API validation and service discovery. We also developed the data enrichment mechanisms and the Envoy plugins.
2. Control plane The control plane was written in Go and ran as a Kubernetes operator. Alongside it we built plugins for the observability ecosystem, including the service mesh and Istio.
3. Security and the frontend On the security side we created the DDoS protection mechanism. The platform was aimed at security teams, and the frontend was user-centered, built around a service graph and analytics.
4. Performance and delivery We created a performance measurement toolkit and used it to analyse and optimize response to attack performance, data aggregation, and memory usage. We also created and maintained the CI/CD project, and covered the product with test automation.

In the client’s words

Thanks to its expertise in networking technologies and Kubernetes, CodiLime has become our reliable technical partner helping us deliver the first-in-class product for monitoring security in microservices. CodiLime’s experienced project managers and engineers played an important role in releasing the final product and thus keeping promises given to clients and investors.

Amit Jain, CTO & Co-Founder, Mesh7