Completely Isolate your App's Traffic: Isolation Segments at the Routing Tier
summary
Cloud Foundry adds routing isolation segments that tag apps with placement metadata so routers only learn routes for matching Diego cells, cutting cross-traffic and eliminating host header spoofing attacks. Implementation uses CF CLI commands, BOSH manifest flags (shared_routing_table, isolation_segment), NATS route emitters and router groups with four modes (shared-only, isolation-only, shared+isolation, all). Live demo sends spoofed Host headers to ELBs and routers and returns 404s, proving the isolation and config enforcement work.
AI-written summary · about
chapters (6)
- 0:00Introduction to isolation segments
- 2:07Motivations for routing isolation
- 8:09Current infrastructure challenges
- 10:43Router configuration modes
- 12:28Live demo of isolation segments
- 19:48Conclusion and Q&A
related talks
37mStay Out of My Yard! Isolation Segments - a New Feature for Isolating Workloads in Cloud Foundry
22mPushing the Limits: Cloud Foundry Runtime and Routing at SAP...
25mEnable IoT and Media Support in CF with Custom TCP/UDP Routers
31mBoF: Security Best Practices in Cloud Foundry
15mRecent Enhancements to Routing in Cloud Foundry
32mCF Networking: All Your Packets are Belong to Us
06mLightning Talk: Cloud Foundry Revisited: UDP, VoIP, and Beyond!
31mCloud Foundry Networking: Enabling Direct Communication for Microservices - Chin, McClure