Securing the runtime installation

A typical Apigee hybrid installation is made of multiple pods, as listed in the following table. Each of these pods require specific access to ports, and not every pod needs to communicate with every other pod. For a detailed map of these internal connections and the security protocols they employ, see Internal connections.

Pod	Description
`apigee-logger`	Contains an Apigee logger agent that sends application logs to Stackdriver.
`apigee-metrics`	Contains an Apigee metrics agent that sends application logs to Stackdriver.
`apigee-cassandra`	Contains the hybrid runtime persistance layer.
`apigee-synchronizer`	Synchronizes configuration between the management (control) plane and runtime (data) plane.
`apigee-udca`	Allows transfer of analytics data to the management plane.
`apigee-mart`	Contains the Apigee administrative API endpoint.
`apigee-runtime`	Contains the gateway for API request processing and policy execution.

Google recommends that you follow these methods and best practices to harden, secure, and isolate the runtime pods:

Method	Description
Kubernetes security overview	Review the Google Kubernetes Engine (GKE) document Security overview. This document provides an overview of each layer of your Kubernetes infrastructure, and explains how you can configure its security features to best suit your needs. For Google Cloud Engine's current guidance for hardening your GKE cluster, see Hardening your cluster's security.
Network policies	Use network policies to restrict communication between Pods and to pods that have access outside the Kubernetes network. For more information, see Creating a cluster network policy in the GKE documentation. A network policy is a specification of how groups of pods are allowed to communicate with each other and other network endpoints. The Kubernetes NetworkPolicy resource uses labels to select pods and define rules which specify what traffic is allowed to the selected pods. You can implement a Container Network Interface (CNI) plugin to add network policies to an Apigee hybrid runtime installation. Network policies let you isolate pods from outside access and enable access to specific pods. You can use an open source CNI plugin, such as Calico to get started.
GKE Sandbox	Enable GKE Sandbox for the Kubernetes clusters that run Apigee hybrid. See GKE Sandbox for details. NOTE: GKE Sandbox is the Google version of the open source project gVisor, a sandbox runtime that provides a virtualized container environment.

Method

Description

Kubernetes security overview

Review the Google Kubernetes Engine (GKE) document Security overview. This document provides an overview of each layer of your Kubernetes infrastructure, and explains how you can configure its security features to best suit your needs.

For Google Cloud Engine's current guidance for hardening your GKE cluster, see Hardening your cluster's security.

Network policies

Use network policies to restrict communication between Pods and to pods that have access outside the Kubernetes network. For more information, see Creating a cluster network policy in the GKE documentation.

A network policy is a specification of how groups of pods are allowed to communicate with each other and other network endpoints.

The Kubernetes NetworkPolicy resource uses labels to select pods and define rules which specify what traffic is allowed to the selected pods.

You can implement a Container Network Interface (CNI) plugin to add network policies to an Apigee hybrid runtime installation. Network policies let you isolate pods from outside access and enable access to specific pods. You can use an open source CNI plugin, such as Calico to get started.

GKE Sandbox

Enable GKE Sandbox for the Kubernetes clusters that run Apigee hybrid. See GKE Sandbox for details.