DMZ network configuration for container application environments

Overview

Kubernetes (hereafter K8s) is an open platform that can flexibly run and manage distributed system environments by automating and managing multiple container applications. To implement the application, we use cloud security network technologies such as VPC and Private Subnet together with K8s.

However, security may require establishing a separate DMZ zone or configuring a network isolated from the server farm to prevent vulnerabilities. To do this, we configure a VPC on the Samsung Cloud Platform (hereafter SCP) to separate the network, and connect the VPCs using VPC Peering. We propose an architecture that deploys a Reverse Proxy in the VPC segment configured for a DMZ role to satisfy security requirements.

Architecture diagram

1. Request two VPCs, one for DMZ use and one for Private Network use. 1. The connection between two VPCs is established via VPC Peering.
2. For a DMZ VPC, request an Internet Gateway for internet connectivity, and request a Private Subnet and Security Group within that VPC. Then, after configuring a Virtual Server for reverse‑proxy purposes, request a Load Balancer to ensure availability.
3. Apply for Subnet and Security Group within a VPC for Private Network use, and provision the Kubernetes Engine for container runtime management and orchestration.
4. To expose the internal services’ HTTP and HTTPS paths to outside the cluster, you must configure a separate Ingress Controller in Kubernetes.
5. To secure the availability of the Ingress Controller, request a Load Balancer and register the Worker Node IP to connect with the Ingress Controller.

Use Cases

Implementation of a mobile web‑based logistics transportation tracking system

When building a logistics transportation tracking system on Kubernetes, you can configure the service as a container‑based application to provide real‑time visibility through end‑to‑end logistics flow monitoring, and set up traffic to pass through a DMZ reverse proxy to control access to service traffic for major customers’ shipment volume information.

Configuring container applications with a high level of security

You can design an architecture that separates networks with a VPC and uses a Reverse Proxy to protect Private Network resources from external threats. Container applications deployed within a Private Network can leverage the advantages of the Kubernetes platform.

Prerequisites

None

Constraints

None

Considerations

None

Related service

This is a list of Samsung Cloud Platform services that are related to the features or configurations described in this guide. Refer to this when selecting and designing services.