Skip to main content

Security

User-Facing API security​

The H2O AI Hybrid Cloud (H2OAIC) App Store relies on OpenID Connect (OIDC) to secure its API; see the Authorization for details on how the App Store leverages OIDC.

Specifically, on requests coming from the App Store web UI, it relies on OIDC-based information stored for the browser session in the database (identified by an encrypted cookie).

For requests coming from other clients, e.g., the CLI, it relies on standard Oauth2 Bearer auth, where the OIDC access token serves as a bearer token.

System-Facing API security​

Internal API calls to the API from App instances, e.g., when downloading the App bundle for execution, are secured using HMAC codes identifying and authorizing each app instance running in the Kubernetes cluster.

Kubernetes network security​

To (optionally) secure the traffic between the App Store API and the running instances, all pod-to-pod communication can be encrypted via a service mesh, such as Linkerd.

Similarly, the App Store supports restricting the network access of the running instances and other pods via Kubernetes network policies, e.g., to accept ingress only from the App Store server, which is responsible for all Authorization.

Feedback