Security Architecture for PubSub+ Cloud

PubSub+ Cloud is highly available and secure as it follows the PubSub+ event broker security practices for a SaaS service. PubSub+ Cloud is designed with security in mind.

In PubSub+ Cloud, architecture is partially determined by the deployment options you choose, which specifies where your event brokers reside. These deployment-based architecture differences affect various aspects of security and can determine whether you (the customer) or Solace is responsible for certain security tasks in your deployment. To understand the security architecture, you should first understand the differences between the deployment options.

Deployment Options

The deployment options can be broken down to the ownership model that the customer chooses and its connectivity. For more information about deployment options and connectivity, see PubSub+ Cloud Deployment Ownership Models and PubSub+ Cloud Connectivity Requirements.

The following is a summary of the deployment ownership and connectivity options.

  • Ownership Model
    • The ownership model refers to the location of the region where the Mission Control Agent and software event brokers are installed. These are the variants of ownership:

      • Public Regions: Dedicated event broker services are deployed in Solace-controlled shared VPC/VNets on public cloud providers such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure.
      • Dedicated Regions: Dedicated event broker services are deployed in Solace-controlled VPC/VNets dedicated to the customer on public cloud providers such as AWS, GCP, and Azure.
      • Customer-Controlled Regions: Dedicated event broker services are deployed in a customer's on-premises or cloud-based Kubernetes cluster, such as OpenShift, Rancher (RKE1), Amazon (EKS), Azure (AKS, ARO), Google (GKE), Alibaba (ACK), Huawei (CCE), and more.
    • The ownership determines who is responsible for the security of the infrastructure and connectivity and is summarized as follows:
      • The infrastructure in Solace-controlled regions (Public Regions and Dedicated Regions) is secure by default for the customer because Solace manages the security for the infrastructure. The customer and Solace collaborate to ensure connectivity requirements are satisfied.
      • In Customer-Controlled Regions, the customer must manage the security for the infrastructure as well as the connectivity requirements.
  • Connectivity
    • The connectivity model refers to the network access and permissions that allow your Kubernetes cluster and event broker services to function correctly. The types of connectivity you need to consider in your deployment are:

      • Messaging Connectivity: The connectivity required for messaging traffic (between event broker services and from applications to event broker services).
      • Management Connectivity: The connectivity required for you to administer your event broker services using the Solace CLI, Broker Manager, or SEMP.
      • Operational Connectivity: The connectivity required to set up your Kubernetes cluster and launch event broker services.
    • Additional network configuration for Dedicated Regions is required for messaging clients to connect to the event broker services and the responsibility is related to the ownership model chosen as follows:
      • For deployments in Public Regions, the customer manages the access of client applications within a private network to the event broker services. The customer is required to set up the connectivity from the private IP addresses or hybrid configurations (e.g., permit external access to the public Internet or configure VPC/VNet peering).
      • For deployments in Dedicated Regions, the customer manages the access of client applications within a private network to the event broker services. Solace and the customer collaborate to ensure that the deployment matches the customer's messaging connectivity requirements. For example, if the customer has client applications that reside in a private network (i.e., private IP addresses within a VPC/VNet), Solace exchanges route information with the customer to set up VPC/VNet peering, AWS Transit Gateway (controlled availability), or set up connectivity in the Dedicated Region.
      • For deployments in Customer-Controlled Regions, the customer manages the connectivity and takes care of setting up the necessary configuration for connectivity from their client applications to their event broker services. (e.g., VPC/VNet peering, site-to-site VPN, AWS Direct Connect, Transit Gateway, loadbalancer, NAT configuration, etc.).

For more information about the security responsibilities of the customer and Solace based on the deployment model and ownership, see Customer Roles and Responsibilities for Security.

Security Considerations

All PubSub+ Cloud deployments have well-defined architectures that share the same security considerations. The option you choose determines whether Solace or you (the customer) are responsible for managing different aspects of security. The PubSub+ Cloud security architecture considerations include:

  • Do the event broker services need to be publicly available from the Internet?
    • For non-public event broker services, Solace recommends that deployments are made in a Kubernetes cluster within an isolated Virtual Private Cloud or Virtual Network (VPC/VNet). These type of deployments are available in Dedicated Regions or Customer-Controlled Regions.
  • What is the connectivity model used to access event broker services? 
    • The messaging connectivity model that the customer chooses for client applications may influence the requirements for the Operational Connectivity (that is, the connectivity to the PubSub+ Home Cloud and the central monitoring service). Operational Connectivity to Home Cloud and the central monitoring service is a requirement for event broker services to function and is not optional. You can use either Public Regions, Dedicated Regions, or Customer-Controlled Regions.
    • Solace recommends that client applications connect using VPC/VNet peering or loadbalancer when using private IP addresses. It is possible to deploy event broker services in the same Kubernetes cluster alongside the client applications that use the event broker services. This configuration may be a preferred deployment option based on the customer's security requirements. This option is available only in Customer-Controlled Regions.

Security Architecture Overview

All supported deployment models permit PubSub+ Cloud to meet various security requirements.

In addition to the deployment model, another factor to consider as part of the customer's security planning is how client applications connect. There are two types of client applications:

  • publishers and subscriber applications that use event broker services for messaging and passing data; these applications often connect from another VPC/VNet or from public infrastructure
  • optionally, the customer can create management applications that manage the lifecycle of an event broker service; these applications are usually account specific

For more information about connectivity, see Client Application Connectivity and Security.

Reqardless of the ownership model and connectivity options, each deployment uses a common set of components as shown in the following diagram:

Architecture diagram showing the PubSub+ Cloud components described in the following text.

Component Description

Home Cloud Region

Solace has regional site for the PubSub+ Home Cloud. The Home Cloud regions do not share infrastructure, data, or any other system, account, or user information with each other.

Home Cloud

The PubSub+ Home Cloud is a collection of microservices that provides the control plane for deployments of PubSub+ Cloud.

Cloud Console

The PubSub+ Cloud Consoleis a web-based user-interface that gives customers access to PubSub+ Cloud functionality.

Deployment Region

The region where the Mission Control Agent and software event brokers are installed based on the ownership model. The regions include:

  • Public Regions
  • Dedicated Regions
  • Customer-Controlled Regions

Mission Control Agent

The Mission Control Agent is a microservice that is required to deploy and manage event broker services.

Event Broker Services

Event brokers provide the data path to allow applications to communicate in real time. An event broker service in PubSub+ Cloud is either a standalone software event broker or a high-availability group of three software event brokers.

Central Monitoring Service

The central monitoring service collects monitoring data (statistics/metrics) and logs from event broker services and stores the information. Operational monitoring metrics, statistics, and logs are centrally monitored from the Home Cloud. The central monitoring service is provided by Datadog. Datadog agents are configured for each event broker service to send monitoring data and logs to the central monitoring service.

Client Applications

A client application can be a program, process, microservice, IoT device, integration component or other runnable consumer, producer, or processor that subscribes to or publishes events through an event broker. Applications may reside on the public Internet or in a customer-controlled region.

Management Data

Management data is sent between the Mission Control Agent, Home Cloud, and event broker services. Management data includes configuration information for event broker services and metadata that is sent back to Solace through secure ports.

Messaging Data

Messaging data, which includes payloads of event messages, refers to the information sent between event broker services and the publishing and subscribing client applications.

Monitoring Data

Monitoring data includes statistics and event broker logs that are sent to the central monitoring service through secure ports.

For more information about each of the components as they relate to security, see the following sections:

Security Architecture for Public Regions

In Public Regions, the event broker services are deployed in a publicly accessible, shared region that is controlled and managed by Solace. Client applications access the event broker services over the public Internet. Solace manages the infrastructure, and always uses the most recent security practices.

The event broker services are deployed to shared Kubernetes clusters per region (Google Cloud Platform) or shared VPCs/VNets per region (AWS or Azure), depending on the cloud provider chosen.

The Public Region deployment is best suited for environments where client applications access services from the public Internet. These can also include client applications from within a customer network, but in this situation, the customer must manage the access to applications from their own private network to the Internet.

In the following diagram, the red box shows the customer's security architecture responsibilities:

Architecture diagram highlighting client applications within the public Internet or a customer-controlled region.

For a summary of the security responsibilities, see Customer Roles and Responsibilities for Security.

Security Architecture for Dedicated Regions

In deployments in Dedicated Regions, Solace also manages the infrastructure using the most recent security practices.Solace ensures that the configuration of the Kubernetes cluster is secure and that your client applications have connectivity.

In this option, the event broker services are run within infrastructure that is dedicated to the customer; usually event broker services are not publicly accessible from the Internet. Client applications access the event broker service from another private network, which is customer-controlled.

This option is ideal when client applications do not access the event broker services from the public Internet. Client applications can connect using VPC/VNet peering technology. It is also possible to configure this option to use a hybrid connectivity model.

In the following diagram, the red box shows the customer's security architecture responsibilities:

Architecture diagram highlighting client applications within a customer-controlled region.

For a summary of the security responsibilities, see Customer Roles and Responsibilities for Security.

Security Architecture for Customer-Controlled Regions

In Customer-Controlled Regions, the customer deploys the event broker services to a dedicated private network, which the customer controls. A Customer-Controlled Region gives the customer the most control over security, network configuration, and segregation to deploy event broker services and configure their infrastructure. The customer also controls the Kubernetes cluster (which can be either on-premises or in the cloud) and all aspects of the VPC/VNet where the Kubernetes cluster resides.

Solace recommends that event broker services are deployed to Kubernetes clusters whenever possible because of the inherent operational, flexibility, and security advantages. Kubernetes provides better fine-grained control and superior security compared to VM-based deployments. For more information, see Deployment Architecture for Kubernetes.

Though less commonly deployed, Solace does currently support deployments to VM-based environments on Amazon Web Services (AWS) and Azure. If the customer wants to use AWS or Azure, they should first consider using Amazon Elastic Kubernetes Service (EKS) or Azure Kubernetes Service (AKS), as alternatives. For more information, see Installing PubSub+ Cloud in Amazon Elastic Kubernetes Service (EKS) and Installing PubSub+ Cloud in Azure Kubernetes Service (AKS), respectively.

In summary, deployments of event broker services on Customer-Controlled Regions require that the customer considers the following as part of their security planning:

  • The requirements of the deployment type for the event broker services. Whether event broker services are deployed to a Kubernetes cluster (on-premises or in the cloud), or a VM-based deployment to a VPC/VNet, the deployment requires user accounts that are configured with the necessary, limited permissions. The customer may need to coordinate with their internal infrastructure and security teams to set up the user accounts.
  • The Mission Control Agent is provided with account permissions to manage event broker services in the customer's Kubernetes cluster. Solace recommends that a very limited set of permissions are assigned account for the Mission Control Agent to limit the risks and the vectors of attack. For more information about the Mission Control Agent, see Mission Control Agent.
  • Metrics and monitoring data is vital for the PubSub+ Cloud solution to work; it ensures that the event broker services are operating correctly. This system-level data identifies the event broker services so that Solace can properly monitor it as a SaaS. Solace doesn't and cannot access the contents of the messages (data) transported on the customer's network. For PubSub+ Cloud to function correctly, the customer must permit outgoing monitoring traffic from their VPC/VNet.

With deployments in Customer-Controlled Regions, the customer manages all aspects of the deployment configuration, connectivity, and security. For details, see Kubernetes in Customer-Controlled Regions .

For considerations specific to VM-based deployments, see Security Architecture for Customer-Controlled Regions (VM-Based).

Kubernetes in Customer-Controlled Regions

For deployments in Customer-Controlled Regions, Solace supports the following Kubernetes implementations:

  • On-premises:
  • In the cloud:
    • Amazon Elastic Kubernetes Service (EKS)
    • Azure Kubernetes Service (AKS)
    • Azure Red Hat OpenShift (ARO)
    • Google Kubernetes Engine (GKE)
    • Alibaba Cloud Container Service for Kubernetes (ACK)
    • Huawei Cloud Container Engine (CCE)

In these deployments the customer controls the management of the resources, configuring the networking, and overall security of the Kubernetes cluster. The customer can coordinate with Solace to deploy PubSub+ Cloud.

Prior to working with Solace, the security and permissions in the customer's Kubernetes cluster should be defined and implemented before the installing PubSub+ Cloud.

In the following diagram, the red box shows the customer's security architecture responsibilities:

Architecture diagram highlighting the Mission Control Agent, event broker services, and client applications within a customer-controlled region.

For a summary of the security responsibilities, see Customer Roles and Responsibilities for Security.

Security Architecture for Customer-Controlled Regions (VM-Based)

Support for VM-based deployments is now deprecated and version 10.0.1 was the last event broker release that supported deployments in VM-based regions. For more details, see the Deprecated Features list.

Solace recommends that you choose a Kubernetes deployment for PubSub+ Cloud rather than the other environments discussed on this page. See Other Deployment Environments.

Deploying event broker services directly to a Customer-Controlled Region using a VM-based approach is supported, but is not the recommended architecture to use.

For Customer-Controlled Regions, Solace recommends that you choose a Kubernetes deployment for PubSub+ Cloud rather than the other environments discussed on this page because Kubernetes deployments offer the following advantages:

  • Kubernetes deployments offer more flexibility and support. For example, new broker versions are available earlier and higher release cadences are available for Kubernetes when compared to VM-based releases.
  • Some features and capabilities are only available in Kubernetes deployments, such as the ability to upscale event broker service and a self-upgrading Mission Control Agent.
  • Deployments on Kubernetes are based on a better and more manageable security architecture. Kubernetes is inherently more secure because the customer environments can be more easily scoped to a cluster namespace, prevent cloud access, and present a better security profile for security teams. For more information, see Security Architecture for Customer-Controlled Regions.

For VM-based deployments on Customer-Controlled Regions, the customer is responsible for the resources, setting up the networking, and managing the security for their network.

This includes initial deployment and upgrades of the Mission Control Agent to the same VPC/VNet where the event broker services are deployed. These considerations are specific to deployments on cloud providers such as Azure, Amazon Web Services (AWS), Huawei, and Alibaba Cloud.

In the following diagram, the red box shows the customer's security architecture responsibilities:

Architecture diagram highlighting the Mission Control Agent, event broker services, and client applications within a customer-controlled region.

For a summary of the security responsibilities, see Customer Roles and Responsibilities for Security.