Security Architecture

graph TB subgraph "External Threats" INTERNET[Internet
Potential Threats] MALICIOUS[Malicious
Actors] BOTS[Automated
Bots] end subgraph "Perimeter Security" CLOUDFLARE[CloudFlare
DDoS Protection] WAF[Web Application
Firewall] RATE_LIMIT[Rate
Limiting] GCP_ARMOR[Google Cloud
Armor] end subgraph "Network Security" LOAD_BALANCER[Load Balancer
SSL/TLS Termination] PRIVATE_CLUSTER[Private GKE
Cluster] AUTHORIZED_NETWORKS[Authorized
Networks] FIREWALL_RULES[VPC Firewall
Rules] end subgraph "Authentication Layer" FIREBASE_AUTH[Firebase
Authentication] API_TOKENS[API Token
Management] OAUTH_PROVIDER[OAuth 2.0
Provider] MFA[Multi-Factor
Authentication] end subgraph "Authorization Layer" RBAC[Role-Based
Access Control] TOKEN_SCOPES[Token
Scopes] PERMISSION_CHECK[Permission
Checking] RESOURCE_ISOLATION[Resource
Isolation] end subgraph "Application Security" INPUT_VALIDATION[Input
Validation] SANITIZATION[Data
Sanitization] CSRF_PROTECTION[CSRF
Protection] SECURE_HEADERS[Security
Headers] end subgraph "Data Protection" ENCRYPTION_TRANSIT[Encryption
in Transit] ENCRYPTION_REST[Encryption
at Rest] SECRET_MANAGEMENT[Secret
Management] DATA_CLASSIFICATION[Data
Classification] end subgraph "Monitoring & Audit" AUDIT_LOGS[Audit
Logging] SECURITY_MONITORING[Security
Monitoring] INTRUSION_DETECTION[Intrusion
Detection] COMPLIANCE_REPORTING[Compliance
Reporting] end %% External to perimeter INTERNET --> CLOUDFLARE MALICIOUS --> WAF BOTS --> RATE_LIMIT %% Perimeter to network CLOUDFLARE --> LOAD_BALANCER WAF --> LOAD_BALANCER RATE_LIMIT --> LOAD_BALANCER GCP_ARMOR --> LOAD_BALANCER %% Network security LOAD_BALANCER --> PRIVATE_CLUSTER PRIVATE_CLUSTER --> AUTHORIZED_NETWORKS AUTHORIZED_NETWORKS --> FIREWALL_RULES %% Authentication flow PRIVATE_CLUSTER --> FIREBASE_AUTH FIREBASE_AUTH --> API_TOKENS API_TOKENS --> OAUTH_PROVIDER OAUTH_PROVIDER --> MFA %% Authorization flow FIREBASE_AUTH --> RBAC API_TOKENS --> TOKEN_SCOPES RBAC --> PERMISSION_CHECK TOKEN_SCOPES --> PERMISSION_CHECK PERMISSION_CHECK --> RESOURCE_ISOLATION %% Application security PERMISSION_CHECK --> INPUT_VALIDATION INPUT_VALIDATION --> SANITIZATION SANITIZATION --> CSRF_PROTECTION CSRF_PROTECTION --> SECURE_HEADERS %% Data protection SECURE_HEADERS --> ENCRYPTION_TRANSIT ENCRYPTION_TRANSIT --> ENCRYPTION_REST ENCRYPTION_REST --> SECRET_MANAGEMENT SECRET_MANAGEMENT --> DATA_CLASSIFICATION %% Monitoring integration AUDIT_LOGS -.-> SECURITY_MONITORING SECURITY_MONITORING -.-> INTRUSION_DETECTION INTRUSION_DETECTION -.-> COMPLIANCE_REPORTING %% Cross-cutting concerns RBAC -.-> AUDIT_LOGS TOKEN_SCOPES -.-> AUDIT_LOGS INPUT_VALIDATION -.-> AUDIT_LOGS ENCRYPTION_TRANSIT -.-> AUDIT_LOGS classDef threat fill:#ffebee,stroke:#d32f2f,stroke-width:2px classDef perimeter fill:#e3f2fd,stroke:#1976d2,stroke-width:2px classDef network fill:#fff3e0,stroke:#f57c00,stroke-width:2px classDef auth fill:#e8f5e9,stroke:#388e3c,stroke-width:2px classDef authz fill:#fce4ec,stroke:#c2185b,stroke-width:2px classDef app fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px classDef data fill:#e0f2f1,stroke:#00695c,stroke-width:2px classDef monitor fill:#fff8e1,stroke:#f9a825,stroke-width:2px class INTERNET,MALICIOUS,BOTS threat class CLOUDFLARE,WAF,RATE_LIMIT,GCP_ARMOR perimeter class LOAD_BALANCER,PRIVATE_CLUSTER,AUTHORIZED_NETWORKS,FIREWALL_RULES network class FIREBASE_AUTH,API_TOKENS,OAUTH_PROVIDER,MFA auth class RBAC,TOKEN_SCOPES,PERMISSION_CHECK,RESOURCE_ISOLATION authz class INPUT_VALIDATION,SANITIZATION,CSRF_PROTECTION,SECURE_HEADERS app class ENCRYPTION_TRANSIT,ENCRYPTION_REST,SECRET_MANAGEMENT,DATA_CLASSIFICATION data class AUDIT_LOGS,SECURITY_MONITORING,INTRUSION_DETECTION,COMPLIANCE_REPORTING monitor

graph TB subgraph "External Network" INTERNET[Internet] OFFICE[Office Network
Authorized IP] VPN[VPN Gateway] end subgraph "GCP Network Security" ARMOR[Cloud Armor
DDoS Protection] LB[Load Balancer
Regional] CLOUD_NAT[Cloud NAT
Egress Gateway] end subgraph "VPC Network" PRIVATE_SUBNET[Private Subnet
10.0.0.0/24] PUBLIC_SUBNET[Public Subnet
10.0.1.0/24] FIREWALL[VPC Firewall
Rules] end subgraph "GKE Security" PRIVATE_CLUSTER[Private Cluster
No Public IPs] AUTHORIZED_NETWORKS[Authorized
Networks] NETWORK_POLICIES[Network
Policies] WORKLOAD_IDENTITY[Workload
Identity] end subgraph "Pod Security" RBAC_RULES[RBAC
Rules] SECURITY_CONTEXT[Security
Context] POD_POLICIES[Pod Security
Policies] NAMESPACE_ISOLATION[Namespace
Isolation] end %% External access INTERNET --> ARMOR OFFICE --> LB VPN --> PRIVATE_SUBNET %% GCP network ARMOR --> LB LB --> PRIVATE_SUBNET CLOUD_NAT --> PRIVATE_SUBNET %% VPC network PRIVATE_SUBNET --> FIREWALL PUBLIC_SUBNET --> FIREWALL FIREWALL --> PRIVATE_CLUSTER %% GKE security PRIVATE_CLUSTER --> AUTHORIZED_NETWORKS AUTHORIZED_NETWORKS --> NETWORK_POLICIES NETWORK_POLICIES --> WORKLOAD_IDENTITY %% Pod security WORKLOAD_IDENTITY --> RBAC_RULES RBAC_RULES --> SECURITY_CONTEXT SECURITY_CONTEXT --> POD_POLICIES POD_POLICIES --> NAMESPACE_ISOLATION classDef external fill:#e3f2fd,stroke:#1976d2,stroke-width:2px classDef gcp fill:#fff3e0,stroke:#f57c00,stroke-width:2px classDef vpc fill:#e8f5e9,stroke:#388e3c,stroke-width:2px classDef gke fill:#fce4ec,stroke:#c2185b,stroke-width:2px classDef pod fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px class INTERNET,OFFICE,VPN external class ARMOR,LB,CLOUD_NAT gcp class PRIVATE_SUBNET,PUBLIC_SUBNET,FIREWALL vpc class PRIVATE_CLUSTER,AUTHORIZED_NETWORKS,NETWORK_POLICIES,WORKLOAD_IDENTITY gke class RBAC_RULES,SECURITY_CONTEXT,POD_POLICIES,NAMESPACE_ISOLATION pod

sequenceDiagram participant User participant Browser participant Load Balancer participant Blueberry API participant Firebase Auth provider Authentication Service participant RBAC Service participant Firestore participant Secret Manager Note over User,Secret Manager: Authentication & Authorization Flow %% Authentication Phase User->>Browser: Access application Browser->>Load Balancer: HTTPS request Load Balancer->>Blueberry API: Forward request Blueberry API->>Browser: Redirect to login Browser->>Firebase Auth: Initiate OAuth flow Firebase Auth->>User: Google OAuth consent User->>Firebase Auth: Authorize application Firebase Auth->>Browser: Return ID token Browser->>Blueberry API: Request with Bearer token %% Token Validation Blueberry API->>Firebase Auth: Validate ID token Firebase Auth->>Blueberry API: Token claims %% Authorization Phase Blueberry API->>RBAC Service: Check user permissions RBAC Service->>Firestore: Get user roles Firestore->>RBAC Service: User role data RBAC Service->>Blueberry API: Permission granted/denied alt Permission Granted Blueberry API->>Browser: Authorized response else Permission Denied Blueberry API->>Browser: 403 Forbidden end %% API Token Alternative Note over User,Secret Manager: API Token Flow User->>Blueberry API: Request with API token Blueberry API->>Secret Manager: Validate token Secret Manager->>Blueberry API: Token details Blueberry API->>Firestore: Get token permissions Firestore->>Blueberry API: Token scopes alt Valid Token with Scope Blueberry API->>User: Authorized response else Invalid Token or Scope Blueberry API->>User: 401/403 Error end

graph LR subgraph "Data Classification" PUBLIC[Public
Data] INTERNAL[Internal
Data] CONFIDENTIAL[Confidential
Data] SECRET[Secret
Data] end subgraph "Encryption Methods" TLS[TLS 1.3
In Transit] AES[AES-256
At Rest] KMS[Cloud KMS
Key Management] ENVELOPE[Envelope
Encryption] end subgraph "Storage Security" FIRESTORE_ENC[Firestore
Encrypted] GCS_ENCRYPTION[GCS
Encryption] SECRET_MANAGER[Secret Manager
Encrypted] REDIS_TLS[Redis
TLS] end subgraph "Access Controls" IAM[Cloud IAM
Roles] WORKLOAD_ID[Workload
Identity] SERVICE_ACCOUNT[Service
Account] AUDIT_TRAIL[Audit
Trail] end %% Classification to encryption PUBLIC --> TLS INTERNAL --> TLS CONFIDENTIAL --> AES SECRET --> KMS %% Encryption to storage TLS --> FIRESTORE_ENC AES --> GCS_ENCRYPTION KMS --> SECRET_MANAGER ENVELOPE --> REDIS_TLS %% Access control integration FIRESTORE_ENC --> IAM GCS_ENCRYPTION --> WORKLOAD_ID SECRET_MANAGER --> SERVICE_ACCOUNT REDIS_TLS --> AUDIT_TRAIL classDef classification fill:#e3f2fd,stroke:#1976d2,stroke-width:2px classDef encryption fill:#fff3e0,stroke:#f57c00,stroke-width:2px classDef storage fill:#e8f5e9,stroke:#388e3c,stroke-width:2px classDef access fill:#fce4ec,stroke:#c2185b,stroke-width:2px class PUBLIC,INTERNAL,CONFIDENTIAL,SECRET classification class TLS,AES,KMS,ENVELOPE encryption class FIRESTORE_ENC,GCS_ENCRYPTION,SECRET_MANAGER,REDIS_TLS storage class IAM,WORKLOAD_ID,SERVICE_ACCOUNT,AUDIT_TRAIL access

graph TB subgraph "Detection Systems" SIEM[SIEM
System] IDS[Intrusion Detection
System] ANOMALY[Anomaly
Detection] THREAT_INTEL[Threat
Intelligence] end subgraph "Monitoring Sources" AUDIT_LOGS[Audit
Logs] SECURITY_EVENTS[Security
Events] NETWORK_LOGS[Network
Logs] APPLICATION_LOGS[Application
Logs] end subgraph "Alert Processing" CORRELATION[Event
Correlation] SEVERITY[Severity
Assessment] TRIAGE[Alert
Triage] ESCALATION[Escalation
Management] end subgraph "Response Actions" AUTOMATED[Automated
Response] MANUAL[Manual
Investigation] CONTAINMENT[Incident
Containment] RECOVERY[System
Recovery] end %% Detection flow AUDIT_LOGS --> SIEM SECURITY_EVENTS --> IDS NETWORK_LOGS --> ANOMALY APPLICATION_LOGS --> THREAT_INTEL %% Processing flow SIEM --> CORRELATION IDS --> CORRELATION ANOMALY --> SEVERITY THREAT_INTEL --> SEVERITY %% Response flow CORRELATION --> TRIAGE SEVERITY --> TRIAGE TRIAGE --> ESCALATION ESCALATION --> AUTOMATED ESCALATION --> MANUAL %% Action flow AUTOMATED --> CONTAINMENT MANUAL --> CONTAINMENT CONTAINMENT --> RECOVERY classDef detection fill:#e3f2fd,stroke:#1976d2,stroke-width:2px classDef monitoring fill:#fff3e0,stroke:#f57c00,stroke-width:2px classDef processing fill:#e8f5e9,stroke:#388e3c,stroke-width:2px classDef response fill:#fce4ec,stroke:#c2185b,stroke-width:2px class SIEM,IDS,ANOMALY,THREAT_INTEL detection class AUDIT_LOGS,SECURITY_EVENTS,NETWORK_LOGS,APPLICATION_LOGS monitoring class CORRELATION,SEVERITY,TRIAGE,ESCALATION processing class AUTOMATED,MANUAL,CONTAINMENT,RECOVERY response

# Network policy for environment isolation
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-default
  namespace: env-pr-123
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: kube-system
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53

# Role-based access control
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: env-pr-123
  name: environment-manager
rules:
- apiGroups: [""]
  resources: ["pods", "services", "configmaps"]
  verbs: ["get", "list", "create", "update", "patch", "delete"]
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list", "create", "update", "patch", "delete"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "list", "create", "update", "patch", "delete"]

# Pod security context
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
        - ALL
    resources:
      limits:
        memory: "512Mi"
        cpu: "500m"
      requests:
        memory: "256Mi"
        cpu: "250m"

graph TB subgraph "Policy Management" SECURITY_POLICY[Security
Policy] RISK_ASSESSMENT[Risk
Assessment] COMPLIANCE_CHECK[Compliance
Checking] AUDIT_PROCESS[Audit
Process] end subgraph "Implementation" TECHNICAL_CONTROLS[Technical
Controls] ADMINISTRATIVE[Administrative
Controls] PHYSICAL[Physical
Controls] MONITORING[Monitoring
& Logging] end subgraph "Validation" SECURITY_TESTING[Security
Testing] PENETRATION_TESTING[Penetration
Testing] VULNERABILITY_ASSESSMENT[Vulnerability
Assessment] COMPLIANCE_AUDIT[Compliance
Audit] end SECURITY_POLICY --> TECHNICAL_CONTROLS RISK_ASSESSMENT --> ADMINISTRATIVE COMPLIANCE_CHECK --> PHYSICAL AUDIT_PROCESS --> MONITORING TECHNICAL_CONTROLS --> SECURITY_TESTING ADMINISTRATIVE --> PENETRATION_TESTING PHYSICAL --> VULNERABILITY_ASSESSMENT MONITORING --> COMPLIANCE_AUDIT classDef policy fill:#e3f2fd,stroke:#1976d2,stroke-width:2px classDef implement fill:#fff3e0,stroke:#f57c00,stroke-width:2px classDef validate fill:#e8f5e9,stroke:#388e3c,stroke-width:2px class SECURITY_POLICY,RISK_ASSESSMENT,COMPLIANCE_CHECK,AUDIT_PROCESS policy class TECHNICAL_CONTROLS,ADMINISTRATIVE,PHYSICAL,MONITORING implement class SECURITY_TESTING,PENETRATION_TESTING,VULNERABILITY_ASSESSMENT,COMPLIANCE_AUDIT validate