@iota-big3/sdk-security/dist/zero-trust/service-mesh-adapter.d.ts

Advanced security features including zero trust, quantum-safe crypto, and ML threat detection

/**
 * Service Mesh Adapter
 * Provides zero trust networking through service mesh integration
 */
import { EventEmitter } from 'events';
import * as grpc from '@grpc/grpc-js';
export interface ServiceMeshConfig {
    type: 'istio' | 'linkerd' | 'consul';
    controlPlaneUrl: string;
    namespace?: string;
    mtlsMode: 'strict' | 'permissive' | 'disabled';
    policyEnforcement: boolean;
    authorizationRules?: AuthorizationRule[];
}
export interface AuthorizationRule {
    name: string;
    from: ServiceSelector;
    to: ServiceSelector;
    when?: Condition[];
    allow?: string[];
    deny?: string[];
}
export interface ServiceSelector {
    service?: string;
    namespace?: string;
    labels?: Record<string, string>;
    principals?: string[];
}
export interface Condition {
    key: string;
    values: string[];
    notValues?: string[];
}
export interface ServiceIdentity {
    spiffeId: string;
    namespace: string;
    serviceAccount: string;
    certificates: {
        root: string;
        chain: string;
        key: string;
    };
}
export declare abstract class ServiceMeshAdapter extends EventEmitter {
    protected config: ServiceMeshConfig;
    protected identity?: ServiceIdentity;
    constructor(_config: ServiceMeshConfig);
    /**
     * Initialize service mesh integration
     */
    abstract initialize(): Promise<void>;
    /**
     * Get service identity with SPIFFE ID
     */
    abstract getServiceIdentity(): Promise<ServiceIdentity>;
    /**
     * Apply authorization policy
     */
    abstract applyAuthorizationPolicy(_rules: AuthorizationRule[]): Promise<void>;
    /**
     * Enable mTLS for service communication
     */
    abstract enableMTLS(_mode: 'strict' | 'permissive'): Promise<void>;
    /**
     * Check if a service can communicate with another
     */
    abstract checkAuthorization(from: string, to: string, method?: string): Promise<boolean>;
    /**
     * Get service mesh metrics
     */
    abstract getMetrics(): Promise<ServiceMeshMetrics>;
    /**
     * Common zero trust principles
     */
    protected applyZeroTrustPrinciples(): void;
    /**
     * Validate service identity
     */
    protected validateIdentity(_spiffeId: string): Promise<boolean>;
    /**
     * Create secure channel with mTLS
     */
    protected createSecureChannel(_target: string): grpc.Channel;
}
/**
 * Istio Service Mesh Adapter
 */
export declare class IstioAdapter extends ServiceMeshAdapter {
    private pilotClient?;
    initialize(): Promise<void>;
    getServiceIdentity(): Promise<ServiceIdentity>;
    applyAuthorizationPolicy(_rules: AuthorizationRule[]): Promise<void>;
    enableMTLS(_mode: 'strict' | 'permissive'): Promise<void>;
    checkAuthorization(from: string, to: string, method?: string): Promise<boolean>;
    getMetrics(): Promise<ServiceMeshMetrics>;
    private syncConfiguration;
    private handleConfigUpdate;
    private readCertificate;
    private applyConfiguration;
    private matchesSelector;
    private queryMetric;
    private countServices;
}
/**
 * Linkerd Service Mesh Adapter
 */
export declare class LinkerdAdapter extends ServiceMeshAdapter {
    initialize(): Promise<void>;
    getServiceIdentity(): Promise<ServiceIdentity>;
    applyAuthorizationPolicy(_rules: AuthorizationRule[]): Promise<void>;
    enableMTLS(_mode: 'strict' | 'permissive'): Promise<void>;
    checkAuthorization(from: string, to: string, method?: string): Promise<boolean>;
    getMetrics(): Promise<ServiceMeshMetrics>;
    private applyConfiguration;
}
export interface ServiceMeshMetrics {
    requestRate: number;
    errorRate: number;
    latencyP50: number;
    latencyP99: number;
    mtlsEnabled: boolean;
    servicesCount: number;
    policiesCount: number;
}
/**
 * Factory for creating service mesh adapters
 */
export declare class ServiceMeshFactory {
    static create(_config: ServiceMeshConfig): ServiceMeshAdapter;
}
//# sourceMappingURL=service-mesh-adapter.d.ts.map