Spillbox solution is a set of software tools to create a secured Hybrid Cloud infrastructure between customer’s traditional Datacenters or Datacenters in the Cloud. In the case of Cloud Datacenter, similar to Spillbox Cloud Bursting product, customers directly work with CSP of their choice to set up a Datacenter in the Cloud.

Network Security
****************
Since Spillbox Datacenter Bursting is used with customer’s provided VPN, this product does not require any additional peripheral security. Spillbox synchronizes customer’s data between physical data centers and the Cloud within the customer’s VPN. No data is exposed or ever brought outside of the customer’s VPN.

Spillbox’s Cloud Burst technology isolates local data from remote Cloud Burst data using container technology. Local data and setup do not require any changes and they never get modified. Container technology has been architected to work in a multi-user environment such that user does not require any privileged access by user.

In Spillbox Datacenter Bursting flow, users do not require any Cloud credentials. Cloud resources are completely managed by the IT team and the user's environment resembles the environment of their on-premise physical datacenter. Users benefit from Elasticity of the Cloud controlled by the IT team. 

Public Access
*************
Both Cloud/Remote and local Datacenter need access to AWS ( Spillbox's software distribution package resides on publicly accessible AWS S3 bucket ) to download the Spilllbox Installation software once. Both Cloud/Remote and local Datacenter need to access auth0.com. All users are supposed to create an account for themselves in auth0.com by doing a self signup. If ITis using domain whitelisting, then IT needs to make sure that auth0.com, terraform.io and hashicorp.com are whitelisted domain for m/c in Cloud. For on-premise, only auth0.com needs to be in whitelisted domain.

Ports
*****
No extra port needs to be opened on the local Datacenter. Local Datacenter will use port 8080 and above as well as port 7070 and above to connect to Cloud/Remote. Cloud/Remote Datacenter should allow port 7070-8090 from the local Datacenter.  Protocols used are https.

Docker and Register Server
**************************
In Spillbox no process runs as root or uses any privileged port. Even NFS servers run in userspace.

Although users can run docker containers, no user has access to docker. Only webserver running on Cloud/Remote Datacenter has access to Docker and facilitate users to run containers through client-server socket communication. Webserver spawns containers on the user's behalf. Webserver can spawn only IT approved commands ( maintained by IT through a config file ) to block users from accessing a web user account. IT needs to create a Unix service account in docker unix group and run Spillbox webserver under this account. Service account needs to spawn jobs on the user's behalf ( sudo -u <user> <cmd>)  so it needs to run the job as a user, not as a service account. For this reason, service accounts should also have sudo access without needing a password on the webserver machine.

For container orchestration, IT can bring their own docker registry server or Spillbox can install and run. Docker registry server is maintained by webserver. Just a registry server on its own should not pose any security risk. It is just a docker image distribution system when one server acts as master for clients to pull the images.

Other containers
****************
If the docker container is not approved by infosec, then rootless docker and singularity containers are also supported by Spillbox. Each container brings its own architecture for deployment. Current document describes architecture which  will work with docker containers. Other containers can be discussed, if needed.

On-premise Client 
*****************
On-premise client software is downloaded from the AWS S3 bucket once in a central area accessible to all users. Client accesses auth0.com as described in the beginning of this document. No other privileges are required. Client will connect to Spillbox webserver and NFS servers spawned by webserver.

Summary of work by Network/Securoty team:

       -  Choose any Cloud Server Provider ( preferably AWS/GCP/Azure/OCI ).
       -  Have about 5Gbps VPN link to CSP.

   Cloud:
       -  May create a seperate VPC for Spillbox.
       -  Whitelist aws.com
       -  Allow incoming  ports 7070-8090 from on-premise machines.
       -  ports 10000-13000 should be open inside VPN between internal m/cs.

   On-premise:
       -  Allow outgoing ports 7070-8090 to cloud VPN network.  
       -  ports 2222-2322 , 8080-10000 should be open between internal m/cs.
