Private endpoints va ichki tarmoqlar

1) Nima uchun xususiy tarmoq

• PaaS/DB/omborlarni ommaviy IPdan ajratish;
• muvofiqlikni soddalashtirish (PCI DSS/GDPR);
• oldindan taxmin qilinadigan kechikishlar va yo’nalishlar.

2) Bazaviy model: VPC/VNet va xablar

Manzillar maydoni: yagona CIDR rejasi, kesishmasdan (masalan,’10. 0. 0. 0/12’atroflar va xablarga bo’linadi).
Segmentatsiya:’ingress’,’app’,’data’,’ops’,’shared’kichik tarmoqlari alohida yo’nalishlarda/ACL/SG.
Tranzit xabi: markaziy VPC/VNet shlyuzlari (VPN/DirectConnect/ExpressRoute/Interconnect), o’zaro VPC peering/Transit Gateway va tarmoq fayllari bilan.
Dual-stack: IPv6 ni oldindan rejalashtirish (NATni tejaydi, manzillar ko’lamini yaxshilaydi).

3) Private endpoints: tamoyillar

• Trafik provayder tarmog’i ichida (Internet orqali emas).
• Endpoint policy qayerga borishni cheklaydi (prefikslar/ARN/resurslar).
• DNS shaxsiy IPga qayta aniqlanadi (§ 6 ga qarang).

Namunaviy maqsadlar: obyekt storlari (S3/GCS/Blob), secret/KMS, navbatlar, voqealar shinalari, boshqariladigan DB, tahliliy servislar, artefakt registrlari.

4) Ichki kirish va muvozanatlash

Internal Load Balancer (ILB) L4/7 uchun, biz faqat shaxsiy kichik tarmoqlardan ko’ramiz.

• ’Service’ turi’LoadBalancer’internal-annotatsiyalar bilan.
• Shaxsiy manzilda Internal Ingress (Nginx/Contour/Gateway API) orqali kirish.
• API Gateway (private): bekendlarga shaxsiy integratsiya; tashqariga - agar kerak bo’lsa, faqat edge orqali.

Misol: K8s Ingress ichki

yaml apiVersion: networking. k8s. io/v1 kind: Ingress metadata:
name: api-internal annotations:
kubernetes. io/ingress. class: "nginx"
alb. ingress. kubernetes. io/scheme: internal # or provider equivalent spec:
rules:
- host: api. internal. corp http:
paths:
- path: /v1/
pathType: Prefix backend:
service:
name: api port: { number: 8080 }

5) Egress-kontur: «default - deny»

• NAT Gateway (yangilanishlar/repozitoriyalar uchun) + FQDN/IP bo’yicha egress allowlist;
• TLS inspeksiyasi/proxy, agar siyosatchilar nazoratni talab qilsa;
• NAT oʻrniga PaaS/registrlarga Private endpoints.
• SG/NACL: aniq ruxsatnomalar per-servis, «sharq-g’arbga» - minimal.
• Egress-siyosat K8s (CNI/OPA Gatekeeper/Calico NetworkPolicy) - tashqi IP, klaster/endpoynt ruxsatnomalarini taqiqlash.

6) DNS: split-horizon и private zones

Ichki zonalarni ajrating (’.internal. corp’) va ommaviy.
Private DNS zones provayder xizmatlari uchun: ochiq nomlar (masalan,’bucket. s3. region. amazonaws. com’) shaxsiy A/AAAA yozuvlariga.
Forwarders/Conditional DNS между on-prem ↔ cloud.
Nomlar formati: muhit/mintaqani inkapsulatsiya qiling (’api. eu1. internal. corp’), PII dan qoching.

api. internal. corp. A  10. 20. 30. 40 s3. bucket. corp. A  10. 100. 0. 25 # via private endpoint

7) Tarmoqlararo aloqalar patternlari

Peering (VPC, VPC/VNet, VNet): oddiy va tezkor; tranzit har doim ham qo’llab-quvvatlanmaydi → Transit Gateway/Virtual WAN/Cloud Router dan yulduz (hub-and-spoke) uchun foydalaning.
On-prem ⇄ cloud: start uchun IPsec VPN, so’ngra BGP va zaxira (ikkita provayder, turli kirish nuqtalari) bilan ajratilgan liniya (DC/ER/IC).
VRF/Route-domain segmentatsiyasi: prod/stage/dev va kartochka perimetri izolyatsiyasi.

8) Zero Trust va ichki autentifikatsiya

mTLS - andoza (service mesh: Istio/Linkerd/Consul), mashina identifikatsiyasi: SPIFFE/SPIRE.
L7 siyosati: JWT/claims/scopes boʻyicha avtorizatsiya, proksi darajasida marshrutlarni/usullarni cheklash.
Secrets: HashiCorp Vault/КMS + External Secrets Operator; qisqa yashaydigan kredenshellar (STS).
Bastion/Privileged Access: maxfiylikka faqat broker/JIT sessiyasi (MFA, buyruqlar yozuvi) orqali kirish.

Misol: Envoy filtri mTLS + JWT-authz (parcha)

yaml transport_socket:
name: tls typed_config: {... spiffe://svc. api... }
http_filters:
- name: envoy. filters. http. jwt_authn typed_config:
providers:
oidc: { issuer: https://idp. corp, audiences: ["api"], remote_jwks: {...} }
rules: [{ match: { prefix: "/v1" }, requires: { provider_name: oidc } }]

9) Privatka ichidagi ma’lumotlar va PaaS

Baza/klastyerlar: faqat shaxsiy manzillar; bastion/JIT orqali adminka.
Saqlash joylari: private endpoint orqali VPCdan foydalanish; endpoint policy faqat kerakli baketalar/konteynerlarga ruxsat beradi.
Navbatlar/shinalar: shaxsiy interfeyslar; prodyuserlar/konsumerlar - xuddi shu VPC/peeringda.
Artefaktlar registrlari: Shaxsiy tarmoqlardagi CI/CD runners’dan shaxsiy foydalanish.

10) Xususiy tarmoqlarda kuzatish

OpenTelemetry Collector - telemetriya shlyuzi sifatida: ichki eksport qiluvchilar - self-hosted (Prometheus/Tempo/Loki/ClickHouse) yoki boshqariladigan backends - private endpoints.
Flow logs/NSG/NACL logs va reachability analyzer - majburiy.
SLO-parchalar:’site/region/vpc/subnet’, egress va kutilmagan «internet yo’nalishi» uchun alertlar.

11) Test sinovi va verifikatsiya

Tarmoq qoidalari/Ingress/Service uchun Policy as Code (OPA/Gatekeeper).
Canary-yo’nalishlar: private DNS test domenlari, turli kichik tarmoqlardan/AZ/mintaqalardan synthetic-tekshiruvlar.
Chaos-tarmoq: o’zaro VPC/o’zaro AZ (netem/Toxiproxy) dagi kechikishlar/yo’qotishlar, taymautlarni tekshirish va retry-siyosat.

12) Konfiguratsiya namunalari

12. 1 Terraform: belgilar va yo’nalishlar (g’oya)

hcl resource "aws_route_table" "app" {
vpc_id = aws_vpc. core. id tags = { Name = "rt-app", env = var. env, zone = "private" }
}
Route on PrivateLink endpoint (interface endpoint is created separately)
resource "aws_vpc_endpoint_route_table_association" "s3" {
route_table_id = aws_route_table. app. id vpc_endpoint_id = aws_vpc_endpoint. s3. id
}

12. 2 K8s NetworkPolicy: kerakli narsadan tashqari hamma narsani taqiqlash

yaml apiVersion: networking. k8s. io/v1 kind: NetworkPolicy metadata: { name: deny-all }
spec:
podSelector: {}
policyTypes: ["Ingress","Egress"]
kind: NetworkPolicy metadata: { name: allow-core }
spec:
podSelector: { matchLabels: { app: api } }
egress:
- to:
- namespaceSelector: { matchLabels: { ns: db } }
ports: [{ port: 5432, protocol: TCP }]
- to:
- ipBlock: { cidr: 10. 100. 0. 0/16 }  # private endpoints ports: [{ port: 443, protocol: TCP }]

12. 3 Nginx Ingress (internal scheme) + HSTS

yaml metadata:
annotations:
alb. ingress. kubernetes. io/scheme: internal nginx. ingress. kubernetes. io/hsts: "true"

13) Antipatternlar

Xususiy kichik tarmoqlardan umumiy «management-internet»; egress-nazoratning yo’qligi.
Split-breyn DNS va tasodifiy qoʻl ’/etc/hosts’.
Kesishuvchi CIDR va «NAT-matryoshkalar».
«Qulaylik uchun» ma’lumotlar bazasi uchun ochiq endpoint’lar.
Qoidalar oqimi/audit loglarining yo’qligi; «ochiq» SG’0. 0. 0. 0/0`.
Kodda uzoq umr koʻradigan statik ulanish kalitlari/CI.

14) Qiymati va unumdorligi

Private endpoints ko’pincha doimiy NAT egress va xavfsizroq arzonroq.
Bottleneck yaratmaslik uchun/az-local NAT klasterlarini rejalashtiring.
Kesh/edge va SWR xoch-mintaqaviy trafikni kamaytiradi.
Protokollarni tanlash: HTTP/2/gRPC ichida → kamroq ulanish va TLS overhead.

15) iGaming/Moliya xususiyatlari

PCI DSS: alohida tarmoqdagi kartochka konturi (CDE )/VRF, internet yo’q; stor/PSP-loglarga faqat private endpoints orqali kirish; o’zgarmas auditlar (WORM/Object Lock).
KMS/Vault: kalitlar segmentlangan per region/brend; imzo operatsiyalari (HSM) faqat mTLS uchun CDE dan mavjud.
PSP/KYC: agar private connectivity/market mavjud boʻlsa, undan foydalaning; aks holda - egress HMAC/mTLS va aniq allowlist bilan ishonchli proksi orqali.
Multi-tenantlik: teglar va siyosatlar’tenant ’/’ brand’; alohida private DNS nomlari va SG qatlamlari.

16) Prod-tayyorlik chek-varaqasi

• Kesishmasdan CIDR rejasi; dual-stack tayyor (IPv6).
• Hub-and-Spoke, Transit, peering; on-prem ⇄ cloud - BGP, zaxira link juftliklari.
• Barcha PaaS/saqlovchilar/DB - private endpoints + endpoint policies orqali.
• Internal LB/Ingress; ochiq perimetr - faqat edge/WAF da.
• Split-horizon DNS, private zones va conditional-forwarding moslashtirilgan.
• Egress andoza «deny»; NAT/proksi cheklangan va jurnallashtiriladi.
• Mesh mTLS + SPIFFE; JWT-authz L7; Vault/ESO, qisqa sirlar.
• NetworkPolicy/SG/NACL - «minimal zarur», flow-logs va reachability-tahlil.
• ichida OTel Collector; egress, SLO’site/region/vpc’bo’yicha sizib chiqish alertlari.
• PCI/audit: WORM jurnallari, KMS/HSM, izolyatsiya CDE, kirish runbook.

17) TL; DR

Aniq CIDR rejali hub-and-spoke sxemasi boʻyicha tarmoqni quring, har bir PaaS/saqlash/DB uchun private endpoints-dan foydalaning, tashqi trafikni esa faqat boshqariladigan egress nuqtalari orqali amalga oshiring. Ichkarida - internal LB/Ingress, mTLS + SPIFFE, split-horizon DNS, qattiq NetworkPolicy/SG va OTel orqali telemetriya. iGaming/moliya uchun PCI segmentatsiyasi, KMS/Vault va o’zgarmas auditni qo’shing; PSP/KYC’ni shaxsiy kanallar yoki qattiq boshqariladigan proksi orqali chiqaring.