INFINI Console Network Segmentation and Security Architecture for Managed Clusters

INFINI Console isolates each managed cluster behind a dedicated reverse-proxy with TLS-encrypted WebSocket tunnels, per-instance configuration isolation, and role-based access controls that enforce least-privilege permissions for both console users and ingest agents.

INFINI Console (infinilabs/console) treats every managed cluster—referred to as an instance—as an isolated endpoint, routing all traffic through a centralized managed-server plugin that acts as a secure reverse-proxy. The architecture enforces network segmentation by maintaining separate configuration namespaces and encrypted communication channels for each cluster, ensuring that cross-cluster data leakage is architecturally impossible.

Managed Server Plugin Architecture

The managed-server plugin serves as the single entry point for all agent-to-console communication. Imported automatically in main.go via _ "infini.sh/console/plugin/managed", the plugin initializes a WebSocket proxy endpoint during its init() function in plugin/managed/server/manager.go.

Per-Instance Reverse Proxy Registration

The plugin registers a centralized proxy handler at /ws_proxy that dynamically builds reverse-proxies targeting specific instances:

api.HandleAPIFunc("/ws_proxy", func(w http.ResponseWriter, req *http.Request) {
    // Build a reverse‑proxy to the target instance …
    wsProxy := NewSingleHostReverseProxy(target)
    wsProxy.Dial = (&net.Dialer{
        Timeout:   30 * time.Second,
        KeepAlive: 30 * time.Second,
    }).Dial
    wsProxy.TLSClientConfig = tlsConfig
    wsProxy.ServeHTTP(w, req)
})

This design ensures all HTTP requests reach managed clusters through a single, audited exit point, preventing direct network access between agents and enabling centralized traffic inspection.

WebSocket Reverse Proxy and TLS Encryption

The ReverseProxy implementation in plugin/managed/server/websocket_proxy.go handles secure wss (WebSocket Secure) tunnels and transport-layer hardening.

TLS and Certificate Handling

When the target scheme is wss, the proxy applies custom TLS configurations. While development builds default to InsecureSkipVerify: true, production deployments can override this with strict certificate validation:

if outreq.URL.Scheme == "wss" {
    var tlsConfig *tls.Config
    if p.TLSClientConfig == nil {
        tlsConfig = &tls.Config{InsecureSkipVerify: true}
    } else {
        tlsConfig = p.TLSClientConfig
    }
    dial = func(network, address string) (net.Conn, error) {
        return tls.Dial("tcp", host, tlsConfig)
    }
}

The proxy also sanitizes headers by injecting X‑Forwarded‑For to preserve the original client IP downstream, and hijacks the HTTP connection to forward raw WebSocket frames—preventing accidental HTTP handling that could expose internal state.

Per-Instance Configuration and Secret Isolation

Network segmentation extends beyond transport security to data isolation. Each managed cluster maintains its own configuration files and encrypted secrets, stored in separate maps within plugin/managed/server/config.go:

var instanceConfigFiles = map[string][]string{}
var instanceSecrets    = map[string][]common.Secrets{}

Instance-Specific Config Loading

The getConfigsForInstance function filters the global configuration repository, returning only files tagged with the requesting instance's ID. Each returned configuration is marked as Managed = true, ensuring the agent cannot access console-wide or other clusters' settings:

// getConfigsForInstance loads only files belonging to the requesting instance
// Source: plugin/managed/server/config.go

Similarly, getSecretsForInstance retrieves keystore entries exclusively associated with the instance, preventing credential cross-contamination between managed clusters.

Credential Management and Optional mTLS

Authentication between agents and the console relies on a shared credential secret combined with optional mutual TLS (mTLS) for certificate-based identity verification.

Hashed Credential Storage

During the setup phase in service/setup/setup.go, the installer supplies a credential secret that is hashed using MD5 with salt and stored in the keystore via credential.InitSecret. The console verifies this hash on every agent request, rejecting unauthenticated connections before they reach the proxy layer.

mTLS Client Configuration

For environments requiring certificate-based authentication, the console supports per-tag HTTP client configurations through global.Env().GetHTTPClientConfig. When a TLS configuration is present, the system constructs an http.Client with embedded certificates:

cfg := global.Env().GetHTTPClientConfig(tag, endpoint)
if cfg != nil {
    hClient, err := api.NewHTTPClient(cfg)
    mTLSClient = hClient
}

This allows different managed clusters to use distinct client certificate pairs, enforcing zero-trust network segmentation at the transport layer.

Least-Privilege Access Control for Ingest Agents

When provisioning ingest users for Easysearch-backed clusters, the console creates restricted roles that limit agents to writing only metric and log indices prefixed by the instance's unique indexPrefix. The role template in service/setup/setup.go explicitly denies broad cluster access:

roleTpl := `{
    "cluster": ["cluster_monitor","cluster_composite_ops"],
    "indices": [{
        "names": ["%slogs*", "%smetrics*"],
        "privileges": ["create_index","index","manage_aliases","write"]
    }]
}`
roleBody := fmt.Sprintf(roleTpl, indexPrefix, indexPrefix)
client.PutRole(username, []byte(roleBody))

This least-privilege approach ensures that even if an agent credential is compromised, the attacker cannot read historical data or access indices belonging to other managed clusters.

RBAC and Realm-Based Authorization

Console users (administrators and operators) authenticate through a pluggable realm system implemented in modules/security/realm/realm.go. The system aggregates authentication results from native, LDAP, or OAuth realms, applying role checks before any API call reaches the managed-server logic.

The realm stack validates permissions against the request context, ensuring that only authorized users can trigger proxy requests to sensitive endpoints like /instance/:id/_proxy. This separates console authentication (realm-based) from agent authentication (credential secret/mTLS), creating defense-in-depth for the network segmentation boundary.

Request Flow Implementation

The following patterns demonstrate how the security layers interact when registering and communicating with managed clusters.

Registering a New Managed Instance

Agents register via POST /instance, handled in plugin/managed/server/instance.go:

// POST /instance
obj := &model.Instance{}
h.DecodeJSON(req, obj)           // JSON payload from agent
res, err := h.getInstanceInfo(obj.Endpoint, obj.BasicAuth)
obj.ID = res.ID                  // server‑generated UUID
orm.Create(nil, obj)             // persisted in INFINI Console DB

Proxying Requests with BasicAuth

When forwarding user requests to a specific cluster, the console retrieves the instance record and injects stored credentials:

// POST /instance/:instance_id/_proxy
instanceID := ps.MustGetParameter("instance_id")
_, obj, _ := GetRuntimeInstanceByID(instanceID)

req1 := &util.Request{
    Method:  h.Get(req, "method", "GET"),
    Path:    h.Get(req, "path", ""),
    Context: ctx,
    Body:    reqBody,
}
if obj.BasicAuth != nil {
    req1.SetBasicAuth(obj.BasicAuth.Username, obj.BasicAuth.Password.Get())
}
res, _ := ProxyAgentRequest("runtime", obj.GetEndpoint(), req1, nil)

All traffic flows through the WebSocket proxy, maintaining end-to-end encryption and per-instance isolation throughout the request lifecycle.

Summary

• Network segmentation is enforced by the managed-server plugin, which acts as a dedicated reverse-proxy for each cluster in plugin/managed/server/manager.go.
• Transport security uses TLS-encrypted WebSocket tunnels (wss) configured in plugin/managed/server/websocket_proxy.go, with optional mTLS support via per-tag HTTP clients.
• Data isolation guarantees that configuration files and secrets are stored in separate maps per instance, accessible only through getConfigsForInstance and getSecretsForInstance in plugin/managed/server/config.go.
• Agent authentication relies on MD5-hashed credential secrets verified during the setup phase in service/setup/setup.go.
• Least-privilege access restricts ingest agents to write-only operations on prefixed indices, preventing cross-cluster data access.
• Console authorization uses a pluggable realm system in modules/security/realm/realm.go to enforce RBAC before proxying requests to managed clusters.

Frequently Asked Questions

How does INFINI Console isolate network traffic between managed clusters?

INFINI Console isolates traffic by routing all communication through a centralized reverse-proxy in plugin/managed/server/manager.go. Each managed cluster registers as a separate instance with its own endpoint configuration, and the proxy maintains distinct TLS contexts and connection pools per target. Configuration files and secrets are stored in isolated maps keyed by instance ID, ensuring no data sharing occurs between clusters.

What encryption protocols does INFINI Console use for agent communication?

All agent-to-console communication uses HTTPS or wss (WebSocket Secure) protocols. The websocket_proxy.go implementation enforces TLS encryption for all outbound connections, with configurable certificate validation. For enhanced security, administrators can enable mTLS by providing client certificates through the GetHTTPClientConfig system, allowing the console to present certificates during the TLS handshake.

How are credentials stored and verified in INFINI Console?

During initial setup, the console stores a credential secret as a salted MD5 hash in the keystore via credential.InitSecret in service/setup/setup.go. Agents must present this secret with each request, which the console validates against the stored hash before allowing proxy access. This mechanism operates independently of the realm-based user authentication used for console administrators.

Can INFINI Console enforce mTLS between the console and managed clusters?

Yes. The console supports mutual TLS (mTLS) through the global.Env().GetHTTPClientConfig interface. Administrators can configure per-tag TLS settings that include client certificates, which the api.NewHTTPClient function uses to construct authenticated HTTP clients. When enabled, the console presents client certificates to managed clusters during connection establishment, enabling certificate-based identity verification at the network layer.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}