Cloud, NFV, containers, and multi-tenancy
Cloud-native LI separates a provider control plane, service-plane points, mediation, evidence, and operations across software-defined infrastructure. Shared platforms can improve resilience but create insider, metadata leakage, snapshot, backup, and jurisdiction risks.
Safety boundary: this chapter teaches lawful, governed system design from public standards. It does not provide operational targeting, activation, decryption, surveillance-evasion, or covert collection instructions.
The mental model
| Concept | Plain meaning | Control that must travel with it |
|---|---|---|
| NFV/CNF | Network functions run as software on shared infrastructure | Platform admins are a new trust domain |
| Control-plane isolation | LI administration uses dedicated identities, networks, and policy | Namespace labels alone are insufficient |
| Secret workload identity | Functions authenticate without shared static credentials | Rotation and revocation must not reveal target state |
| Ephemeral compute | Instances are replaceable and stateless where possible | Sensitive buffers, crash dumps, and disks still need handling |
| Multi-tenancy | Infrastructure serves many customers or operators | Case metadata must not cross tenant or support boundaries |
| Data residency | Processing and backups stay in approved locations | Autoscaling and disaster recovery can move data |
Apply it as a controlled workflow
- Create separate trust zones for provider platform, LI control, observation, mediation, and audit.
- Use dedicated workload identities, network policy, encrypted storage, and narrow operator roles.
- Disable or govern snapshots, debugging, memory dumps, and support access.
- Keep case details out of labels, metrics, traces, billing, and general logs.
- Test node loss, rescheduling, backup, restore, region failover, and forensic acquisition.
- Prove deletion and key retirement across active, backup, and replicated stores.
Evidence to demand
- Cloud control-plane logs can be reviewed without revealing target identifiers.
- Platform support cannot attach debuggers to sensitive workloads by default.
- Residency policy is enforced in placement and restore workflows.
- A compromised tenant cannot infer LI activity through shared resource side channels.
Failure to reason about
An autoscaler metric is named with a case identifier. A general cloud operator cannot read content but can infer who is under surveillance. Treat metadata as sensitive and use opaque operational identifiers.
Feynman check
Cloud computers are rented rooms in a huge building. Locks, keys, cleaners, cameras, backup storage, and emergency moves all need rules—not just the application door.