Bảo mật, HA, Load Balance & Hiệu năng

CRITICAL/HIGH đã fix

100%

Service có healthz

Tier load test

DLQ+Retry

Event bus

1. Bảo mật (Security)

JWT + RBAC action-based với project isolation; MFA TOTP + backup codes; refresh-token rotation chống reuse.
PBKDF2 hashing cho API key & token; service principals cho M2M, TTL giới hạn.
Centralized auth tại API Gateway: mọi request đều qua middleware validate.
Path traversal protection cho object-storage (regex whitelist + resolved path containment).
Command-injection protection ở compute exec, git clone, docker build args (regex whitelist + reject metacharacters).
File permission 0600 cho metadata nhạy cảm.
Audit log tập trung qua audit-service; policy-service theo OPA-style.

#	Hạng mục	Mức	Hành động
1	Per-user + per-endpoint rate limit	MEDIUM	Bổ sung middleware token-bucket trong gateway
2	JWT key rotation (multi-key kid)	MEDIUM	Hỗ trợ JWKS với 2 key active đồng thời
3	Audit cho thao tác API key	LOW	Bắn event qua audit-service
4	Redact secrets trong build log	LOW	Mask URL có credentials trước khi ghi

Stateless services — toàn bộ 72 service Go scale ngang; persistent state nằm ở Postgres/Redis/RabbitMQ/Object Storage.
Health probes — mọi service expose /healthz; Docker Compose & K8s readiness/liveness.
Postgres HA — postgres-service & alloydb-service hỗ trợ streaming replication, automated failover.
RabbitMQ DLQ + retry — package events tự động retry, dead-letter để không mất event billing.
Container Health Monitor — auto-restart container unhealthy (monitor-service).
Multi-region — global-lb-service routing geo/latency, xem MULTI-REGION.md.
Backup & snapshot — backup-service, snapshot-service, gke-backup-service cho VM/PV/etcd.

Lớp	Dịch vụ	Tính năng
Edge global	global-lb-service	Geo + latency routing, fail-over region
L7 ứng dụng	load-balancer-service · waf-service	HTTP routing, sticky session, WAF rules, rate-limit
L4 transport	load-balancer-service	TCP/UDP target groups, health checks
Service-to-service	API Gateway / DNS-SRV	Round-robin, header-based, retries
K8s ingress	cluster-bootstrap addons	Nginx/Envoy ingress controller, TLS termination

DB pool tuning — GORM pool 30 max / 10 idle/service (package dbconnector).
Cache layer — Redis cho session/auth + cache-service cho CDN-style invalidation.
Build cache — git-deploy: SHA-256 cache key trên lockfile, restore/save node_modules/.next/.pip_cache/.gomod_cache.
Streaming I/O — object-storage Get/Put streaming, không buffer toàn bộ.
Edge caching — cdn-service + cache-service multi-region.
Async processing — billing & audit qua RabbitMQ, không block request path.

Test	File	Mục tiêu
All services smoke	`tests/load-test/all-services-load.js`	Phủ ramp 50→500 VU, tất cả endpoint healthz
Gateway	`tests/load-test/gateway-load.js`	Stress đường vào
Compute stress	`tests/load-test/compute-stress.js`	Tạo/xóa instance đồng thời
Database	`tests/load-test/database-load.js`	CRUD bursts qua DB-engine
Network	`tests/load-test/network-load.js`	Provision VPC/SG ở concurrency cao
Security services	`tests/load-test/security-load.js`	WAF/DDoS/IAM tải đồng thời
New services	`tests/load-test/new-services-load.js`	AI/Vector/Spanner/AlloyDB

tests/security/run-security-scan.sh & .ps1 — scan tự động (gosec, trivy, semgrep). Báo cáo lưu tests/security/reports.
tests/integration/pentest_test.go — bộ test pentest tích hợp (auth bypass, IDOR, SQLi, command-injection probe).
tests/integration/security_services_test.go — kiểm tra rule WAF/DDoS/Firewall áp đúng.