Hybrid Boundaries: Modeling On-Prem and Cloud as One System

Why this matters

A service moves to cloud while its database stays on-prem, connected by a tunnel nobody diagrammed. Latency doubles, the firewall team sees unexplained flows, and the first incident finds three teams with three different maps. The boundary was crossed without being designed: no inventory of crossing flows, no checkpoint, no owner. Hybrid failures are boundary failures, and boundaries need models before they need tunnels.

Concepts

A boundary changes three things at once. Network: address spaces that may overlap, DNS that resolves differently per side, paths through proxies and gateways instead of direct routes. Trust: credentials valid on one side mean nothing on the other until federated or reissued. Operations: different change windows, different on-call rotations, different monitoring. The model names all three per flow, or the flow crosses unmanaged.

Crossing flows are allow-listed explicitly: this service to that database on this port through this checkpoint with this identity. The L63 lab picks required egress flows against a fixture allowlist and tests them; everything else denies by default. The allowlist is the design artifact: reviewed, versioned, minimal. A flow not on the list does not exist, and its failure is the policy working, not an outage.

Identity crosses deliberately. Workload identity per side (service accounts, roles) with federation or issuance at the boundary beats shared long-lived keys spanning both estates. Short lifetimes limit the blast radius of a captured credential; audit at the checkpoint records who crossed, when, for what. Keys that span the boundary are the hybrid version of the shared cluster-admin from M17: convenient, total, and eventually incident-defining.

Worked example

A fixture models two sides (lab-east namespace, lab-west namespace) with a checkpoint proxy between them. The learner lists the three allowed flows, tests each through the checkpoint, and shows a fourth flow denied with the policy quoted. The topology diagram labels every element fictional; the allowlist mechanics are the real lesson.

Common wrong move

Flattening the boundary: one network, one credential set, both estates. It works until the first compromise or the first compliance review, and then the flattening is the finding. Boundaries are designed, not discovered.