@xdev-asia/xdev-knowledge-mcp 1.0.39 → 1.0.41

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (21) hide show
  1. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/01-phan-1-kien-truc-nen-tang/lessons/04-bai-4-threat-modeling-stride-dread.md +41 -52
  2. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/02-phan-2-iam-keycloak/lessons/01-bai-5-setup-keycloak-realm-benh-vien.md +33 -84
  3. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/02-phan-2-iam-keycloak/lessons/02-bai-6-phan-quyen-rbac-abac.md +6 -23
  4. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/02-phan-2-iam-keycloak/lessons/03-bai-7-smart-on-fhir-oauth2-oidc.md +25 -36
  5. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/02-phan-2-iam-keycloak/lessons/04-bai-8-mfa-passkeys-emergency-access.md +7 -23
  6. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/03-phan-3-data-layer-postgresql/lessons/01-bai-9-postgresql-security-hardening.md +23 -69
  7. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/03-phan-3-data-layer-postgresql/lessons/02-bai-10-ma-hoa-du-lieu-postgresql.md +25 -80
  8. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/03-phan-3-data-layer-postgresql/lessons/03-bai-11-row-level-security-column-encryption.md +26 -55
  9. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/03-phan-3-data-layer-postgresql/lessons/04-bai-12-audit-logging-cdc-pgaudit.md +51 -87
  10. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/04-phan-4-microservices-quarkus/lessons/03-bai-15-ma-hoa-end-to-end-microservices.md +18 -63
  11. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/04-phan-4-microservices-quarkus/lessons/04-bai-16-mtls-service-mesh.md +26 -88
  12. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/05-phan-5-compliance-audit/lessons/01-bai-17-hipaa-technical-safeguards.md +50 -61
  13. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/05-phan-5-compliance-audit/lessons/02-bai-18-audit-trail-opentelemetry-elk.md +11 -34
  14. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/05-phan-5-compliance-audit/lessons/03-bai-19-data-masking-anonymization.md +113 -223
  15. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/05-phan-5-compliance-audit/lessons/04-bai-20-backup-disaster-recovery.md +92 -149
  16. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/06-phan-6-production-van-hanh/lessons/01-bai-21-zero-trust-architecture.md +126 -271
  17. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/06-phan-6-production-van-hanh/lessons/02-bai-22-container-kubernetes-security.md +10 -52
  18. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/06-phan-6-production-van-hanh/lessons/03-bai-23-penetration-testing.md +51 -90
  19. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/06-phan-6-production-van-hanh/lessons/04-bai-24-capstone-deploy-production.md +137 -232
  20. package/data/settings.json +2 -1
  21. package/package.json +1 -1
package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/04-phan-4-microservices-quarkus/lessons/04-bai-16-mtls-service-mesh.md CHANGED
@@ -33,61 +33,26 @@ mTLS và Service Mesh giải quyết tất cả các vấn đề trên.
33
33
 
34
34
  ### 1.1. Defense-in-Depth cho Inter-Service Communication
35
35
 
36
- ```
37
- ┌─────────────────────────────────────────────────────────────┐
38
- │ Secure Inter-Service Communication Layers │
39
- │ │
40
- │ Layer 1: Network Policies (Kubernetes) │
41
- │ ├── Namespace isolation │
42
- │ ├── Pod-to-pod firewall rules │
43
- │ └── Egress restrictions │
44
- │ │
45
- │ Layer 2: mTLS (Istio Service Mesh) │
46
- │ ├── Automatic certificate provisioning │
47
- │ ├── Certificate rotation (24h default) │
48
- │ └── Mutual authentication (both sides verified) │
49
- │ │
50
- │ Layer 3: Authorization Policies (Istio) │
51
- │ ├── Service-to-service access control │
52
- │ ├── Path-based authorization │
53
- │ └── JWT claim-based policies │
54
- │ │
55
- │ Layer 4: Application Security (Quarkus) │
56
- │ ├── JWT validation │
57
- │ ├── RBAC (@RolesAllowed) │
58
- │ └── Business logic authorization │
59
- │ │
60
- │ Layer 5: Payload Encryption (JWE) │
61
- │ ├── Field-level encryption │
62
- │ └── End-to-end encryption │
63
- └─────────────────────────────────────────────────────────────┘
64
- ```
36
+ ![5 Security Layers cho Inter-Service Communication — Network → mTLS → AuthZ → JWT → Encryption](/storage/uploads/2026/04/healthcare-service-communication-layers.png)
37
+
38
+ **5 lớp bảo vệ:**
39
+
40
+ - **Layer 1**: Network Policies (Kubernetes) — Namespace isolation, pod-to-pod firewall, egress restrictions
41
+ - **Layer 2**: mTLS (Istio) — Auto certificate provisioning, rotation 24h, mutual authentication
42
+ - **Layer 3**: Authorization Policies (Istio) — Service-to-service ACL, path-based, JWT claim-based
43
+ - **Layer 4**: Application Security (Quarkus) — JWT validation, RBAC, business logic authorization
44
+ - **Layer 5**: Payload Encryption (JWE) — Field-level encryption, end-to-end encryption
65
45
 
66
46
  ### 1.2. mTLS vs One-Way TLS
67
47
 
68
- ```
69
- ┌─────────────────────────────────────────────────────────┐
70
- │ One-Way TLS (Standard HTTPS) │
71
- │ │
72
- │ Client ──────────────────────────► Server │
73
- │ ◄── Server Certificate ──┘ │
74
- │ │
75
- │ • Client verifies server identity │
76
- │ • Server does NOT verify client │
77
- │ • Any client can connect │
78
- │ │
79
- ├─────────────────────────────────────────────────────────┤
80
- │ Mutual TLS (mTLS) │
81
- │ │
82
- │ Client ──── Client Certificate ──► Server │
83
- │ ◄── Server Certificate ──┘ │
84
- │ │
85
- │ • Client verifies server identity ✓ │
86
- │ • Server verifies client identity ✓ │
87
- │ • Both sides authenticated │
88
- │ • Encrypted channel established │
89
- └─────────────────────────────────────────────────────────┘
90
- ```
48
+ ![So sánh One-Way TLS vs Mutual TLS (mTLS)](/storage/uploads/2026/04/healthcare-tls-comparison.png)
49
+
50
+ | | One-Way TLS | Mutual TLS (mTLS) |
51
+ |---|---|---|
52
+ | Client verify server | ✓ | ✓ |
53
+ | Server verify client | ✗ | ✓ |
54
+ | Kết nối | Any client có thể connect | Cả hai đều authenticated |
55
+ | Kênh truyền | Encrypted | Encrypted + verified |
91
56
 
92
57
  ## 2. mTLS Configuration trong Quarkus
93
58
 
@@ -441,42 +406,15 @@ istioctl analyze -n healthcare
441
406
 
442
407
  ### 4.2. Istio Architecture với Healthcare Services
443
408
 
444
- ```
445
- ┌─────────────────────────────────────────────────────────────┐
446
- │ Kubernetes Cluster │
447
- │ │
448
- │ ┌────────────────── istio-system ─────────────────────┐ │
449
- │ │ istiod (control plane) │ │
450
- │ │ ├── Certificate Authority (Citadel) │ │
451
- │ │ ├── Configuration (Pilot) │ │
452
- │ │ └── Telemetry (Mixer replacement) │ │
453
- │ └──────────────────────────────────────────────────────┘ │
454
- │ │
455
- │ ┌────────────────── healthcare ───────────────────────┐ │
456
- │ │ │ │
457
- │ │ ┌──────────────────────────────────────────────┐ │ │
458
- │ │ │ Pod: patient-service │ │ │
459
- │ │ │ ┌───────────────┐ ┌────────────────────────┐│ │ │
460
- │ │ │ │ Envoy Proxy │ │ patient-service ││ │ │
461
- │ │ │ │ (sidecar) │◄►│ (Quarkus container) ││ │ │
462
- │ │ │ │ │ │ ││ │ │
463
- │ │ │ │ - mTLS │ │ - Business logic ││ │ │
464
- │ │ │ │ - Auth policy │ │ - JWT validation ││ │ │
465
- │ │ │ │ - Telemetry │ │ - RBAC ││ │ │
466
- │ │ │ └───────────────┘ └────────────────────────┘│ │ │
467
- │ │ └──────────────────────────────────────────────┘ │ │
468
- │ │ ^ mTLS v │ │
469
- │ │ ┌──────────────────────────────────────────────┐ │ │
470
- │ │ │ Pod: lab-service │ │ │
471
- │ │ │ ┌───────────────┐ ┌────────────────────────┐│ │ │
472
- │ │ │ │ Envoy Proxy │ │ lab-service ││ │ │
473
- │ │ │ │ (sidecar) │◄►│ (Quarkus container) ││ │ │
474
- │ │ │ └───────────────┘ └────────────────────────┘│ │ │
475
- │ │ └──────────────────────────────────────────────┘ │ │
476
- │ │ │ │
477
- │ └──────────────────────────────────────────────────────┘ │
478
- └─────────────────────────────────────────────────────────────┘
479
- ```
409
+ ![Istio Service Mesh Architecture cho Healthcare — istiod + Envoy sidecars](/storage/uploads/2026/04/healthcare-istio-mesh.png)
410
+
411
+ **Architecture:**
412
+
413
+ - **istio-system**: istiod control plane (Citadel CA, Pilot config, Telemetry)
414
+ - **healthcare namespace**: Pods với Envoy sidecar proxies
415
+ - Patient Service + Envoy (mTLS, auth policy, telemetry)
416
+ - Lab Service + Envoy
417
+ - Tất cả traffic giữa services đi qua Envoy → mã hóa mTLS tự động
480
418
 
481
419
  ### 4.3. PeerAuthentication - STRICT mTLS
482
420
 
package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/05-phan-5-compliance-audit/lessons/01-bai-17-hipaa-technical-safeguards.md CHANGED
@@ -23,41 +23,33 @@ course:
23
23
 
24
24
  ![HIPAA Security Rule — Administrative, Physical, Technical Safeguards](/storage/uploads/2026/04/healthcare-hipaa-security-rule.png)
25
25
 
26
-
27
26
  HIPAA Security Rule yêu cầu các tổ chức xử lý ePHI (electronic Protected Health Information) phải triển khai **Technical Safeguards** — các biện pháp kỹ thuật bảo vệ dữ liệu y tế điện tử. Đây là phần quan trọng nhất đối với developers và engineers.
28
27
 
29
28
  ### 1.1. Cấu trúc HIPAA Security Rule
30
29
 
31
- ```
32
- ┌─────────────────────────────────────────────────────────────┐
33
- │ HIPAA Security Rule §164.302-318 │
34
- │ │
35
- │ §164.308 Administrative Safeguards │
36
- │ ├── Risk Analysis │
37
- │ ├── Workforce Security │
38
- │ ├── Information Access Management │
39
- │ ├── Security Awareness Training │
40
- │ ├── Security Incident Procedures │
41
- │ ├── Contingency Plan │
42
- │ └── Evaluation │
43
- │ │
44
- │ §164.310 Physical Safeguards │
45
- │ ├── Facility Access Controls │
46
- │ ├── Workstation Use & Security │
47
- │ └── Device and Media Controls │
48
- │ │
49
- │ §164.312 Technical Safeguards ◄── BÀI NÀY │
50
- │ ├── Access Control (§164.312(a)) │
51
- │ ├── Audit Controls (§164.312(b)) │
52
- │ ├── Integrity Controls (§164.312(c)) │
53
- │ ├── Person/Entity Authentication (§164.312(d)) │
54
- │ └── Transmission Security (§164.312(e)) │
55
- │ │
56
- │ §164.314 Organizational Requirements │
57
- │ ├── Business Associate Agreements (BAA) │
58
- │ └── Group Health Plan Requirements │
59
- └─────────────────────────────────────────────────────────────┘
60
- ```
30
+ **HIPAA Security Rule §164.302-318:**
31
+
32
+ - **§164.308 Administrative Safeguards**
33
+ - Risk Analysis
34
+ - Workforce Security
35
+ - Information Access Management
36
+ - Security Awareness Training
37
+ - Security Incident Procedures
38
+ - Contingency Plan
39
+ - Evaluation
40
+ - **§164.310 Physical Safeguards**
41
+ - Facility Access Controls
42
+ - Workstation Use & Security
43
+ - Device and Media Controls
44
+ - **§164.312 Technical Safeguards** ← **BÀI NÀY**
45
+ - Access Control (§164.312(a))
46
+ - Audit Controls (§164.312(b))
47
+ - Integrity Controls (§164.312(c))
48
+ - Person/Entity Authentication (§164.312(d))
49
+ - Transmission Security (§164.312(e))
50
+ - **§164.314 Organizational Requirements**
51
+ - Business Associate Agreements (BAA)
52
+ - Group Health Plan Requirements
61
53
 
62
54
  ### 1.2. Required vs Addressable
63
55
 
@@ -1221,36 +1213,33 @@ fi
1221
1213
 
1222
1214
  Khi sử dụng third-party services (cloud providers, SaaS), BAA yêu cầu các đảm bảo kỹ thuật:
1223
1215
 
1224
- ```
1225
- ┌─────────────────────────────────────────────────────────────┐
1226
- │ BAA Technical Requirements Mapping │
1227
- │ │
1228
- │ Cloud Provider (AWS/GCP/Azure) │
1229
- │ ├── Encryption at rest: AES-256 │
1230
- │ ├── Encryption in transit: TLS 1.2+ │
1231
- │ ├── Access logging: CloudTrail/Cloud Audit Logs │
1232
- │ ├── Data residency: Specify region │
1233
- │ └── Incident notification: ≤ 60 days │
1234
- │ │
1235
- │ Database Service (RDS/Cloud SQL) │
1236
- │ ├── Encrypted storage volumes │
1237
- │ ├── Encrypted backups │
1238
- │ ├── Audit logging enabled │
1239
- │ ├── Network isolation (VPC) │
1240
- │ └── IAM authentication │
1241
- │ │
1242
- │ Monitoring Service (Datadog/New Relic) │
1243
- │ ├── PHI masking before sending │
1244
- │ ├── Data processing agreement │
1245
- │ ├── EU/US data residency │
1246
- │ └── Log retention controls │
1247
- │ │
1248
- │ Email Service (SendGrid/SES) │
1249
- │ ├── TLS enforced │
1250
- │ ├── No PHI in email content │
1251
- │ └── Breach notification capability │
1252
- └─────────────────────────────────────────────────────────────┘
1253
- ```
1216
+ **Cloud Provider (AWS/GCP/Azure):**
1217
+
1218
+ - Encryption at rest: AES-256
1219
+ - Encryption in transit: TLS 1.2+
1220
+ - Access logging: CloudTrail/Cloud Audit Logs
1221
+ - Data residency: Specify region
1222
+ - Incident notification: ≤ 60 days
1223
+
1224
+ **Database Service (RDS/Cloud SQL):**
1225
+
1226
+ - Encrypted storage volumes + backups
1227
+ - Audit logging enabled
1228
+ - Network isolation (VPC)
1229
+ - IAM authentication
1230
+
1231
+ **Monitoring Service (Datadog/New Relic):**
1232
+
1233
+ - PHI masking before sending
1234
+ - Data processing agreement
1235
+ - EU/US data residency
1236
+ - Log retention controls
1237
+
1238
+ **Email Service (SendGrid/SES):**
1239
+
1240
+ - TLS enforced
1241
+ - No PHI in email content
1242
+ - Breach notification capability
1254
1243
 
1255
1244
  ### 8.2. BAA Compliance Verification
1256
1245
 
package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/05-phan-5-compliance-audit/lessons/02-bai-18-audit-trail-opentelemetry-elk.md CHANGED
@@ -331,40 +331,17 @@ public class PatientService {
331
331
 
332
332
  ### 3.1. Correlation ID Architecture
333
333
 
334
- ```
335
- ┌─────────────────────────────────────────────────────────────┐
336
- │ Distributed Tracing - Patient Data Flow │
337
- │ │
338
- │ Client Request │
339
- │ Headers: X-Request-ID: req-abc-123 │
340
- │ traceparent: 00-trace123-span456-01 │
341
- │ │ │
342
- │ ▼ │
343
- │ API Gateway (span-1) │
344
- │ │ trace_id: trace123 │
345
- │ │ span_id: span-gw-001 │
346
- │ │ attributes: {user_id, request_id, client_ip} │
347
- │ │ │
348
- │ ▼ │
349
- │ Patient Service (span-2, parent: span-gw-001) │
350
- │ │ span_id: span-ps-001 │
351
- │ │ attributes: {patient_id, action, department} │
352
- │ │ │
353
- │ ├──► PostgreSQL Query (span-3, parent: span-ps-001) │
354
- │ │ span_id: span-db-001 │
355
- │ │ attributes: {db.statement, db.operation} │
356
- │ │ │
357
- │ ├──► Kafka Publish (span-4, parent: span-ps-001) │
358
- │ │ span_id: span-kafka-001 │
359
- │ │ attributes: {messaging.destination, event_type} │
360
- │ │ │
361
- │ └──► Lab Service REST Call (span-5, parent: span-ps-001) │
362
- │ span_id: span-ls-001 │
363
- │ attributes: {http.method, http.url} │
364
- │ │
365
- │ Trace ID: trace123 liên kết TẤT CẢ spans trong flow │
366
- └─────────────────────────────────────────────────────────────┘
367
- ```
334
+ ![Distributed Tracing — Patient Data Flow qua API Gateway → Patient Service → DB/Kafka/Lab Service](/storage/uploads/2026/04/healthcare-distributed-tracing-flow.png)
335
+
336
+ **Trace Flow:**
337
+
338
+ - **Client Request** với `X-Request-ID` + `traceparent` headers
339
+ - **API Gateway** (span-1) → trace_id, user_id, client_ip
340
+ - **Patient Service** (span-2) → patient_id, action, department
341
+ - PostgreSQL Query (span-3) — db.statement, db.operation
342
+ - Kafka Publish (span-4) — messaging.destination, event_type
343
+ - Lab Service REST Call (span-5) — http.method, http.url
344
+ - **Trace ID** liên kết TẤT CẢ spans trong flow
368
345
 
369
346
  ### 3.2. MDC (Mapped Diagnostic Context) Integration
370
347