Building secure applications that ensure data privacy and security when deployed to a public cloud environment is crucial for businesses that collect customer data, particularly for regulated industries like finance, retail, banking, and others. In this article, I introduce you to an Example Bank application my team built to explore and share approaches for creating secure cloud-based applications with Red Hat OpenShift 4.3 on IBM Cloud.

Overview of the Example Bank application

The following image shows the front-end view of the example secure cloud application we built. The JavaScript simulator application presents a Web-based view of a mobile application run by a Node.js service running inside an OpenShift cluster. We built back end of the Example Bank application with just a few straight-forward microservices that record dynamic user transactions in a PostgreSQL database.

See how the application works

Create an account (via IBM App ID) by using a generated name in the app’s dropdown. When you hit the home button of the app, you can click on the various app icons there to create credit card transactions.

Try out the credit card example

Secure microservices application architecture

When building our Example Bank application, we had to keep public cloud security top of mind. The application is secured with HTTPS, and the interaction between the microservices is even encrypted with TLS via the OpenShift Service Mesh. Even the build pipeline for the application includes a scan of the codebase for security purposes.

The following diagram outlines the architecture of the software:

The back end of Example Bank consists of several microservices, including two Java services to keep track of events and users respectively, a nightly service to delete user data, a Node.js front end, and a PostgresSQL instance to keep track of it all. The Java services communicate with a JavaScript front end to display the app to users.

How we built the credit card application

Use the open source code and instructions in the following content to understand the steps we followed to build the secure cloud application with OpenShift 4.3:

• Article: An introduction to OpenShift 4
• Article: Threat modeling in the context of microservice architectures
• Tutorial: Fun with OperatorHub
• Code pattern: Focus on data privacy with a back end for a mobile bank app
• Code pattern: Microservices with the OpenShift Service Mesh
• Tutorial: Build serverless Node.js applications with the OpenShift Serverless Operator
• Tutorial: Build a Tekton Pipeline to deploy a mobile app back end to OpenShift 4

Conclusion

Building secure, private cloud applications is more important than ever. The credit card example application we built serves to:

• Share a working integration of the latest features of OpenShift 4
• Explore concepts of public cloud security and approaches for creating cloud-native applications

Here at IBM Developer, we plan to use this example to dig deeper into emerging features of OpenShift and hope to integrate with new IBM Cloud for Financial Services. Stay tuned to our work in GitHub.