Fully-managed secure connectivity among constituent services of distributed applications

A system, comprising:

• a control plane server of an application management service of a cloud computing environment;
• and
• a plurality of container execution resources, including a first container execution resource and a second container execution resource;
• wherein the control plane server is configured to:
• obtain, from a client of the application management service, a programmatic indication that (a) a plurality of constituent services of an application of the client is to be executed using at least the plurality of container execution resources, (b) connectivity between individual constituent services of the plurality of constituent services is to be established using Transport Layer Security (TLS), without obtaining networking information of the individual constituent services from the client and (c) digital certificates for establishment of TLS connections among pairs of constituent services of the plurality of constituent services are to be obtained and rotated automatically by the application management service;
• propagate, to a first connectivity agent established by the application management service at the first container execution resource without receiving a request from the client to establish the first connectivity agent, a first digital certificate assigned by the control plane server to a first constituent service of the plurality of constituent services of the application for establishment of connections between the first constituent service and one or more other constituent services of the application, wherein the first digital certificate is generated by a certificate authority at the request of the control plane server, wherein the first digital certificate is propagated to the first connectivity agent during an initialization phase of the first connectivity agent prior to initiation of communication between a first program implementing the first constituent service within a first container at the first container execution resource and other programs implementing other constituent services of the application;
• in response to determining that a criterion for automated certificate rotation has been satisfied by the first constituent service, propagate, to the first connectivity agent, a second digital certificate assigned by the control plane server to the first constituent service, wherein the second digital certificate is generated by the certificate authority at the request of the control plane server;
• and
• wherein the first connectivity agent at the first container execution resource is configured to:
• establish, using the first digital certificate, prior to receiving the second digital certificate, a first TLS connection with a second connectivity agent at the second container execution resource;
• transmit, via the first TLS connection, to the second connectivity agent, one or more messages generated at the first program and directed to a second program implementing a second constituent service of the plurality of constituent services at a second container on the second container execution resource;
• establish, using the second digital certificate, after receiving the second digital certificate, a second TLS connection with the second connectivity agent at the second container execution resource;
• and
• transmit, via the second TLS connection, one or more messages generated at the first program and directed to the second program.