Cloud Native Computing Foundation CNCF Webinars, 21 Apr 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Webinar: K8s with OPA Gatekeeper

Description

If your organization has been operating Kubernetes, you probably have been looking for ways to control what end-users can do on the cluster and ways to ensure that clusters are in compliance with company policies. With Kubernetes, how do you ensure compliance without sacrificing development agility and operational independence? Gatekeeper is a customizable admission webhook for Kubernetes that enforces policies executed by the Open Policy Agent (OPA), a policy engine for Cloud Native environments hosted by CNCF.

Presenters:

Sertaç Özercan, Software Engineer @Microsoft
Lachie Evenson, Principal Program Manager @Microsoft

A

A

All right we're gonna go ahead and get started. I'd like to thank you for going who's joining us today. Welcome to today's cncs webinar, ensuring compliance without sacrificing development, agility and operational independence in kubernetes, with OPA gatekeeper, I'm, Karen, Chiu community program manager at Microsoft and CN CF, ambassador I'll be moderating today's webinar and we'd like to welcome our presenters today.

A

Yes, sir Tasha sure John software engineer at Microsoft and lock watching Vincent principal program manager at Microsoft, just a few housekeeping items before we get started during the webinar, you will not be able to talk as an attendee you. There is a Q&A box at the bottom of your screen. Please feel free to drop in your questions there and we'll get to as many as we can. At the end. This is an official webinar of the CNC F and, as such is subject to the CNC f code of conduct.

A

Please do not add anything to the chat or questions that would be in violation of the code of conduct. Basically, please be respectful to all of your fellow participants and presenters. Please also note that the recording and slides will be posted later today to the CNC F up in our page, at CNCs, Iowa, slash, webinars and with that I will hand it over to sir Tasha Maki to kick off today's presentation.

B

Wonderful, thank you very much. Karen hello, everybody and welcome. You are in for a real treat today today we're talking about OPA gatekeeper and for those of you who've, never heard of OPA or gatekeeper, we're going to walk you through everything, everything you need to know about policy and governance for your kubernetes cluster.

B

So today we're gonna go on a journey telling you what OPA gatekeeper does sharing how you would use it walking through a real-world scenario from end to end in both personas, both admins and developers alike, share some demos with you and then tell you how you can connect get connected into OPA gatekeeper. Now it's worth noting that OPA gatekeeper is a sub-project of open policy.

B

So when I say OPA I'm speaking about open policy agent, which is a CN CF project, gatekeepers, specifically about how we implement OPA into kubernetes using the kubernetes api and Ciardi, so we're going to go through the whole thing, how you can create policy and how you can make sure that all your kubernetes resources are in compliance to that policy. You can see the link there down the bottom on github. So, if you're interested in following along everything, we're going to be sharing today is available at that github link.

B

So we're excited to get started here. First next slide, so toes. First we're going to share what gatekeeper actually is under the hood. Gatekeeper is, as it states there are customizable kubernetes admission webhook. So if you're not familiar with admission web hooks, you can actually create pieces of software and for each request that comes into the kubernetes api. You can send them over to this web book to make a decision to whether admit to admit that request or deny that request.

B

So we can actually create policy behind that back by OPA and decide on whether we should admit or deny each request that comes into the kubernetes api, and why would we want to do this? It's to enforce policies and strengthen governance, so we're going to dig into exactly what that means and how it affects you next slide.

B

So really, we want to understand why people would be interested in using gatekeeper and the problems it tries to solve. So if you've been or using, kubernetes and operating kubernetes you've probably been looking at ways for end-users to actually have a great experience and control what end-users can do, whether they're creating any types of resources? You want a way to actually understand and create policy and say whether those resources can be created. For example, can you label two deployments a specific way?

B

Can you create specific objects with specific specifications in those objects, so at object creation time in the kubernetes cluster? We can actually control what we will admit based on some criteria there that weekend. So we can create policy here to meet governance and legal requirements and also just to enforce best practices. For example, I've seen some policies out there to say: hey you're using a deprecated, kubernetes api, you could send a message back to your user so that they can be enticed to move to a stable API.

B

That's just an example: we're going to walk through some other examples of how you might actually use gatekeeper. So, let's get into a real-world example here now the way we're going to break this example down is we're going to do it in the perspective of two different personas in a fictitious company called agile Bank.

B

So, of course, agile Bank is building the greatest p2p money transfer ever created, but more to the point, is they're in a highly regulated industry, so they need to ensure that their cluster resources on a kubernetes cluster are compliant with some governance that they've defined for those resources. Now I, like the last point here, both admins and Davila and developers, are unhappy. Let's see how we can use gatekeeper to make of both of those personas happy and how we can actually not get in the way of the great experience. Kubernetes haves.

B

So first of all, I'm gonna be wearing the admin hat. I'm gonna pass it to Sir Charles to where the developer hat. But let's take a look at the admin persona, specifically so I'm an admin I can't keep up with infrastructure changes. People need new resources. People want access to different types of things. You have persistent volume secrets: different backends, different networks, load balancers, for example.

B

I do I want to allow access to external load balances, so that's really hard for me to keep up with when the idea of kubernetes is that an admin does not necessarily get in the way of the developers doing their jobs.

B

So how can I actually create a system that allows policy to be expressed without me and my team needing to get in the way of that, so we're spending at the moment too much time on understanding whether things are compliant or not compliant, it's manual, labor I need all the resources and look for anomalies that don't meet compliance.

B

Everybody keeps making the same mistakes so we actually need everything labeled a very specific way, so that is compliant, but some development teams aren't labeling things the way that we need them to so can we take an action on that and figuring out what resources belong to? What groups is hard? Does this sound familiar? Can we actually solve this problem with gate keeper and make my life and out my team's life much easier now we're going to pass it over to the developer persona, so Tash I.

C

Undid all over here cannot make changes. I am ready to go, I know exactly what I want I want to test. My app I want to deploy to production. I, don't have any permissions to do it, because I need to wait for admin to give me access to the resources, so I need to I. Keep waiting for admin make these changes, and sometimes it takes a long time. Sometimes turnaround is really. It was really long, so I just keep waiting for for these changes, family and then, when I do something it's hard to know.

C

If that changes conformance. Sometimes these conforming see changes. So it's really hard to keep track of what changes over time, while I just want to focus on the app I wanna focus on my code. I also need to know about all these conformance changes that happens an agile back all the time. These changes are proposed, rejected, updated re proposed, so it's very hard to keep up with overtime and in turnaround time is. Is it this a day? So it takes a long time for to keep up with all the changes that happens.

B

Okay, before we go into the user requirements, I see some great questions that I would love to answer live so I'm going to take a moment. Please keep the questions coming. We are here to answer those questions and thank you for asking them. First question is we'll the demo code samples be made available afterwards.

B

Absolutely so, if you go to the gatekeeper repository on the first slide that we had there, which is open policy agent gatekeeper, there is a directory called demo in that directory is a script where we are going to run through the demo later in this webinar, and you can recreate it on your own afterwards, so you should be able to get access to the complete demo, so don't worry about typing or taking screenshots. Also, this will be recorded and we have recordings of the demos as well. So hopefully that answers your question.

B

Thank you very much.

C

All the demos will be under demo and gel Bank and then there's a script called demo to this each. So if you run it, you'll get to hold them explains that they'll gonna show later.

B

Thank you, sir touch. Second, a second question: I'm going to take a stab at at some point. It would be good to understand the difference between OPA, gatekeeper and Cheever know, which is a similar project. Unfortunately, I don't have all the knowledge of qivana I'd have heard of it. So I can't speak, authoritative, the differences so touch. Do you know Isis.

C

It seemed for Mia I only know yeah.

B

So unfortunately we can't speak to it. Hopefully we will give you enough of the equation today to answer what gatekeeper dozen how it operates, and then we can take a look at key burner. Thank you for asking that question last question is: does OPA allow specific cluster role allowed or not to a cluster and by who is there a github repository to give useful rules to be set inside a github inside a kubernetes cluster?

B

So there are two parts for this question I'm going to answer the second part we have links later in this, where we have policy, libraries and example, policies that you can apply to a kubernetes cluster for the most common use cases. You are also free to write your own policies and PR them up as well, but we have covered many things that we'll cover in this webinar. The first part of that question: do you can you answer that so does it?

B

It is, does OPA allow specific cluster role allowed or not to a cluster and by who so.

C

Using gatekeeper you can set up rules to be able to allow certain things could be like images. It could be labels. It could be anything even not. Basically, in those things we are going to show some of the libraries in this webinar, so you'll be able to try those out and then see if those work for you or not, and then we also have these security policy equivalent sort of policies that you can try out. Indian see see if they work for your use case.

C

If not, you can always add on to it or develop your own.

B

Excellent well, thank you very much for those questions feel free to keep them coming and, as we see them, come in we'll take a moment to have them answered back to user requirements. That says: does.

B

B

Slow down slow down, yeah, okay, there we are okay, so we're at user requirements, so remember we're going through the requirements of azure bank from the perspective of the admin and the developer. So now what we're going to do is just codify exactly what those requirements are. So we want to free up admins time, allow them to have audit and enforcement and have that automated for them make sure they have common best practices.

B

So we just had a question about what a common best practices will show you how to enforce common best practices for kubernetes clusters and all resources have a key, a clear owner. So that's just for our add our administrative team, our operational team to understand who owns what resources and from the developer side, we want to unblock developers, so admins are no longer standing in the way of all the changes they need to make to their specific application.

B

So self-service is no longer a risk to conformance and fail-fast means that developers we can actually implement ways to give developers instant feedback. Okay, so from here, let's take a look at some specific government's policies that we're going to create. So here are some policies that agile Bank would like us to create. All namespaces must have a label that points to a portal point of contact. All pods must have an upper bound for resource usage. Everybody knows having no resource usage on your pods can cause all kinds of fun.

B

This is a great way to actually make sure that everything has a resource limit. All images must be from an approved repository, so your container repository you have an internal corporate container repository. How do you make sure that everything deployed to this kubernetes cluster only comes from that repository? Super-Important I hear that one very often, services must have globally unique selectors. Have you ever typo'd a label selector on your service and actually pointed to the wrong service on the back end? Also very common I know I've done so.

B

I would love to have a way to make sure that label selectors are globally unique and ensure all ingress host names are unique. This is also a fun one. If you reuse ingress host names unbeknownst to somebody else in some other namespace, you can have weird and wonderful effects on your ingress controller, so you can actually enforce that out of the gate and make sure that all your ingress is are globally unique.

B

Ok, so we're going to dive into it now and get straight into constraints and constraint. Properties here I will flick it to surcharge.

C

So defined constraint properties as things we want to end together. So in this sense that we want to express intent by ending them together, we only make the cluster more constraints sit and in removing can only lose in these constraints. So by that there should be no weird interaction between adding one constraint that happens that something happens over there.

C

We only want to make it more constrained and by adding more constraints in removing, can only loosen them, and then, if, since these are all ended together, one rejection should end up being the whole request being rejected. So in this way we can keep track of like hey when I end these together and then, if any of them is not true, then we request reject requests and then we also want to define a schema where we can write constraints that gives the intent of like hey.

C

This is the this is the name that we want, or this is the regex that that we are looking for in this way it's going to be less error-prone. In this slide, we are going to see an example of an constraint, so this this one is bi type constraints, gatekeeper that SH and then it is kind required labels. So this is the agile banks. All namespaces must have an older use case. So in this case we are just looking for the namespaces kinds since namespaces are in the core. Ip I grew up.

C

We just leave that on empty and if you want deployments, for example, it would be him like the apps API group or, if you have, if you're watching any you want to match any anything, any other resources that you would just define as part of the the kinds here and then this is the parameters that that we see so these are intense.

C

So the message is: is a nicer message that user you gets when their request is rejected. So all namespaces are several on the label that points to your company username. So this way you failed, but at the same time you you get a message that saying why you failed. So this is a cogniser way of knowing like hey I need to do these actions, and then here is the for the HL bank says you use case here: is they allow reg X that users can add their user names or whatever?

C

So, if your you put your name there, agile demo in this case for the accepted username. So this way, when somebody looks at the namespace, they would know hey this person from this Miss Department created this namespace. So this way we can track who created what over time, Soto's.

B

Can you just go back a second I'd like to ask you a few questions? Is that okay yeah, so when we think about constraints, this is a new word to me. How should I understand constraints? Is it as a essentially a policy or I'm.

C

Still constraints are it's basically and so in later, they're gonna see constraint, templates. So in constraint, templates you define the logic of what happens of like is the Renko code that executes when you wanna, when you want to run some of the policy engine are basically constraints, give some of the parameters to those to those templates. So if.

B

C

Have certain restrictions any like ice mentioned before they're ANDed together? So if you want to keep adding more stuff, so you would do so with with constraints, for example, you would be able to say: hey I only want this red X to be allowed for allowed.

A

Images, for example, so.

C

You can only pull from my company's private private registry for all images, or you can only pull from this other registry also that I am using for something else. Okay,.

B

So I see that this is of kind kubernetes required label, so I would expect to see a constraint template, which is a CR d4 called complying. Read labels, okay, understand and those parameters would be inputs into the scheme or into them.

C

This is basically how you give key parameters to that template.

C

So if you want to your message very excellent to.

B

C

Is how we do it.

B

Excellent okay, thank you. Do we have a moment to pass a couple of questions, so I I will read for the first question is gatekeeper a validation web? Can it also be a mutation webhook to satisfy constraints.

C

Validating my book, they don't support mutating weapons right now, but that's something they're discussing okay.

B

So mutation is is on the roadmap second question: it seems that there's been some months since I heard OPA GK will be made GA. Are we in the same status? If, yes, what are the main blockers to go GA so.

C

We are all on the road to GA IV ever defined lists of things that we want to accomplish. We are getting there, I think so.

C

So, basically you in our issues this, if you go and look for the labels blocking GA you'll, see exactly what needs to be done so for GA. We want to define H a like high availability, but so just in case, so you want to have the at least like the definition of AI availability and then some other items. If you go to the issues, you'll see what needs to be done, so it's one example isn't, for example, cash warming.

C

So, for example, when when you a keeper starts, it should look at the existing constraints and constrain templates in the system and then put those into a gatekeeper in you, know, pH and then start serving after these are all processed and then have the ready check. After all, of these are process. Okay,.

B

Two more questions: do you think that OPA that with OPA we can manage to obtain a multi-tenancy kubernetes called secure cluster I would I were to have a touch I I think this can be used as a piece of the puzzle. Security has many layers. This can be one of them to enforce how resources are created and how they're an allowed access.

B

So it would be one piece: I wouldn't go as far to say that if you implement this, you would have a multi-tenant secure, kubernetes cluster, only because multiple layers, even then, a container runtimes authorization. There are many pieces to that puzzle, but this is can be used to complement your security model in kubernetes.

B

This one I think I can answer, but I'll read it out for cert, as if OPA gatekeeper is down, does it block active deployments? Does it run in a chain mode? So, as I was saying, the definition of hey che is one of the blockers to get v3 to GA. So at the moment it depends on how you configure your validating webhook configuration.

B

You can either have it fail, open or fail close meaning that if gatekeeper is down, will you allow the request or will you block it, and that is part of your validating webhook configuration on the kubernetes cluster? So you can do it in both ways, but obviously we want it to always run, which is why we would like to have a a che option. Yeah.

C

So currently failing open, which means if the gatekeeper is down, it is going to allow requests, but we want to get to fail close. So that's the ultimate end goal. But for for that to happen, we need a che.

B

Thanks ash plays continue.

C

So in the next topic is basically audits, so audits. We want to look at the resources in the last cluster and then periodically evaluate if the how these are doing against constraints if these are in violation or if they are, if they're, in compliance. So in this one is good, so developers or admins can look at cluster States and then compliancy of the resources that are running in the cluster. As it happens. Basically Indian.

C

You can always take action against these audit results, so these audits are exposed where the status field of constraint, we're gonna, see in the next slide. So basically, this is like a really nice way to just look at the state of the cluster and then a recent change in the gatekeeper is. We are now allowing the keeper audit as a separate deployment, so for it you don't have to have their validating web poke deployed to run audit.

C

So this is like a very you ask for use case because some people- just they they just want to start with audits- and you see like what are compliance without actually deploying the web book and then seeing rejections. So this is like a really good way to see like what are the this stuff that is in compliant or not compliant in your cluster.

C

So this is the basically the the constraint we just deployed earlier that maybe just saw it earlier. So in the in the status field, like I mentioned, you'll see there are at times them. So this is the last time that all it happens and then under violations you'll see what namespaces are are in violation of this rule. So in this case we have default gatekeeper, system, Q, public subsystem and then because of resource constraints in the cluster. We are keeping these violations limited by default that believe, it's 20, but you can always increase it.

C

So since these are limited, we also added a total violations fields, so this will be truncated at some point. Unless you change that setting and then twelve total violations will always list whatever violations you have wildly, the violations list is drinking it.

C

Any questions about this one keep.

B

C

Yeah, like I, like I, mentioned earlier, we want to test these without enforcing them. This is where the dry run comes in. So just just like audits, I mean this is part about. It, you'll see the evaluations in the status, but in this case they are not actually enforced, but they're only seen in the cluster as violations. So similarly, if you add a enforcement action, dry run you'll get into the dry run mode for that constraint by default enforcement action is denied.

C

So if you didn't specify enforce action that will be denied, if you did specify, deny that's what we default behavior or you could specify dry run. So in this case, the violations you see are for dry run so there with the book in the audit results, but they are not enforced with the book.

B

Yeah I just want everybody to take a moment to understand, ordered and dry run, specifically so I think the use case here is I. Have a cluster with a lot of resources and I want to bring that cluster into compliance. So I haven't installed a brand new cluster or created a brand new cluster and put gatekeeper on it. I have a lot of resources. I want to bring them into compliance so with dry, run and audit.

B

It allows you to actually get visibility and pass through that loop of all your policies and see what's out of compliance and then take action to fix things, and you would eventually have this status field empty once everything is in compliance. So now I want to pass that answer back through a question we have here. Is it possible to crash or block your kubernetes cluster?

B

If you have a bad rule, it is absolutely possible to do that, which is why we create a dry run and Aude it to allow you to actually say I, want to test this policy and see if it's catching the things that I want it to catch and then clean them up without having the risk of actually blocking admission to the cluster. So that's one one question keep going so.

C

Indeed, one of the other agile biases scenarios is B, wanna enforce global, unique English host names for the only uniqueness. This is in use case because we wanted to define some constraints that compare things to each other and then to make sure that they are unique, and some of these constraints are impossible to write without access to two estate more than just the object under test. So because we want to see the other objects in the cluster and then by default or audit will request each resource from the communities API server.

C

So it uses the discovery client to chat with the communities API server in each cycle of the audit, but and we have a flag called audit from from cache. It goes through. So if you set this flag, the source of truth will be the open cash, so so PA will have had the cash so in and it's defined by this config object on the right. You'll see here so it'll basically charge things that I can escape service pod, name space. You could have like ingress or service, and in here in English, for example.

C

Here, whatever things you want, so if you want to compare objects against each other things like this, you need in this case you would need data replication and the config object, but but by default it will use the kubernetes api server. So you would not need this unless you are handling uniqueness cases.

C

And then we talked about constraint templates earlier so red always the is the language for OPA. I mean this. The constraint template contains the regular old signature, so it basically contains all the logic of what happens when, like gatekeeper executes these constraints and then, if the rule matches the constraint is violated, and then we also talked about the schema for the constraints, and this is where the the schema is defined. This is little small. Hopefully you can see this one.

C

So this is this for the same example for the case required labels you'll see the the schema defined here, and this is the exact one we looked at earlier. So this is where you define your schema, while the constraints contains your parameters. So in this case we are defining things like the message, which is of type string or allowed reg X, which is also a third string. It is this is the schema of the constraint in then under the targets in the red oak. This is where the the reg- oh, like the logical.

C

So if this is this matches, then you get the deny message basically and then we also so like the message earlier. This is that's the message that that you would get returned so if this executes and if it is true and you get that you get.

A

C

Deny basically so in in this is where you define your different logic and then we're going to see on the library. You can take a look at it. We have some of the common use cases and ensure you can always get started with those things. So you don't have to come up with all these for yourself, but in the library we have most of the common use cases, and then you can also define things like helper libraries or anything in heroes.

C

And so you want to talk about metrics also, so one of the later additions to a gatekeeper is the inclusion of metrics. So currently we are supporting Prometheus as a back-end for metrics. So we are. We are metrics for things like violations per enforcement action.

C

This is what you see here, so you would see like how many, how many denies have you seen how many dry runs of these violations, so you could track over time what happens in your cluster, but if you are going to see them also a total number of constraint, templates and constraints. The when was last audits. How long did the audit take.

C

B

Continue we'll take questions in a moment, so I think one of the one of the biggest values that gatekeeper brings to OPA is allows for code reuse. So if you've worked with open policy agent, building your own reg o policies to actually do the thing that you intend to do can be complex and you need to understand it.

B

But one of the things gatekeeper brings is a structured schematized version of that by constraint, templates and constraints using kubernetes, so that you can actually share these things around put them in your CI CD pipelines, test them make assertions on the scheme of the types. So you can actually build some really good safeguards using kubernetes api s around what you're putting into that reg o, which is the native language policy, language of OPA.

B

So the good thing about constraints and constraint, templates and gatekeeper is we can build policy libraries and share them and bring your own parameters, which is absolutely fantastic. So what I'm going to do is take a moment to answer a few questions here and then we're going to move into a time of demos.

B

So a couple of questions- and this is one- that's probably interest to you- interesting- that the violations are kept in the custom resource for the rule, how about generating events for the concerned resources so that it also shows up on the violating resources? Does this make sense, Soto's so I'm, guessing that you would annotate in the status field of a deployment? If it was in violation, is what the question is: yeah.

C

So right now we have it under this status field of the constraint. I think the questions was about events. You don't have don't believe events but yeah, so there are currently others I. Think.

B

That's interesting at the moment we wanted to coalesce them into one place around the policy, so you didn't have to go and look in many places, but that's that's. An interesting thing feel free to raise an issue. If you want to discuss that further I think there's one more related: the violations can either be viewed in the constraints status or sent to logs. Is there an alerting, integrations ie, send the violations to slack or how can we implement with any community tool? So do we have an event in system? You just said no.

C

Oh, so you can always define these through metrics, for example, if you could set up primitives to set up alerts to whatever platform you want. Okay,.

B

So a manager via the metrics in Prometheus is what you can do today. How much performance impact can I expect? What if I have hundreds or thousands of policies yeah.

C

It's really hard to say like hey: this is the this. Much is what you can expect, but the more constraints you have, the more constrained templates you have and then also depending on limits, the more performance impacts you see and then you should definitely test for your use case. It's really.

B

Hard to say, hey.

C

B

Have done both.

C

Testing in the past- and indeed these are also published, so you can take a look at it. I can also put that link somewhere. These.

B

Are great questions keep them coming in the same vein? How scalable is the cache if I have a thousand plus services, a thousand plus ingresses in this in the cluster, to keep them for unique names? Will this be a problem for OPA yeah.

C

Definitely the more resources you have the more it takes if you are using the OPA cache so yeah. That's the only concern if you have a lot of stuff and if you're talking about like tens of thousands or something that's just like.

C

B

Trying to build some benchmarks right so for guidance about how much memory, and so we're working on that. That is a something that they're interested in building. So the short answer is we don't know the long answer is we're going to test yeah.

C

Yeah I did some load testing before I can okay.

B

Can you well there's a few more questions here? Go to the next slide, please so towers. So we have some demos they're going to they're pre-recorded we're going to walk through them now. Can you just pull up the first demo and I'm going to quickly answer just a few more questions, so it has our first one is: is there any existing repository hub for constraint templates that has regular generic policy? Yes, we have a link in the deck a little bit later, so we will you'll see that.

B

But there are some policies already there to go. Can metrics be sent to anything other than Prometheus like data dog, not currently only through Prometheus, and then maybe you could use alert manager to fire something to data dog.

C

Yeah, you know in our oh man. We also want to implement open census agent, so you can specify whatever and.

B

Yeah, so that's.

C

Definitely in issue we have so if you like to contribute, look amazing.

B

In the future, gatekeeper could evaluate service to service policies. I think absolutely there's a flexibility in OPA to be able to do that. You could absolutely do that on custom resources. Let's say you're running a service mesh. You could send them over and do validation absolutely.

B

How is Comcast different from opa GK, so I will have a start at this, and, let me know so it does if I miss anything comp test test, Rhaego policy, so rural rego policies, there was some talk to implement it to make it understand, constraint, templates and constraints, so OPA GK is using and leveraging the kubernetes api s and custom resources and custom resource definitions to schematize your policy and parameterize the rego, whereas contest is just taking R or a go and then passing it through a set of resources, so either world had the same effect.

B

I would say the way to think about. Opa GK is a kubernetes native implementation, leveraging the kubernetes api x' to make policy authoring and sharing a little bit easier.

B

Anything you want to add so touch.

B

Okay and one more is the deployment model always to co-locate OPA gatekeeper in the same cluster as being controlled? Please describe more about the target model, including hey che remote deployment. One too many clusters.

C

I, don't I, don't believe, tested with different clusters, but as long as like, if there is the Kabbalah dating my book, that can target it should work. But it's not.

B

Yeah, it's certainly doable I would just caution. Obviously your failure. Failure scenario is when you use a web hook that points off cluster or to another cluster. Obviously you need to really understand the paths there to understand how it's going to operate if it fails, but we've been co-locating it and testing with colocation. Currently, okay. So thank you for all those questions. This first demo we're actually going to step through those policies that we've created for agile, Bank and show you how they look for not only an admin but for a developer.

B

So kick it off. This is a great demo. Yeah.

C

It was good, just gonna, say: there's nothing magic behind the scenes, so right now we're just creating your client cluster. So for those that they're not familiar with kind, it stands for communities in docker, so it basically creates like a local communities cluster in your machine, yeah.

B

Absolutely so you can install gatekeeper on any kubernetes cluster right right, whether that's local, using kind or whether that's a cloud provider or something that you are running on Prem, okay, so we're just gonna get pods I! Think we're gonna run through the install right now. I've got a pair and get it on with a cluster okay, so we're just applying the gatekeeper set of manifest, which creates and sets up gatekeeper and installs it on this cluster. So we can see that that has happened.

B

B

Information here so that we can test it there we go so we can see now they're in the gates, keep your system namespace. We have a pod called gatekeeper, controller manager.

B

So now we're the developer go ahead. So.

C

I'm, the developer I'm, creating this advanced transaction system, namespace, cube, CTL, create and as write ad.

C

And then suffice weeks go by I, move different projects and then everybody forgets about the advanced transaction system and then Maki. Yes,.

B

So I want to understand as an admin here who created this namespace, and how can I trace it back to the person that created all the team that created it? Okay, so before I delete it I have I, can go and create a policy to make sure that I make sure that there's never happens again. So here we have some constraint templates that are just applied to the cluster. The interesting one is required labels for this specific demo.

B

You, okay, we're going to have a look at those constraints and we're going to apply the constraints which provide the parameters to those constraint templates and, as we can see here, that all must have all namespaces must have an owner and that which means that there must be a key owner with a value that meets that regex. For it to be allowed.

B

Okay, so we've applied those constraints back to the developer and.

C

Then now I'm going to try to create a production namespace, because I can because I'm a developer. Oh wait: I got a error from.

B

C

It's all my old name: spaces must have an older label, but I don't have it because I just created try to create the namespace production directly in your CTL. Oh wait and here's what a good resource looks like so I'm, including this owner label, into my production in space. Oh wait: it's created, that's nice!

C

So now anybody can identify it and then I want to deploy some pods. Would that I define no limits and then I get another error from server saying like that, my my pod doesn't specify any resource limits, so I should maybe I should specify some resource limits. So communities would know how to take care of so.

B

Maybe I specified.

C

Too high, that's not good right.

B

Because it's going to take a lot of memory.

C

Space and then I deploy it from my my personal repo, for example. That's not allowed because I should be using the company's allowed private.

B

Or just say, for example,.

C

And in here and I want to deeply I change it a lot of repos to open policy agent in this case and then like as you can see, the error messages are like instructable I mean make actionable, so you can take action immediately based on the error. So in the end, when I deployed they at the OPA one it it.

B

Proceeded as this, because.

C

If that was loud, I mean here is a duplicate service, so I deployed.

B

C

And then all is well with the world until the this is getting cut off in evidence and then until the big big outage happens, then lucky.

B

Right so now we're looking through the audit news case. How do I actually look at resources that already exists that are non-compliant with that policy, so we're going to go check the audits, because we have some pods without resource limits. How do we actually look at that? Of course, we take a look at the Cates container limits customer resource and we can go and take a look at specific in the status section. We can see the pods that don't have any limits, so you can see down here in status.

B

We have a bunch of pods that do not have resource limits, so then I can take it upon myself to go and action them and apply resource limits again. Super simple I've defined the policy and then unleveraged order to go and remediate.

B

Okay, so we've rolled out this new policy to production I can now guarantee that everything is in compliance. We also want to make sure that all ingress names are unique. So this is a common one. That causes a lot of failures. Now we're taking a look at introducing new policies can be dangerous. We had a question about this earlier. How do we gain poll? How do we gain confidence that a policy that we've defined is actually doing what we need and doesn't break our kubernetes cluster or bring down the entire stack?

B

So here we can actually create a constraint in dry run mode so that it doesn't enforce, and we can see that if there are any conflicting ingress, hostnames.

B

B

All right so we're going to apply that dry run template and then we can obviously use audit.

C

And it gives me we need the dry run Tim. Please.

B

Constraint, template and this is it uses the cash to confirm if any thing names overlap right and there's the constraint we get ingress is we have two ingresses with the same hostname? You can see there and now, if we get the constraint, we should be able to see.

B

So there we can see that we do have some that conflict I'm going to create a third ingress to show that dry run does indeed not block and he creates with the same hostname. Yes,.

C

This we're doing this in dry run mode. It does not block.

B

Yes, so, as you can see, there here is another ingress host two with the same host name as the other and that's being allowed. It should show up in the order to say that we indeed have a that example. Okay, so soup-to-nuts, that is the the whole flow from admin to developer. Soto's is also going to show you what the metrics look like Soto's, which is the second then I, go ahead. This.

C

B

Demo for the metrics.

C

So this is the the Prometheus dashboard, so they're going to see them we're just doing this locally from the from the from the kind cluster. So these are the same metrics that that happen during the demo. Basically I, just recorded I had the Prometheus running. So you see in this case, we had 32 tree deny violations in 24.

C

Dry-Run violations- and you can also have been other- you- can also define your own sort of like an enforcement action when that one is categorized, is on record.

B

Recognized in me.

C

Then so that's zero and then you can graph it. So you can over time you can see like how much changed and how many dry run changes. You add, so you could have alerts baby. You know a lot manager to say like hey, if there's any drive-in eating they're denying alert me on slack or whatever, and in this case we are seeing the audit lost last run. So this does the nice time timestamp of the audit one and then here how many constraint templates we had.

C

So in this case we had four and a midpoint another one. Then that's five and then I believe we.

C

Are gonna see that number of constraints, so we have one dry run it you, as you saw last lusts part of the demo, and we had four deny constraints.

C

C

Then you can see that the values there too and then these are the requests count. As you know, communities always does requests in which are allowed, so the red one you see are the the requests that the communities does to herself and then these are the ones that we did it and then that got denied. So those are four forty nice, but communities keeps doing requests, so you can keep track of those as well, because.

B

C

B

To denied also that.

C

Just keep having then going back to the demo. Okay.

B

Excellent, thank you so tears I'm going to power through the rest of the deck here, and we have a few questions so just a status on the project. It's in beta, which we've answered. It's looking to define H a to go to G a for v3 of gatekeeper. If this is something that interests you we're interested in understanding how you want to use, it feel free to raise issues.

B

I've heard a lot of questions on different things that we haven't thought of as part of gatekeeper, filtering them to bring them to the community, and we will show you the links in a minute. Keep going I know there is were some questions about policy libraries they're all in the upstream repository, so there are predefined constraint, templates and even a pod security policy equivalent where we've modeled effectively what the pod security policy API does in a gatekeeper constraint templates.

B

So you could consider using that- and that was something that was just asked generally in the community. So the main Tanners went and worked on that okay and keep going potential growth. Here we've had a question about mutation. Mutation is complex, so it's a lot of work to make mutation um work in the way and make it have a stable outcomes, so feel free to come and help with that.

B

If you're interested external data sources like different directories, different places where you can make decisions on whether you admit or deny a request, authorization likely a separate project, but kubernetes allows different web hooks for both admin, admission and authorization. Could it be used for authorization as well developing audit features. We had some great questions about that where we could support audit data and just develop a tool in making it way more simple to use and integrate into. There are all areas we're interested in getting people involved in.

B

Finally feel free to come and join us. There are meetings every alternating Wednesday and there is on the open policy agent slack at kubernetes policy channel. You can come there or you can just go to the gatekeeper, repository and start getting started and with that that concludes our slide. Deck I will try and rush through these final three questions that we have before we close at the time. Is there any support to deploy a PA GK via customized.

C

Food today, by default, we use customized for the default, u builder like installation, but other than that we support llamo to deploy and also an outcome charter. Thank.

B

You this this question is really interesting. I'll take it if, if an old pond pod from a deployment violates a new rule, I understand that it will not affect what will happen if the node, where the pod was running is drained, does the old pod get re recreated on another node or deleted? So this is an important thing to remember and I'm going to answer this very quickly.

B

This is an admission, so it doesn't change values at runtime if a node is drained and the pod needs to be recreated by a controller like a deployment controller. If it now violates that you're going to see an error on that replica set, saying, I cannot create this anymore and you're going to see the policy violation rule at the replica set level so go check there, but it's not going to modify things at runtime only it admit time. So, if you have pods running that are now in violation, you've got to delete them yourself.

B

Can I use Prometheus metrics to track violations for a specific policy or just across all I? Think I can answer this. It's just across all currently and I'm. Gonna, try not the last one out what.

C

We didn't want to do for specific things because of like privacy concerns since Prometheus in any metrics and.

B

C

A public publicly, so everybody can see it, so we didn't want to specify things in there that could be on.

B

Cotton, you officer, touch Karen's, got ten seconds. Okay,.

A

All right, thank you, sir now and lucky for a great presentation. That's all the time we have for today, thanks for joining us, the webinar recordings and slides will be online later today, and we look forward to seeing everyone future CN CF webinar have a great day. Thank you.

B