►
From YouTube: Lightning Talk: Don't Wait, Secure your DevOps Processes Using Open Standar... - Dov Hershkovitch
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Lightning Talk: Don't Wait, Secure your DevOps Processes Using Open Standard Methods Today! - Dov Hershkovitch, GitLab
Security is shifting left. What used to be a straightforward task in the past, such as deploying an application, today involves secrets. Secrets are typically stored in a secret management solution framework, yet available to the engineer's disposal. In this lightning talk, I will explain how you could secure your DevOps process today, using an open standard (JTW) to access secrets, without compromising due to security or complaints, or waiting for a DevOps vendor to build a native integration framework for you
A
So,
let's
start,
but
before
we'll
get
going,
a
quick
definition
of
what
is
the
secret
secret
is
an
object
that
enables
the
process
of
accessing
restricted
data
or
a
resource,
meaning
that
the
data
itself
or
the
environment
that
you
want
to
access
is
not
a
secret
that
is
protected,
but
the
way
to
access
the
data.
The
key
is
the
actual
Secret.
A
Now
we
all
know
that
software
is
all
about
speed.
Any
software
organization
want
to
develop
and
deliver
features
to
our
customers
as
quickly
as
possible.
We
want
to
react
quickly.
We
want
to
close
vulnerable
vulnerability
holes
in
fixed
bugs
as
fast
as
we
can
this.
This
is
why
devops
become
such
a
wide
practice
in
our
in
our
industry.
A
So
in
order
to
achieve
that,
first
of
all,
we
need
to
understand
that
cigarettes
need
to
live
in
a
dedicated
secret
solution.
This
is
why
there
are
so
many
secret
Solutions
out
there.
All
the
cloud
providers
have
different
secret
management
solution,
key
management
system
to
store
and
handle
cigarettes,
and
also
there
are
the
dedicated
secret
management
solution
that
you
all
know
like
hashikov,
Achilles
and
more.
A
There
are
a
lot
of
tools
in
the
market
and
a
lot
of
solution
to
choose
from,
but
as
we
mentioned,
we
want
to
make
sure
that
we
are
integrating
this
with
our
Devil's
platform,
meaning
our
cicd
pipeline,
because
we
want
to
pull
those
secrets
and
use
that
as
a
part
of
our
processes,
to
allow
us
to
manage
our
application
and
manage
our
infrastructure
or
deploy
our
application
in
a
secure
Manner.
And
now
we
are
facing
with
another
dilemma:
which
tool
should
we
choose
from?
A
Should
we
simply
choose
a
secret
management
solution
based
on
the
available
integration?
Doesn't
make
sense.
We
want
to
use
the
best
of
breed.
What
if
my
organization
is
using
a
tool
that
simply
does
not
support
my
devops
platform
and
cannot
integrate
me
with
my
cicd
pipeline
or
if
I
have
a
multi-cloud
strategy
and
I
want
to
integrate
with
all
the
different
Cloud
providers?
What
should
we
do?
What
should
you
do?
A
Well,
if
there
is
a
native
integration,
if
one
of
the
vendors
built
the
native
integration
for
you,
then
great,
you
can
simply
use
it,
but
as
a
product
manager
in
gitlab
as
much
as
I
would
love
to
integrate
with
all
the
secret
Management
Solutions
that
are
out
there,
I
simply
can't.
So
there
is
something
that
we
can
do
until
someone
will
build
that
integration
for
you
and
to
do
that,
we
need
to
familiarize
ourselves
with
two
concept:
open
ID
and
the
JWT.
Now
the
open
ID
is
an
open
standard
for
decentralized
authentication.
A
The
JWT
is
a
token
and
one
of
the
ways
to
implement
open
ID
connect,
it's
a
short
lived
ID
token,
and
the
good
news
is
that
all
the
cloud
providers
or
the
secret
management
solution
and
many
of
the
devops
platform
support
the
open
ID
with
the
JWT
implementation.
In
fact,
I
still
haven't
seen
the
tool
that
does
not
support
that
I.
Think
it's
practically
a
you
know
a
standard
today.
The
fact
that
it
is
a
standard.
So
if
we
have
that
in
our
disposal,
what
can
we
do?
A
The
solution
will
be
in
the
form
of
integrating
our
open
ID
with
our
devops
platform.
So,
in
order
to
do
that,
we
need
to
do
the
following
step
or
you
need
to
do
the
following
steps
and
it's
practically
the
same,
and
it
doesn't
matter
which
tool
you're
choosing,
but
the
steps
are
more
or
less
the
same
number
one.
You
need
to
configure
trust
relationship
with
open
ID
collect
in
a
declarative
manner.
You
need
to
tell
your
Cloud
providers
or
your
secret
management
solution.
A
A
Then
it
gets
authenticated
and
if
it's
get
authenticated,
you'll
get
an
access
token
back
once
you
get
that
access
token
back,
you
can
go
ahead
and
retrieve
any
secret
that
you
like
in
order
to
implement
it
as
a
part
of
your
cicd
pipeline,
as
I
mentioned,
to
manage
your
info
infrastructure
or
your
deploy,
your
application,
that's
it.
This
is
how
you
set
up
a
an
integration
between
any
Devil's
platform
to
any
secret
provider.
A
Now,
like
anything,
you
know
the
industry,
any
solution
in
our
industry,
there
are
pros
and
cons
for
both.
So
let's
work
them
quickly.
The
benefit
of
using
the
JWT
in
devops
workflow
is,
first
of
all,
it's
way
more
secure
because
you're
using
a
short-lived
ID
token,
even
if
the
token
get
clicked
an
expiration
time
of
five
minutes.
So
there
is
probably
not
a
lot
of
things
that
an
attacker
can
do
in
a
course
of
five
minutes.
You
have
no
vendor
lock.
You
don't
need
to
wait
for
anyone
to
build
an
integration
for
you.
A
You
can
go
and
build
that
integration
right
now
and
also
secrets
are
stored
and
secured
in
a
dedicated
system.
You
gain
all
the
features
and
all
the
benefit
that
the
secret
provider
brings
you.
The
downside
of
using
the
JWT
in
devops
workflow
is,
first
of
all,
you
need
to
know
how
to
configure
open,
ID
connect
and
also
the
setup
of
the
configuration
in
your
CI
pipeline
also
a
little
bit
complex.
A
Although
this
is
one
something
that
you
need
to
do
one
time
and
then
the
entire
organization
can
use
still
someone
needs
to
do
it
for
you
interviewing.
Even
in
gitlab,
we
have
like
a
handful
of
Engineers
that
really
know
how
to
do
it
and
the
rest
of
the
engineers
are
simply
using
it,
and
also
there
is
an
Associated
cost,
with
storing
secrets
in
Cloud
providers
or
any
secret
management
solution.
A
Lastly,
if
there
is
one
slide
that
I
want
to
remember
from
this
lightning
talk,
is
this
one
basically
recapping
the
entire
the
entire
presentation?
The
challenge?
The
way
I
said
that
secret
are
typically
stored
in
a
dedicated
management
solution,
but
we
know
that
Secrets
need
to
integrate
with
our
devops
platform,
meaning
our
CI
CD
pipeline.
A
Now,
in
this
lining,
talk,
I
don't
have
the
time
to
go
into
the
depth
of
how
to
build
that
integration,
but
I've
created
one
slide
with
a
lot
of
working
examples
that
you
can
simply
use,
and
it's
very
easy
I
mean
all
you
need
to
do-
is
go
to
your
documentation
of
your
provider
and
just
look
for
open
ID
connect
or
oidc
and
you'll
immediately
see
it
with
that.
I
want
to
thank
you,
and
hopefully
you
enjoyed
this
talk.
Bye-Bye.