►
From YouTube: Sponsor Demo: Cisco - All Your Policies Are Belong To Us
Description
"Cloud adoption & DevOps methodology are dramatically changing how forward-looking organizations innovate today. In the midst of this transformation, Security owners are finding that the traditional methods of integrating security into this new world is not keeping pace with the highly agile continuous software delivery model. The traditional perimeter, on-premises or hardware-based security controls are often perceived as inhibitors to the speed & agility our modern-day developers require.
Codify your security policy at the beginning of the software journey. Include security and policy as part of your DevOps culture by using the tools & platform your developer already uses, enabling security to become a shared responsibility for the entire organization.
The best part? This Policy as Code will be enforced across the infrastructure (Kube, VMs, ADC, Firewalls, and Clouds)!"
A
Hello,
welcome
to
this
demo
we're
going
to
talk
about
how
all
your
policies
are
belong
to
us
and
how
basically
we're
going
to
use
the
cicd
integration
of
saturation
to
keep
a
single
repository
of
all
our
policy,
a
single
place,
a
single
ring
to
rule
them
all.
In
some
extent
my
name
is
remy
philip
and
I'm
going
to
walk
you
through
this
and
how
we
can
get
that
done
with
situation.
A
So,
let's
start
with
a
few
slides
number
one:
let's
get
the
you
choose,
whatever
you
want
to
put
there.
Policy
is
never
as
easy
as
just
three
boxes
on
a
diagram.
Despite
what
people
tell
you
it's
a
lot
of
things
that
go
together
at
some
point
to
get
policy
work
in
and
obviously
different,
people,
different
owners,
different
teams,
and
I'm
going
to
kind
of
give
you
a
spoiler
on
this
one
life
is
not
as
easy
as
it
seems,
and
what
happens
well.
A
A
Now
the
problem
with
all
that
is
obviously
when
you
want
to
set
a
policy
somewhere.
Well,
ideally,
it
works
from
end
to
end
right
I
mean,
if
you
can't
get
your
policy
to
start
from,
say
the
internet
and
go
down
to
your
workload
and
all
the
dependencies
of
your
workload.
So,
for
example,
the
cloud
in
this
example
well
you're
kind
of
stuck.
A
So
what
do
I
need
to
open
for
this
to
work?
Well,
quite
a
few
points.
You
have
to
look
at
all
the
green
boxes
where
I
have
to
do
some
kind
of
action.
This
action
could
be
set
up
the
ddos
prevention
to
actually
protect
incoming
traffic.
It
could
be
configure
dc
edge
or
copy
just
configuring,
some
kind
of
group
somewhere
else
in
the
environment,
so,
for
example,
aws
to
access
a
service
provided
over
there.
A
So
there's
quite
a
bit
of
things.
We
need
to
do
now,
it's
kind
of
a
little
problem,
because
I
mean,
if
you're
here
looking
at
that,
you
probably
have
some
kind
of
stick
inside
the
container
architectures.
So
what
do
you
control?
Well
just
this
right.
I
mean
tiny,
tiny,
tiny
piece
of
the
puzzle
and
so
many
other
teams
control
so
many
different
things
across
the
environment
that
it
doesn't
seem
realistic
to
think
that
you
can
actually
go
and
enforce
this
policy
easily
across
all
this
right.
So
I've
been
a
little
bit
negative
there.
A
A
A
We
have
things
like
firewalls
and
things
like
that,
they're
all
just
there
they're
available
and
we
just
can't
get
them
to
work
together.
Well,
that's
something
that
we're
actually
changing
with
situation
and
the
idea
is
actually
to
go
and
make
this
work
together,
much
better
in
a
simple
workflow
and
ta-da.
Here's,
the
workflow
developer
actually
comes
in
and
just
put
a
star
developer,
because
it
could
be
anyone
that
just
feels
comfortable
with
gits
and
if
you
don't
feel
comfortable
with
git,
just
go
to
the
web
ui.
A
So
you
take
your
policy
here,
you
go
and
you
put
it
in
the
source
control
and
this
policy
just
follows
the
network
policy
format
of
coup.
We
didn't
reinvent
the
wheel
again,
it's
something
simple
something
you
can
actually
use
to
this
environment,
so
you're
going
to
push
it
along
with
your
code
and
that's
going
to
go
in
your
build
pipeline.
A
A
Then,
if
the
linter
actually
succeeds-
and
obviously
failure
and
successes
depend
on
your
preference,
it's
just
a
return
code.
But
if,
if
the
success
is
there
for
the
linter,
then
you
can
deploy
your
policy
to
the
test
environment
and
you
can
just
go
and
run
your
integration
testing
with
the
actual
policies
deployed
in
this
environment.
A
A
What's
going
on
behind
it,
go
and
fix
it,
push
your
new
code,
etc,
etc
in
a
very
iterative
fashion,
once
you're
happy
with
all
that
trigger
the
promotion
of
the
builder
to
prod
you
trigger
this
promotion,
guess
what
the
test
policy
just
flips
from
dev
to
prod
policies
goes
there
and
that's
about
it,
and
you
don't
need
to
care
about
enforcement
points,
because
titration
in
this
context
will
act
as
a
policy
plane.
It's
going
to
go
and
configure
or
work
with
partners
to
make
sure
it
can
configure
the
whole
environment,
cisco
or
not.
A
A
This
application
is
custom
built
it's
just
a
bit
of
code,
it's
actually
public
on
github,
so
you
can
go
there
on
titrator
demo
policy
pipeline
and
you
will
see
here.
I
recommend
you
read
the
comment,
notes,
there's
lots
of
entertainment
across
that,
so
the
goal
of
this
application
is
super
simple.
It's
to
show
you
what
you
have
access
to.
A
A
I
didn't
set
anything,
see
the
comments
everywhere.
Actually,
let
me
zoom
in
a
little
bit.
Oh
everything
is
commented
out,
except
the
default
deny,
so
I'm
actually
blocking
everything
in
my
environment
and
how
does
that
translate
inside
titration?
Let's
go
and
have
a
look.
I
can
go
to
my
policy
here.
I
have
zero
absolute
zero
default
and
everything
is
capsule
deny
exactly
as
my
policy
states
here.
A
So
it's
kind
of
expected
that
this
policy
does
not
work
here
right
and
you
want
a
spoiler
remember.
I
told
you
third
parties,
integration,
the
actual
policy
is
even
not
enforced
and
well,
it's
actually
enforced
in
multiple
places,
but
one
place
it's
actually
enforced
is
directly
on
the
load
balancer.
A
Here
then,
I'm
going
to
add
allow
connection
to
to
dev,
because
I
mean
we're
not
very
good,
so
prod
dev,
I'm
reversing
the
terms
all
the
time
and
I'm
going
to
allow
access
to
everyone
to
my
environment.
Let's
go
here
and
let's
open
up
this,
so
I've
just
saved
my
policy,
so
I
have
a
policy
that
allows
anyone
to
accept
to
access
and
talk
in
french
now
to
access
my
service
here,
and
I
can
allow
my
application
here
to
talk
to
prod
my
application
to
talk
to
dev
and
my
catch-all
stays
denied
pretty
simple.
A
A
Obviously
I
sped
up
a
bit
the
video
here
because
I
don't
think
you
care
to
see
all
those
steps
be
playing
out
and
now,
if
I
go
back
to
my
policy,
I
got
my
policy
here,
remember
what
we
say:
everyone
to
my
app
the
service
here
and
then
port
80
and
then
the
different
stages.
Here
at
this
point
so
now
I
basically
push
the
policy
and
this
policy
is
actually
getting
enforced
on
the
platform
as
we
speak,
so
we
can
go
and
have
a
look
at
that
all
right
looks
like
this
policy
is
now
enforced.
A
I
can
see
that
I
can
access
my
database
in
prod
sorry
in
dev,
and
I
can
access
my
application.
So
everything
looks
pretty
good.
Remember
we
give
access
to
everyone.
So
now,
if
I
go
to
my
clients,
I
can
see
that
I
have
access
to
about
everything
here,
which
is
exactly
what
we're
expecting
perfect.
So
we've
just
set
a
policy
through
the
csc
pipeline.
A
Now
again,
remember
uncle
ben
with
great
power
comes
great
responsibilities.
Let's
come
and
let's
add
some
guardrails
at
this
point,
because
you
have
the
power
to
basically
shoot
yourself
in
the
foot
and
probably
everyone's
standing
around
you.
Let's
avoid
that.
So
what
I'm
going
to
do
is
now
I'm
going
to
set
a
policy,
an
overarching
policy
which
is
actually
going
to
say
that
at
this
point,
dev
cannot
talk
to
prod.
So
let's
give
it
a
shot
here.
A
A
A
A
A
right,
so
let's
go
and
push
our
policy
awesome.
Our
policy
has
been
pushed.
Let's
go
and
have
a
look
at
that.
Okay
now
I
have
two
rules,
one
that
says
my
ip
address
and
one
that
says
one
ldap
specific
group
which
is
1109,
which
is
there,
which
happens
to
have
two
workloads
inside
it.
So
now
let's
go
and
have
a
look
if
this
has
actually
been
enforced.
A
Okay,
so
we're
on
rds
everything
is
working
as
expected.
I
can
access
the
dev.
I
can't
access
the
prod,
then
I
can
go
to
my
session,
which
is
tony
at
this
point.
Let's
see
looking
good,
perfect
time
out,
that's
expected
and
now
let's
finally
go
and
see
our
next
user.
Alright,
let's
look
at
that.
This
policy
seems
to
be
enforced.
I
can
see
blocked
on
this
workload.
A
A
The
beauty
of
this
is
that
we
actually
combined
enforcement
from
pieces
coming
in
from
the
campus
through
ice.
Three
things
coming
in
through
the
anyconnect
client
things
coming
in
through
the
f5
device,
so
we're
actually
merging
enforcement
across
a
whole
bunch
of
platforms,
and
you
can
see
my
policy
being
rendered
here
on
the
f5
directly.
A
But
at
the
same
time
I
can
actually
go
to
my
containers,
and
here
are
all
my
container
policies
which
has
been
rendered
for
me,
took
into
production
workload
at
this
point,
for
example
the
drop
that
we
created
and
so
on.
So
hopefully
that
was
interesting
for
you.
We
just
went
through
quite
a
bit.
We
showed
how
we
can
use
the
policy
in
a
single
policy
master
inside
the
tradition,
to
help
and
control
the
whole
platform
from
a
single
place.