Cloud Native Computing Foundation Kubernetes Community Days Bengaluru 2021, 10 Jul 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Zero to Secure How Kyverno Can Help Secure Your Clusters in under Five Minutes

Description

Kubernetes Community Days Bengaluru'21

Kyverno is a Kubernetes-native policy engine that helps you define policies using Kubernetes compliant manifests. Kyverno uses the Kubernetes admission webhook to validate, mutate, and generate Kubernetes resources. Using Kyverno, a central platform team can define policies and ensure the configurations are compliant with their security and best practices standards. The best thing about Kyverno is it does not require learning a new programming language to define a policy. Creating and operating a policy is really easy! Attendees will learn how Kyverno works and how they can use it to secure workloads on their cluster using Kyverno.

A

Okay, so here's the situation, a new team member set up a jenkins cluster and the cpu keeps fighting 200 percent. When I investigated, I found that it did not add port security policies, as they heard psps were depreciated, the lack of port security on the cluster allowed introverts to run privileged boards and launch crypto mining workloads that causes the cpu to spike and results in large cloud provider bill.

A

While it's true that psps are marked for depreciation in version 1 or 21, you can still use them until an entry replacement is ready. However, implementing psps has many challenges, which is why they are depreciated to begin with. So what's one to do, I've heard about this new cncf project called killer, no, which also implements spot security, and I know one of the maintainers. So let's learn about it and see what it can do. Hey puja. Thank you for hopping on the call real quick. I am actually in the middle of a situation.

A

So there is this jenkins cluster, which is running a port that has security context set. Privilege is equal to true. Now I want to make sure that creation of such pods are blocked.

A

Okay, so you're looking for security policy that can block the spot. Yes, this is exactly what I'm looking for. Have you tried psps? um I was thinking of implementing psps, but again it has its own disadvantage.

A

Make sense. uh So did you try any other policy management tools? um I checked kiwarno and oppa, and I recall that you were involved in some kiwanos project. So can you help me to understand which will be the best case to use here?

A

So let me tell you about both kiberno and opa. Okay. Kirano is a policy engine designed specifically for capabilities, and it has a full implementation of pod security standards and other policies to help secure configuration while oprah it is general purpose policy engine and it provides high level declarative language that lets. You write specific policy as hope it. Its policy are written in rigo. Oh, we go so is there any other language to learn?

A

Yes, but don't worry kevin comes handy here. You can write policies in yemen, so no need to learn new language awesome.

A

So can you show me the pod configuration so that we can check it quickly and we can decide what kind of policy we need here? Let me know my screen and yeah. This was the pod yaml file. I was actually looking at and if you can see, the security context has set. Privilege is equal to true here, yes, and I can see that it has host access which is not secure.

A

So I think yes, this sky kybeno fits very well here. It is specially designed for handling these kind of scenarios. Oh it's really. I'm really glad to to understand that kiwano is the best use case here. Can you tell me more about kevino, so kibano actually runs as a dynamic admission controller in kubernetes cluster.

A

This means all the kubernetes api requests can be validated or mutated by keyboard policies. When we install kiberno it will register itself as some mutating and validating network based on the policies we define in the cluster humanoid can validate mutate or generate new configurations.

A

um I have shared you a link, so let's try installing kiberno in your cluster okay, so you are telling that the single link will help me to install given in my cluster exactly okay. So let me install this pretty quickly and here it goes. I think this is getting installed. So let's wait for a while and yeah it's created. Can you take a look at your side and check whether the configuration looks good, yeah, sure, okay, so here we can see kevin o'bot is running. This means keyboard no is installed in your cluster.

A

So now coming back to your use case. First, let me explain the policy structure so that you will understand it better when we apply it to your cluster.

A

So here we, this is how policy structures looks like under policies. We have a collection of rules under rules, we can mention match and exclude clause, and these are the parameters which you can mention under this clause. So here math match means the resources you can mention under. This is on which you want to apply the policy, and similarly exclude is the resources which you want to exclude and another rules. You can mention three types that is mutate validate and generate.

A

So now, let's cover your use case policy, which I have it here.

A

So, as your use case was regarding the privileged containers, this is a perfect policy for you, and this is a validate policy, so what it does is it will be applied to all the parts which will be created and it will match with this specific pattern.

A

So here we go for the definition that validate does the validation of the resource with the patents which we mentioned here.

A

So what this policy will do is it will go and check in the part for this specific words that specific keys, that is spec in it containers, security context and privileged so other end, you will go for the the policy will check for the privilege keyword and it will check that its value is false. If the value is false, it will allow the part to get created. If it is true, then it will give this error message, so it will block the policy.

A

So uh considering your use case, I have just changed the policy a bit. I have added an extra parameter as namespace, then all so what this policy will do is it will be applied to all the parts which will be created in this specific namespace.

A

So now, let's deploy it and see, how does it.

A

A

Yeah now let me check: let's play this.

A

So this is supplied yeah. Now I have a sample part handle which is similar to what you showed me now. Let's try to create this.

A

Class so yeah, so the part is blocked. So now your cluster is safe from all this kind of parts and your it is secure yeah. So this is really awesome pujam. While you were doing this, I was uh thinking of some more use cases. So can you tell me some other kind of policies in kiberno sure.

A

Okay, so here are the three three type of policies: what we have so coming to the validate policy. I have, I already explained it with your use case. So let me explain you the other two types which is generate and mutate so come to generate. Let me take a simple example.

A

Okay, so we have an example that is ad network policies. So what validate? What what generate does is? It will uh help you to create an additional resource on creation of a new resource, so here you can see what will happen is it will be? This policy will be triggered when you create a new namespace and it will generate a network policy under the created name space with this inline data.

A

So this is a simple uh generate policy example. You can also go and check for other generate policy through this filter. Now let me explain the immediate policy, so mutate policy are basically used for modifying the matched resources. So if you see this policy, this will ahead label smashed resources.

A

Okay, so this is awesome puja. Let me go back and secure. My cluster also wait a second. How do I learn more about give or know?

A

I have shared you the documentation for kilberno, so you will find a github link on the same, and there are also free workshops and training from the company like network who created um ping me in case you need anything else. Sure. Thank you thanks a lot, it was really helpful. Thank you. A lot hi. My name is dollas. I'm working as a devops engineer in nermata hi. This is pooja. I am working as software engineer in nmata, so today we saw how kiberno can help secure your cluster in under five minutes.

A

Details are available at givernow.io.

A

Please check this out and hope it helps. Thank you. Thank.

A