Cloud Native Computing Foundation Online Programs, 15 Dec 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: CNCF Live Webinar: Cloud native DevOps security

Description

No description was provided for this meeting.
If this is YOUR meeting, an easy way to fix this is to add a description to your video, wherever mtngs.io found it (probably YouTube).

A

And let me give y'all a little intro and off we'll go. Thank you. Everyone for joining us. Welcome to today's cncf live webinar cloud native devops security, I'm libby, schultz and I'll be moderating. Today's webinar I'm going to read our code of conduct and then hand it over to sebastian straub and simon milot solutions: architects, with prismacloud by palo alto networks, a few housekeeping items before we get started during the webinar you're, not able to speak as an attendee. There's a q, a box at the bottom of your screen. Please feel free!

A

Sorry on the right hand, side of your screen, please feel free to drop your questions in there and we'll get to as many as we can. At the end. This is an official webinar of the cncf and, as such is subject to the cncf code of conduct.

A

Please do not add anything to the chat or questions that would be in violation of that code of conduct and please be respectful of all of your fellow participants and our presenters. Please also note that the recording slides will be posted later today to the cncf online programs page at community.cncf.io.

A

Under online programs- and they will also be available via your registration link and on our online programs- youtube playlist with that, I will hand it over to sebastian and simon to kick off today's presentation. Take your way.

B

Thank you libby for your introduction. Thank you, everyone for joining our webinar today. My name is sebastian straube and I'm the cloud solutions architect in palo alto networks. Here, I'm sitting in zurich, switzerland- and I also want to introduce you seaman, milot he's also cloud susan's, architect, hello, siemen,.

C

Hey hello sebastian here, thank you, libby for the introduction, and indeed I'm a cloud solution architect at palo alto network, so basically mainly focusing on christmas cloud product and uh yeah. I'm happy to be here. I prepare like a nice demo and I will be jumping into the demo uh after the presentation of server 10.. So.

B

Thank you siemen, so I'm super happy seaman joined today he's our demo god, so we all pray to him. So all good. um So, um let's uh quickly start with our presentation. I prepared a couple of slides for us today here to grasp a little bit around what checkoff is and why check off has something to do with cloud native, devops security.

B

So first thing we we looked at uh in in our um quick research. We did. We looked at public repositories uh in the telephone registry and in the open source code, and we found um a pretty interesting um result here and we we scanned these.

B

We scanned these repositories, these open source repositories and we found that a lot of them were insecure or misconfigured.

B

Misconfiguration is one of our biggest challenges in public cloud environments um and also in general, application development life cycle security, in which we need to think around how we can secure our codes. How we can secure can we secure our infrastructure?

B

So um we take this away and say: okay, uh is security checked uh in by default, or how do we think around security and what uh I want to present you quickly? What checkoff is um so for the people who don't know actually what it is?

B

It's um chekov is an open source statistic analysis tool, so it enables us to scan um infrastructure as code in a methodology that is called policy is code in which you can actually then automatically scan code and and introduce this as scan code into and visibility in which we see vulnerabilities compliance problems and best practice problems in our infrastructures. Code templates in check up, we pre-built hundreds of policies over our compliance and best practices across all the public cloud provider.

B

So when we create an infrastructure's code, template for aws, azure, google and also kubernetes templates, like haven, charts, etc, we actually can use them and scan them with checkoff, and then this can show us the winnability and compliance issues inside this code.

B

In the moment we are around two million downloads with checkoff, so it's a very popular infrastructures code scanner.

B

In the moment on the market, um the um natively supporting, uh as I said before, also um kubernetes manifest, but also terraform cloud formation, uh the uh arm and others, um and also what I want to highlight here, is that checkoff is written in bison. So it's fully extensible. um If you want to use the source code and want to extend some functions if you're a python pro, you actually absolutely are in the way to do so.

B

um So it's a very simple, flexible tool um where we actually can control policies and enforce um that we can use our code. So, as we said before, siemens is actually um doing the demo after I showed a couple of slides uh in the meantime.

B

If you want to check out, uh you can go to this url and can check the code, um but I just want to give you a couple of more contacts around this product when you have checked your software development life cycle- and you know, you need to check every corner of your code and of your infrastructure's code templates, etc. um So our our approach here is that we actually try to to find um this vulnerabilities and compliance issues.

B

um We want to fix them, so we can fix them directly in the either like, for example, visual studio code. We have plugins for all the major development environments in the market, and we also won't want to prevent that. These problems are going into production environments, but we can also fix problems inside production environments, um so we can fix problems also at build time. So that means we can integrate our scans into the build time and into the time so in production, in in um running environments and in our csd pipeline.

B

uh As we said before, it's an open source product um and we also, um for example, can merge, pull requests um and we can uh detect and transform mis configurations. That's a very important point um and also we enforce our policies in your workflow. So how does it work? Actually? um The this is the challenge actually with with our code, because today we have the topic shift left.

B

That is very important to us, because we want to automate our um code and our security of the codes in our development environment and not in the production environment, because here on this side, we see that, for example, we we have one misconfiguration and vulnerable code into our bid pipeline, and then we deploy this um template, maybe 100 times or more, and then we create actually in runtime a lot of security alerts in production, environment and all this whole shift left topic is around reducing the security alerts in production environments.

B

um Without creating you know, tickets, uh jira, pager, duty or service now, and then actually need to come back into the build process, change and then deploy again. So you want to fix a problem in the beginning um and how? How do we handle this? So uh it's handy list like like pros and um we want to show you how this works.

B

So what we do is actually, when we, um when we do some code, combat, we want to fix and uh prevent in in the development environment and per request and build bid blocks that some vulnerabilities are going into the test environment, for example, and then also in the deployment operation state. We monitor and we can remediate in in this stage um and what we also do before we actually commit this code.

B

We scan these infrastructure templates um and also um make sure that this configuration meets the requirements of your of your department and what you also do is we. We then show some compliance reports, policy engines and show also some notifications around this topic. So we can integrate in your host csd pipeline in your workflow that you work every day and we make it easy for you to integrate uh and scan this whole different repositories and templates this. What do we integrate?

B

It's a very important question because we don't want to write this integrations by ourselves right. So you see a lot of logos. I don't need to describe every logo. I think you all know what they are and where they're coming from.

B

But what I want to highlight here is that we support all the major cloud provider, uh including kubernetes here um and then also integrate with the typical development environment, including github actions, jet lab and also jenkins, including also instant messaging alerts and communications, and also you also integrate in infrastructure is called frameworks like terraform and helm.

B

So so this is absolutely a great starting point for you. What's the benefit very quickly, so actually over time, when you using this kind of methodology in in the checkoff tool, you lower the remediation time. um This is um really interesting because at the end, you don't want to fix the problems in production rise, and then you want to decrease the high severity events. That means that we find vulnerability problems inside the app and reduce the attack surface from the beginning.

B

We simplify the compliance by checking compliance inside the template already and then by at the end. What we do is with all this combined together, we are minimizing the attack surface. So what are actually the requirements when we look at how to achieve these benefits and these requirements are that we need? Actually, these infrastructure is code security, a tool where we implement some guard rates.

B

We need drift detection. Drift detection means that we automate the deployment of the uh of the code um with the template, we're checking the template before deploying and then when we change something something inside the clouds. Some resources are changed inside the cloud we detect this change and then the the um notify on this change uh and also um scan scan this change then, for example, what you also need to implement is in secret scanning, so we want to make sure that we don't deploy or commit secrets into our production stage or into other stages.

B

um That's something we really want to avoid and then for sure, what's very important is the least privilege in identity access management. So that means you don't want to over privileged some user that have access to environments. So we also check this one. So one thing I wanted to show you is the box ticker. So checkoff is an upstream uh tool, so there's also a downstream tool for enterprise environments, uh and um maybe later you can check out what kind of functionality you need.

B

But if you need some specific functionality, then you can also check out the downstream tool so before we going into the demo. um I just want to give you a glimpse around our approach and how we tackle today's security situations. What is actually this situation?

B

um We are not only looking at um our security of the code, but the security of our whole environment, and that includes a lot of different aspects and when we look at these different aspects, we actually see that, for example, gardner give us some trends in strategic technologies which customers are looking at and we want to understand in which way we, for example, understand cyber security measures and how we can do hyper automation um on the uh on the right side here, and we also want to understand how to do uh data loss prevention, uh data classification and also looking at virtual protection security poster management.

B

All these kind of topics to come, then, together in the dashboards, to have a centralized poly policy in poster management.

B

So we emphasize here um for for um customers that they actually introducing some kind of cloud native application platform approach, and these cnep enables iot leader actually to laser focus on shift left so bringing or removing the problems out of the production environment. Bringing solving the problems inside the development lifecycle then also optimizing the deployment time and integrating security in the devops processes, reducing the application, downtime for break fix procedures, reducing security alerts and false positives and stocks also very important, because it takes a lot of money and time to solve them in production environments.

B

We also increase the agility and resilience and also we enable centralized management and dashboards and constitute the two landscape. So this cnap approach is something we really can recommend, but now, let's focus on the demo so simon.

B

I would like to take over my screen and I would.

C

Start starting mine, thank you silverstein for the presentation, and um let me hide this one so yeah.

C

Basically, what I want to show you like today is how to get started, also with a check off and the first uh stuff that you you need to do that you need to do is like install uh check off on your laptop computer, whatever uh so just by doing like a pip3 uh install check off, and uh that would be sufficient to get like a checkoff on your uh on your computer and then, as of that, you can run this kind of command check off minus l just to list all the policies that we have like embedded inside a chekhov, and then you are.

C

If you want to scan a specific file, you can just minus f docker file from apple. It will scan a docker file, and here on the on the right side of the screen, you can see like uh uh the fact that I have scanned a directory which contains a couple of like terraform templates whatsoever, but that's the output. You will get with the cli.

C

uh So if you want to do this, uh you you have the the command line, which is here it's minus d like directory, and uh you have to specify uh the uh territory here is like the current one and of course uh there is sometimes like a policy that could be like uh not uh very interesting for you in your situation, so it's cool for what we could call like a false positive. For example, you want to publish an aws spree bucket on internet and uh yeah.

C

You you need uh file, it's normal, that is publicly available, so you don't want to get you don't want to fail pipeline because of that, so you can skip some check, of course, and the other solution is to check if you do check that will specify only the check that you want to uh uh to do so, for example, now, if we go back, if we go to the demo here, I'm I'm in a directory where I have like a small python application.

C

I hope it's big enough for you guys, or maybe I can zoom it a bit um so uh and this uh I have like a python application with like a requirement stay here and I have a docker fry. So, for example, if I do like check off minus f docker file, the command that we just saw in the slide, it will scan the docker file and will give you like some kind of recommendation.

C

So, for example, here you have the ckv uh this policy from chekov, which is ensure that that the user for the container has been created. If it's not the case, because here it was not the case, uh but then that means you need to uh to do some extra uh to add the inside your docker file, for example, or to, for example, this one other than check. For example. What I could do is like skip check and just to make it uh correct. So let's do like that and then comma security, doppler, 2 and yeah.

C

You don't need to put a space here and here that will give you only the the correct uh the check which was correct before and that would assume that those two check uh they are failing, but uh you assume that it's like false positive for your development uh before to continue.

C

There was also like a command which is like check off minus l uh that will list all the policy that we have and, for example, here you can see that, uh for example, with uh this kind of uh uh checkoff policy will check all the aws access keys. So, for example, if we find inside the file uh aws access key, it will create an alert and, for example, it could block the pipeline and and this kind of stuff.

C

So you could really try to limit the fact that the access keys is published publicly or this kind of stuff. That's a bit the id then- uh and I think I don't know if I do uh something like that- I get. I think we have had it like last week or like something about look for g for j um yeah. That was a miscreation exclamation mark here. Where is my pipe.

C

Sorry for that so yeah, so for example, last week we have added like uh two uh policies uh for the love4j uh finality that has been discovered and basically this one is just uh ensure that we have a prevent message hookup in for g2, so it's related to the cvg that has been released so and for example, here we we can see that this one is for cloud formation, so the type of the policy is for cloud formation and this one is for terraform.

C

So we have like two policies which are checking the template for cloud formation and making sure that log4g is enabled on a web application firewall of aws all right, so that's kind of stuff we can do and then, of course, uh if I do like check off minus d and current directory, it will scan all uh all the current directory and uh doing some recommendation on the fire here here in this year.

C

I in this uh principle so but here we have like a docker file, but, for example, I had also in my repository some kubernetes definition like uh this one was to deploy the python application. I'll just show you and, uh for example, you should minimize uh admission of root, containers and and stuff like that, so we and of course, each time you have like some recommendation that you have here and and the guide also to help you.

C

So if you click on it, you get uh like a documentation with all the security id, and we have also the bridge rule. But uh here is we are talking about chekhov, and uh here you get like uh what you should do in your communities.

C

Definition uh to deploy this application and to make sure that uh han has none root should be equal to true for number this kind of stuff, and then it's like much easier to uh to fix uh your uh your your different configuration files, all right, so uh that's about like uh check off in itself, so the policies and so on, and I remember if you want to test it. It's like uh like open source of course, and if you want to test it, is like as simple as uh this set of commands.

C

It's really quick and of course you have a help for data help that will provide, like all the the helping regards of the cli of chekov that you can use.

C

Then, if you want to integrate this in a ci cd pipeline, there is already maybe first step is install. The checkoff extension into vs code or intellij do is, and then I will show you in this demo like a an azure devops pipeline, where I do a validation, so I will scan first, the external module of that I'm using in a terraform template.

C

Then I will scan the terraform template itself, which is deploying a communities cluster and virtual machine on azure, and then the I will publish the report in a g-unit format inside azure devops, when I do that, I can do the same kind of inside the asia devops. This cli output, but with the g-unit, is much like, cleaner and easy to browse. If uh not, everybody is like technical to go in the in a different step of azure devops pipeline.

C

Then it's like better published and I will show you that also uh then we have like uh the second stage of the the pipeline will be a plan and then there we will do a terraform uh plan command and we will output the format into like a main.json like a json file and then with chekov. We will verify the plan than json. So that's the idea is that you can have like different here.

C

I do it everything in once, but the idea is that you can have a different pipeline that generate a json file and then the json is sent to a different pipeline and stuff like that. And then I have a stage which is like yeah approve the change or I don't approve, and then we applied the configuration. So we do terraform apply and it executes the terraform template against uh azure and it creates like the communities, cluster, the content registry and the virtual machine that we need and in bonus.

C

But I'm not sure we have the time we'll see how it goes. The demo and sebastian put enough pressure on me or as a god of demo, but uh we'll see how it goes, but that's the idea then. I have also some example in regards of the github action uh so yeah, but basically can everywhere you can run a python. You can run chekov, that's the id, uh so that means you can integrate more or less everywhere that you want uh it's just that, for example, github action. We have like a super easy integration.

C

uh Azure devops is a bit less easy, but yeah you'll see. I will go through all that during the demo, all right. So now I will change of terminal I'm here in azure devops. In my repository and here I have couple of five.

C

Let me zoom in a bit, uh so I have my azure pipeline, we'll go through it uh like in the second phase, uh and then I have like a here and a case of file that I'm using, which is to deploy the azure community services on azure, and here I have also the module.tf, which is using an external module and I will scan the external module with check off. So, for example, here, if I do like like we did before check off minus d current directory, it will scan the directory and give you the.

C

Everything which is uh not non-compliant to the policy that we have and if I go up, we have like uh six uh checks which are failed, a tweet that we skipped and basically that's uh a way of, avoiding the fact that we want to uh like a false positive. So we skip some check uh inside uh inside the code.

C

I will show you that later and we have to check that has uh passed so if we go through them, for example, we'll see that on the access file uh there is uh some ensure that aks enable private cluster and I will go back. I will go to the to the base code, and here I have the extension, which is a checkoff. So let me grab it for you.

C

And I the forgot, so this is a the checkoff extension you just uh search for it. You install it and uh that would be uh sufficient uh to run so once it is stored. It integrates super uh smoothly inside inside of vs code, so the id and then let me remove it.

C

Maybe I can zoom it a bit yeah, that's better, and here what you have is basically, when you receive, I will change some configuration. I will hit a save button and you see that checkoff is running already to scan the different resources of this file. So now you see that here I'm creating a container registry here, I'm creating a humanities. Cluster is your community's cluster, and here I do the whole assignment for the to give the permission of communities cluster to pull container images from the container registry.

C

Of course, and here you can see that this one is in red and that means check off, discover some misconfiguration there and, for example, here we can see that ensure that aks enable private cluster what we just saw in the cli. So it's exactly the same. It's exactly the same output that we see once you've. You see that then you, you have a button which is here which is quick fixed. What you can do there is either you apply.

C

A skip uh you generate a skip command to evolve to to mention is the fact that it's like a false positive, for example, and uh or for what. What we could do is also, uh for example, ensure that aks eks as an api server authorized range ip, and here, if I go to the quick fix for that one, I don't have something like apply fix, which is out of the box from the vs code extension. It will provide me like a suggestion so and I can only generate a skip comment, but I don't want that.

C

I I want to fix that issue because I want to. I have a range ip that I want and I want to allow only this higher range ip to access my communities cluster. So what you should do is you click on the link and once you are here, you see that you should just add uh this uh this wrench. So let's do something like that.

C

Let's copy the piece uh that rule or we put it in front of the tag- and here we have something and let's say that my ip is a public ip, so 117 82 something and slash 24., let's, let's save and again check off his running. So this uh this check should be like uh okay, now, okay, so we just have seen that. Okay, let me remove it again up. I will save it again and once it's done, I will show you also another way to do it. So here we have the the check off.

C

That has several fade options. So if I go here in the quick fix- oh yeah, sorry, you can also apply the fix directly from the cli. So here is like ensure logging, azure maintaining, is configured and then it will add this uh profile stuff. So then we can fix the other option.

C

Just by doing this, quick fix generate and skip comments. um Yeah! That's let me grab this one, and I will add this one up like this all right and I will generate the other command just to make sure that uh it goes okay and then I will push the change into the pipeline and I will see how it goes over there.

C

So now I have like a humanities command, and here I can use the quick fix to apply the fix for the airbag, for example, and this will add that back as well- and I will take this like that-.

C

Oh, I will check quickly if the.

C

Integration so, and now I can also like uh quick fix uh and show that enables private cluster, for example, and then we have all that which is fine all right, and then I will, I will add, also the last one, and it should be all right, and this is like the skip comment and if you have like a skip comment, you can use file.

C

You have to use this in uh this syntax, which is like a check off uh and then skip equal, the checkoff id, and that you have it of course everywhere like, for example, this is the checkoff id and then basically, you just add uh like a double point, and then you put whatever command you want, for it could be like anything uh so and for example, I will azure policy either on or not. That was not.

C

Oh sorry, this one um yeah a quick fix.

C

Yeah, I think this is the one I didn't enable yet so.

C

Okay- oh sorry,.

C

Okay, I have to generate uh so now check if it's running again for the the last comment and I lost like windows v somewhere yeah, I do okay, so I have this. Addon perfect is twice so I can remove this one so, and this is uh what chekhov does it's really giving you like recommendation on the on the developer seat? What you should do to improve your your code before pushing it in production, so now check off his running and uh we will see how it goes.

C

If we have a green mark, that means uh chekhov does not have any recommendation anymore. Then we can push uh the change uh to the pipeline and in regards of the pipeline, what we do here- and I will come back to that uh so we'll trigger the pipeline- and this is for azure devops, of course, but we'll trigger the pipeline on the master branch and then yeah. We are using ubuntu. So we will install uh uh check off by doing uh by uh doing this command uh peeping soul uh check off.

C

Then we will in initialize the terraform and we'll give like a couple of uh information regard of the backend. So the backend is safe on the azure site and then we will validate the configuration of the terraform and then we'll check here with check off the current directory or the the set module. So we'll we'll skip.

C

Also all the check which which is in regard of docker and the output will be sent to uh with the format of geonet xml and it will be sent to a specific file, then that I will use that file to publish inside uh azure devops, that's a big id and then once the modules are okay, we will verify uh the main file so for the terraform template, which is the aks uh terraform and all the files that we have seen before.

C

And then we publish also those results, and then we have the plan and the plan is also has to initialize, because it's like a different virtual machine, a different stage. So we have to install again the checkoff. Then we have to initialize the terraform template and then we have to execute the plan. And here in the plan you can see that now uh we are, we will show the plan and we'll output inside a main.json.

C

That will be scanned with the checkoff dash f command, and then we will also output that comma, uh that that command yeah the output will in g we need xml as well, and then we will send the output in that specific file and then, of course, here we have all the parameters to go against the azure environment that we have, and here we have the publish uh test results. So we will.

C

We will publish the checkoff plan report uh that you can see here all right and then we have the approved stage and we have the apply the apply again. We have to initialize and then just execute the terraform apply. Auto approve command all right, so I think uh that would be it in regard of the explanation and then let me first check.

C

Oh if I don't have any uh exception anymore in my file here and I see that ssh excel okay, so I have like yeah, that's one of the modules I'm using inside the model.tf and it it tells me ensure that ssh access is restricted from the internet. So I should either deny the access either.

C

Add a specific port for a specific range, so what I will do- and here it is this- is the model.tf. I will just deny this action. Not. I don't want to allow ssh from directly from all the internet to my uh to my virtual machine. So let's do a check of minus d. Again, it's checking everything, and so we have like no skip check one, but we don't have any fake checks. So now I'm safe to push. So I will push the.

C

The change I've made fix, check off.

C

Issue or recommendation: it's not an issue with recommendation.

C

Okay- let's push it like that now that should have triggered like a pipeline on azure devops, and this is my pipeline, which is out not failing yet yeah. This is the one so it's running here and it will go through the different stage I just explained. So we have the validate the plan, the wait for approval and the apply so job was expanding.

C

Let's see how it goes here, so it will install the check off with the pipe by three installed check off and then yeah checkoff should be installed at the end so successfully uh update it will initialize the terraform so we'll check. Also with the oh, that's not good.

C

What's going on, init fade good one.

B

Can you maybe um zoom in a little bit so because text is very small.

C

But wait here: I have like infinite character and I test line 38. ah I think it's the recommendation from yeah. It should be like something all right, so fixing typo, so we'll fix the. I think this is 938. Okay. So let's push the change again and check off recommendation v1.

C

um Yeah is it okay now, for you guys yeah?

C

Oh! Thank you! Okay! Thank you! Okay! So let's go back to the validate option, so we have to wait again. Sorry for that.

C

So side note for me is to fix this. It should be like a double code and not simple code, the in the in the documentation. So let's wait a bit, so it's running like a again installing check off.

C

Then it will insert our form validate the configuration of the terraform template and then it will check the modules, because I have one model- and I didn't show you uh that much yet, but this is uh how to create uh the network, so it's provided by uh azure and uh the to create a v-net, providing like couple of names and uh and doing some fire fight the cost center for cncf.

C

This is on you guys, um okay, so my config is still not valid, so uh validate fade exit good one.

C

Oh, my god, but so let's validate it with exit one that will yeah.

A

If anybody see.

C

The the error just hit me, and otherwise I need I will oh, I will do something else uh just for the sake of the remote uh to be able to uh to go uh until the end. I will save this configuration and I will see.

C

And here I have the filling and then I will quick fix and I will generate a skip command for that so demo fee because of you.

C

So, let's save like that, I will push the change fix issue with api.

C

All right, so, let's push it like that and now we go back to the pipeline photos for the last time. I hope and then it should be all right.

C

So, let's see how it goes now, yeah. Of course we have to go through that all that again, but yeah. It's gonna take like a couple of seconds all right and what I wonder like.

C

Yeah well yeah, for the time being. Let me go back to that, because I'm not sure to understand why the mistake was on the field and appropriate for your setup ah yeah. I think it's like yeah and it's like um an array so yeah we might instead of of this okay, but anyway we we can fix it later, I'm sure so here we have the validate option and yeah.

C

Now the valid validation goes through and you can see that I've checked the module which are okay, and now I have the main file which is exiting with one and finishing blah, blah blah, so it failed the pipeline, and now we can go here in the pipeline.

C

We see on the last instance here and we can go in test, and here we have the full report, which is ensure that a case add an add-on cluster blah blah blah ensure that okay uses asia, police uh policies, add-on communities- cluster like yes, so we can see like which pipeline has failed, uh which action has failed and we can also see all the path actions or, if I clear all that, then you have a list of all the policies that have been checked and which one have been failing.

C

So, for example, here I have the cave this one, which is failing so and here I can go when I go to this uh fire. I will go to that website and see what is the recommendation from youtube? And here basically they just said that I should enable this. I I thought I have done it, but let's go back here and add on profile, oms azure policy yeah. I should basically add just this here.

C

Okay, so let's.

C

Okay, that will take some time.

C

Enabling equal to and then I can remove this.

C

C

All right so that let's do like this and yeah, I have.

C

Something like that, so, let's fix the terraform uh format, yeah yeah. That seems alright to me and now we can push the change with azure polished c, which is enabled enable azure policy.

C

And that's a bit uh what we are.

C

Wanted to show you it was also we can fail the pipeline in regards of the configuration that we have done and then uh now I'm running a new pipeline uh with a change I just committed. So let's go here for the live pipeline.

C

And let's wait a bit for the the fact that he installed chekov and initialized the terraform.

C

A

C

Always uh a bit painful to wait for the older uh that to be applied, but yeah. That's uh the live demo right. uh We need to to be a bit patient, and so now uh the the different steps are successful. I know I will go to the plan and like, like I mentioned before in inside the pipeline in the plan, so we will generate here the terraform plan.

C

We will output the configuration to a specific tf plan file, which is the main and then we'll use that file uh with the checkoff cli here yeah, basically, we'll show the the which is on first we'll convert to tf plan in json and uh and then we'll scan the json file with the checkoff okay and that's what we do over here.

C

So initialize terraform again and then you should go through.

C

Which is kinda yeah, which is which could be interesting as well, is that you have like some like a lot of affirmation here in the test plan. uh When you go to the once. I think and I will open it in different tab, and I will show you that uh just right after uh but oh, I can show you, and that was the one yeah. We don't have anything.

C

So if you double click here, you have also this kind of diagram, and you know that you have eight checks which are passed four that have not been executed. So that means uh those are the the different check from chekhov. I did, and I uh the one that I I passed for the one I I skipped basically okay.

C

So now, if I go back to the pipeline, yeah, okay still doing the terraform plan and yeah that's terraform, taking some time for that, but uh yeah.

C

But otherwise yeah, I think we'll go like. uh Maybe I can show you like very quickly on the terraform uh yeah. There is the chekhov website here that you can uh visit and uh I shared a link uh in the in the chat.

C

uh So you can also go there and create some customer policies if you want to, uh and otherwise just to show you like a couple of lines, how to do the integration with um with github action and here, if my telephone, basically that's how you should do so, you should set up python3.hey and then you can uh with the checkoff action. You can just pass a couple of parameters that you want, and here you have the different options that we have seen into the cli. You have them also.

B

Very sorry, can you zoom in again please.

C

B

Hard to read so thank.

C

B

C

uh Too big screen for me uh yeah, so basically yeah. What I was saying is like we set up the 3.8 python environment and then we can uh use the chekhov action which is out of the box file. You can just use like this and then you give like a couple of parameter parameters to skip some check.

C

If you don't want to skip some check and you can use white cards here right, so you can, for example, uh if you don't want to scan to check anything which is aws, you can do ctv underscore aws star and to escape all that, then you have the quiet option. You have the surf face. So, for example, if you want to make sure that the pipeline goes all goes okay, uh even if you have like fade check, then you just set it through and it will uh it it will allow.

C

Anyway, it will return uh a zero to the the command instead of one in case of failure, then you have to specify the uh the framework that you are using or and the output that you want and so on, and then we can in that way we can also in github. If I come back here in action.

B

Someone just a quick reminder: we have five minutes left. Thank you. Yeah.

C

Sure I'm almost done- and here we have like uh also this kind of report that you have, which are a bit less sexy than the azure devops. So that's why I spend most of my time on azure devops but uh yeah. uh Basically, that's all. I wanted to show you and if I come back here on the checkoff here, I have the branch and here you have the test, and this is uh what I wanted to show you today so yeah.

C

If, if there is any question, please use the the chat file, q, a box that you have like in the bottom right of the of the screen. If I remember correctly and uh yeah, I don't know if there is any question.

B

Yeah we had a couple of questions. I tried to answer them already with some questions around the documentation where we can find learning learning content, um then we had some questions around how we create this uh checkoff uh policies.

B

um I answered them by um using uh you know, using the open source, poi requests to create new content and also it's managed by the product management. So when we see new vulnerabilities coming up, then we integrate them into the latest version um and um yeah, maybe um uh siemen. When you know from your perspective, when we look at the demo- and you know um what we can achieve with great results here, including them in the csd pipeline. um What is the best starting point that you see for some someone who's new to chekov?

B

um What did you um yeah.

C

It's like uh for me and that's what I did when I discovered chekhov is like just install the cli, then uh go inside the director like a directory that I used to have and then improve my terraform template, I'm a big fan of terraform, so yeah and I was like uh really uh happy to see how fast I can go like uh like improving my telephone template and out to better secure, because the problem, also like you you're explaining.

C

If, if you have a telephone template the idea behind it, is to reuse it and reuse it. And then uh you might end up with a lot of ticket, because if you need to fix, uh if you discover that you have like a misconfiguration inside a terraform template that you have been using, I don't know for like 100 times. Then you have to to fix like a 100 uh production issue, and that could be like a lot of issues. So that's a bit uh uh yeah!

C

I was like really impressed by all the recommendations and how to improve the security on the yeah before to uh before, to uh to push the configuration and so on.

B

Okay, thank you. um We have one question one new question from lorenzo he's asking how the british group pricing plan works. um We are actually counting in the pricing plan the number of code blocks and we have something that is called credits. So we you buy licenses through credits and then we count the code blocks against the number of credits and, for example, 50 resources would divide 50 by 3, and then you have the number of credits we are using.

B

Any other questions and uh yeah, maybe as additional um information, we don't count uh execution of scans. We just count how many, how many number of resources we are scanning, not the number of scans.

C

So, for example, here in my terraform procurement is cluster. We have a container registry, we have a azure communities cluster and here we have a whole assignment. That would be like three resources. That would count as like uh one credit in term of christmas load, but checkoff is free. I mean it's free to use this open source, so you can use chekov without the virtual program platform exactly.

B

So do we have any other question.

C

Yeah thank you to bruno to give me the solution to fix my error, but I should have copy paste and not try to okay.

B

Okay, cool, so then, from my point of view, it's uh thank you very much for your attention and for joining our webinar today. um I would like to close the webinars a couple of minutes, giving you back and uh simone. Thank you very much for being the god today and uh yeah enjoying enjoy your day enjoy your evening. Thank.

C

B

C

Alright guys, thank you very much for your time.