Cloud Native Computing Foundation Production Identity Day: SPIFFE + SPIRE North America 2021, 30 Oct 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Providing Identities to Serverless Workloads - Agustín Martínez Fayó & Marcos Yacob, HPE

Description

Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Providing Identities to Serverless Workloads - Agustín Martínez Fayó & Marcos Yacob, Hewlett Packard Enterprise

There are many situations where installing SPIRE Agent is either not possible or not desirable. One of the most common situations is workloads running on serverless computing architectures offered by the cloud providers like AWS Lambda, Google Cloud Functions or Azure Functions. This talk presents how SPIRE could solve the challenges associated with this, through the introduction of the SVIDStore plugin type, enabling SPIRE Agent to store identities in external stores in a secure way, so they are available for consumption by workloads running in an environment where installing an agent is not possible.

A

Hello, thank you for joining us today.

A

In this presentation we will be talking about how you can use spire to securely provide identities to serverless workloads. My name is austin martinez ashore. I am a maintainer of the spire project and I am part of the hpe security engineering team. I'm here with marcos jacob, which is also part of the hpe security engineering, team and marcos, will run a demonstration later in this presentation.

A

So, let's go through the topics that we will be discussing during this session. We will first have a quick overview of how workloads are attested inspire in order to provide them an identity.

A

We will see, then what are the challenges for the process in serverless environments and how sbd store plugins can help in this situation and and finally, we will see a demonstration of how spyro can be used to provide identities to serverless workloads, leveraging svg store, plugins.

A

So, if you're familiar with how spire attests and provide identities to workloads, you probably know that this. This is a pretty straightforward process where workloads simply call the workload api to get the identity.

A

But what happens if you can't deploy spire agent in your environment?

A

One example of such a situation is serverless computing.

A

What usually happens in this scenario is that an event triggers the execution of a function that runs in an execution environment, interacting with different services, and this model of having functions as a service uh is increasingly being used because of the associated benefits that it has like the lack of the need of managing servers on the way that you can easily scale, depending on the load, um just to name a couple, but the same characteristics that make it so attractive represent some challenges.

A

This model, where the runtime environment of the function exists just to run the function doesn't play well with the usual way that you deploy spider, where you have a spiral agent and next to the workloads that call the workflow api to get their identities.

A

um So uh in serverless computing you can call the workflow api from your function simply because uh you don't have it available um and it would be very difficult to deploy this variation in in the runtime environment.

A

So um we we have to look at ways uh to issue identities, uh to workloads without interacting uh with the workflow api, um and we explored different options for that. um One of them was to have the function uh or workload a testing directly to aspire server to obtain its identity.

A

We saw this pull model attractive for certain scenarios, but at the same time, we found some challenges uh related uh with performance and reliability.

A

um um The majority of the feedback that we got from the community pointed to a push model rather than a pull model.

A

With that context, we also looked at how a push model would look like where s bits are pushed to a platform. Specific stores and the function would essentially get the identity material from a predefined store.

A

In that way, uh the sv management is moving out of the execution time frame of the function. uh Solving both the performance problem and the reliability concerns around the dependency on inspire server that we needed to be available to issue the identity.

A

So the svd store, ancient plugin type, was introduced with the purpose of being able to store the esvits in a designated store.

A

So let's have a quick overview at how the sv uh as we store plugin uh works. um This diagram shows uh a basic deployment of spire where you have spiral server with a data store that has the registration entries.

A

um Spyro agent communicates to that server, fetching the identities that are entitled to that agent and keeps the asian cache updated. So.

A

It has the s bits for the workloads ready to be provided to the workers through the workflow api.

A

um What the new svd store, plugin type does is to provide a way uh to identify the entries that you will use to issue identities to servers workloads, uh and what this means in practice is that um when you create a registration entry, you are now able to specify if you want to store externally the resulting s bit from this entry, and this store action is done, buy an svd store, uh plugin uh that receives uh the updates uh from the asian cache.

A

So when there is a new identity, uh it's notified uh unfold um when the svd store plugin is notified about a new identity or an existing identity. That is rotating.

A

What spire does is, um instead of having that identity ready to be fetched through the workflow api, uh it pushes it pushes it to a designated store and the details of how the identity is stored in the specif and the specific attributes that each store requires are specified uh through the selectors of the entry.

A

um So, for example, if you are using aws secrets manager as a store, you will be able to specify the secret name through the selectors of the entry, and this provides a pretty flexible mechanism to describe the attributes needed by each specific store platform.

A

um So the aws plugin will need cell phones, things uh different than google cloud or microsoft azure um and can uh can be also used to describe attributes needed by a completely uh different store. Mechanics like it can be a plugin to store um the identity material on disk.

A

So finally, we see here that the workflow running in a serverless architecture environment can fetch its identity from the secret store uh in the same way that it gets other other other secrets.

A

So, for example, an aws lambda function can get the identity from aws secrets manager that was started by a specific aws secrets, manager plugin.

A

So at this point I will hand it over to marcos now that will show a demonstration of how spire can be used to provide identities, to servers, workloads and specifically, in this case, to an aws lambda function so marcos. Please go ahead.

B

Thanks austin hello, I am marcos jacob, as adoption mentioned, I am part of hp security engineering team. I am going to demonstrate how we can use spire to provide identities in a serverless environment.

B

We see a spire agent that is configured to use a speed store plugin. That plugin is the one that is storing identities as json on awpa second manager. Each circuit will be contained. The dtd in the second binary that contains the spf id the search chain, the private key, the bundle and all the threaded bundle that it related with.

B

At the same time, I will demonstrate a lambda extension.

B

That extension is the one that is communicated with circuit manager to get a specific set and storing that binaries in perm formats. On disk. We choose to use extensions because we configure it to start with the container and storing the material on disk and when the function is called, it will be using the information that is there.

B

This function is a very simple function that only do is to get their attribute x, 509 certificates and returning them to the camera. So, let's move to the terminal.

B

Like I started, aspire server and asian in advance, as we can see that agent is configured to use, it will be a second manager and needs storing the the secrets in this duration. At the same time, the plugin is getting the access key id and the second access key for my environment.

B

We can verify that the server does not contain any entry, so I will start creating the first one.

B

Here is an entry that we will using for the deep client and storing that's that secret as db secrets. Here we can see that the selector contains the plugin. We will be using the variable that we will setting as id. That is the second name and the id itself. It is possible to use the r if, if we want.

B

As soon as I create it, we can move to the logs here in logs. We will see that the entry was created, the speed is updated and it is propagated to the aws. Here is the arm of the circuit, where it is provided on the second name and what line will use.

B

We can verify that the circuit was created or rotate it. Let's call it an idlibs. Second manager's desktop function.

B

So here we can see, it was changed now here is the name, and an important part is that we provide a tax. The tank is spiral speed. It is usable to define what cigarettes are managed for spire and will be kept updated.

B

I will create in another entry for a second function we will use in this function is called with web line, and I choose to put the second name with secret.

B

The same way as we did before as soon as I created, the circuit is updated on aws, but something important here is that the visitor works the same way that word lockheed works, but that means that any time that is, it is updated because it is rotationally, considered rotation or a3 interchanges and force the speed to be rotated, and if it is provided to aws or any environment, we want to export.

B

So, for example, I can update that entry. I just created.

B

And I will add, in a federation relationship.

B

Here we see it is updated because the relation changed and it has a relationship in the same way, this bit is updated and it is propagated to aws.

B

We can build, we can verify it the same way we did before just calling the website remember the time I did it.

B

And here I have, it is to have the teachers right now. Is that the same time as we mentioned, and here is the name.

B

Okay, now the spice that is done, let's start the function.

B

The function consists in two things, as I mentioned before, an extension that is the one that is fetching a separate phone utilities and the function, as I mentioned before, the function is a very simple that we use to just get the speed and return it to the color.

B

So let me just deploy it.

B

This with an extension building the function, publishing the layer and that the layer is the extension I mentioned before. Here we have the spine extension. That is the name of it and is compatible with python. That is, in our case.

B

Right now, and it is creating the db client here, you have the client- and here it's important- that we provide the secret name as an environment variable. This is the secret that it is going to use.

B

And here we have the layer that will be running before, in this case the spire extension, and now it will be creating the web client that is developing the same. And we have the client that have a role that have access to secrets that had its own environment and it had relationship with the spy extension.

B

Okay, now that is done, I will call a very simple function, then, basically, is going to call the function, storing the response and parsing the response to get the certificates and the spf id it contains.

B

So let me call it.

B

B

Here we have the speech id what it means the function call use get the certificate is provided for extension and return it to us and, as the result is that we have the spf id, we was waiting for only for this demo purposes. I add some logs that returns the certificates, the keys and the bundles and more information and list on logs. It is not a normal case just for this case, so I will get logs.

B

Here it got the street id, we was waiting for. It expired here, the certificates it contained, it's actually changed. It contains a provide key, it contained event.

B

The same thing will happen if I invoke the web client, but there is no difference here. We can see the web as we expected, but the difference is in the logs because.

B

B

Remember that for that entry we add a fedex bundle, so here we can see that that and that client is getting the federal faded panel too, and of course it's getting the spf id we was looking for and the certificate and the private key and the bundle.

B

So that's all I hope you enjoy my demo and it was useful, see ya.