Cloud Native Computing Foundation TAG Security / Policy WG, 7 Jul 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: CNCF Security TAG Policy WG - 2021-07-07

Description

CNCF Security TAG Policy WG - 2021-07-07

A

B

A

C

Hi, jim hi robert hi, mr.

B

Hi hi, I am, how are you.

C

I'm good, how are you I'm good.

B

Hi jim, how are you.

A

A

D

Robert just checking the agenda didn't seem like we had any specific entries or items for today. um Anything any other topics you wanted to cover or.

E

No, I I didn't have a chance to uh organize any presenters for this week, I'll try to try to look ahead a couple of weeks and see if we can get uh someone for them, if not the next session session. After I hope everyone had heads down with the cfpb's anyway,.

A

A

Hello there, hello good morning, good morning.

E

A

A

E

So I think, if uh yeah, if everyone's here jim, do we, if we don't have anything formal on the agenda, do we just want to review? Are there any prs or issues on the crd that we need to approve or review or.

D

Yes, so we can kind of do a quick update on the crd projects from manuscript. I don't think steven's able to make this meeting, but if he joins he can do a quick update as well, and then um you know yeah the few other things we had carryovers were.

D

There were some items, I don't know if you had a chance to look at the zoom account and the youtube setup, but we need to get that done.

A

Yeah, if you want.

E

To start there, I'm in a bit of a quandary, because what the cncf folks told me is that I guess everyone's moving to bebbie.

E

So I I didn't want to set up the zoom account only to move over to baby. But I was going to clarify on the 10 a.m, call and see if someone could give us definitive guidance as to whether that's a requirement or a suggestion.

D

Yeah I haven't heard of that. I I would just maybe get the zoom setup done for now and then, if everyone's migrating over uh in bulk, then I guess they'll just migrate over all groups.

E

uh I can ask yeah that I didn't get that it was more. You know typical, uh you know, here's the here's, the directive. Now everyone go, find their own path to it, so but I'll double check, I'll, find out, okay and then yeah. If there's no, if there's no official guidance or that was just a rumor, I mean I did google around- that there were some blog posts about it, but um regardless, if, if I don't get clear direct in then I'll, just pull the trigger on zoom.

D

Yeah, let's go ahead and get that done, uh because I think again we need to update the meeting invites we need to get these videos done, and it's just um you know would be good from a housekeeping point of view to have that done.

E

Right yeah, but that to my point I I don't want to do that twice.

D

E

Don't think again, if.

D

They're migrating it so this is, you know again looking at the sick life cycle. I would just follow whatever is in this document right because it goes through. It has all of the checklist things like that.

E

Yeah I had done all that before, but anyway,.

A

E

Revisit it but, like I said I'll circle around after the 10 year, call: okay! Sorry! If that's the process still, then then I'll do it again and we'll see where we go. This time.

D

Right yeah and you can check with kristoff to see if the kubernetes you know, sigs and working groups are doing anything different, but again, if this is what we're seeing, let's get that set up and I'm sure again, if they're doing a full account migration, then they'll figure out a way to migrate. Everyone listed here but yeah, let's, let's find out and let's see if we can get this done.

D

Let me know if you need anything on those two things, because I think again, once we do that we can update the meeting, invites and uh see if we can get access to these videos, which has been lacking.

E

Yeah and just uh I think, brandon did pull the last two presentation: videos, okay, great those are on. uh If you, google, and youtube uh for the tag. Of course, then you'll see the policy work group videos there for last couple.

D

Okay sounds good um all right, so those are those two issues on the white paper.

D

I think there's a pending pr um where jaya had made some additional changes, so that could be also that's something we can probably review and try and accept uh before, like the white paper, subgroup meets again and I think we should figure out what would be the timeline to get at least a draft of the pr available for wider review right. So we can discuss that a little bit more tomorrow.

A

D

All right, um yes, I think we're good on this.

D

Okay, so then the only other items we can cover- or maybe the updates on the mania adapters or you know, integrations for the crd, so maybe anushka. If you want to just provide a quick update on where we are, and things done last week.

C

Right, uh thank you. I will quickly just update on what's been happening in the last two weeks uh I I have been able to uh you know I have an initial working model, ready, which is great, because now we just need to alter a few things here and there and uh well we'd, have the falco adapter. If it's all right, I would just I like to share the working demo jim. If that's okay,.

D

Of course, yeah.

C

I have a 30 second video I'd just like to share that.

C

C

Right so uh of course, right now, I'm taking outputs by a falco psychic web ui, but I'll just update on what's happening. There.

A

C

Now it's simply mapping and giving me a policy report, a very initial kind, with the mapping that was discussed earlier with carson, jim and others on the community and, yes, there's some initial priority severity logic established, which will of course be changing and well that's all so right, right now I am working on developing a web server, which removes the web ui dependency.

C

We are also exploring how we would go about contributing to falco sidekick with thomas and dan on the community and yes, otherwise, uh that's that's really all that's all I'm up to right now I have a sort of working web server that takes thomson's fake events generator and uh tries to give me the json, but that's still in the works. So that's all. Thank you. Everybody.

D

Yeah, so just to on the overall um direction, I know we've kind of discussed various approaches and there was some at one point.

D

You know there was some discussion with also the falco team on whether this should go into falco sidekick or be standalone. So the I think the latest on that is we're. You know we're thinking. This should become part of falco's sidekick and uh available configuration there.

C

Right we're exploring that.

D

A

D

Decided, or is that.

C

Thomas has asked me to work on the web server, so he can see. uh I mean earlier seeing the demo that I just showed. He said that this would uh this. This could be a contribution to falco psychic and he wanted to know a little bit more. So that's why I'm working on the web server right now using his uh fake events generator and once he has a better look at that, I think we would know for sure. If uh you know that's the direction we take, you got it.

D

Sorry, mercenary you had a question.

B

Yeah, no, I just had one doubt like in this project, like the project, looks excellent. The demo also looked like it's a working prototype that we are able to create the policy report from falco. If I heard it right that it was falco, sidekick, ui, so yeah so ui, but I I was just I have this question like. If, if we are able to install falco sidekick ui using hem commands, then why are we thinking of creating another server like why why we are doing the same work again?

B

Do you don't you think that would be a same work like like jim? Even you can agree with me on this type. We have already a falco sidekick ui, which is giving us the outputs. So if we are fetching those outputs, maybe we can use that and produce the policy reported that or or if the idea is that we have to contribute to falco city, then we might need a web service. Otherwise I think ui is also pretty much doing the same job. So.

C

So um I mean my understanding of this would be, of course, jim. Please add to it uh that you know web you uh taking outputs from web. Ui is just making giving a little more.

F

C

Want to do is make policy generator as an output for falco psychic. That's what we are looking into so that the way uh falco psychic gives outputs to other places. It could give an output as a resource for a policy uh report. uh So I think that's what we're trying to do. We like what we have right now is taking outputs by our website web ui, but that's just another dependency that we are. um You know working on, so I'm not sure uh if that answers the question. Okay,.

B

So what what is your suggestion, jim? According to.

D

Yeah, so I I, if I understood correctly, what we're talking about the web ui is just the deployment in falco's sidekick right. It happens to be called web ui, but because it has a ui component. But it's also doing all of the translation work like when you're, when it sends messages to slack or anything like that right.

B

Yeah, so is what it is doing. What I have studied in falco city, like falco, when we we installed falco sidekick, using hem, install falco and valco sidekick and falco sidekick ui. So I guess we pulled forward falco sidekick to a local host and with that it is visible.

B

The alerts are visible using their web ui, but what we are, but I guess I saw the code that she gave in the community channel and in that code I was seeing that she is using http.get to fetch those alerts from falco sidekick ui, uh which is deployed on port 2302 and it's available on route events. So she was fetching she is getting the outputs, the alerts, the events from there and then I guess she was in that course. She was mapping those with our policy report and generating the policy report.

B

So that was the working cycle that I could see in that code. So it was something like that like for us, when we, when we built the cube bench adapter, what we did was we were using nested job to get our output, so the falco sidekick ui is doing the same job with its events route. So, if we go to our even like, like in chrome, we open localhost, two three zero, two route uh events, so that will give pure json output of our alerts, all the outputs, the rules, the priority.

B

Everything and uh the same thing is being fetched in the program. I guess she was is doing. Http dot get to do headlines, so so yeah. So that's what I understood. So if we are getting it that those outputs already in real time, then creating another uh web service may require deployment of that web service inside the cluster. So that will be. You know another same kind of job that you are all at that falco side.

B

Kick is already doing for you, so that I feel would be a repetitive task and we can even go ahead.

A

B

Falco sidekick ui. If, if it's already doing the same thing, I mean that's, that's that was in my head, like seeing the initial code, I may be wrong, but that if we have a different plan of architecture, so that's that's what I said.

D

Okay, yeah: let's we can discuss more offline and kind of figure out where the best place to plug it in is uh but yeah I mean we want to simplify it. We if we can eliminate the dependency to the ui component. That seems like the right approach uh and then we like we had talked about underscore. Maybe we have to start with? How will the user configure this in falco sidekick right? So, let's define that and then once we have the user experience defined, we can figure out the rest of the details.

C

Right, that's right too,.

D

Okay, that sounds good. I bet I think, let's. uh I think it will be good to get that decision made quickly, whether we're contributing to falco sidekick or we need to do something separately. So if we can get that decided on this week or so then at least we know which direction we will proceed to complete the implementation.

C

Right I'll work on that as soon as I can, I mean I'll get to some conclusions as soon as I can.

D

Sounds good yeah and let's, let's discuss more offline on you know some of these other details.

C

Thank you, mr thank you, mr thank you so much. Thank you. Jim.

D

You're welcome man all right, so I think that's most of what we had you know with that. Stephen has also been in discussions with the um with the uh with the trivia, as well as uh the starboard team, in terms of how exactly the adapter can potentially plug in. So we should. You know we're also trying to finalize where that fits and we'll send out some more updates on slack for that.

D

um So those are the you know, sort of ongoing items. I don't know if there's any other things, we should plan or want to do either today or for the next session, but we can open it up to everyone.

E

Yeah under kind of the open mic topics- um and this may not be interesting to the whole group, so we can always break it off as a separate discussion, but um you know anka, I I have been talking more and more folks. You know now that oscar 1.0 is out it'd, be interesting to stand up kind of uh you know best practice.

E

You know version of kubernetes clusters producing the cr, uh producing the policy output, kind of ingesting that with auscal producing oscar output based on that. So definitely not something at the policy level per se, but more of the instantiation of all the stuff we've been talking about and actually the cr using it.

E

So you know, could touch all these adapters and whatnot or could be much more simple, just the minimum mvp. But uh if, if.

A

Anyone is interested in that.

E

um You know, I think we can we could. We could put it onto the slack channel or we could break it off in a separate slack channel, but I think that's an effort that there's a lot of interest in out in the in the broader community. You want to kind of see the rubber hit the road.

F

You are talking about this outside the white paper. Just uh just on open. I mean.

E

It certainly could inform the white paper. You know if, especially as we roll up sleeves and.

F

Yeah something like problems.

E

F

Yeah, it would be parallel. um We uh we uh have an um implementation of of the oscar framework um as open source. It's called trestle compliance and um it's what we had used across ibm and research party integrations to develop um those reports and, and particularly the translations between you know, current reports due to oscar so that we align with the framework. So um I think we can. We can see that, as you know, starting point so people that start using oscar, you know have some some uh starting point with uh utilities.

E

I definitely and- and I've looked at trestle and I think that'll be a part of the solution. Absolutely I think the goal here is to get to the finish point where you know a non kubernetes operator can see a kubernetes stack uh cluster and then see all the you know. We can even use that exactly and maybe modify.

F

E

F

I have today in uh in the white paper those two uh use cases that we have discussed uh the use case of the um namespace administrator and the interest on having more of an operational view of the of the policies and then the second one is, you know from a compliance officer, point of view and more of a compliance view of the um of the results, and that's where you know trestle comes into the picture, taking the first one and you know helping to translate it and have it in the in the oscar format.

F

I hope you finished that part and and and push it uh I mean jim. Thank you so much you. You helped me with the uh the the apps and you know everything is now linked works with it uh and so on. I I need now to exercise the the you know the push and the commit.

A

F

uh I'm not sure if you you, we take it from there or I need to create a pr from from my environment. I I'll ping you when I when I get there for now.

A

F

In operating mode, yeah.

E

Okay, great yeah, so I think the idea is I'm working with a couple of the uh cloud folks who you know might be willing to set up kind of a cyber range where we, you know kind of host them.

F

E

F

From which? Which companies.

E

uh Well, since I don't have a hard commit, I don't want to put anyone on on the record if you will so okay.

F

E

You want to throw.

A

E

F

The ring yeah you can invite to this discussion, also gov ready um uh greg um craig. What is his last name, um so he he works on on the ui uh version of of the um oscar implementation.

F

So we we work together so that between the the trestle on git and the ui with the with the database, we we provide a complete experience right depending on the level of uh so he would be a good, a good participant in this. In this discussion.

E

Yeah, I think you have my email, so if you want to just uh later on, when you have a chance to look up his contact, if you just want to loop us all on the thread.

F

Yeah yeah we have, uh unfortunately, I'm I'll be out the next two weeks, um but I can, I can put you in touch with uh with greg and chris. We have a regular meetings uh on on this topic, so we can, uh you can start you know discussing with them, uh so uh your email, I think I have it from this. uh This.

A

F

That that uh jimmy is editing, okay,.

E

I just and I'll put it here: that's there.

F

Okay, I'll go right now and put you in contact with them.

A

F

So this way and kick off the the the discussion at this small scale, while I'm off.

D

Should we also maybe invite the trestle folks to do a demo and show what you know how that tool works? Would that be of interest.

F

Yeah, oh yeah, yeah. Yes, of course yeah we can have. We can invite a cr chris from trestle. We can invite them um greg. Maybe he can give a ui and maybe by then we will have also the interlock between the two. So you can demo how they work together.

D

Okay, anka is that something that you could reach out to chris and greg.

A

F

A

F

Send one email, robert and jim and I'll put all these items in them. So this way you perfect yeah.

E

I'll take the action item once once you make the intro I'll I'll, coordinate with them and try to get them on the calendar.

E

Are you going to be back for the next session, or should I push it to two.

F

Sessions it it doesn't matter, I think chris can present with without me being involved. It's not another yeah. So this way we make progress. I think rather align it with jim's plans for the agendas rather than me being present. Okay,.

E

Great I'll take that once you make the intro I'll, take the action and get us all, hopefully on the schedule for next session.

D

Okay, that sounds good, yeah speaking of demos. One thing I just remembered is: we had also talked about inviting frank um who has authored the policy reporter too, to do a demo so I'll reach out to him and see you know when we can get that scheduled as well.

D

All right anything else.

D

Okay, if not, I guess we can give back 30 minutes to everyone, uh so have a good week and we'll reach out in slack. If anything else comes up.

A

Sure talk to you guys tomorrow. Thank you all.

F

A

Take care bye, perfect.

F

Thank you for giving some time to work on the white paper.

A

All right take care, bye,.