Cloud Native Computing Foundation TAG Security / Policy WG, 4 Aug 2021

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: CNCF Security TAG Policy WG - 2021 08 04

Description

CNCF Security TAG Policy WG - 2021 08 04

A

Morning, everyone well see if we give folks a couple more minutes to join.

B

All right, thank you.

C

Hi guys hi robert.

C

I'm good, thank you. How are you doing well.

D

A

Good morning, how are you.

D

Good hi hello, bud, hey, I guess.

A

Go ahead and get started and others will probably join in. Let me see, can I share my screen. I've got the agenda updated here today. Okay,.

A

Someone seeing my the agenda meeting here.

B

C

A

Okay, uh so I can review the project board if everyone would like to do that.

A

I know we've had a couple of.

A

Break work breakout working sessions on the white paper and I think the the big news is that our kubecon presentation panel has been accepted so we'll be doing the panel discussion uh in october.

A

So all the more impetus to complete the white paper.

A

Yep oops, I somehow stopped sharing sorry about.

A

um I didn't I don't. I don't think there were other um defined topics for the agenda today. I certainly didn't have any um anyone else I'll I'll give opportunity for anyone else to make uh agenda suggestions? Is there any.

D

Yeah I had a question. um I seen the slack for the policy work group lot of comments about enablement for various engines to generate policy report. Do we have like um one spot? We can go and look at what all is out there.

A

So sorry, they're looking for how to create the policy report or no.

D

No I'm talking about what are all the various enforcement points that generate policy reports today right. Do we have like an inventory of it that we can and maybe point us to the details right because I see a lot of I know. A lot of work was done. Some people came and presented here, etc, and I also see some uh posts in the workgroup policy um slack channel.

D

But what I'm trying to figure out is, you know, do we have one spot? I can go and see what all is out there right.

B

Yeah convenient list.

D

A

Okay, uh I will so, I think the short answer is there should be github issues in the repo for each of these and obviously, um if, if we're keeping those fresh there should be, the status should be captured there, but um yeah I can. I can rarify the github.

D

Yeah we could just create like a table um like, for example, in our policy collection, repo right, that's what we have right. We have a table where every time a new policy gets contributed, we added.

D

Something like that.

D

In you know, github, I think that'll be great.

A

And where, what's the best way to broadcast that out, is that I mean other than we can? We can create the table and kind of post it to the slack channel, but is there if we wanted to put it somewhere, that's more permanent and folks would find it more easily. What do you think is there a should we ask for it to like literally be in something we.

D

Can just have it in github itself right um where people are contributing. Let's see here, I have to find that link.

E

D

D

What I'm suggesting robert is, we already have a spot where the policy report spec resides and everything right. So, if you just create the table there, okay, that way it goes together right.

A

A

I'll take that as an action item.

A

um Guess then kind of a complimentary question to that is recruiting new and more projects to to then take out the policy report.

A

So I think that's.

D

Great yeah, because once we start putting together the table, then we'll have a view of you know what do we have today right and then, as we progress our white paper, you know we're going to talk about some of the cncf projects uh for various uh enforcement points right, so then we can start um seeing how we can make more progress in having all of them generate policy report right, that's where we want to head right so.

A

Well, and also, I think um what would be enormously helpful, and maybe this is something we can talk about on the panel but visualizing and surfacing those policy reports in a meaningful way downstream to the you know, to the devops team to the compliance team, whoever whoever is looking at this, I think, once people see the kind of the value the benefit, then there will be more momentum around getting more and more of the projects to support it. Does that make sense.

D

Yeah absolutely- and I think we have the beginnings of that in the open cluster management project um where we now have are using the policy report, um schema uh actually the pulse report cr for some of the uh insights and so on. Right and um and then we are working right now to integrate uh our policy violations into it. So then we can start visualizing that as well, so gus from my team is on the call here.

D

So maybe because we can take a follow-up to come back and present here sometime on those details, right sounds.

B

D

Once we make some more progress on that front,.

A

Yeah that'd be great.

A

Oh sorry, typo, okay,.

D

A

So I think that uh I think that should be kind of a focus area for the next month, while we're kind of polishing the white paper.

A

If we can, you know, get all of the materials around the policy report. Usage cleaned up. You know better, better publicized if you will so that as folks, hopefully we generate a little bit more attention to the effort at kubecon, then folks can come and find these materials more easily.

A

Link to you know, projects uh link to presentations about using the policy report in a meaningful way like that, will all be very helpful. Come you know, late october, when everyone's really excited about okay, great I've just learned about this new thing: how can I operationalize it actually use it day to day.

F

A

Seems like a good seems like a good uh sprint from here to the end of october.

A

Is there anything um so we've? You know when we first started the policy report effort it was. It was a response to you know there were there were projects who were kind of already producing variations on them? Is there a similar push on the policy definition side that we need to?

A

Maybe not in the next? You know 30 60 days, but in the scope of the next six months. Is there a policy definition effort that needs to be reviewed, or is that just now just everybody can use their bespoke rego yaml, jason, whatever whatever they want to use, and then we just let that fit the purpose, the right tool for the job so to speak.

B

There's there's definitely a broad spectrum of you know. Like you mentioned what everyone uses today,.

B

Certainly could be some advantages to having it.

B

You know some some standardization around it, but I would imagine.

B

There's certainly be some some difficulties around getting all the you know, different use cases to line up properly.

A

One one project I recall- and I can't remember if it was oprah or caverno, but I think someone had been looking at kind of everything compiles the wasm and that kind of became. You know that might become like the de facto standard and then you know, arguably there would be a corresponding.

A

You know policy asset policy, something crd, so that you could actually deploy your policies and manage them on the on the front side.

A

I'm not sure if anyone has had experience with those efforts or if those efforts kind of died in committee or if they're they're, ongoing.

B

A

Not keeping up to the latest and greatest.

A

Okay, well, I will, I will take it as a an action item to kind of refresh.

A

I can reach out to the oprah folks as well and see if that was still an active effort or there's pr's that can be refreshed.

A

Okay, any other topics, any other agenda items that folks want to put on the list.

F

Hey folks, it's jim, I just joined in apologies for running late. um Yes, sir robert one, one topic I did want to quickly bring up is the linux foundation fall. Mentorship program is getting started and you know in the past. What we've had is, of course, folks, like um you know, martin j and also um you know now what we're doing on the falco side as well as the you know, trivia adapter.

F

So the question is: what do we? What should we tackle? Next? I think there was a issue logged in github on coupe armor.

F

So that's something you know we could take on um and I think there was also a discussion I mean we had on and off discussion on, gatekeeper so wanted to know, and I don't know if jaya and team have had some. You know more recent interactions. I haven't had any recent interactions with the gatekeeper team, but maybe good to revisit as well and see what their thoughts are on supporting the policy report.

D

Yeah, that's a good question um so guys have we done any uh recent work in the gatekeeper community. I know we have a couple of folks involved, but I know we've been busy with other things too. So.

D

I think the way we are doing our integration gym is, um if you remember the open cluster management architecture, we have a hub site and we have the manage cluster side right. So the gatekeeper will be running on the manage cluster side and then what we are doing from a policy report. Integration point of view is: we are trying to integrate on the hub side.

D

So, okay, um yeah.

B

So right now, I think gatekeeper is exposing. You know the equivalent data through through events, and you know those events would certainly, uh I think they you know, expire after some amount of time.

F

B

Right, they're just kubernetes events, so something like this certainly sounds reasonable and- and I I haven't you know, talked to anyone, but it it seems like a good idea.

F

Okay, because if you want to initiate that, if you want to add an issue to our github and also perhaps to the gatekeeper github- and I I again- I've been a little bit out of touch with that community. I don't know if rita is still the right person, but we can certainly have the discussion. I've spoken to her in the past about policy report and she had some concerns at that time on scale and management.

F

So we can go through those issues and discuss how we've solved for other tools.

B

Yes, uh yeah, and I certainly understand that concern I think, had to have that concern too, but yeah. We can certainly open up the issues and get get a discussion going.

F

Okay, I think that would be great and um robert. I think you had also you had opened the issue on coupe armor right, I'm not sure if you've had any interactions with them recently, but certainly that could be another. That's a runtime tool uh which we could look at supporting.

A

Falco next generation, but um yeah, I think so I think they could be interested in that I have. I haven't spoken to them uh in any depth since the presentation, but I do have channels that I can reach out there. I I will I I have reached out to tim and ash for oppa, so I will refresh that they've always been receptive. um I just think they're busy, so I'll continue to ping there as well.

A

So in addition to gatekeeper, oprah, proper.

G

A

I know on the on the ingestion side I see we might have kapil on so I know custodian might be interested in consuming the policy reports so not necessarily producing, but maybe both, maybe maybe producing and consuming.

G

Generally, yeah: that's what we uh for various finding reporting things in various systems. We generally want to support both um posting them, creating them as well as consuming them as a artifact of filtering to those resources which have extant reports against them.

A

That be, uh would you guys be with the project be interested in uh linux foundation, project.

G

um I was just thinking george castro, uh about this. I wasn't I'm not fully aware what the details are for the with.

D

The mentorship.

G

Projects like what's the intent on the program itself,.

G

I can look up that up out of band to that. I'm just I just don't know what the context is.

F

Yeah the program is, has a much wider scope, so it would be good to look that up and you know kind of see what it does, but from the conv in the context of our working group.

F

The idea is to you know, and a few of the folks who are on like stephen anushka murtanje they're, all you know either currently doing these mentorships or um have graduated from them. The idea was to take the policy report and you know kind of show how we can adapt other engines other tools in the ecosystem um to produce the policy report. So that's we've mostly been focused on the produced side of it, but happy to look at the consumption side, and it's really based on you know. I guess community needs adoption things like that.

F

But the first thing to do is for maybe your team to evaluate and see if it makes sense and how what that would look like.

G

Yeah, I think robert had mentioned previously that he had been looking at potentially adding student support for it, but uh so we had trailed off. um Are there any extent of open source consumers of the reports.

F

There are right there so there's a project called policy reporter, which is, it was just recently donated to the caverno project which can consume. Any policy report displays that in cluster also, can you know send that to slack or pagerduty or other things? So that's probably the best thing to look at.

G

Great. Thank you.

A

Yeah so on the I mean jim, I I think you hadn't joined, but just a few uh minutes back. We were talking about if we can demo the value from the consumer side and surfacing and visualizing. Maybe um the policy reports so like show.

D

A

What I get at the end of the process that that could drive, you know more momentum around getting more and more of these projects to support it right, because it's good to have both it's kind of a two-sided marketplace, but at the end of the day, the ones who are actually looking at the reports or managing devsecops around it are going to be the ones kind of pulling saying hey. I need more and more of these projects to support this, because I'm trying to build a unified. You know dashboard report compliance report.

A

Whatever that use case is.

F

Right that makes sense. Yes, sir, and I know it talked about, I believe frank had done an early demo, but maybe it's a good idea to reinvite him, and I can do that and add him to the agenda for our next meeting.

F

The frank's, uh the you know, lead on the policy reporter.

B

I think that'd be great.

F

Okay, we'll do.

A

C

A

A

Yeah, okay, um so I have a couple of action. Items for me um sounds like jim, so you'll, jim you'll kind of shepherd. The linux foundation discussion for is that.

F

Yeah absolutely so, let's decide on you know: coupe kubernetes, gatekeeper, open couple. If you want to get back to us on the you know, cloud custodian side and see what makes sense and we can um and I'll I'll then file the linux foundation requests based on that.

D

um So gus- and I were talking earlier today in a different context about qb scan. Have you guys looked into that.

F

I have not I'm not familiar with it.

D

Does do you want to give like a quick uh executed summary of what it does since you have played with it?.

B

Yeah, so kooby scan is focused on what they call risky roles, so it it highlights any roles, you've defined as is either you know, not a concern or, um or you know, kind of a warning or critical based on um you know some some definitions on on certain types of roles being being risky um by, like you know, access to secrets- and you know things like that- that could could be- you know higher risk than than a lot of other things.

B

um They. um You know it's it's just a standalone tool and you run it and it generates. um You know a report on your console. So there's no kubernetes feedback. uh It's all just you know a visual feedback that a user can see, and you know I think.

B

I'm not sure how active the project is it you know when I submitted a pr some time ago, it really took a long time to get any kind of feedback, so I think that would be the main concern of that project, although it would be something you know useful to to consider and it's a k-u-b-I scan.

B

I can probably look up the.

B

Page real, quick.

B

Cyber art to be scanned.

A

A

I know um is it: uh what's that fair winds, don't they have something similar I can? I can. I know they have several tools.

A

I can't remember the name um there's also not in a kubernetes. It sounds like it's very similar to like an im access analyzer if you're familiar with aws stuff, it kind of kind of scans, all your. I am roles and looks it inherited. You know.

A

Trusts relationships and then decides you know if something has more privileges than it should.

B

It generates a finding that.

A

Kind of thing I don't know if that's applicable to the um kubernetes are back model because kubernetes are back, I don't think has a deny and I don't think it yet has all sorts of complicated trust permission, uh trust models, but cool. Take a look.

F

I mean certainly there's no lack of projects in a lot of different areas right and I think we probably need to figure out. Obviously, based on you know, community usage active support things like that. What makes sense to add and where this fits. So maybe the first step is to have the project team, invite them to come and present, and you know show us what it does, how it fits and then we can discuss if it makes sense to either adapt or have a native policy report type of support.

A

Yeah, no, I think that I mean in general. I think that should be the flow like you know someone. If someone sees an interesting tool, we should probably reach out um and I'm happy to to do that, reach out to the project see if they will come, give a presentation um and then based on that you know pitch pitch them on the benefits of the policy report, but hear their feedback and and concerns and or uh suggestions.

A

So that'll. You know they make the spec better over time.

F

A

Yeah, if it kind of graduates and kind of a mini, cncf project process, it kind of graduates to the level where there's a user community and a lot of engagement, then you know the linux foundation. Mentorship might be a way to keep building out adapters.

A

Are there any other mechanisms for that jim other than just the linux foundation?.

F

And there's always this google summer of code there's of course, uh contributors uh in the community right so folks want to, and of course the project teams themselves can contribute.

D

So jim, how does this linux foundation fall? Mentorship project work? You just submit a proposal and then there's a review process and.

F

Right so working group, six and linux foundation or other cncf projects can do that.

D

Oh got it: okay, cool.

B

A

Yeah again, I think it's going to be. You know once we we have a few projects doing generating it would be nice to get gatekeeper um and falco certainly will be, will be huge, um but then I think it's going to definitely need a pull from the consumption side so that people can see the use cases and really crystallize like what's the value.

A

Is it otherwise it's generating lots more stuff in my generation yeah, my in my data lake so to speak, is kind of interesting, but until I can actually do something with it make my job easier, I think we'll will go a long way in moving things forward.

E

Cool hello hi: this is ankur. Sorry, I couldn't join earlier.

A

To have you we're we're just about to wrap up unless other folks, okay, that you had any.

E

No, I just wanted to mention that I'm um I'm in romania for the month of august. So I see all these invites for uh you know, writing the paper, the white paper and it's always like 1am for me, you know so um so I want to just get an update uh if I have to do any changes, if you got a chance to look over what I wrote and if there is any feedback on on updates.

A

Yeah, so um I did look at what you wrote. It looks good, I think. Probably uh romania is gmt plus three.

E

Seven ah plus uh plus two, I think now it's 6 30.

A

Okay, so yeah, so I think you and I can I mean anyone- is welcome to join, but um I can I'm typically up early pacific time, so I think we could probably find a working session.

E

Okay, okay, so so you have, we have you have work to do to merge things or and so on. So we can schedule something cool.

A

Yeah, let's schedule a half hour or maybe an hour max.

E

Excellent. Okay! Thank you. Thank you. So much! That's all I wanted, because I miss all of those and busy. Otherwise you get a chance to sing quiz with you guys. Okay, thank you. So I'm looking forward for uh for a time that works for you.

A

Fantastic I'll reach out to you.

E

Okay, okay, thank you. Bye.

C

Okay, uh hi everyone can, I just uh take a minute, and uh you know, show uh showcase a few updates on the falco adapter.

A

Yes, please would you do you want the screen share.

C

uh Yeah, that would be great.

A

All right, how do I stop uh sure?

A

No, let's see, can you did you, take it or.

C

I know I'm not able to share.

A

Okay, sorry, I'm not I'm not a zoom expert.

E

So I've also noticed that zoom started to ask for authentication. This is something new. I had never used to ask before.

A

uh It's not super new, but okay. Well,.

E

B

It was new to me.

E

Yeah, so so it's it's a new setting on this zoom, because for me connecting to this zoom it's the first time I was to authenticate so okay.

A

Yeah, it's been asking for authentication for a little while.

E

Okay, so it's not, it wasn't just me being on the blacklist. Okay, thanks.

A

G

Actually, on that topic uh it would it be useful to actually update the the working group readme with regards to the meeting link to actually note the password.

A

I thought it was in the the sevens, but.

G

uh It is not um this working group meetings, uh at least I didn't see it when I I I guessed using the tech security one when it happened to work. Otherwise I would have been locked out as well.

A

Well, there's there's a third rail you're touching there, which is.

E

Oh, I see okay. Okay, I see I could I use my google one. Okay, thank you.

A

Yeah, well I'm trying to get the the kubernetes infrastructure to get us our own zoom, so I'll try! Yet again. This will be the fourth try, but we made I may just jim. I may just make the executive decision that we're just going to use this new tool and go rogue a bit, because this is kind of getting ridiculous anyway,.

F

Robert did you reach out to christoph on that, because he should be able to help us.

A

I did but anyways we'll try one more time.

C

All right, thank you, everybody, so I uh jim and I we've been working on uh alcoa adapter and integrating that to falco psychic as another output called policy report output. I have been uh in touch with gas and thomas, and we have been working on this right now we are able to create. We are.

C

We are working on a draft pr in falco psychic and we are able to create a policy report which has all the uh alerts generated with a specific name space and a cluster-wide report which has uh all the events without a namespace or for information. So uh we will be working on. um uh Furthermore, updates which I'll just tell you about after a quick demo.

C

So right, uh that's policy report enable and it's creating a dummy policy report and dummy cluster policy report. I just went ahead and got a few events from thomas's fake generator.

C

I am also working on getting these events from falco itself.

C

C

So that's my policy report and the other one is my cluster policy report. So yes, that's what we have right now and.

C

Great so now we're working on being able to create n plus one reports. That's in uh namespace specific reports and one clusterwide report. I have added a couple of customizable options in the configuration like a one bound, which would uh give some sort of uh integer value, for uh you know the events which will be mapped to fail and won in the policy report summary, and I will be adding a few more by the next demo and yes, that's all for now. Thank you so much.

A

B

D

B

D

Yep very cool. Thank you.

C

Thank you guys. Thank you for all the help. Thank you. Jaya.

H

It was great thank you.

H

So jim, I also wanted to discuss the issue that we were discussing on uh the other day like the wrong summary numbers in the policy report cube venture doctor. So I guess I tried to run cube bench uh parallelly, like the rock cube bench that we have and the other one in my adapter and both were giving uh only the difference was there in the warning.

H

So if we look at it, as I mentioned as I have sent the screenshot even in that github repository issue, uh what happens is that uh uh three warnings are being missed and when I checked it like, whenever it is running inside our policy report like inside our custom resource definition, then it's not showing those three warnings. Otherwise it's adding those three warnings. Additionally, when we are running it raw, so I I checked it in the job dot yml and I haven't seen any update since the time we have embedded it.

H

So uh I checked- I I will try to look. I was last week was pretty hectic due to the internship and my university exam. So I will look into that issue again this week and hopefully, by the end of this week, we we hope that that will be resolved.

F

Okay, yeah that'll be great. Thank you. Yeah yeah.

A

Okay, uh anything else.

A

Otherwise, we'll give folks back 20 minutes.

F

Sounds good thanks. Everyone thanks everyone. Thank you. Take care, bye,.

C

Bye. Thank you. Bye.

B