Continuous Delivery Foundation cdCon 2021, 6 Jul 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Sponsored Lightning Talk: Leveraging Pipelines to Automate Security Enforcement... - Cesar Rodriguez

Description

Sponsored Lightning Talk: Leveraging Pipelines to Automate Security Enforcement with Minimal Effort - Cesar Rodriguez, Accurics
Speakers: Cesar Rodriguez
Infrastructure as Code (IaC) and CI/CD pipelines help cloud native development teams deliver complex applications in the cloud, at scale. They also provide a great foundation for automated security controls that protect against accidental misconfigurations and help you eliminate security risks before they reach your runtime environment. This lightning talk explains how open source technologies can help you deliver more secure apps with automated IaC scanning and policy enforcement.

For more Continuous Delivery Foundation content, check out our blog: https://cd.foundation/blog/

A

Hello and thanks for joining this learning talk where we're going to talk about how to leverage automation within your ci cd workflow, to enhance infrastructure security requirements.

A

So why do we want to automate infrastructure security guardrails, while adopting cloud native architectures? We treat infrastructure more like software, where it's provisioned, tested and managed to declarative languages. The ephemeral nature of cloud infrastructure makes it hard to quickly identify and remediate security issues when you're limited to scanning only at runtime.

A

So we want to make sure that we evaluate the code used to manage our infrastructure components as early as possible and using automated workflows and tools so that our security approach can scale as our environment, scales and evolves and doing these security checks in your pipelines before changes are made into your runtime environment is ideal as it's easier to check for issues and fix them with minimal impact, and today we'll demonstrate how to do this.

A

Let me introduce myself before we get started. My name is cesar rodriguez and I'm a developer advocate at acryx. I've been working as a cloud security architect for most of my career, implementing cloud security programs and helping organizations with their cloud migration and I enjoy contributing to open source projects.

A

So one of the most scalable approaches to implement your security guard rails is using policy as code. So policy is code, means that you're writing the security requirements that are important for your system to be compliant with as code into a declarative language that can be used to ex to evaluate your infrastructure's code against.

A

So your helm, charts your kubernetes configuration yaml, terraform or any other declarative language can be evaluated using policy as code, and this makes sure that you're consistently enforcing your requirements as part of your systems, development, life cycle, and there are multiple, multiple benefits of using policy as code. You can implement your security requirements with low friction and there's no ambiguity onto what needs to be accomplished. In order to meet those requirements.

A

Your system would have security controls embedded in it from the beginning, which reduces the number of issues that need to be addressed once you're in a runtime production environment, where they're harder to fix and there's also increased visibility into the security controls. Your system needs to comply with. Since we can store the applicable security requirements with our systems code and they can easily, then we can easily identify what we're compliant with and any gaps that need to be addressed so to implement policy as code.

A

You need a declarative language that your policies are going to be written in and one of the best tools out there to accomplish this is the open policy agent project. Oppa oppa is an open source. Cncf graduated project with which is regal language allowed us to have a unified language and a framework to do policy evaluations against our systems and for a demo. Today, we're going to be looking at two example: regal policies which come from the kubernetes cis benchmark.

A

The first example policy is to detect when the privilege escalation setting in the security context of a container is undefined or set to true, and here on the slide on the left side, you can see our two functions that help us check for that on the first function, on top it will trigger when allow privilege escalation is set to true and on the second function. Here we detect when the setting is undefined and here, on the right hand, side. You can see an example of um a gmo snippet, that's not compliant with this policy.

A

The second example regal is checking when containers have the ability to run as root. So, within the security context, we're checking whether run is non-root is set to false or if front is user is set to zero, which is the root user or if any of these are undefined.

A

And here on the right side again, you can see a couple of um yaml snippets that are violating these policies, so um the tool that we demo today is called terascan, which is an open source tool that allows you to implement policy as code guardrails and includes many different regal policies for security-based practices on multiple infrastructure scope providers like kubernetes, helm, customized, terraform and multiple cloud providers, and it's packaged as an executable, and that makes it easy for us to integrate it within your workflows and using the operator policies for the policies it evaluates.

A

So we're going to be integrating this into our cacd workflow.

A

So this is a typical high level picture of a github ci cd workflow, where an engineer pushes code to a git repository and then this code goes through a ci process where it's built tested and we push a docker image to an image repository and then we're here we're using argo cd to sync, uh with our git repository and deploy our application into kubernetes.

A

So we can use turret scan here on multiple places. um The first place will be on the engineers local environment, where this is the best place to do iac scanning, as the engineer can detect any issues as early as possible and fix them quickly without having to wait for ci jobs to execute or for the issue to become a bigger problem once it reaches the wrong time environment. If it's not detected early.

A

um The next place is part of your ci pipeline, where you can have tara, scan a terror, scan job, execute and fail. If there are any issues that you deem critical enough for your workflow for your workload, next place is using a precinct hook, inaugural city, where terrascan is executed and prevents argo from syncing changes. If there are any issues and finally, we can use terascan as an admission controller to your kubernetes cluster.

A

So when terrascan is running in server mode, it can be configured to be triggered by the kubernetes admissions web hook and prevent issues from reaching your runtime environment.

A

So um you can check out the turks scan docks, for example, all the different ways that terascan can be used in your workflow, and today I wanted to demo how to use terascan as an argo cd precinct hook.

A

So for our demo, we're going to be using the argo cd example, apps repository in particular, I'm going to be using the guestbook app, the classic guestbook app, um which is a simple docker image that has a guestbook application.

A

So I copied it over to my local environment and I also am pushing the tire scan precinct and here what I'm doing is basically running um a argo cd precinct which uses the tourist can latest docker image and we're running tara scan against my fork of the repository, in particular the guestbook application, and I'm only triggering this for high severity issues. That terraskin is finding and I'm using the default policies that come with terrascan.

A

So the first thing I need to do here is deploy the application see if I have this yep, so I'm going to go ahead and create the guestbook application.

A

And now let's go to the ui.

A

I see that guestbook here is appearing, I'm going to go ahead and sync it from the ui which will pull the latest changes from the repository and also around the terrascan precinct as part of this. So we have to wait a little bit while terra scan runs on the repository as a precinct. So the way that argo cd works with precincts is that it will execute that presync before it tries to copy over and deploy the application itself.

A

So our sync has failed and let's take a look at the logs.

A

So, taking a look at the logs, we can see that terrorists can detect it. The two high severity issues that we discussed in the slides it doesn't have any settings to minimize the admission of fruit containers and it doesn't have anything regarding to the allow privilege escalation setting. So let me go ahead and add that to the code.

A

A

I'm going to add the security context for this container and set allow privilege escalation to false and run as non-root 2 and give it a non-zero run. As.

A

A

So now going back to this ui, I'm going to go ahead and sync again and now turret scan is going to execute against our updated copy in our repository. So it should not find any issues.

A

Great so terascan um was successfully executed. If we look at the logs we'll see that it didn't find any fun anything any issues in our updated code, any high severity issues, because I'm filtering for high severity issues and our guest book app is was successfully synced.

A

So thank you for watching today. If you want to learn more about tara scan, please visit the github repository where we have instructions on how to get started thanks for watching.