Continuous Delivery Foundation Spinnaker Summit 2021, 9 Jul 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Executing Policies within CD Pipelines with OPA - AbdulBasit Kabir, Interswitch

Description

Executing Policies within CD Pipelines with OPA - AbdulBasit Kabir, Interswitch

It is common for organizations to have policies guiding their SDLC. Policies like who can deploy & approve, deployment windows, allowed artifact source, mandatory approval steps, and much more. These policies are most often hardcoded during tools setup or enforced through reliance on the goodwill people following "standard" practices. We all know that's not always the case. Policy engines like OPA (Open Policy Agent) help automate the enforcement of policies (defined as code). This talk covers some basics of OPA and policy enforcement within Continuous Delivery

For more Continuous Delivery Foundation content, check out our blog: https://cd.foundation/blog/

A

Thank you, everyone for joining us as we explore executing policies with within cd pipelines with opa, so I'm abdulbasitzkabir I work with interswitch indus, which is an african oriented. Technology-Driven company focused on facilitating and making payments.

A

I work on improving our sdlc software delivery life cycle, where we review and analyze how we deliver software and improve it as need, be I'm obsessed with improving continuous delivery pipelines and I'm curious about how things work.

A

So we all know software is it in the world there's software everywhere and as long as the software it has to be delivered. Delivering the software or deploying the software usually takes a set of practices and setup principles.

A

Every delivery is done in line with some certain practice and that and those practices are well known within the group that engages in the delivery. This is what we refer to as tribal knowledge, but as any group grows in frequency and size, private knowledge gets pushed to its limits. It doesn't scale. Well, it doesn't um it driver knowledge doesn't have any guarantees and also it's difficult to maintain.

A

So this means that some form of formalization, of the tribal knowledge needs to be done.

A

When these principles are formalized in a wiki or a document, a policy document, then you have something: that's more structured, something that's it's easy to maintain, but at the same time, policies defined in a wiki or in a policy document are not they're. Not they don't have any enforcement guarantees.

A

They're, well-defined they're easy to maintain, but there are no enforcement guarantees. So how can you ensure that the policies you need in your software delivery pipelines can always be enforced?.

A

You could set up the tool or the software delivery, um your tooling, your pipelines, you could set them up conforming to certain policies and enforcing those policies, but this is hardcoding the policies into the tool, and there are a few issues with it.

A

The first of whenever the policy changes, then no matter how many pipelines you have. If you have 100 pipelines, if you have 20 pipelines, you need to go and do the rework of coding the new policy on these pipelines.

A

The second issue here is: the pipelines are not usually context aware, for example, the pipelines wouldn't know when it's a holiday or not the pipelines, wouldn't know who the sre alcohol is.

A

Wouldn't it be great to have an engine that knows the policies and also be contacts aware, but at the same time these policies are easy to maintain.

A

We apply an easy to maintain policy to a fully context aware engine the engine generates the policy decision and those decisions will be used for enforcement, so decoupling the policy decision and the policy enforcement where the decision is generated and the the generated decision is now then used to enforce the policy.

A

Basically, what we need is a decision engine as we move from private knowledge, which is less structured and has less control and will most likely need to be enforced manually. So that's relying on everybody to do the right thing or making someone else go and check whether the right things have been done.

A

We move through wiki, creating your wiki, creating a policy document that defines all the policies. So at least now the policies are well defined, they're easy to maintain, but enforcement's us also has to be manual. We put hard code the policies into the tool into the setup of the tool or into our pipelines.

A

These gives us some level of automation, but again, the policies are now more difficult to maintain.

A

If you put the policy in the configuration, so the pipeline goes and picks the configuration and finds if, um if the process, if your pipeline is conformant to the policy, enforces the policy that is in the configuration yeah, this is another level of um this is a better level of automation, a better level of maintainability, but decoupling policy decision and decoupling policy from your application from your tool set, gives you the best level of maintainability and the best in terms of automated enforcement.

A

All the pipeline needs to do is so the service here since the pipeline. All the um all the pipeline needs to do is to query the policy engine. The policy engine has our policies.

A

And knows the context based on what's what was sent in the query and has the backup data the data that you, the user, that the opera might need to put together with the policy to make a decision and oppa is just an open source. General purpose policy engine opera stands for open policy agents.

A

It takes your you query, upper for a policy decision.

A

It takes your inputs, compares it with uh you takes the inputs, uses it to generate a policy different based on your policy in lego. Having um being fully contacts aware with the data, that's is it's the.

A

Decisions with the open policy agents are decoupled from enforcements, so the pipeline the service, gets to offer to generate a policy decision and that policy decision is now used by the pipeline or the tool to enforce the policy.

A

So a a system like this, the open policy agent policy is written for oppa. Where will they actually function in your cd pipeline?

A

Taking a typical cd pipeline that starts from its commits, build test package and deploy? Where would an upper policy written?

A

B

Say everywhere.

A

In commits and bills, you could have a policy that you require. A policy like all checked in juventus. Manifest must be validated reduction. Configurations must not contain uat parameters, docker files must be hardened and only use compliant base. Image.

A

In the tests phase of the pipeline, only q is an approved automated test. All scans must come below all scans that score below 80 must be manually approved if, for some reason, your static code analysis, the score of that is below 80 percent. You need a manual approval for the pipeline to proceed.

A

Qs must sign off on all production bills.

A

Build artifacts must not contain vulnerable dependencies.

A

These are the kind of policies that opera could enforce on the package stage of your pipeline on the deploy stage and there's a lot done in the kubernetes community with gateskeeper and the likes you could enforce- and this is like this- this particular policy has is not specific to kubernetes.

A

That applications must not be deployed on weekdays between 9am and 4pm, so no deploy between that window between the 9am and 4pm window on weekdays, only fully approved service request tickets can be deployed if you are using a ticketing system to log your changes. Only a fully approved ticket can be used in a deployment and terraform plans by developers must not have a delete action on any resource other than a vm.

A

So checking your terraform plans and see what's the checked, entire form is meant to do so. Let's take a typical example:.

A

You have the policy, and this will be. The policy in english policies must not be sorry. Applications must not be deployed on weekdays between 9am and 4pm. What would this policy look like in regul.

A

There you go, you would have this policy something like this, and you can check there's a lot of documentation on the openpolicyagent.org website on how to write up your your policy. Your regular files, a policy that enforces no deployments between 9 am to 4 pm on weekdays needs to know whether whether today is a weekday, so it basically chooses the current timing needs to know whether today is a weekday. So as long as it's not a saturday, it's not a sunday, then it's a weekday also it needs to it needs to know the time.

A

So we get the time in hours means and seconds and just and find out if it's between nine and four pm I'll show how this I'll I'll show how this policy works.

A

A

As I've explained um just checks, if it's a weekly and if the time is between nine and nine and six um before we actually um apply this policy and see how it works, let's validate it on the regular playground.

A

So there's a there's: this cool tool called the regular playground where you can test any and validate any of your policies before you apply it. It's at play.openpolicyagent.org, so just copy it and paste. It here paste your policy here. If you need any inputs and for this particular policy we don't need any input. You can evaluate it.

A

So, between nine and four on a weekday you get a deny um just to show you, let's see, let's check the time. So um one thing I like about the regular playground is, I can evaluate part of the policy, so I lighten this. I can evaluate the highlighted.

A

Portion um so you can see that's my time currently is 12 hour or 12 a.m: 11th hour, 38 minutes and 70 and 17 seconds. Of course, my time zone is africa lagos! That's my time zone. If we evaluate the date.

A

The day of the week today is a wednesday.

A

So if today is a wednesday and the time is 11 30 something, um then it means that definitely we will get a deny, but just to see if we'll get something else.

A

um I'll change this to 12, because 11 is, it doesn't fall within 12 16 about 4 pm. So, let's check.

A

Yeah, so we can see that the deny is empty, which means that um this deny phase didn't pass and just when, if you enable the coverage, you can actually see what lines got evaluated.

A

So the weekly line got evaluated as it true, and this line got evaluated as a false. So when this sign gets evaluated, suppose there's no need to go to the next line and the whole rule gets evaluated as a false. So let's see how that would work in your pipelines.

A

So switching over to vs code.

A

So we know that we have this policy, um so what's what we did was to now, just for demo purposes, set up um set up um us as an agent. The offer agents are supported in my comments cluster. So this is it.

A

A

So we have the we have the open pod and we have the service so just for demo purposes, I'll also put forward the service so that I can always reach it. On chrome,.

A

So now it's listening on.

A

A

So, let's see the policy, so if you follow the documentation on setting up your as a pod running early as a part in the kubernetes, then you can easily add the policies via config files and that's what I have here so the same um the time slot policy that we had we saw in rego file. That's what we have here in as a config file.

A

So it sends slots.

A

A

So yeah it is it's. I minimize this a bit.

A

So you can see just a config file created from that file from the rego file.

A

And I've applied it to my cluster, but I can also apply it again to ctl apply.

A

Let's just confirm saturday sunday, between between twelve to four.

A

Regions also, four, let's start with between lines to save that city apply, have an f my policy, which is it.

A

A

Configured um if it's here.

A

A

Channel, let's launch yes,.

A

Yes, so we can see is the.

A

A

um So it's the same policy. You can see it's applied. So, let's see, let's see, let's see how we can try to get opera to generate a policy decision based on this.

A

So once so, once we know that the policy is applied, we can always create a policy and there's you have questions. We've got ordered the opel code. You can always call this on localhost.

A

This is to just query the policy, and this is the policy. um um This is the policy raw. You can see the name of the policy of our date time slots policy, dutch policy times..

A

So how do we get the policy decision uh to get the policy decision? We can also use the curl, so this is uh using the curve. You can basically use any tool and just add a web hook stage that makes the policy um call to oper to get the policy decision. Once you have that policy decision, then you can decide what to do with it.

A

So using a call command to get the policy decision for the same policy we just added- and this is exactly what we had when we had when we tried to get the policy decision on the regular playground or deny using the nine to using the nine to four. So let's make a modification and change it to and and change it to um well, two.

A

So I did the edit. This save keeps it.

A

A

Apply the config.

A

A

This is taking some time.

A

Yes describe the config map just to confirm, yeah and generate the policy decision again.

A

This time I'll add deny to which the specific music decision.

A

Yeah, you can see that there's no results here and which means that um that's policy, that particular policy decision didn't evaluate and that's exactly the same case as what we had.

A

What what you had when we used 12 here, then I was empty. So basically there were. There was no results of running the deny policy.

A

Okay, so this all looks good and fine when you're doing it um using crawl.

A

But you know how does it really fit into a pipeline and because I'm very conversant with spinach, I'm very uncomfortable in spinach, we can test it out on spinach and I'll, be using um even dos tool I'll be using the ops, mx rendition of optimized modification of spinnaker.

A

So I'll show you that maybe, let's switch over to the so starting with uh enterprise open enterprise spinnaker. So this is like the enterprise platform or enterprise components of the um of the oes does open enterprise financial by ops, mx.

A

We there's there's a policy management page where you can create new policies, um so I'll just create a new policy.

A

So yeah they deploy um it's like invented.

A

Purpose operator policy engine: you see this description and you can do anything you want, but I'll just paste the same policy here copy this and it still has our 926 right. um So, let's test that so save this.

A

Okay policy: now we can deploy um so now to add the policy to um to the to a pipeline, and that can be done um still on the enterprise platform. So you go to setup here. You'll see a list of several pipelines, several applications, sorry and you edit, a particular application. So we'll use the test pipeline.

A

That's policy pipeline, so create a policy, create a policy stage. Choose the environment, give it a particular name. It doesn't depend on anything. Then you can choose your policies, so we're working with the node weekly deploy, save this.

A

So just to confirm.

A

Yeah so let's reach the spinner currency, um see so yeah. This is the same application desktop the same pipeline test policy. Let's just confirm um yeah it's getting the right policy. It is exactly what we have from our policy and policy management.

A

Package, opera policy up to date, time slots.

A

So executes and we should expect it to fail, because um on the policy we have a time between nine and four and yeah it failed rightly was the failure. Output.

A

You can see, there's a deny no deployments allowed between 9 00 p.m, um 9, 00 a.m and 4 p.m. So let's modify the policy and see if we can get it to pass um so I'll just put it time. That's it's very close to the um end window.

A

um So that's what three! Let's put three here: it's just 15 save.

A

Come back here.

A

A

And this will pass here success, so this is something you can easily do in your pipeline. Make this stage a pretty precise understate so, um except if until this stage passes the next stage, wouldn't we wouldn't run at all and you can easily block all um policy violations using this. So you can see we've described, we've explained how you can use policy, add policies to your pipelines and hopefully um you'll, go out check the open policy documentation and explore more on what you can do with policies that the possibilities are limitless.

A

Thank you very much and enjoy the rest of the conference.

B

So, thank you, everyone for joining joining the session. If you have any questions I'll be here to answer so there are some charts that were going on in um some discussions going on the chat. um But let me start first by answering the question: um the q, a tab um hi. Thank you for your talk. Is there a way to use oppa to limit the origin of docker images that are allowed to running inside the kubernetes cluster.

A

Yes, you could use opera as um gatekeeper, so there's this. um What I called um so opera can be deployed as an admission workbook um using the gatekeeper project and that will limit. What's with that, you can set um limit on what can run in your kubernetes clusters. um However, the parts of the focus of this talk was to look at where opera fits in in the ci cd pipeline, your cd pipeline, and to so you can, instead of just stop stopping the docker images at the end.

A

At the point of deployment, you could stop them all the way um at the beginning, when the code is committed to to your git repository and you you can, you can use this there's another project. um I think it's conf test I'll put that in chat um so confidence. You can use that to um to check what gets them pushed into your kits repository and you run them against some policies.

A

um Another question: do you have do you use or have considered githubs? Why or why not?.

B

I I don't think I can talk much about.

A

Github's, um it's something that I've! That's that's! That's very interesting and I've looked into it, um but currently you are not adopting that um so ops mx doesn't have a way to load open policies directly from git. If I'm getting leave, ui is this manual or do you have any recommendation, a recommended way to manage this with fashion control and automatically um so I've discussed with the object max team and I knew them having policy from your um policy version in any, maybe a triple it's something that they're looking into as part of the.

A

What you call next set of features that they might be delivering um but again feel free to reach out to up. I think they're. There you'll find them in the maybe vendors or expo lounge. um Maybe they'll have more information on that feel free to reach out to optimix.

A

So let me just check the chat.

A

So one more minute, um do you deploy outside cuba interest clusters right now? Yes, we deploy the psyche ventures, clusters and what I should which opera, um with our policy with our pipelines. um That would work whether or not we're deploying to cabinets or not. um So basically, it works on the pipeline, not um not not where you're deploying.

B

It to so any more question: how are we doing with time? Can you.

A

Validate from code, yes, you can file the terraform code. I.

B

Integrate with other pipeline checks, yes, you.

A

Can do that um on the on the upper websites, open policy asian.org? There is a terraform example.

B

And I think we're about out of time.

B

Okay, thank you, everyone and I hope you really enjoyed it um feel free to reach out to me. You can connect with me on linkedin and I'm dropping my email. Okay, thank you. Thank you. Everyone.