GitLab Govern: Security Policies, 21 Oct 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Container Security Technical Walk Through

Description

A walk through of the pages and code that are related to container security and how to test it both locally and in production

A

Okay, I am sure.

B

A

Going to forget, um I was working on this this banner. By the way it looks very nice eh.

B

A

B

um Yeah, so, as I was talking about, is how to set up a dummy cost and get access to the network policy page. So if you go under the operations menu back there now it's on the left side.

A

It is oh, it is oh okay,.

B

And then kubernetes.

A

Oh, it's project level that is interesting.

B

Yeah and then they change it a bit, I guess, um integrate with cluster certificate. I would imagine agent is a new thing.

A

So you've been uh you've stopped working on this for two seconds and they've already changed everything.

B

Yeah yeah, I have not seen that actually the agent thing so go to the connect existing class at the top.

B

And then, given its class name can be anything like literally entertainment question.

A

Sorry, uh that is a bug with this banner. Actually, the if you click x, it reloads the page.

B

A

uh Yeah, I don't know how to fix it. Maybe if we have time we'll uh I'll ask you for your help: okay, so, um okay, so cluster name, whatever.

B

Yeah and then api url, just and http test.com um certificate can be like any string like test test just enough. I think you might not even need a certificate, just leave it blank for now. Actually um you need talking and talking can be anything um okay, yeah and then add, keep an eyes question just green button.

B

Yeah, so you say you have a question you can do wherever you want.

A

Nice is this: I can't remember: where is yeah where's our you're, the code you're working on folk center.

B

I know it is the next thing so after that go operations, environments and you need a deployment environment first. um So kubernetes is the platform we are deploying our application. An environment represents a specific deployment of the application. It can be um staging production on any kind of environment review, apps go into their own environments, so normally environment is created during deployment by like ci job, for example, but in this case we will create it ourselves. So click new environment.

A

I feel like my gk, is running very slowly right now,.

B

uh It was a thing common thing for me, I don't know it's usually really sluggish for some reason. I.

A

B

This specific case, because uh assets have been processed, probably.

A

B

Sometimes there are more problems, so yeah for environment just again named can be anything and then external url. Just for every url. You want to use it's just. It has to be http something yeah, just press save um so from the um github section right now you have applications that was deployed to cluster, so this unbox quite a few pages, for example, metrics page will unblock, but in our case we're interested in security and compliance uh pay menu and then.

A

B

Right the threat when you're doing yeah this one.

A

Oh yeah, I have not seen a lot of these options before.

A

B

So you could see there is a drop down and policy page that allows you to select which environments you want to see, and then you can click new policy and yeah. The banner at the top environment does not have blah blah blah blah it's kind of normal, but that's the policy builders that we have. So you can essentially like the easiest way is to like click neural um and fill like under the rose thing.

A

Oh right, there yeah. That thing was in the way.

B

Yeah, so this essentially builders at all you to compose a so-called kubernetes network policies that allow you to isolate your application uh traffic and based on the set of roles that you're interested in the policy itself is represented in a yamo structures that you see on the right side, um yeah, and if you want to see a human description, you can click a rule on the policy preview.

B

It will tell you what it exactly will do in the human words, so you can add as many blocks as you want um and then, if you press, um yammer mod under the editor mod, um it's a bit higher yeah. You can essentially drop back drop into the simple yammer editor and essentially type in the policies that you want. If you wish to do that, yeah, that's that's about it. When you press create policy, it goes into your cluster. In your case, it will fail to deploy, because your cost is not an actual quest.

B

It's just a dummy one, but if you want to do changes up here, it should be enough right. You can change everything you want.

A

Yeah, I see um so if I cancel.

B

Yeah, it will go back to the fret monitoring page and you can press on each policy well, once it's still gonna load. I think it works really slow because it works for the kubernetes environment that doesn't exist properly.

B

So those policies that you see you can click on them, like the dropout bound it will open and the sidebar um this the information, it's a bit different for user created policies, and you can edit policies from there, but the policies you see right now: it's we call them predefined policies. This policies is just something we ship for users to quickly deploy um yeah. So essentially all the actions will fail right now, because you don't have a question, but.

A

um Oh, I see up here, yeah yeah, what um okay, so these are predefined, and these are sort of like you, product is determined. These are things that are commonly used, that somebody would want okay. So so that's how you're able to test the policies page, because these are predefined, as well as the policy creation deletion without actually having any policies.

B

Yep got it awesome yeah, and there is also statistics tab on the page. It essentially fetches some data from the cluster. It's oh.

A

B

Yeah, you obviously don't have a data, but if you would have a data and you have to like set up parameters and for the application firewall which is going away, so you shouldn't worry about it too much, but for contingency in network policies, you have to set up parameters for stats to work. um There is a docs page. I think, if you click on the um learn more, it will get you to the docs that has the necessary requirements for the specific stats to work. um Yeah. You have what it says.

B

I think you have one environment, you have psyllium installed and you know it's a bit high. I think at the top of the page, yeah continuing to quite simple.

A

uh From eps yeah.

B

Yeah and then, if you have a psyllium custom installation of psyllium, which you probably won't have so don't bother that. But if you have custom stuff, you would need to change config a little bit, um but otherwise yeah that's about it. What we did on the front and side. um Nothing really else comes to mind this two main pages we work on.

A

What about um so, so you don't have psyllium on your local machine and and you do, but you do have prometheus correct.

B

um Yep, that should be enough if you want to simulate the data, um but the easiest way is actually.

B

If you really want the data is either simulated from the oco gtk, but I usually connect to the um demo cluster like. If you will go to the github.com, uh I think, um protect uh and contain security damage or something there is a whole cost with all the stuff installed on it, um and you technically can and has a parameters and everything you need.

A

B

Yeah, so one of the options is to connect to that demo, cluster demos. I think.

B

um And yeah those all projects are independent, but can you select kubernetes wait, wait um yeah? Can you select kubernetes at the left side in the sidebar.

B

Do you have access to it? No, you don't! So if you would have access to that stuff. ah Actually, are you go back for a moment?

B

uh Could you please press on them and not just open it just press on it? Oh.

A

B

Just like that and then go to kubernetes right now. Yes, so this is the classes that has everything installed, that you might ever need. um Click on a demo related group oops time to have some rest.

A

B

So if you click environments- and you could see that it already has all the demo projects running on this cluster, so if you just want to check how everything looks in production, you can check the environment, um but you also can connect to this cluster it. It requires some kubernetes tinkering, and I probably will not do that in this video. Specifically, I think samia should be able to.

A

Walk you through.

B

The steps it's a bit technical, but again it's still probably the easiest way to try things locally is just to connect to this cluster because you don't have to set up anything afterwards. It will be set up for you uh already um and you can just start using policies. You can start checking stats and stuff like that.

A

Got it um very cool yeah that was going to be. My next question is how do you, how do you test these things in? Well, I don't even have access to these, but how do you test these things once you've gotten something merged, yeah like what projects and staging do you use or production.

B

For network policies, there is network policy demo, you can click like you see in the project's list. There is network policy, then we click on it um and then, if you will go to security and compliance thread, monitoring it should have. um I.

A

B

Various policies in there already um and you can deploy new policy update. There is no like voice. If you mess up some things, I I don't wouldn't worry. If you need to just try to deploy something and then maybe delete it, if you don't want to.

A

Yeah, do you mind if I just.

B

Yeah do that um I think uh you need the name at least.

A

B

Can you try part with labels but the way both.

A

Oh yeah, that's right.

B

Yeah, I please submit yeah.

A

B

A

Anyways, there's there's there's errors though, but I could you have been able to successfully do this before.

B

Yeah, you should be able, like someone mentioned, that it was broken. um I haven't, I don't know what the state of it, but previously this is the project like we used during validation in production and stuff like that and testing stuff yeah. um Can you can you delete? The roadblock like essentially, the policy is just name should be a valid policy.

B

No, I think there is something wrong with the question right now. um Yeah, that's strange.

A

So if there's something wrong with the cluster, maybe it's is there.

A

Have you encountered something like this before like? Is there someone who manages the cluster or.

B

um Is that usually me, or was that me so right now? It's probably sammy is mostly who knows how to think fix those things, so I would ask him to see why why it's not hoarding, um because right now it says something is wrong. I guess it can't connect to the um cluster right now.

B

A

There's a 500 um okay. uh Is there an equivalent for staging.

B

No, I think we usually use the temporary environments. What I would usually do is create a project set up everything we need up there, because um I know how to do that. It's really fast, but we don't have a persistent environment staging right now it might be worth setting up, um but previously because, like our projects would be, um it has a question.

A

But it doesn't.

B

Work, I'm pretty sure it's removed.

A

Oh yeah so kubernetes on the left-hand side. It's.

B

It's operations, given it's here, operations.

B

Yeah those classes, they don't exist any longer we removed them a while ago, but github doesn't know about that. I guess our staging environment.

A

Okay, so when you said you normally just use temporary does.

B

That mean like testing it.

A

Locally with, like a master or something.

B

No, we usually go to staging and set up new class to install nest or applications and start testing against a new cluster, but then because clusters cost money to company. I think it's about. If you have a goodness cluster is just one node, it's 20 per hour.

B

That company has to pay for your environment, so we we tend to not keep um long grinding clusters unless it's really necessary. That's why it's mostly temporary environments and staging to just save on cost.

A

Yeah and just for clarification, temporary meaning the way we set it up locally, where you just put in some like fake uh information.

B

No, we set up rail cluster on google cloud results.

A

Necessary stuff.

B

A

I see um got it because I mean you can have like this project all set up pointing to get lab staging, and then you just go on google cloud and create get lab staging and then refresh.

B

Here, actually you actually can do it from this environment click. You probably don't have access, but the way you do this is click connect question with certificate.

B

So, if you use oh, I click jiggy right now, let's check, if you have an access to um just yeah it, it will ask you your google account um and it will connect your google account talking to the github instance. So it could see um scroll, be down, select project and google cloud project platform project. Yeah, always select group defend.

B

And then select done interesting. I think you don't have the full access in this case, but what normally would happen? You select group defense, it's how like google cloud group specifically to us um and then you select a zone, usually it's america for you and then number of nodes.

B

If you don't need to specifically test multi-node setup, you always use one and then machine type, the one that will be selected for you and then, if you, you know, click create kubernetes quest after that it will just go and set up gcp gke cluster for you and we'll connect to the github.

B

But you need enough access permission to the google cloud platform. Usually you go and ask um our it team to set up permissions for you. You need to open a ticket for that. um But, um alternatively, you can just ask that me to set up staging environment for you.

B

He has necessary. Access to this groups got.

A

A

A

Well, that's all the questions I can think of at the time this. Oh this, um this the code for threat monitoring, that's probably in threat, monitoring somewhere.

B

It's the um enterprise edition only so it's under e e e front end. um It's probably the yeah threat monitoring and everything up there.

A

So these are all the components.

B

Yeah and stars and stuff.

A

Yeah, okay, so it's just it's just this repo yeah.

B

Or this isn't this directory yeah? That's a separate view app just for that and on rails side, it's again e controller thread, monitoring.

B

Thread monitoring controller sure yep that.

A

Oh, it's funny.

B

Yeah there are a few actions, because most of the stuff is in view.

A

Yeah um I take it, then so here's the filter- and if I go in the x here, oh there's the policy out of there. This is.

B

And there are two separate apps actually inside here: the one is for the stats and main page and policy. Edit is separate view app. um That's why they have two entry points up here.

A

B

Yeah, it's essentially two separate view: apps.

A

B

It's it's in the hem, oh yeah. um It's not uh yeah. It's threatmantering index um gs. I think right.

B

A

B

A

There's the policy editor okay, so this is page's project, start monitoring edit and then this one, oh for new there's the show.

A

I see here they are yeah here they are okay and then, similarly, on the haml side, they're there somewhere.

A

During index.h.

A

uh I forgot how to find those paths back there, but I can find it.

B

It's views, threat, monitoring.

A

Oh right, actually, probably the fastest way to search for this is, um is by the js.

B

It's actually um hamilton, yeah or otherwise. This year.

A

Yeah there it is okay, so project start managing yeah yep, like you said, there's the edit right. There was no index. That's.

B

Fine all right, it's show yep, it makes sense. Yeah.

A

Okay and then this all points to the yeah for my terrain, controller.

A

Dope wow look at all this data being sent up.

B

Yeah, the main page is a bit heavy um yeah.

A

Minus one, okay cool, I think that's all I've got. Thank you so much for walking through that with me.

B

No problem, um hopefully nothing, will uh prevent you from being efficient with this card.

A

B

It's fresh standard. It's a bit sometimes tricky to set up environment, as you mentioned. I personally like when I just do a front-end. I use a dynamic cluster.

A

B

Does not really exist, but then, when I need to test, then when it when I go and create something um again be careful with setting up costs, because if you forget to remove it, it will be just leaching money out of the company, roughly at the rate of 20 us dollars per hour per node. So if you have let's say by default, it's three nodes cost.

B

It will cost 60 dollars per hour. So so.

A

B

Careful with that.

A

Got it cool? I'm gonna stop three.