GitLab Protect Stage, 16 Jul 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Container Network Security - Kubernetes Network Policies in Action with Cilium (Cloud Native)

Description

GitLab provides Cilium as a managed application enabling you to work with Network Policies. Network policies in Kubernetes, detect and block unauthorized network traffic between pods and to/from the Internet.

This video shows Network Policies in action and how you can install Cilium as a GitLab managed application.

Follow @awkwardferny and @gitlab on twitter. 🐦
Installing Cilium as a Gitlab managed application: https://docs.gitlab.com/ee/user/clusters/applications.html#install-cilium-using-gitlab-cicd
RoadMap for Container Network Security: https://about.gitlab.com/direction/defend/container_network_security/
Network Policy Rules: https://kubernetes.io/docs/concepts/services-networking/network-policies/
Get in touch with Sales: http://bit.ly/2IygR7z

A

99 100., oh hey there. My name is fernando and I'm a technical marketing manager here at get lab, and today I'm going to go over container network security and how it can work for you.

A

Gitlab provides and manages psyllium a network plug-in for kubernetes that can be used to implement support for network policy resources.

A

A network policy is a specification of how a group of pods are allowed to communicate with each other and other network endpoints network policies make sure pods are secure and aren't communicating with any pods they shouldn't be communicating with.

A

In this example, I'm going to show you how a network policy can only allow a pod with a certain label to be able to access another pod. There are many other ways to configure network policies for more information on this see the links in the description.

A

Let's create a network policy. Here's a network policy which only allows pods with the label access equals true to make requests to pods with the label app equals notes. I will apply this policy to the staging namespace, where my application is hosted by default. If there is no network policy created, then all incoming and outgoing traffic is allowed within that namespace.

A

Now, let's go ahead and test that network policy we just created.

A

My application is exposed on the cluster internal ip using a service.

A

Here I'm creating a pod in the same namespace without the label access equals. True, now, let's send the request to our note service. We can see that it times out.

A

Now I'm going to create a container within the namespace with the label access equals. True, now sending a request to our note service does not timeout and comes back with a response.

A

Gitlab also provides threat monitoring here for the container network policy. You can see all the packets which have been received and dropped.

A

You can also go ahead and view, as well as edit the network policies within a cluster. This makes it easy to sort your network policies by namespace.

A

There are a few things you must do to install psyllium onto your cluster. First, you must set up gitlab managed apps. This can be done by adding psyllium to the config.yaml.

A

In the gitlab ci.yamo file, you must add the manage cluster applications gitlab template from your kubernetes cluster settings. You must add the project you are using as a cluster management project, thanks for watching and be sure to subscribe for more information on container network security, see the links in the description here at gitlab. Everyone can.

A