GitLab Protect Stage, 5 Nov 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Cluster Image Scanning with the GitLab Agent

Description

Documentation: https://docs.gitlab.com/ee/user/application_security/cluster_image_scanning/#cluster-image-scanning-with-the-gitlab-kubernetes-agent
Epic (leave your feedback here): https://gitlab.com/groups/gitlab-org/-/epics/3410

A

Hi, my name is brian rams and today I'm going to be showing you a demonstration of cluster image scanning with the getlab agent. This feature is available now on gitlab.com and will be available for self-managed with the release of gitlab 14.5.

A

Before we begin, I would like to give a quick disclaimer. This feature is currently an alpha status and may contain bugs or have breaking changes introduced. We currently do not recommend running this feature in production.

A

If you would like to try in a non-production environment, we would appreciate it if you could do that and provide us with your feedback. I will provide a link to an issue where you can leave your feedback down in the description below so without further ado. Let's begin, cluster image scanning is a new feature that allows you to scan container images that are running in your kubernetes cluster.

A

uh This is actually an integration with the starboard operator, which is a tool that watches for new workloads and it automatically scans those workloads with a container scanning tool in this case trippy.

A

uh So as a prerequisite to use this feature, you need to install the starboard operator and to do that, you should reference the starboard installation, documentation.

A

And my preferred method for installing starboard is use home, there's a home repository available, so you will add that to home, and then you run home and stop in order to install start work in your kubernetes cluster. um One thing to note is that starboard has different installation marks and I and uh the namespaces that starboard watches are controlled by this target namespaces value, and so, if you would like to scan only the default namespace, this is the value that you would use.

A

If you would like to scan different namespaces, you will need to change this, and if you would like to scan all namespaces, you can leave it.

A

You can set it to an empty stream, so I I will be deploying my application to the default namespace, so I will go ahead and leave this the way it is.

A

And now the starboard operator has been installed in my cluster.

A

And I do there should not be any vulnerability words yeah, because I do not have any resources running in the default namespace yet, but one way that I can verify the installation is to go. Look at the custom resource definition, and you can see here that there are a few resources declared uh by starboard the one that we care about for this feature is vernability reports, dot security.

A

Now that we've installed the starboard operator in our cluster, the next step is to install to get that kubernetes agent. You can reference the kubernetes agent installation documentation for steps on how to do this, but I will walk you through it real quickly.

A

I have a demo project set up here and I have already created the gab agent configuration here. uh So this is what the configuration looks like for starboard.

A

uh You can reference this in the kubernetes agent configuration documentation- and there are some examples here, but uh this is a basic configuration that retrieves all of the vulnerability reports from the default namespace.

A

So now that I've created my agent configuration, uh I'm able I'm ready to create an agent and get them to do that. You go to infrastructure, kubernetes clusters and then you click on gitlab agent manage clusters and click integrate with the github agent.

A

uh Since I've already created my configuration, I'm able to pick from the drop down here and I'll use uh my existing agent configuration and then this gives me a doctor command that I can run in order to install the agent note that the agent token is a secret and it is used by the agent in order to authenticate to get them so be careful uh about exposing this.

A

um Before I publish this video, I would delete this one since you all have seen it and now this docker command will install to get that kubernetes agent in my cluster, that's done, and now, if I go to check the path.

A

I can see that the left kubernetes agent has started in the get that terminator agent name space.

A

If I check the logs.

A

You can see that it has started the vulnerability report watcher, so the starboard integration is configured. It was able to load my configuration from the gitlab repository.

A

So at this point I've done everything that I need to do in order to set up my cluster to begin scanning workloads.

A

What I have here is a small demo application which I have shown locally and it's a simple go application uh which runs a web server uh that returns hello world and I'm going to to deploy this application to my kubernetes cluster.

A

So I have a hello world app.yaml manifest, and this will create a deployment with two replicas using the image of my application, and it has a service which will allow this application to run on port 80.

A

And then there is an ingress which exposes this application on port 80 and I will go ahead and you cannot see the bottom of my terminal. It just moves.

A

There we go uh so I will apply this manifest food control.

A

And now my application is created and a job is launched which scans the container that my application is using.

A

And this job typically completes very quickly, but you can see here that it needs to download the vulnerability database.

A

So that's why it's taking a little longer than usual, but usually this completes extremely fast, and so now that now the vulnerability database has been updated. It is finished already and if I go look at vulnerability ports, you can see the vulnerability port for my application.

A

uh It has detected 20, critical vulnerabilities, 85, high vulnerabilities, 166, medium 35, low and six unknown. Now, if I go back and check the kubernetes agent.

A

It is now creating these vulnerabilities and get that uh 312 foreign. This might take a little bit of time because it needs to create the vulnerabilities one by one. But when I go here and look at my vulnerability report, they should start showing up. I have a couple sas vulnerabilities, showing there right now that if I repress the page now you can see the cluster image standing vulnerabilities.

A

So that's it for now. I hope you enjoy this feature and I'm looking forward to hearing your feedback. Thank you.