GitLab Protect Stage, 1 Feb 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Walkthrough Cilium and NetworkPolicies with cluster integration, GMA v2 and minikube.

Description

Gitlab GDK:
- https://gitlab.com/gitlab-org/gitlab-development-kit#gitlab-development-kit-gdk

Minikube setup:
- Dev onboarding: https://gitlab.com/gitlab-org/threat-management/onboarding/-/blob/master/.gitlab/issue_templates/ContainerSecurity-TechnicalOnboarding.md#minikube-and-local-registry-on-macos
- Cilium related info: https://docs.cilium.io/en/v1.8/gettingstarted/minikube/#getting-started-using-minikube
- Minikube official docs: https://minikube.sigs.k8s.io/docs/start/

Adding existing cluster to GitLab:
- https://docs.gitlab.com/ee/user/project/clusters/add_remove_clusters.html#existing-kubernetes-cluster

Creating cluster management (GMA v2) project:
- https://docs.gitlab.com/ee/user/clusters/applications.html#usage

Assigning a cluster management project to a cluster:
- https://docs.gitlab.com/ee/user/clusters/management_project.html

Install Cilium and Ingress through GMA v2:
- https://docs.gitlab.com/ee/user/clusters/applications.html#install-cilium-using-gitlab-cicd
- https://docs.gitlab.com/ee/user/clusters/applications.html#install-ingress-using-gitlab-cicd

Managing CiliumNetworkPolicies through Threat Monitoring:
- https://docs.gitlab.com/ee/user/application_security/threat_monitoring/

Environmental variables:
- https://docs.gitlab.com/ee/user/project/clusters/#deployment-variables

A

Hello: everyone uh today, we will be going through the setup required for having syrian installed for both network policies and alerts. That's going to come as part of the next set of features and uh from the point we are going to start from is assuming that uh you all have the hitlab development kit setup.

A

So in this case here, if I go on my local and I do a git lab status, sorry.

A

Jdk status.

A

That's what we're looking for uh git lab, ks, ku kubernetes agent- can be can be ignored here, but all the other ones should be running and working so in this setup here, it's part of this setup is part of our onboarding issue that we have for new engineers working protect.

A

So we are relying on mini cube for having a local cluster and mini cube. Setup is going to be a combination between what we have on the our onboarding.

A

What we have on the mini cube documentation and also a couple of steps required to have scene installed as part of mini cube.

A

So, let's get started, I'm gonna go to mini cube on my terminal and we are going to start a new cluster here.

A

uh Just a quick uh review uh memory parameter it's it's going to be the amount of memory that minicube is going to take the default. I think it's less than this in this case here we are using uh kubernetes version. 1.15.6.

A

The the next uh parameter is security registry. Is the local register that I'm using as part of the my gitlab instance and uh for ceiling? We have. We need to have the network plug-in cni, because by default it's going to start with bridge, but later on, we want to be able to. When we run the gma v2, we want to be able to set ceiling as the cni plug-in and the drivers hyperkit here is just uh I just use this, but I I think at this point, uh mini cubes is in hyperkit as default.

A

So let's run it and let's create the the local cluster here.

A

While this is building, um I'm gonna go back here and just show this page. uh This is the the main page that we have explaining how to install applications using cni uh the gma v1 on this upper part here under usage, it has basically three steps. One is you you need to have a cluster management project.

A

In this case. I have this repository here on my local that has this.

A

The the first step is to have a sorry. Second step is to have defined the template management class applications. So that's very similar to what I have here in my as part of my.

A

Gitlab.Cml file- what I have here as well is that I have defined a template for the registry here and uh usually you should not usually should not need this, but in this case I'm waiting for amr to get part with a cup of the hubble. That's a fit a part of ceiling, and I would like to have that in our example. So then I had this line here, but if you, if you are running this in the future, you don't need this line, because this ammar is going to be merged pretty soon.

A

Also, if you don't care about hubble at this point, you also don't need this land, because sodium by the ceiling was added a couple of iterations ago, so it shouldn't be an issue.

A

Next, I have the zoom things here, I'm going to move to the corner, okay, so next uh we need to have a config file, that's going to contain which applications are going to be installed and again here. If you go back to this repository and we go inside, get good lab dot management apps, we have the config file here and all we care right now is to have ingress and ceiling as we are going to run ceiling on the local cluster. That's not gke!

A

We can get rid of this line here and we can save it. I'm gonna commit it to master, because uh that's not something that we it's part of the review process for this one.

A

um Let's see what more also something else is that uh on the third step here, fourth step it. There is an optional step here that if you wanted to customize the values for each of the applications that you're going to install, you need to create a values.tml file under the folder, with the name of your application.

A

I did that here to have a more robust example, so we have seedum folder here and inside we have values.tml.

A

So here the only thing I'm doing is that I'm setting uh audit mode fall as false, because I want to have a blocking behavior.

A

So that's it for this, uh for the cluster vma yeah vichy and then I'm gonna go back to the ceiling section here. Is that that's explaining the the things that we already discussed so, let's check on the cluster, so we have here, um I'm gonna do cube ctl pods, all namespaces and I'm gonna watch for changes, so those are the pods we have for now.

A

There is one step required by cilium that is to ssh and to enable the ppf. Let's do that here?

A

Okay, that's done so now. What we need to do. We need to integrate the if you go again on top of this.

A

Thing here, you're going to see that you have to to connect a cluster so how we connect here's the club instance that I have for gitlab. If we go to operations kubernetes, that's the place that the instances are going to be and then we need to follow a couple of steps, those steps our document are here.

A

I have those commands here. So basically, I'm just gonna go through each of them. I think there is a youtube video just for setting up a cluster, so I'm gonna skip the one and this one and do kind of quick uh here.

A

Okay, just bear with me a little bit.

A

I'm gonna run this commands here. So then I can grab all the information at once and drop into the.

A

Cluster, so the first one is the url: let's go there, then we go with the.

A

A

There we go with the secret token.

A

And that's it: you can create the cluster. We can create an integration with the cluster.

A

um This is the just for clarification, everything under applications here, uh it's part of gitlab gmav1. That's not we're not considered for this feature, I think there's an existing video for this one as well. So if you go to advanced settings here, we can finally define which project we are going to have as part of the main repository for vmav gma feature in this case here, I'm using cluster application project, so I'm just going to go there and hit save.

A

This is the project that we are into so now. If I go to my pipeline and if I run the pipeline for this.

A

We are going to make the transition between everything that we set on this repository into the cluster.

A

If we watch the cluster here on the right top window, we should see the seeding get installed and also ingress.

A

A

It takes a little bit of time. It might be good idea to watch this video in a higher speed like 1.75 or 2. Just to minimize this.

A

A

Yeah it's to installing ceiling here.

A

You can look into the.

A

Yeah, this is what you're going to have as part of your pipeline log. It's going through sydney. First, it's part of a helm installation. Let's go to the top here and see yeah, so you're going to see helm file.

A

That's how uh gma v2 install the cluster applications into the cluster.

A

And now, if you go back down, we should see ingress.

A

Get installed yeah and that's it. Jobs succeeded. You should see past here nice. So now, if you go here, we see both uh I'm gonna clean, the screen here, yeah and we see ceiling installed. We see hubble and also we see ingress both controller and default back end.

A

Let me clean this one here.

A

So then uh one thing is that whenever you're, using any cube, if I do here um you're going to see that external ips expanding for ingress controller, the way that you can overcome this is just to do a mini cube, a tunnel.

A

It's going to assign a it, might ask for a password, it's going to assign a external ip for all uh for all searches that are the that have the type of float, balancer and yeah. We are going to use this for for deploying a couple of other projects that we are going to deploy. So ceilings installed.

A

If we go to the security compliance and we go thread.

A

Monitoring we have, we are now able to use the policies because we have environment for deployment and then here, uh if we create a policy here.

A

Let's say uh accept none and uh if we enable that.

A

And if we here, which one should I set.

A

Let's say that we want to have: um we want to prohibit ingress from any. We want to enable ingress only from the endpoints that have this label abnon and in my case in my setup, I have none. So if I create the policy, the policy is going to be shown here and now. uh If we look into the.

A

Syrian logs, we should see.

A

Some of the drop messages there we specify the container that we want to follow. We do dash app just to follow it true, so.

A

So if we go here, environment, operation.

A

A

I don't have a deployment for this. uh Let's take a look at the pods, so then we can have a better understanding of what's happening.

A

What we have available to generate an example.

A

So we have season pod having grass, I have hubble and then.

A

Let's check the network policies that we.

A

A

Let's check the content of this one, it has this.

A

This policy here that's upset, none and then, let's see the output.

A

It yeah it's exactly the one we set, but this is not helping us because it in this name space there is not much so what we want is probably to generate a similar one inside another name, space.

A

A

Can do it manually just for the sake of the example, so I'm gonna copy this one.

A

Save this into a file.

A

And then check the files there.

A

For here, let's delete this line. This line is set on space, we're going to change the name space. The other thing is we don't care much so now, let's do.

A

Gitlab management apps: that's the namespace that we have ingress that we have cedium, it should work so let's save it and then let's apply this policy to the.

A

A

So we have here so now. If we look into the logs again.

A

Yeah, we start seeing some uh some drops so that that confirms to us that ceiling has been installed and the ceiling is uh it's. It's working as expected.

A

I made a mistake by not creating a wider cluster. um Maybe we can do that. Maybe let's go there and, uh let's add the cluster as an instance cluster, following the same steps as we did before.

A

I think that's going to be helpful and then we can remove the integration that we did on the lower level. So let me reset this: let's grab all those things that we did during the cluster integration.

A

This is the credentials required for integrating the cluster with gitlab.

A

Because then, we can use a policy that we create through the ui. It's a more complete example that just rely on the manually, adding the policy as part of the terminal through the terminal.

A

Yeah, so it's adam here, let's uh as part of close management, we need to set the file the project here same one. We did before it's going to complain about the scope, because it cannot have the same scope for two different.

A

Two different two different clusters, so for now we can just set up.

A

You can just set up a scope here.

A

It actually worked. It's weird.

A

Okay, just fail to integrate here. So let's go to the other project that we were setting up the information and we go to kubernetes.

A

A

Remove the you see a project level and instance level. We want to remove the project.

A

One yeah, so that's the one we want and then now, if we go to, if we go back to this cluster here, we can set up the the cluster management project as expected. Okay and then, if we go to another project that I have is this asian project here uh right now? What matters that it's just a go application? That's what we're concerned!

A

Let's go to the pipeline and build it.

A

The only thing is that whenever you set the ingress from gmav2, you either have to set the base domain on the integration page or you can come here and set up the cube domain variable. That's what we're going to do just to not rely too much on that ui. So here we set this variable here.

A

Let's go to the cluster and grab this value here we do keep ctl gatsers.

A

Then we, if we see here in grass controller, we have external ip, that's the way we want for the base domain, and then we do this.

A

And let's run the pipeline for this project.

A

Same as before, we should see uh it has a build stage. That's going to put the result, application in the docker image and the production is going to deploy the docker image into the cluster.

A

So we are watching the cluster the pods here, so we should see uh things coming up and what we are going to do on the same time is to remove the the silly network policies that we have added.

A

We don't want to have them into the.

A

And delete both of them.

A

A

We delete this one, so then we don't interfere with whatever is going to come up from this in the apply.

A

So now we shouldn't see any network policy, um I'm going to add the logs for syrum here on the left side of the screen, just for us to.

A

Follow both uh siri syrian hubble.

A

Let's complain about something.

A

A

Okay, so it's it, uh it has installed, as you see, on the top right of the screen has installed application.

A

So if we go to environments from this project can actually see the deployed application yeah and now, if we add a network policy associated to this, similar to the one that we saw before, if we go here to try monitoring.

A

Policies if we create a new policy, that's going to allow none on new rule combine on and then, if we save it.

A

Now, if you try to load this app, it's going to time off because it.

A

It doesn't deserves, it's not does not allow uh uh ingress from uh from ingress controller as per policy, and then uh on the same time, if you go there and we disable it disable true here save it now, if we stop and run it yeah, we should see it. That's it.

A

So what we have here is that we have uh the cluster integration. We have the gma v2 with ceiling in ingress.

A

We have the cluster management app, that's going to be the main repository to install cluster apps into the cluster, and also we have, uh let's call it a demo project, that's going to deploy and create environment that we can play with, and also we we, we pulled this together with the network policy, as we just showed.

A

The next steps from here would be to install cass and agent k for this project and being able to see alerts displayed here, but that's going to be another feature. Thank you so much for watching.