►
Description
Red Hat OpenShift has a lot of moving pieces, and sometimes it may seem like too much to remember. Maybe you have a config problem that no amount of search engine kung-fu can solve? Or that you don't know where to get started with learning and applying these tools to your day-to-day work? That's where "Ask an OpenShift Admin" comes in.
Join Andrew Sullivan and Jonathan Rickard Wednesdays at 11 a.m. ET for a full hour explicitly designed to help OpenShift admins. Each episode addresses your questions and covers the different tools that containers need to run in a cloud-native environment.
Try Red Hat OpenShift: https://red.ht/3uVxkya
Follow us:
Andrew Sullivan https://twitter.com/practicalandrew
Jonathan Rickard https://twitter.com/jrocktx1
OpenShift https://twitter.com/openshift
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1
About Ask an OpenShift Admin:
Do you have questions? We want to answer them! Every Wednesday at 11am ET, hosts Andrew Sullivan and Jonathan Rickard sit down to answer your questions about Red Hat OpenShift.
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
OpenShift on redhat.com https://red.ht/3rYz5ZS
OpenShift on GitHub https://github.com/openshift/
A
B
Hello
and
welcome
to
this
week's
ask
an
openshift
admin
office
hours
live
stream.
I
am
your
host
andrew
sullivan
technical
marketing
manager
with
the
openshift
business
unit,
and
I
am
joined
as
always
by
my
co-host,
mr
johnny
ricard
good
morning.
Sir
hey,
how
are
you
it
is?
It
is
a
beautiful
red
hat
day.
You
know,
as.
A
B
B
Anything
that
you
would
like
to
ask
us
about
we're
here
to
help
answer
those
questions,
whether
or
not
those
are
related
to
today's
topic,
which
happens
to
be
security
and
openshift,
and
I
am
very
happy
to
welcome
someone
who
I've
have
been
wanting
to
have
as
a
guest
for
a
long
time,
kirsten
newcomer
to
talk
about
closed
loop
security,
with
red
hat
and
with
openshift
kirsten.
If
you
don't
mind
introducing
yourself.
C
Sure
hi
folks
great
to
be
here
kirsten
newcomer,
I'm
director
of
security,
product
management
for
the
openshift
team.
So
that
includes
container
and
coop
security.
Of
course,
red
hat
advanced
cluster
security,
which
we'll
we'll
chat
about
more
as
we
keep
going,
but
all
things,
security
for
cloud
native
applications.
B
Yeah,
you
know
it's
just
a
small
topic.
It's
it's
just
a
little
thing.
You
know
no
big
deal
yeah
security,
we
don't
yeah,
it's
it's
just
automatic
right.
We
don't
have
to
do
anything
so
yeah.
This
is
one
that
you
know
we're
what
64
episodes
in.
I
got
to
look
at
the
little
banner
at
the
top
of
our
screen
here
and
we
we've
touched
with
we've.
You
know
or
or
touched
upon
and
flirted
with.
B
So,
as
always
here
at
the
start
of
the
show,
we
have
our
top
of
mind
topics
and
I
I'm
actually
I
was
not
expecting.
I
think
we've
got
like
what
five
six
of
these
johnny.
I
I
every
week,
every
monday
or
a
wednesday
morning
at
like
9
a.m.
My
time,
which
is
8,
am
johnny's
time
and
he's
kind
enough
to
reply.
I
always
send
him
a
message
like
hey.
What
are
we?
B
B
B
So
I
believe
that
that
is
a
wednesday
thursday,
monday,
tuesday
or
a
tuesday
wednesday.
I
don't
know
I'd
have
to
look
at
a
calendar,
but
we
won't
be
streaming
that
week
so
just
mark
your
calendars,
please
go
attend
summit,
see
all
the
cool
stuff
that
they
got
going
on
there,
instead
of
coming
and
listening
to
johnny,
and
I
prattle
on
the
other
thing
that
I
wanted
to
talk
about
that
are
kind
of
logistics.
Things
is
next
week
so
next
week
on
the
14th,
we
have
the
what's
next
or
roadmap
session
for
openshift.
B
So
that's
thursday
at
I
believe.
10
am
eastern
time
we'll
have
the
product
management
team
on
to
talk
about
the
openshift
roadmap
and
all
the
things
that
you
can
expect
to
see
over
the
next
few
releases.
So
always
a
good
time
johnny,
and
I
will
be
here
to
help
answer
questions
I
think
christian
is
planning
on
being
on
along
with
a
handful
of
others.
B
Usually,
mr
mike
foster
is
the
one
who
who
manages
that
behind
the
scenes
which,
coincidentally,
he
is
the
acs
tmm.
So
let's
see
moving
on
here,
oh
a
follow-up
from
last
week.
So
last
week
you
remember,
we
talked
about
two
topics,
so
one
was
how
to
replace
a
failed
control,
plane
node
when
using
assisted,
installer
or
really
any
non-ipi
deployment,
and
the
other
one
was
how
to
create
a
customized
grafana
instance.
B
So
for
that
first
one
for
that
replacement,
control,
plane
node,
you
remember
when
I
was
going
through
the
demo,
and
we
got
to
the
point
where
I
was
joining
the
node
back
in
I'm
like.
Why
did
it
get
this
random
ip
address?
What
I
created
a
dhcp
reservation
and
I
just
kind
of
ignored
it
and
pushed
on,
and
surprisingly
it
still
worked
yeah.
So
so
it
turned
out
as
I
was.
You
know,
troubleshooting
and
kind
of
looking
into
what
happened
there.
Peter
lauterbach
and
I
were
chatting
and
he
was
like.
B
Maybe
you
have
a
a
second
dhcp
server
and
you
know
like
a
brick
smacking
in
the
face.
It
was
yeah.
That's
exactly
what
happened.
I
had
my
normal
dhcp
server,
for
whatever
reason
wasn't
doing:
dns
updates
for
dhcp
clients,
so
I
had
temporarily
turned
it
off
and
moved
to
the
router
dhcp
server
and
never
actually
fixed
that
or
did
anything
when
it.
So
when
my
helper
node,
rebooted
and
dhcp
restarted,
I
now
had
two
dhcp
servers
so.
A
B
Yeah
so
yeah,
if,
if
you
were
paying
attention
last
week,
if
you're,
you
know,
if
you
saw
that
fiasco
which,
again
surprisingly,
it
still
worked.
That
was
why
I
had
two
dhcp
servers
and
they
were
competing
with
each
other
yeah
alossa
dag
it
was
not
dns.
Surprisingly,
and
actually
I
just
I
swapped
out,
I
used
the
I
use
a
a
coffee
cup
with
the
lid
when
I'm
streaming,
so
I
don't
make
a
mess
of
myself.
B
B
B
There
we
go
so
I
happen
to
have
the
security
advisory
here
or
the
bug
fix
advisory.
Rather
so
just
a
reminder
to
anybody
and
everybody
who
happens
to
be
listening
to
us
anytime.
We
block
an
upgrade
path.
We
will
release
an
errata
that
announces
that.
So
this
is
the
errata
22
colon
1086
notification
of
delayed
upgrade
path
to
4.9.
B
B
Unfortunately,
I
don't
know
of
a
way
to
filter
these,
so
that
you
only
get
specific
ones,
but
if
you
go
to
access.redhead.com
errata
and
then
you
click
so
I'm
I
am
logged
in
here.
You
won't
see
this
if
you're
not
logged
in
click,
this
notification
preferences
and
then
it
will,
you
know,
say:
hey
what
do
you?
What
do
you
want
me
to
send
you?
You
see?
I
have
mine
disabled
because
I
this
is
my
developer
account
not
my
normal
account,
but
normally
you
would
want
to
get
those.
B
All
right
come
on
there
we
go
so
you
should
be
able
to
search
for
like
delayed,
upgrade
or
or
upgrade
path,
something
like
that
in
the
subject
and
that
should
filter
just
the
ones
that
are
affecting
any
upgrade
or
blocked
upgrade
paths
moving
on.
So
I
strangely
and
the
questions
seem
to
come
in
waves.
I
don't
know
if
you've
noticed
that
johnny
oh
yeah,
there
was,
I
don't
know
like
three
or
four
or
five
folks
who
asked
some
internals
red
hat
some
external
red
hat
like
hey.
B
B
That
was
not
what
I
wanted.
I
want
to
tell
come
on.
I
want
to
download
it
there
we
go
so
if
I
click
this
download
latest
here.
This
takes
me
to
the
standards.
You
know
download
interface,
that
we've
all
seen
for
rel
and
for
every
other
red
hat
product
for
ages.
But
if
I
click
the
down
the
this
button
here,
the
drop
down.
It
shows
me
all
of
the
versions
that
are
available
and
you'll
notice
that
there's
for
rail
8
and
for
rel7.
B
So
the
reason
why
I
suggest
people
go
to
this
interface
is
because
you'll
notice,
for
example,
there's
no
10.,
4.10.2
or
1
or
0,
or
anything
like
that.
This
only
shows
you
versions
that
are
ga,
so
versions
that
never
made
it
out
of
candidate
or
anything
like
that
are
pre-release
versions.
They
don't
show
up
in
this
interface.
So
if
I
wanted
to,
for
example,
install
4.9.13,
I
simply
click
here
and
then
I
can
come
down
and
download.
The
client
that
I
need,
which
is
just
open
shift.
Install
I'm
sorry,
client
is
oc.
B
B
I'm
just
going
to
console.redhat.com
openshift
releases,
so
4.10
yeah,
so
4.8
is
in
candidate.
It's
not
a
ga
release
yet
and
4.10.7
it
looks
like
is
going
to
get
skipped
because
it's
not
in
fast,
so
it
looks
like
it
was.
You
know,
dropped
from
being
promoted.
So
it's
one
of
those
like.
Yes,
you
can
go
to
the
mirror,
but
you
just
have
to
be
conscious
and
careful
of
which
version
you're
downloading,
because
you
could
end
up
in
a
situation
where
you
accidentally
deploy
an
unsupported
version.
A
B
That's
a
good
point.
So
if
I
come
back
here
to
the
mirror
and
go
to
dependencies
and
core
os
and
4.10
you'll
see
that
there
is
only
one
4.10
core
os
release,
this
is
perfectly
normal
and
in
fact,
if
we
go
back
to
like
4.9
something
that's
been
out
for
a
while
you'll
notice
that
there's
still
only
one
for
4.9,
they
only
release
a
new
core
os
image.
B
If
there's
something
that
affects
the
image
normally
in
the
install,
what
happens
is
we
you
know
it
deploys
with
4.9.0
in
this
instance,
and
then
the
first
thing
machine
config
is
going
to
do
is
push
the
current
version
or
the
version
that
matches
the
cluster
install
to
to
that
host.
So
thank
you
for
that
reminder.
Johnny
yep.
B
And
then
the
last
one
that
I'll
mention
here
is
stack
rocks
so
so
kirsten.
This
is
one
that
is
near
and
dear
to
your
hearts,
and
I
know
that
you
have
been
participating
in
for
quite
a
while,
and
that
is
stack
rocks,
which
is
now
known
as
red
hat
advanced
cluster
security
for
kubernetes
yep
is,
is
now
open
sourced.
So
congratulations
to
you.
Congratulations
to
the
team.
I
know
there's
a
lot
of
work
that
went
into
this.
B
C
No,
just
we're
really
excited
stat
rocks
with
the
the
upstream
community
is
still
called
stack
and
stackrocks.io
is,
as
is
being
shown.
There
is
the
home
page
mike
foster
is
our
community
manager.
So
so
you
know
great
thanks
to
mike
for
doing
that.
We're
super
excited
about
you
know
working
with
the
broader
community.
C
C
I
also
noticed
that
in
the
in
the
chat,
there
is
a
question
about
if
I
haven't
seen
it
if
I
scroll
past
it,
I
believe
there
was
a
question
about
stackrock's
requirements:
hardware
requirements
for
installation,
so
they're,
basically
the
same
as
red
hat
acs
kind
of
the
I'm
just
posting
a
link
which
I'm
hoping
one
of
my
colleagues
will
put
into
chat
to
the
acs
installation
doc.
So
really
it's
it's.
You
know
the
same.
If
there's
not
enough
information
in
that
doc,
for
you,
we
can
follow
up
afterwards.
B
Yeah,
that
was
rockhound
that
was
asking
all
right
regarding
the
new
security
stackrock
solution.
What
would
you
rate
as
hardware
requirements
with
cores
ram
etc,
to
run
so
thank
you
and
stephanie
our
our
producer
on
the
back
end,
who
does
amazing
work?
She
is
depending
on
what
platform
you're
you're
watching
us
on
she's,
either
red
hat
open
shift,
or
I
think
it's
openshift-
on
youtube
or
red
hat
on
the
the
red
hat
youtube
channel.
C
Yeah
something
else
I
might
say
about,
if
you're,
if
you're,
going
to
install
acs
or
stack
rocks
on
openshift
and
and
for
rockhound
for
your
home
lab
right,
so
there
are
the
ui.
The
is
installed
is
central.
You
could
install
that
on
an
infra
node.
If
you
actually
have
an
infra
node
for
open
shift,
you
could
have.
If
you
are
playing
around
with
acm,
you
could
probably
install
acm
on
the
same
infranode
with
acs.
C
C
That
does
need
to
be
on
every
node
that
you
that
you
want
that
security
on
control,
plane
worker.
You
know
nodes
infra
nodes,
whatever
you
decide
and
then
the
other
components
there's
a
sensor
which
you,
which
is
used
to
actually
kind
of
all
the
data
that's
collected
from
secured
clusters
or
fed
through
sensor,
there's
also
the
scanner
if
it's
a
local
openshift
cluster
and
your
images
are
being
stored
in
the
internal
openshift
registry
rather
than
an
external
registry.
C
C
The
acs
scanner
is
actually
a
fork
of
clear
v2,
red
hat
quay
ships
with
claire
v4
and
one
of
our
projects.
One
of
our
roadmap
activities
this
year
is
to
get
to
a
single
clear-based
scanner
that
will
be
available
from
red
hat,
so
it
will
be
you'll
see
that
we
will
be
the
the
acs
stack
rocks
team
will
be
contributing
code
into
clear
v4,
because
that
divergence
happened.
There's
a
fair
amount
of
refactoring.
That's
going
to
have
to
happen
today.
C
You
know
one
scanner
where
no
matter
where
you're
accessing
the
red
hat
scanner,
you
get
the
red
hat
version
of
claire
you,
you
get
this
coverage
and
if
we
circle
back
to
spring
for
shell
for
a
minute
I
know
one
of
the
links
that
was
shared
was
a
mention
were
working
to
get
updates
into
the
acs
scanner
database
for
discovery
for
spring
for
shell
internally,
we've
had
a
few
glitches
in
our
release
pipeline.
Otherwise
this
would
have
been
out
already,
but
but
we're
still
working
to
do
that.
C
Correct
so
that
is
the
the
latest
update
and
in
fact
so
I
did
notice
the
questions
and,
and
we've
shared
a
couple
of
links
about
those,
so
one
of
them
is
to
the
red
hat
security
bulletin,
which
has
which
is
always
updated,
as
as
we
figure
out
new
things.
So
it
was
a
an
initial
mistake
when
they
thought
full,
you
know,
openshift
core
was
impacted.
They
realized
absolutely
not
our
product
security
team
digs
in
but
serverless
functions.
C
B
B
Yep,
so
it
scans
any
images
that
are
put
into
that
registry,
whereas
acs's
image
scanner
can
scan
kind
of
any
any
image,
including
and
some
of
the
really
cool
demos
that
I've
seen
lately
are
like.
I
have
a
pipeline
and
I'm
building
an
image,
and
before
I
even
push
it
into
the
registry,
I
can
use
acs
to
scan
that
image.
C
Well,
so,
actually
what
what
acs
is
doing
when
you're
scanning
in
a
pipeline?
So
absolutely
you
can
scan
using
the
red
hat
acs
scanner
in
a
pipeline.
However,
what
it's
going
to
do
is
it's
going
to
connect
to
the
registry
where
you're,
storing
that
image
in
the
pipeline.
That
said,
we
have
on
our
roadmap
the
ability
and
we're
shooting
for
it'll
probably
be
might
land
late.
2022
might
be
early
2023
the
ability
to
use
the
acs
scanner
to
scan
an
image
on
a
developer's
local
desktop
right.
C
We
really
want
to
shift
security
even
further
left
right,
so
when
people
think
devsecops
one
of
the
first
things
they
do
for
the
devsec
part
of
that
closed
loop
is
they
add
vulnerability
scanning
into
the
ci
cd
pipeline?
That
pipeline
does
include
a
registry
right.
You
need
a
place
to
store
the
container
image
that
you're
building.
We
want
to
shift
that
further
left
so
that,
even
if
you're
just
doing
a
build
on
your
desktop
or
your
laptop,
you
can
do
that.
B
C
Yeah
acs
acs
can
connect
to
what
you
have
to
give
acs
the
credentials
to
connect
to
whatever
registry
you're,
using
with
your
cluster
that
could
be
an
external
registry.
It
could
be
artifactory,
it
could
be
nexus,
it
could
be
red
hat
quay,
acs
re,
it
could
be
amazon.
Ecr
acs
doesn't
care
which
registry
you
just
need
to
give
it
the
access
so
that
the
metadata,
the
the
the
content
can
be
pulled
manifest.
That's
the
word
I
wanted.
C
B
C
That
is
a
great
question
so,
right
now
we
aren't
great
with
scratch
images
or
just
roleless
images.
The
scanner
needs
there
is
there's
work
that
needs
to
be
done
there
and
again.
That
is
something
that
is
on
the
roadmap.
We
don't
encounter
it
a
lot,
but
we
do
encounter
customers
using
scratch
or
distro-less
images
like
many
scanners
in
this
space
right
now
we're
kind
of
leveraging
package
related
data
as
part
of
our
mapping
to
known
vulners.
C
B
Yeah
that
that
makes
sense
because
it
and
I'm
sure
it
slows
down
the
process,
because
you
don't
have
this,
you
know
with
a
from
known
base
image.
You
already
have
this
catalog
because
you
scanned
it
once
and
now
you
can
check
against
that
all
right,
so
I
we've
kind
of
already
launched
into
today's
topic,
but
and
in
our
hope,
nine.
B
I
see
your
question
there
we'll
get
to
that
in
a
moment,
but
I
want
to
officially
launch
into
into
today's
topic,
which
is
again
that
closed
loop
security
with
openshift
in
red
hat,
and
I
this
is
the
first
time
that
I've
heard
that
phrase
coming
you
know
from
from
you
and
from
your
team.
So
I'm
curious
what
that
means,
and
you
know
kind
of
again
security.
Is
this
big
topic
and
it's
baked
into
every
level,
every
aspect
of
openshift
and
what
we
do
and
you
know
johnny
and
I
have
brought
up
many
times.
B
C
Yeah,
so
so
the
reason
I
like
the
phrase,
closed
loop
security
is
again
devsecops
popular
topic,
something
we
hear
about
a
lot
and
I
in
many
of
the
conversations
that
I
have
with
folks
again.
As
I
said
earlier,
it's
kind
of
like
I
hear
many
people,
think
of
devsecops
as
what
I've
started,
calling
devsec,
that
is,
shifting
security
left,
adding
some
security
gates
to
the
cicd
pipeline,
but
that's
only
part
of
that
infinity
loop,
that
is,
that
is
devops
or
devsecops.
C
C
You
can
catch
issues
early
and
you
can
what
you
find
in
the
cicd
process
to
set
security
policies
that
are
applied
at
deployment
time
with
admission
controllers
and
other
security
policies
that
may
be
relevant
at
run
time
and
so
that
secops
part
that
second
part
of
the
loop
is
also
important.
So
you
can
inform
your
your
policy
creation
with
what
you
learn
at
runtime
and
what
you
I'm
sorry
with
what
you
learn
in
the
ci
cd
process
and
what
you
learn
at
runtime
absolutely
should
inform
back
to
the
development
team.
C
An
example
of
that
with
acs
today
is
that
acs
will
do
an
analysis
of
the
network
communications
of
your
running
pods,
and
it
can
auto
suggest
ways
to
tighten
those
policies
and
it
can
also
help
you
apply
those
policies.
It
can
simulate.
What
the
communication
path
would
look
like
with
that
auto
suggested
policy
and
then
help
you
apply.
C
Those
if
you
wish
so
that's
also
a
place
where,
depending
on
how
the
policies
are
defined
and
who,
in
your
organization,
is
given
permissions
to
do
those
definitions
again,
what
you
see
in
runtime
can
inform
back
to
the
developer
loop.
We
also
have
on
our
roadmap,
working
with
some
of
our
ibm
research.
C
Colleagues,
looking
to
shift
the
generation
of
network
policies
left
as
well,
do
some
analysis
of
your
app
config
and
your
app
data
early
on
to
define
to
propose
a
network
policy
that
would
work
well
in
run
time
and-
and
I
see
this
mention
of
zero
trust.
For
me,
zero
trust
is
an
even
deeper
level
conversation
right.
C
There
are
so
many
layers,
but,
but
maybe
we
can
use
that
andrew
to
circle
back
to
what
you
said
about
the
the
layers
of
security
and
openshift,
because
when
we
think
about
it,
there's
a
there's
a
lot.
There
are
a
lot
of
different
layers
that
need
to
be
considered
right,
so
you
mentioned
selinux
right,
so
rel,
coreos
container
optimized
operating
system
only
has
the
content
needed
to
run
open
shift.
Therefore
it
reduces
your
attack
surface.
C
It's
se,
linux,
on
by
default,
sc
linux
has
demonstrated
the
ability
to
protect
against
or
mitigate
the
known
container
escapes
to
the
file
system,
security,
context,
constraints
and
openshift
which
allow
the
administrator
to
control
the
privs.
A
workload
can
run
with
by
default.
A
regular
user
cannot
deploy
to
privileged
workload
to
open
shift.
Of
course,
a
privileged
user
is
a
little
bit
different
right.
That's
that's
another
scenario
that
has
to
be
looked
at
carefully
in
audit
logging,
both
for
the
host
layer
and
the
api
server
layer,
kube
network
policies
for
micro
segmentation.
C
You
can
implement
zero
trust
at
the
network
policy
layer
by
starting
with
a
deny
all
policy
for
kube.
If
you
for
your
cube
network
policies
now,
is
that
really
what
you,
where
you
want
to
start?
I'm
not
sure
most
people
are
more
likely
to
start
with
I'm
going
to
allow
communication
between
all
pods
in
the
same
name,
space
or
openshift
project.
That's
a
more
common
pattern
right
and.
C
Yeah,
that's
a
really
great
question
it
it.
So,
as
you
say,
you
know,
by
and
large
that's
they're
a
combination
of
things
that
lead
to
what
you
just
described
and,
and
certainly
it's
absolutely
true.
Openshift
out
of
the
box
is
more
hardened
than
the
majority
of
the
kube
distros
that
that
are
out
there.
C
I'm
not
sure,
I'm
aware
of
one
that
is,
that
is
more
hardened
than
open
shift
doesn't
mean
there,
isn't
one
so
and
it's
largely
security
context
constraints,
but
also
the
se
linux
piece
and
the
way
that
they
work
together.
So
the
challenge
is
that
often
workloads
request
privileges
or
that
that
maybe
they
do
or
don't
actually
need,
but
they're
just
used
to
requesting
them.
C
So
one
of
the
things
that
we're
working
on
so
it's
a
really
best
recommendation,
use
something
like
kubelinter
or
acs
to
analyze
your
deployment
configs.
To
look
for
what
privileges
are
being
requested
by
the
workload,
what
linux
capabilities
user
identification.
Anything
like
that
right!
It's
it's
in
that
config
data
security
context,
a
whole
range
of
places
to
find
it
use
one
of
those
tools
so
that
you
can
analyze
in
advance
whether
or
not
your
workload
is
going
to
be
accepted
to
be
run
with
the
restricted
scc
on
openshift.
C
There's.
Also,
some
additional
work
that
that
we
have
kind
of
handed
there's
an
upstream
project
called
the
security
profiles
operator
that
will
help
you.
If
you
know
you
need
privileges
that
this
the
sbo
can
help.
You
define
sc
linux
profiles
that
will
further
contain
any
concerns
that
you
might
have
related
to
the
fact
that
workload
is
running
privileged.
C
B
Of
randomly
assigned
uids
for
each
namespace,
and
I
came
from
the
storage
realm
and
especially
ffs
right
with
nfs.
Now
I
have
you
know
random
uids,
and
so
I
I
used
to
get
a
lot
of
frustration
from
folks,
because
you
know
oh
it
just
it
doesn't
work
the
way
you
know
it
should
just
work.
I
just
want
it
to
work
out
of
the
box.
I
don't
have
to
think
about
it
and
it's
one
of
those.
Like
you
know,
where's
christian
is
christian,
still
still
listening
right.
B
C
But
you
really
don't
want
to
make
don't
make
dan
cry
exactly
you
just
don't
want
to
do
that,
and-
and
there
are
other
options
you
know
and
and
it's
interesting,
some
of
the
other
workloads
that
can
be
challenging
are
workloads
in
the
telco
space
where
they
need
to
talk
with
you
know,
host
there
may
be
secondary
network
interfaces
that
they
need
to
interact
with
right
and
that's
a
whole
different
level
of
privilege
there
again,
but
you
can
still
limit
it.
That's
one
of
the
values
of
linux
capabilities.
C
The
challenge,
though,
is
that
not
every
developer
thinks
about
or
works
with,
linux
capabilities
at
that
level,
and
they
don't
also
also
they
don't,
may
not
know
what
system
calls
their
app
needs
to
make
which,
which
is
one
of
the
reasons
we're
investing
in
the
security
profile
operator.
You
know,
how
can
we
help
create?
You
know
provide
some
automation
that
informs
provides
additional
security
for
those
more
privileged
workloads.
A
C
A
C
C
B
C
Well,
and
and
as
we've
been
seeing
right
with
log
for
shell
and
now
spring
for
shell,
I
mean
new
vulnerabilities
are
discovered
regularly
and
and
oftentimes
these
are
just
or
even,
if
we
think,
all
the
way
back
to
meltdown
inspector
right.
These
are.
These
are
sometimes
vulnerabilities
that
have
been
around
for
crime
but
but
were
never
noticed.
Weren't
exploited
suddenly
become
exploitable
and
as
an
industry,
we
scan
we
scramble
to
respond
right.
C
So
so
we
absolutely
want
to
think
about
how
do
we
harden
and
how
do
we
provide
protection
that
can
mitigate
in
the
in
the
case
of
escapes?
So
so
certainly
there
are
environments
as
as
is
being
kind
of
mentioned
in
in
the
chat
right.
There
are
environments
that
you
know
are
are
truly
not
just
disconnected
from
the
internet,
but
but
just
can't
you
know
anybody.
Somebody
said
locked
in
a
vault
right
air
gap.
C
A
C
C
B
B
A
B
B
C
So
at
the
moment
the
analysis
is
that
I
mentioned
earlier
that
config
analysis
that's
focused
on
the
deployment.
Configs
helm
charts
those
sorts
of
things
rather
than
sccs.
So
it's
really
looking.
So
if
you
know
scc's
openshift
thing
security
context
constraint
comparable
to
coup
pods
security
policies,
pod
security
policies
have
been
deprecated
pod
security
admission
is
the
new
thing,
we'll
still
support
sccs,
so
sccs
are
cluster
objects
and
yes,
an
application
has
to
have
the
privs
to
access
one
of
those
sccs,
but
sccs
are
managed
by
the
administrator.
C
C
C
The
question,
though
around
that
is,
that
those
really
are
not
directly
tied
to
applications
they're
indirectly
tied,
whereas
deployment,
configs
and
helm
charts
are
directly
tied
and
and
will
ask
for
certain
privs
and
so
analyzing
nscc
will
tell
you.
You
know
what
I
have
on.
You
know
what
kinds
of
privileges
a
workload
might
be
given
on
a
cluster,
but
until
you
make
that
connection
between
the
scc
and
the
workload
that
caught
that
that
is
allowed
to
use
that
scc.
C
B
Yeah-
and
it
brings
up
a-
I
think,
a
tangential
question
for
me,
which
is
like
we
have
the
openshift
security
guide
and
all
that
other
stuff.
Do
we
have
a
for
lack
of
a
better
term,
a
set
of
best
practices
or
recommendations
around
security
practices?
For
things
like
that,
and
things
like
you
know,
I
think
the
anecdotal
recommendation
has
been
you
know:
don't
create
custom
secs,
just
out
of
convenience
right
going
back
to
the
whole.
C
C
You
have
to
have
the
right
level
of
of
privs
on
the
cluster
to
create
an
scc
that
could
either
be
cluster
admin
or
project
admin,
as
we
call
it
right
if
it's
if
the
scc
is,
is
going
to
be
associated
with
a
project
but
and
in
terms
of
sort
of,
if
we
circle
back
to
your
example
about
storage
andrew,
oh
thanks
for
thanks
for
whoever
shared
the
yeah
andrew
shared
the
security
guide.
That
was
the
first
part
of
the
question
right.
What
advice
do
we
have?
C
C
C
C
I
there
are
blogs,
there's
a
great
blog
I'll,
try
and
find
the
link
that
talks
about
the
neuid
issue
and
the
interaction
with
sc
linux
I'll,
try
and
find
that
link
for
you
all.
If
not
while
we're
talking,
we
can
share
it
later,
but
I
think
it's
maybe
we
should
have
a
white
paper
that
that
kind
of
digs
into
that
there.
C
B
And
I
I
think
this
also
flows
into
a
question
that
our
hope,
9
had
asked
earlier,
which
is
you
know,
can
acs
or
any
of
the
openshift
tooling
identify
and
the
core
of
his
question
is
effectively
identify
bad
practices
right.
So
his
specific
question
was:
can
it
flag,
lazy
bills
or
those
that
should
really
be
a
multi-stage
build?
But
I
think
that
there's
other
things
encompassed.
C
C
It
will
check
for
package
managers
in
running
containers
right
in
many
ways.
You
know
some
base
images
include
package
managers,
and
so
they
just
kind
of
wind
up
in
your
app
because
they
were
in
the
base
image.
But
you
it's
really
better.
If
you
don't
have
a
package
manager
in
your
running
image,
because
that's
a
that's
a
an
exploit
path
right
and
so
there
are
a
whole
series
of
known
bad
behaviors.
C
That
acs
will
analyze
for
an
alert
on
and
some
of
those
it's
not
so
again,
if
you
think
vulnerability
scans.
Generally,
I'm
looking
at
a
static
set
of
data.
It's
an
image,
a
manifest
file,
known
set
of
vulnerabilities
yeah,
the
known
set
of
phones
changes
regularly,
but
that's
still
kind
of
not
within
context
acs.
Runtime
analysis
can
go
beyond
that
and
add
context.
C
That
includes
the
kinds
of
things
I
just
described.
Crypto.
You
know.
Crypto
mining
package
manager
present
exec
in
the
container
and
also
we'll
do
a
runtime
baseline
analysis
of
your
deployment,
and
if
there
is
a
significant
change
in
behavior
it,
it
will
be
flagged
as
anomalous
behavior
and
an
alert
will
be
sent.
So
there's
kind
of
this
initial
collection
of
data
that
says:
okay,
we've
looked
at
this
for
an
hour.
We
think
this
is
the
expected
behavior
for
the
running
and
running
container,
and
if
that
changes
we're
going
to
tell
you
about
it.
C
So
there's
a
lot
more
and
also,
if
you're
looking
at
vuln
data
for
an
image
that's
deployed
to
the
cluster,
we
can
tell
you
also
whether
a
package
that
has
that
vulnerability
is
actively
used
by
the
application
based
on
that
observation
or
not.
If
it's
not
used,
take
it
out
right,
interesting,
see
what
you
can.
You
know
get
rid
of
it.
Why
you
know
reduce
your
attack
surface.
B
It's
funny
when
you
mention
package
manager
and
why
that's
a
bad
thing.
You
know
it's
a
path
for
exploitation.
Of
course.
The
first
thing
that
came
to
my
mind
was
andrew,
being
a
lazy
administrator,
and
oh,
this
isn't
working,
I'm
just
gonna.
You
know
connect
into
the
into
the
running
container
and
install
the
package
and
then
I'll
fix
it
later
in
the
image
build.
C
And,
of
course,
you
know,
that's
that's
never
best
practice,
because
as
soon
as
that
pod
goes
down
for
some
reason
it's
going
to
be
deployed
from
the
image
without
the
fix
that
you
just
made.
Even
if
you
haven't
you
know
so
until
you
fix
that
image,
your
you
know,
anything
you
do
in
the
runtime
environment
is
is
short-lived.
B
Yeah,
so
I
I
want
to
take
a
moment.
I
want
to
talk
about
the
compliance
operator,
the
the
profiles
that
are
there,
because
I
think
that
you
know
we've
talked
about
it
in
bits
and
pieces
and
other
places
and
stuff
like
that,
and
I
think
it's
important
to
highlight
that
you
know.
While
thus
far
we've
been
talking
a
lot
about
application,
layer
and
kind
of
platform.
You
know
things
running
inside
of
openshift,
there's
still
like
core
os
and
and
all
of
the
stuff
that's
happening
there.
C
C
C
I
always
oh
essential
8
for
anybody,
who's
in
australia
and
needs
to
conform
with
the
australia,
essential
8,
and
so
generally,
the
profiles
have
two
named
parts.
One
is
checking
the
node
level
and
the
other
is
checking
that
that
kubernetes
layer,
you
can
run
these
scans
out
of
the
box.
The
majority
open
shift
is
configured
to
meet
the
majority
of
the
cis
benchmark
recommendations.
C
There
are
some.
We
think
it's
important,
that
a
customer
choose
at
cd
encryption
and
you
can
do
encryption
at
many
layers.
Do
you
do
it
if
you're
running
on
a
cloud
provider
or
do
you
do
it
on
the
s3
bucket?
Do
you
do
it
on
the
rel
core
os
disk?
Do
you
do
it
at
etcd?
Do
you
do
all
three?
What's
the
performance
impact
is
your
you
know
how
you
manage.
C
That
is,
is
really
something
a
customer
needs
to
decide
so,
but
once
you
know
which
framework
you
care
about-
and
you
want
to
be
sure
your
cluster
meets,
you
run
the
scan.
You
get
feedback
the
great
dashboard
in
acs.
With
these
details,
compliance
operator
comes
with
openshift,
you
can
run
it,
but
there's
no
ui.
It's
just
kind
of
cli
output
and
controls
that
allow
you
to
do
a
human,
readable
report.
You
know
you
could
use
the
cli
to
generate
the
human
readable
report.
C
If
you
want
that
nice
dashboard,
that's
an
acs,
but
also
once
you've
decided,
which
controls.
If
there
are
some
that
are
out
of
compliance,
and
you
want
to
turn
those
on.
You
can
automatically
remediate
using
the
compliance
operator.
You
can
also
tailor
a
profile
right.
It
may
be
that
you
want
to
turn
on
some
controls,
but
not
all
of
them.
C
A
C
And
we're
working
one
of
our
other
road
map,
things
is
with
acs.
We
want
to
make
it
easier
to
we're
going
to
do
kind
of
reports,
trending
reports
out
of
the
compliance
operators,
so
you
can
see
changes
over
time
right,
we'll
we'll
store
data,
so
you
can
see
trends
and
then
we'll
also
be
able
in
acs
to
do
workflow
through
the
acs
ui.
C
C
The
runtime
behavioral
analysis
in
acs,
I
believe,
is
different
from
so.
The
collector
falco
is
a
big
project.
It's
got
collector
libraries
and
it's
got
its
runtime
behavioral
analysis,
so
the
acs
team
is
going
to
be
contributing
to
the
falco
collector
libraries
conversations
already
happening
right
now.
The
the
runtime
engines,
the
behavioral
analysis,
are
not
the
same,
and
so
that's
an
area
of
conversation
and
collaboration
and
we'll
we'll
see
whether
over
time
you
know,
maybe
we
get
to
a
single
runtime
engine.
C
B
C
B
If
there
is
anything
that
comes
to
mind
after
our
stream
or
if
you're
watching
this
not
live,
feel
free
to
reach
out,
you
can
reach
out
to
me
or
to
johnny
I'm
easy
to
get
andrew.sullivan
redhat.com
but
yeah
other
than
that
I've
got.
I
think,
there's
a
couple
of
questions
here.
I
I
I
did
want
to
so
walid,
please.
If
you
could
expand
on
your
question
there
about
odf
encryption
at
rest.
I'm
not
sure
I
understand
your
how
cluster
encryption
without
kms
statement.
B
B
C
I
I
think,
I
think,
that's
yet
another
sort
of
little
joke
right
similar
to
the
base.
64.
I
mean
yes,
people
do
it.
It's
it's,
of
course
not
preferred
and
in
fact
oftentimes
we
talk
on
my
team
about
you
can't
secure
what
you
can't
see,
and
so
certainly
some
people
do
sometimes
rely
on
obscuring
something
you
know
actually
base64
encryption
for
cube
secrets
is
a
good
example
of
that,
but
it's
really
not
particularly
secure.
C
B
C
C
Yeah,
so
you
know
what
I
think
there
may
be
some
news
on
that
in
the
what's
next
deck
next
week
and
I
will
but
that
might
be
something
I
need
to
check
with
our
colleagues.
My
recollection
is
that
we're
not
there
yet,
but
but
let's
double
check
on
that,
you
know
and-
and
I
will
say
there
are
partners
certified
red
hat
partners
who
do
that
today.
B
B
All
right
well
again,
so
thank
you
so
much
kirsten
for
joining
us
today.
This
conversation
has
been
fantastic
and
I
I
I
think
our
audience
has
enjoyed
it
as
well.
Security
is
something
that
is
near
and
dear
to
I
think,
everybody's
heart,
whether
or
not
we
want
it
to
be.
It
is
near
and
dear
to
everybody's
heart.
B
So
yes,
christian,
thank
you
for
plugging
your
show.
I
do
want
to
highlight
that
christian
has
a
new
co-host
on
the
get-ups
guide
to
the
galaxy,
so
everybody
who's
interested
in
that
please
go
and
join
tomorrow,
say
hi
and
welcome.
Welcome
them
to
the
show
for
everybody
else,
so
we
will
be
back
next
week,
johnny.
I
still
think
we
haven't
figured
out
our
topic
for
next
week.
So
sorry
stephanie,
we'll
figure
that
out
don't
forget
on
the
day
after
the
14th
is
the
what's
next
session
and
anyways.