►
Description
Red Hat Advanced Cluster Security (RHACS) integrates security into Kubernetes environments using its rich context and native controls to protect cloud-native applications across build, deploy, and runtime. As deployments scale, organizations must simplify how they manage and secure these crucial environments.
Let's start as if it’s day 1 with RHACS and work to build a complete “DevSecOps” pipeline. We’ll showcase features and discuss common pitfalls during implementation along the way. Bring all of your Kubernetes and security questions as deep dive into RHACS!
Want to learn more?
Try Red Hat OpenShift: https://red.ht/3uVxkya
Follow us:
Andrew Sullivan https://twitter.com/practicalandrew
Jonathan Rickard https://twitter.com/jrocktx1
OpenShift https://twitter.com/openshift
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1
About Ask an OpenShift Admin:
Do you have questions? We want to answer them! Every Wednesday at 11am ET, hosts Andrew Sullivan and Jonathan Rickard sit down to answer your questions about Red Hat OpenShift.
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
OpenShift on redhat.com https://red.ht/3rYz5ZS
OpenShift on GitHub https://github.com/openshift/
#RedHat #OpenShift #Kubernetes #ContainerPlatform
A
B
B
B
You
know
we
we
unexpectedly
canceled
kind
of
at
the
last
last
moment
last
week,
and
that
was
it
was
really
my
fault.
So
after
two
and
a
half
years,
I'm
pretty
sure
I
finally
got
got
covered.
So
I
never
never
tested
positive,
but
I
was
just
using
you
know
the
at-home
quick
tests
and
supposedly
those
are
less
accurate
with
the
current
variants.
But
you
know
I
had
the
the
congestion
and
all
of
that
other
stuff.
B
So
my
wife
and
I
just
assumed
that
I
had
it
and
I
last
week
I
was
coughing
and
all
that
other
stuff.
I
was
self-isolating,
my
wife,
who
is
the
polar
opposite
of
me
when
it
comes
to
things
like
fitness
and
all
of
that,
like
she's
she's
training
for
an
athlete
games
thing
so
she's
gonna
be
a
competitor
and
she's
like
I
don't
want
any
of
that.
I
don't
even
want
a
chance
of
getting
any
of
that,
because
her
competition
is
now
two
and
a
half
weeks
away.
B
B
Yeah,
as
I
take
a
pause
to
cough
right,
so
it's
it
still
got
me
a
little
bit,
but
I'm
definitely
feeling
better
feeling
more
like
99
today,
rather
than
probably
closer
to
60
last
week,
but
yeah.
So
it's
good
to
be
back.
You
know
unexpected
week
off
and
all
that
other
stuff.
It's
it's
nice
and
the
week
before
that
was
was
our
off
site.
So
I
I
got
to
meet
our
guest,
mr
michael
foster
in
person
for
the
very
first
time
it
was
phenomenal.
C
B
Yeah
it
was,
it
was
funny
because,
as
I
was
packing
my
bag
and
getting
ready
to
go,
I
always
have
in
my
backpack.
I
always
carry
kind
of
two
little
first
aid
kits
right,
so
one
is
just
you
know
what
you
call
a
booboo
kit
right,
it's
band-aids
and
stuff
like
that,
because
you
always
end
up
injuring
yourself
and
the
other
one
from
when
I
used
to
travel.
B
All
the
time
is
a
pouch
of
nothing
but
like
cold
medicine,
because
every
time
I'd
go
to
a
conference
or
something
like
that,
you
know
I'd
always
end
up
with
some
sort
of
congestion,
some
sort
of
sinus
infection.
So
it
was
funny
as
I
was
you
know,
getting
everything
together
for
the
first
time
that
I've
been
around
more
than
you
know,
five
or
six
people
in
two
and
a
half
years.
It's
like
oh
yeah.
I
remember
why
travel
is
kind
of
a
pain,
oh
yeah
and
sure
enough.
I
go
and
get
a
sinus
infection.
B
You
know
a
week
afterwards,
so
anyways,
it's
great
to
have
you
here,
michael
so
just
to
introduce
today's
topic.
So
if
you
missed
the
title
here,
we're
going
to
be
talking
about
red
hat,
advanced
cluster
security,
and
I
think
we've
talked
about
it
briefly
before
I
know.
We've
brought
it
up
on
a
number
of
occasions,
but
I
think
this
is
a
great
opportunity
to
bring
it
up
with
we'll
talk
a
little
bit
more
about
this.
In
a
moment,
new
openshift
release
some
new
features.
B
Some
new
capabilities
are
going
on
in
acs
and
just
security
is
an
important
topic.
It's
it
comes
up
a
lot.
It's
been
coming
up,
I
wouldn't
say
more
frequently,
because
that
would
imply
that
it's
never
not
come
up
but
yeah.
I
think
this
is
a
really
great,
really
timely
topic.
So
it's
something
that
I'm
looking
forward
to
so
I'll
I'll.
Ask
you
to
introduce
yourself
michael.
C
Yeah
hi
to
the
audience,
thanks
for
bringing
on
andrew
and
and
johnny,
I'm
mike
foster,
I'm
a
principal
pmm
here
at
red
hat,
I've
been
in
the
kubernetes
space
for
a
little
over
coming
up
on
five
years
now
and
kubernetes
security,
specifically
about
two
and
a
half
years.
So
I
was
a
part
of
stack
rocks
in
early
2020
and
then
moved
over
to
red
hat
during
the
acquisition
in
early
2021.
C
A
C
B
Yeah
and
and
don't
let
michael's
title
fool
you
there,
he
he's
a
very
technical
product,
marketing
manager
for
anyone
who's
familiar
with
our
with
how
we
assign
titles,
I
guess
to
folks
here
inside
a
red
hat.
So
I
I'm
do
not
be
discouraged
or
fooled
michael
can
out
out
technical
me
on
many
times
many
occasions.
B
C
B
Yeah,
so
a
little
bit
of
background,
so
michael
and
I
are
our
teammates
right,
so
we
we
sit
on
the
same
extended
teams
and
so
therefore,
for
years
right
as
long
as
as
you've
been
working
at
red
hat,
we
have
like
weekly,
you
know
coffee
hour
type
things
amongst
the
team
and
for
a
while
michael,
was
building
like
custom
building
this
wall-mounted
pc.
That
is
absolutely
gorgeous
and
really
an
impressive
amount
of
work.
So.
B
B
B
So
my
my
I
keep
my
system
at
default,
but
dark
mode
by
default,
and
you
can
see
that
it
picked
up
on
that.
I
didn't
actually
have
to
change
anything
or
do
anything
it
just
automatically
went
to
dark
mode.
So
yeah.
If
you're
curious
about
4.11,
you
can
see
4.11.0
go
check
it
out,
so
you
can
get
the
bits
in
the
normal
places.
B
So
if
we
go
to
console.redhat.com
openshift
and
if
I
go
to
releases
here,
you
can
see.
Openshift4.11
is
up
so
note
that
fast
and
stable
are
both
here
but
know
that
the
upgrades
from
4.10
to
4.11
are
not
available
yet
right
same
thing.
That
always
happens
with
every
openshift
release.
It
takes
somewhere
between
45
and
60
days
on
average
for
upgrade
channels
between
the
previous
version
and
the
current
version
to
open
up
so
just
be
patient
use
this
time
to
kind
of
explore.
B
B
B
Oh
odd
security
admission,
so
with
4.11,
which
is
really
this
is
based
off
of
the
underlying
kubernetes
version.
Kubernetes
1.25
sccs
have
changed
so
the
default
restricted
is
no
longer
present.
Right
is
no
longer
accessible
by
default
to
every
pod,
every
user
that
gets
deployed.
Instead,
there
is
restricted
v2.
You
can
see
host
network
v2,
non-root
v2.
B
Now
this
has
some
important
ramifications
and
I
think
they're
best
described
over
here
in
aha
here
it
is
in
this
blog
post.
So
I'm
going
to
post
that
there
and
request
that
if
you
could
please
post
that
into
the
various
chats,
so
this
blog
post
kind
of
walks
through
a
lot
of
the
changes
that
have
happened
inside
of
kubernetes
1.25,
how
they're
impacting
openshift
4.11.,
so
in
particular
it
walks
through
and
let's
see,
if
we
come
down
here,
you
can
see
workloads
that
qualified
for
the
restricted
sec
previously
do
not
qualify
for
v2.
B
B
So
this
is
a
really
good
opportunity
to
you,
know
kind
of
inspect
and
verify
for
your
applications
that
they
are
going
to
work
as
expected.
Of
course,
everything
red
hat
related
we'll
make
sure
that
all
of
that
stuff
works.
We're
working
with
our
partners
if
you're
not
familiar
connect.reddit.com
is
the
partner
portal,
so
we're
working
with
our
partners
to
make
sure
that
all
of
their
operators,
everything
have
been
updated
to
take
this
into
account.
C
Yeah,
I
just
I
think
it's
a
it's
a
good
step
forward.
I
think
the
the
architecture
is
a
lot
better,
having
a
sort
of
default
open
and
default
hardened
version
of
the
admission
controller
and
there's
a
middle
ground
there
as
well.
I
think
it's
better
than
the
way
psps
were
originally
enforced
because
either
you
had
to
have
psps
if
you
didn't
have
them
in
the
cluster,
all
of
a
sudden,
nothing
worked
and
that
really
wasn't
really
good
for
beginners.
So
I
think
it's
a
step
forward.
C
That
being
said,
it's
not
a
be
all
to
end
all
for
catching
up.
There's
still
a
massive
use
case
for
security
tools
to
come
in
and
enforce
based
off
of
that
emission
controller.
It
kind
of
just
allows
you
to
set
some
heart
and
defaults
in
open
source
kubernetes
that
I
think
openshift
already
had
been
accounting
for
in
a
lot
of
the
previous
versions.
So
again,
it's
just
dialing
that
knob
correctly
for
your
clusters
default
out
of
the
box
and
it's
it's
a
lot
better
in
terms
of
implementation.
B
Yeah,
I'm
I'm
really
expecting
the
vast
majority
of
this
impact
to
be
on
upstream
kubernetes,
right
openshift,
because
we've
used
that
restricted
sec
for
so
long
right.
No,
no
root,
containers
right
all
that
other
stuff.
I
I
personally
think
that
this
will
be
a
relatively
minor
change
for
for
our
customers.
You
know:
what's
what's
the
hardest
part,
what's
the
biggest
complaint
that
most
people
have
when
they
first
start
adopting
openshift?
C
A
little
sorry,
a
little
bit
of
background
information.
I
think
one
of
the
bigger
things
are
all
the
security
tools
that
were
using
kubernetes
native
frameworks
for
enforcement,
so
companies
or
organizations
that
would
use
psps
in
the
back
end
to
enforce
security
policies.
I
don't
want
to
name
names,
but
that's
that's
a
big
change
in
terms
of
architecture
for
your
application
right,
if
you
were
indeed
yeah.
B
B
A
B
B
B
So
we
want
to
check
and
see
if
anything
has
been
added
here,
it
hasn't
and
there's
no,
you
know
set
or
a
privileged
execution.
So
this
pod
will
be
perfectly
fine
or
this
container
there's
no
other
pod
or
containers
in
this
pod.
So
but
that's
one
way
that
you
can
check.
Of
course
many
different
ways.
You
can
script
that
or
otherwise
automate
it
in
order
to
check
that
information.
But
that's
what
you're
going
to
want
to
check
for.
C
B
C
Terms
of
architecture,
it's
always
just
extrapolating
those
those
security
contexts
right,
like
those
in
terms
of
deployments,
haven't
changed.
Really
it's
just
we're
using
an
admission
controller
or
we're
using
some
other
tool
to
make
sure
that
these
are
correct.
When
we
get
into
acs
we're
looking
at
the
same
exact
features
too
and
reporting
on
them
and
helping
you
weigh
risk
so.
B
B
I
think
nutanix
is
joining
us
right,
jakani
yup,
who's
coming
the
week
after
that
somebody's
coming
the
week
after
that,
too,
I
don't
remember
right
where
that's
right
so
again,
if
you
are
familiar
with
or
or
are
not
familiar
with,
I
should
say
all
of
the
stuff
that
has
happened
in
4.11,
I'm
trying
to
talk
and
do
other
things
at
the
same
time.
So
I
can
paste
this
link.
B
So
that's
a
short
link
that
I
just
posted
to
next
and
new
goes
to
the
whole
pm
presentation
right,
it's
an
hour
and
a
half
long
and
goes
into
details
on
everything,
but
we've
also
got
a
number
johnny
and
I
have
been
collecting
a
whole
list
of
topics
to
cover
that
are
relevant.
We
think
for
you
all
for
our
administrator
audience.
So
if
you
have
requests
or
anything
like
that,
don't
hesitate
to
reach
out.
B
A
Yeah
so
so
conveyor
five
days
ago,
went
to
the
cncf
as
a
sandbox
project,
which
is
pretty
awesome.
So
if
you
know
conveyor
is
part
of
the
migration
toolkit,
you
know
that
red
hat
uses.
So
that's
that's
a
pretty
big
deal.
We
did
an
episode
with
those
guys
a
couple
months
ago.
I
could
try
and
find
the
link
and
post
it,
but
it's
it's
a
pretty
big
deal
for
them
and
we're
really
happy
that
you
know
they're
part
of
the
cncf
umbrella.
Now,
that's
that's
an
awesome.
A
You
know
achievement
and
congratulations
for
them
and
then
the
other
thing
is,
you
know
with
kubernetes
version
1.25
there's
a
lot
of
changes
that
are
coming
out.
You
know
one
is
the
pod.
Security
policies
are
going
away
completely
and
then
some
of
the
other
things
that
we're
going
to
see
are
on
the
storage
side.
A
This
the
csi
driver
for
glossaryfest,
is
going
away
completely.
The
the
quote
from
the
documentation
is
that
it
there
is
a
csr
driver
that
was
built,
but
it
hasn't
been
maintained,
so
they're
just
gonna
deprecate
it
out.
The
other
thing
is
that
vsphere,
so
the
vsphere
version
support
is
going
to
be
a
minimum
of
7.0
update
2.
A
So
if
you're
on
an
older
version
of
vsphere
and
you're
wanting
to
use
kubernetes
version,
125
or
openshift,
I
think
411
has
125
that's
going
to
be
an
issue
down
the
road
so
make
sure
that
you've
got
your
your
clusters.
The
underlying
infrastructure
for
your
cluster
is
updated
to
the
at
least
to
7.0,
on
update
2.
B
But
yeah,
just
as
as
an
aside
on
that,
I
think
vmware
is
ending
support
for
vsphere,
6.5
and
6.7
this
year,
so
they're
also
pushing
hard.
You
know
outside
of
kubernetes
outside
of
openshift
they're
they're
pushing
hard
to
get
folks
up
into
the
7.0
range
as
well.
So
I'm
excited
I
found
out.
Speaking
of
you
know,
travel
and
large
groups.
B
I
found
out
I'm
going
to
vmware
explorer,
so
if
anybody
is
going
to
be
at
vmware
explorer,
look
for
the
red
hat
booth
I'll,
be
in
the
red
hat
booth
happy
to
to
chat
happy
to
to
discuss
anything
you'd
like
I'm
looking
forward
to
seeing
what
they've
got
to
say
there
so
christian.
I
think
I'm
the
only
person
on
the
planet
that
liked
gluster
fs.
B
No,
that's
not
true
at
all.
There's
lots
of
folks
who,
like
cluster
fs-
and
I
recently
learned
so
some
folks
may
know
in
my
home,
lab
I
use
trunas.
So
truenas
has
two
versions:
there's
trunascore,
which
is
the
bsd-based
version.
That's
been
around
for
ages
and
there's
truenas
scale,
which
is
debian
based
and
they
actually
one
of
the
new
fanciness
that
they
use
is.
You
can
create
a
cluster
of
multiple
nodes
that
uses
cluster
underneath
the
covers
and
it'll
like
create
a
cluster
of
resources
and
yeah.
B
A
B
Think
that's
all
of
our
top
of
mind
topics,
yeah
trueness,
for
life
right.
Thank
you
mark
all
right.
So
this
is
one
of
our
a
office
hours
series
of
live
streams
here
on
red
hat
live
streaming,
which
means
that
we
are
here
to
talk
about
answer
questions
you
know
whatever
it
is.
That
is
on
your
mind.
We
are
here
to
help
answer
those
questions
so
between
the
three
of
us,
johnny
myself
and
our
guest
today,
michael
we'll,
do
our
best
to
answer
those
questions.
B
If
we
don't
know
the
answer,
then
we'll
use
our
resources
here
inside
of
red
hat,
so
product
management,
engineering,
whoever
it
may
be
in
order
to
get
those
answers.
Hopefully,
while
we're
on
the
stream,
although
sometimes
we
can't
always
get
folks
to
respond
on
chat
or
it's
a
longer
in-depth
conversation.
But
if
not
then
we'll
follow
up,
you
know
we
can
follow
it
via
social
media.
B
Again,
you
can
reach
out
to
johnny
or
I
via
social
media
or
you
can
reach
out
or
we'll
follow
up
on
the
next
stream,
depending
on
how
it
may
be
so
with
that
being
said,
let's
talk
about
advanced
cluster
security,
and
I
I
some
folks
have
probably
heard
me
mention
before
that.
One
of
my
you
know
part
of
my
my
day.
Job
that
isn't
streaming.
B
It's
both
intimidating
into
the
just
the
sheer
amount
of
stuff
that's
inside
of
there,
but
also
terrifying
in
the
visibility
that
it
gives
and
all
of
the
information
that
it
can
pull
out
and
surface
up.
And
I
I
love
the
demo
that
we
do
with
it
for
the
open,
hybrid
cloud
stuff,
which
is
basically
defining
a
policy
to
detect
log
for
shell,
and
then
we
hook
pipelines
into
that
so
that
when
you
commit
code,
it
kicks
off
an
openshift
pipeline
that
builds
it.
That
does
all
the
things
that
it
does.
B
It
spits
out
a
container
image
at
the
end,
and
then
we
use
acs
to
validate
to
scan
that
container
image
and
if
it
detects
log
for
shell,
it
rejects
it.
It
errors
and
the
pipeline
fails
and
kicks
an
error
back
to
the
developers.
So
that's
like
just
I
know-
that's
just
scratching
the
surface
of
what's
possible
here.
C
I
was
going
to
say
that
that
should
have
came
with
a
spoiler
alert,
because
that's
basically
what
I'm
going
to
tell
them
I
was.
I
was
part
of
that
process
for
the
the
hybrid
cloud
demo,
so
yeah,
it's
it's
great
and
those
policies
that
come
as
default
now
so
yeah
log
for
shell
you'll
immediately
see
it's
it's
massively
highlighted
in
dashboard.
Oh
good.
B
B
So
yeah
all
right
that
that'll
be
great,
so
yeah,
I
know
so
one
I
wanna!
I
don't.
I
don't
wanna
hijack
your
your
flow
here,
but
can
we
start
with
just
you
know?
What's
an
overview
of
acs
like?
Why
do
I
care
about
acs?
When
do
I
need
acs
and
I'll
also
quickly,
point
out
to
folks
that
acs
is
included
with
openshift
platform
plus?
So,
if
you're
using
openshift
platform
plus,
you
already
have
access
to
it
so.
C
Yeah,
so
in
2018
I
think
2017
was
original
pivot,
but
we
really
focused
on
kubernetes
native
security
solution.
You'll
see,
you
know
other,
let's
say
other
companies
organizations
take
a
more
cloud
cloud-based
approach,
because
you
need
to
secure
all
these
containers
across
different
platforms,
but
with
kubernetes
there's
so
much
more
context.
That's
missed!
C
So,
if
you're
only
doing
vulnerability
scanning
that
might
be
just
okay,
for
you
know
some
basic
containers
or
your
smaller
use
case
as
a
startup,
but
when
you
get
to
the
organizational
level
you
know
and
a
log
for
shell
comes
up,
it's
not
just
about
seeing
the
vulnerability,
but
also
seeing
is
this
publicly
accessible
if
you're
in
a
detached
environment-
and
you
have
a
lock
for
shell
in
a
ai
ml
pipeline
in
a
contain
in
a
cluster?
That's
you
know
off
to
the
side
and
nobody's
touching
it.
C
That's
not
as
important
as
the
one
that's
publicly
accessible,
so
we
wanted
to
create
a
product
that
gives
you
that
context.
Give
it
to
you
quickly.
As
andrew
said.
Sometimes
you
see
all
these
vulnerabilities
and
there's
just
a
lot
of
information
to
sort
through
and
you
get
overwhelmed
right
and
you
go
and
scan
it
and
then
next
month
you
scan
it
again
and
there's
more
vulnerabilities
that
pop
up
it
seems
like
it's
never
ending
right.
It's
the
you're
just
chasing
all
these
vulnerabilities
all
the
time.
C
Because
I
equate
it
to
you
want
to
go
on
a
field
trip
and
you
go
and
you
bring
all
your
papers
home
and
you
get
them
signed
by
your
parents
or
whatever
you
get
money
and
then
towards
the
end
right
before
you
about
to
go.
Your
teacher
says
hey
by
the
way
you
haven't
done
this.
You
haven't
done
this.
You
haven't
done
this
and
we
want
to
get
rid
of
that.
C
We
want
to
make
here
get
all
these
signed
and
just
give
back
to
me
in
one
go
and
then
you
can
go
and
deploy
it
into
production
and
do
whatever
you
want
to
have
fun.
So
that's
the
philosophy
behind
it.
In
terms
of
the
architecture,
we
have
a
central
and
a
secured
cluster
component.
So
your
central
is
your
ui,
your
database,
everything
for
scanning
and
that's
going
to
host
all
the
the
big
tools
and
take
up
the
most
resources.
The
rest
of
it
is:
what's
called
a
secured
cluster
resource.
So
it's
your
collector.
C
That's
going
to
deploy
into
all
your
clusters,
whether
they're
on
premise
in
hybrid
cloud,
in
gke,
in
openshift,
rosa
whatever
you're
deploying
that's
going
to
collect
your
information
report,
it
back
to
the
user
interface,
and
that
gives
you
that
hybrid
cloud
solution.
Now
in
the
roadmap
we're
going
to
have
a
security
as
a
service
software
as
a
service
announcement
coming
up
that'll
be
towards
the
end
of
q4
q1
next
year,
where
you
can
just
go
and
get
into
the
acs
ui
and
just
go
and
deploy
your
agents
across
any
cloud.
C
B
You
can
deploy
all
those
things
into
that
one
cluster
and
it's
all
infrastructure,
there's
no
there's
no
entitlements
associated
with
it.
So
even
before
you
know
the
managed
service
that
michael
was
referring
to.
You
can
still
certainly
on-prem
take
advantage
of
that.
That
we'll
say
cost
advantage
sure
we'll
go
with
that
term
model.
C
Yeah
for
sure,
if
I
don't
mind
I
could
share
my
screen,
I
can
go
through
sort
of
how
to
get
started
the
different
ways
to
get
start
to,
because
just
in
case
nobody
knows,
acs
is
downstream
of
the
upstream
stack
rocks,
which
is
open
source.
So
we
got
to
keep
the
name
alive
when
red
hat
purchased
us
last
year,
which
we
were
super
excited
too.
We
still
have
monthly,
rockstars
and
a
monthly
meeting.
If
anybody
is
interested
in
that
yeah,
so
you
can
get
started
a
bunch
of
different
ways
through
the
marketplace.
C
C
So
if
you
head
to
stackprox
on
github,
there
is
a
whole
walkthrough
on
how
to
get
started.
Helm,
charts,
yaml
files-
if
that's
your
flavor
of
deploying
extremely
easy
to
go
and
deploy
it,
and
you
can
play
around
with
it,
regardless
of
if
you're,
using
openshift
or
not
so,
I'd,
recommend
that
and
then
honestly,
for
all
the
questions,
I
would
go
to
the
cncf
slack.
We
have
a
stack
rocks
channel
there
and
we
have
people
who
work
currently
at
red
hat
and
people
ex
stack
rocks,
co-workers
they're
all
there.
C
C
B
C
Yeah,
it
was,
and
it's
we
have
a
whole
blog
right
up,
because
everybody
thinks
oh
open
source
just
means
dropping
code
and
making
it
public
on
github.
No,
you
need
the
licenses.
You
need
to
make
sure
that
your
customers
that
are
in
the
code
are
properly
aware
right,
like
there's,
there's
a
lot
a
lot
of
housekeeping
that
needs
to
be
done
and
if
you
go
stackrocks.o,
we
kind
of
break
down
why
it
took
us
a
year.
B
So
yeah
it's
surprising
to
me.
I
think
how
many
folks
don't
realize
that
openshift
and
acm
and
ac,
like
all
of
these
things,
are
all
open
source
there's
a
lot
of
folks
who,
for
whatever
reason,
you
know,
think
that
it
is
proprietary
in
some
way
I
can
sort
of
get
some
of
it
right.
There
are
some
some
things
that
we
have
done
to
extend
the
kubernetes
paradigm,
so,
like
routes
routes
is
usually
the
one
that
most
people
use.
As
an
example
of.
Oh,
you
use
a
route.
B
C
C
C
Yeah
there
we
go,
it
works
right,
acs,
we
can
go
into
the
operator
and
we
can
deploy
a
central.
Now
central
does
need
a
database.
I
gave
it
you
50
to
100
gigabits
and
it's
pretty
good.
It
does
do
a
lot
of
scanning
and
a
lot
of
information
collection,
you'll
see
the
resources
there
a
lot
of
it's
because
during
that
initial
deployment,
especially
if
you're
going
into
multiple
clusters,
when
you're
doing
that
first
deploy
it
has
to
collect
scanning
information,
networking
information,
all
those
configs
from
the
different
kubernetes
and
openshift
clusters.
C
So
it
does
a
lot
once
you've
deployed
the
central
you're
going
to
get
an
init
bundle.
Basically,
all
your
certificates
and
you're
going
to
deploy
that
secured
cluster
into
your
different
clusters
for
to
collect
information
and,
in
the
end,
you'll
get
a
dashboard
that
looks
like
this
with,
and
this
is
just
from
one
cluster.
So
what
andrew
is
talking
about?
The
overwhelming
amount
of
information?
You
can
only
imagine
if
you
have
6
7
10
20
clusters.
C
This
is
just
basically
a
couple
applications
and
one
cluster,
so
I
kind
of
want
to
showcase
why
there
are
so
many
it
might
seem
overwhelming,
but
where
we
really
set
this
up
to
be
able
to
filter
down
into
what
you
need.
Typically,
the
high
to
critical
vulnerabilities
are
the
ones
you
need
to
care
for,
so
what
we
want
to
do
is
just
a
high
level
overview.
Let's
say
we
care
about
the
default.
We
care
about
front
end.
C
We
care
about
a
couple
of
our
demo
applications
that
I
installed
it
will
go
and
it'll
get
real-time
information
on
the
application,
so
you
can
sort
it
by
whatever
group
you're
looking
at.
Maybe
it's
the
the
back
end
crew
or
the
front
end
crew.
You
can
you
can
sort
and
catalog
and
also
get
reporting
based
off
of
this.
So
as
you
can
see,
we
have
two
critical
14
high.
These
are
really
the
ones
you
want
to
focus
on.
So
when
we're
only
looking
at
the
applications,
now
it's
a
little
bit
more
consumable.
C
We
can
look
at
exactly
what's
going
on
all
of
everything.
That's
blue
here
can
be
clicked
through
and
bring
you
to
another
page
which
I
really
like,
because
you
can
do
the
sorting
here
and
then
click
through,
and
it
will
bring
you
the
page,
that's
already
sorted.
So,
for
example,
we
have
an
apache
struts
violation,
that's
critical
and
we're
not
enforcing
currently
so
apache
struts,
it's
2017
vulnerability.
So
obviously
it's
a
little
old.
C
I
think
log
for
shell
is
probably
the
biggest
one
that
I
was
hoping
was
going
to
pop
up,
but
it
will
show
us
the
deployments
and
the
specific
images
that
are
associated
with
it.
So
we
have
a
risk
priority.
We
can
see
the
cvs
we
can
see
exactly
what's
fixable
as
well.
So
even
though
there's
three
massive
vulnerabilities
two
are
fixable.
These
are
the
ones
we
can
focus
on.
If,
for
example,
this
deployment
was
maybe
this.
C
This
package
was
in
all
of
our
deployments,
because
it's
a
base
package
that
everybody
at
your
organization
uses
you'll
start
to
see
this
environmental
impact
score
go
up.
So
what's
nice
too,
is
you
can
triage
by
risk?
You
can
triage
by
the
vulnerability
and
you
can
see
exactly
the
impact.
So
if
log
for
shell
came
in
and
all
of
a
sudden
20
was
affected,
you
know
you're
gonna
have
to
do
a
lot
of
cleaning
very
quickly
right.
If
it's
one
percent
effective.
Maybe
you
change
your
weighted
score
on
what
you
really
want
to
triage.
C
B
C
C
C
Yeah,
so
everything
in
terms
of
authentication
is
built
around
kubernetes,
so
you
can.
Yes,
you
can
set
specific
access
scopes.
So,
for
example,
you
have
admin,
you
have
analyst,
you
can
have
rules
for
your
ci
pipeline,
so
the
pipeline
that
I'll
showcase
towards
the
end
and
and
really
you
can
scope
the
roles
too,
as
an
admin.
So
when
you're
creating
reports
and
generating
reports,
you
can
be
based
off
of
those
groups.
So
let's
say
I
say:
hey
here's,
the
analyst
role
and
it's
for
the
mit
or
ml
team.
C
I
could
set
the
scope
of
that
resource
set
the
the
name
spaces
to
look
at
and
then
I
can
generate
automatic
reports
every
week
to
send
out
to
say:
hey,
you
guys
are
getting
more
and
more
insecure.
You
guys
are
doing
a
great
job.
Look
at
your
cutting
down
on
these
vulnerabilities,
which
is
a
really
good
way
to
to
actually
get
security
information
and
show
that
you're
doing
a
good
job.
I
think
all
that
data
is
is
good
for
security
teams.
A
Yeah,
this
is
nice
because
you
think
about
like
the
issos
and
issms
that
are
out
there
that
are
always
trying
to
like
collect
information
from
sysadmins
and
stuff,
like
that,
like
this
gives
them
a
nice.
It's
unfortunate
for
the
sysadmin
now
because
now
there's
this
interface
that
they
can
go
to
and
find
out
the
ground
truth
on
if
they're
updating
their
stuff.
C
Yeah
so,
for
example,
you
know
you
can
create
weekly
reports
select
notifiers.
If
you
want
something
like
an
email,
we
have
integrations
with
slack
microsoft
teams,
things
like
that,
so
you
can.
You
can
blast
information
out
depending
on
what's
going
on,
this
can
be
all
automatic.
So
it's
it's!
You
can
sort
of
gamify
the
system
from
some
of
those
developers.
Maybe.
C
One
last
thing
in
production:
one
less
thing
to
triage,
because
let's
say
you
set
a
bunch
of
enforcement
policies
in
production
like
you,
don't
want
a
cube,
ctl,
exec
and
then
all
of
a
sudden,
your
acs
dashboard
is
not
working
and
you
as
an
admin
want
to
go
in
and
go
hey,
keep
ctl
exact,
and
then
you
just
go
and
evict
your
own
acs
dashboard
right.
So
it's
one
of
the
reasons
why
enforcement
is
off
by
default
in
acs.
C
You
have
to
go
and
turn
it
on,
and
then
you
need
to
be
very
careful
about
the
policies
that
you
enforce
and
just
in
general,
with
security
applications
anytime,
you
see
a
sort
of
automatic
removal,
automatic
discovery,
automatic,
let's
say:
enforcement.
Your
like
a
flag
should
be
going
up
saying.
How
is
this
working
and
how
do
I
make
sure
that
I
don't
evict
my
own
people
in
my
cluster
right?
But
yeah,
hopefully
that.
B
I
I
worked
with
a
customer
one
time
who
this
was
back
in
my
virtualization
days
and
you
know
we
were
showing
them
how
to
use
like
power
cli
to
do
a
bunch
of
stuff
with
virtual
machines,
and
it
was
we
don't.
We
don't
want
to
automate
because
you
know
if
we
make
a
mistake,
you
know
suddenly
it's
affected
all
of
the
vms
or
hundreds
of
vms.
Instead
of
you
know
the
one
or
three
or
five
that
a
human
can
get
to
before
we
figure
out
the
mistake.
C
Yeah
and-
and
we
had
a
lot
of
great
engineers
on
staff
building
stack
rocks,
who
had
been
through
the
ringer
with
exactly
we
were
talking
about
10
15
years
ago,
and
they
realized
that
as
much
as
you
want
to
create
the
ideal
security
tool,
you
really
do
need
to
map
it
to
people.
So
you
want
to
get
these
policies
and
you
want
to
get
these-
let's
say
information
as
close
to
developers.
So
you
hear
that
shift
left
turn.
C
The
marketing
term
shift
left
technically
a
pmm,
so
I
hear
it
all
the
time,
but
really
it's
about
those
policies
that
you
see
those
vulnerabilities,
those
critical
ones
going
and
when
a
developer
goes
through
the
build
process
for
the
first
time,
it's
flagging
them
saying
hey.
This
is
a
critical
vulnerability.
You're
gonna
have
to
fix
this
before
it
gets
to
prod.
Now
that
doesn't
necessarily
mean
you
break
it
for
dev
right.
Maybe
you
let
the
developer
go
and
for
the
next
six
weeks.
C
It's
I'm
not
gonna
break
your
pipeline,
but
then
that
three
week
time
where
it's
you
know,
we
need
to
make
sure
everything's,
stable
or
we're
doing
testing
or
maybe
there's
a
three-day
security
check.
Where
we're
where
we're
fixing
things,
then
you
have
to
come
and
say:
if
you
don't
fix
this
in
time,
we're
going
to
have
to
break
your
build.
There's
there's
a
lot
of
flexibility
in
that
that
architecture
and
it's
it
doesn't.
It
doesn't
seem
like
you're
coming
at
that
last
minute,
with
the
permission
slip
and
slapping
on
the
developer's
desk
right.
B
C
Yeah
yeah,
it
cures
the
newcomers
on
it.
So
for
those
watching
we
do
a
security
live
stream
every
month
on
the
third
tuesday
at
2
p.m,
and
kiersten
newcomer
was
on
our
discussion
yesterday
when
we
were
chatting-
and
she
said,
devops
was
always
supposed
to
have
security.
The
issue
was
the
actual
implementation
of
it
and
doing
it
in
a
way,
that's
effective
and
it
doesn't
come
through
with
you
know:
1700
vulnerabilities
for
the
developer
right
so
part
of,
like
you
said,
seeing
all
this
information
is,
you
could
scope
those
policies
to
say.
B
C
Sounds
like
one
install
per
environment-
I
you
just
one
central
is
typically
pretty
good
and
then
the
secured
cluster
components
will
need
to
go
in
every,
I
think
of
it
kind
of
like.
What's
the
word
for
it,
what's
the
logging
agent
that
I'm
blanking
on
right
now
or
like
a
prometheus,
install
right,
yeah,
very
similar
architecture.
B
Well,
I
think
it's
interesting
that
it
just
let's
sidetrack
for
a
moment,
so
I
can
have
a
single
central
install
and
I
can
point
you
know
dev
test
and
production
all
as
clients,
if
you
will
of
that
single
instance,
and
that
allows
you
to
take
the
things
that
have
been
learned.
You
know
security
policies,
all
the
other
stuff
that
you
would
want
to
apply
and
dev
and
test.
You
learn
them
there
and
then
apply
them
in
production
or
learn
them
in
dev,
test
them
and
test
and
then
apply
them
in
production.
B
C
C
Yeah,
I
look
at
it
kind
of
like
security
gates
right.
If
you
want
to
get
to
production,
you
know
you're
going
to
have
to
meet
this
standard,
we're
going
to
tell
you
the
standards
up
front
as
soon
as
you
start
building
and
you
want
to
apply
for
that
process,
but
it
also
helps
because,
let's
see
you
could
push
back
a
little
bit
as
a
security
team
to
say
developers,
we
gave
you
three
weeks.
We
told
you
about
this.
You
knew
this
was
coming.
C
If
you
don't
like
the
way
we
notified
you,
we
can
fix
that
we
can
get
more
scoped
but
yeah.
I
I
agree
with
the
it
really
part
of
that
cd
deployment
is
the
the
biggest
aspect
you
don't
want
to
just
be
looking
at
an
issue
in
the
ui
and
then
sending
an
email
to
a
developer.
Saying,
hey,
update
this
container
and
then
scanning
again
to
see
if
it's
updated,
you'll
drive
yourself
crazy.
That
way,
you're.
B
Yeah,
I'm
going
to
completely
derail
you
for
a
second
just
because
it's
bothering
me
in
the
back
of
my
head.
I
seem
to
recall
that
acs
also
had
the
ability
to
like
not
inspect,
but
look
at
how
maybe
pods
and
different
namespaces
were
communicating
and
be
able
to
help
with,
like
creating
networks,
policies
and
stuff
like
that.
C
Oh
yeah,
so
this
is
our
network
graph.
Typically,
when
you
come
in
I've
already
been
through
this,
so
I've
selected
exactly
what
I
want
to
look
at.
But
if
you
had,
let's
say
10
clusters,
this
graph
would
be
massive,
so
we're
going
to
get
very
scoped
with
what
we
want
to
see
when
you
first
deploy
acs,
it
will
go
and
look
at
the
average
network
traffic
over.
C
That's
because
they
have
network
policy
set
up
they're
scoped
for
exactly
the
network
traffic
that
they're
supposed
to
accept,
and
that's
all
good
now
my
little
sock
shop
demo
that
I
think
has
been
hanging
around
for
nine
years
now.
I
don't
know
how
old
it
is.
Maybe
seven
dating
myself.
Now
it
has
no
network
policies,
so
of
course
it's
going
to
come
in
as
red
now.
C
What
I
would
probably
want
to
do
is
scope
the
namespace
to
sockshop,
look
at
the
network
traffic
and
then
try
the
network
policy
simulator
to
just
to
see
if
it
it
would
probably
just
give
me
a
deny
all,
because
I
haven't
sent
any
traffic
to
that
namespace
at
all
right,
but
at
least
that's
a
good
starting
point.
Now
what
we're
working
on
in
the
roadmap
and
we're
working
on
this
with
ibm
as
well?
C
Is
it's
a
netpull
application
and
it's
the
ability
to
scan
all
of
the
deployment
yamls
early
in
the
process
so
that
we're
not
doing
the
simulation
through
the
ui
so
that
when
a
developer
goes
and
checks
in
their
code
and
says,
here's
my
deployment
yaml?
That
goes
with
my
application.
It
will
say:
oh
we
see
that
you
need.
C
You
know
four,
four,
three,
eight
four,
four
three:
whatever
pod,
you
know
node
port,
whatever
it
is,
and
then
it
will
generate
the
network
policy
at
par
part
of
the
build
process
and
check
it
in
as
an
artifact
with
it
right.
So
you're
you're,
actually
getting
basically
the
developer
doesn't
need
to
worry
about
the
dark
policy,
but
you,
as
a
security
person,
are
going
to
come
in
and
say:
oh
sock,
shop,
all
of
a
sudden
has
network
policies.
C
Oh
these
are
the
recommended
ones
and
then,
when
you
go
through
tests,
you
can
kind
of
say:
okay,
were
these
the
correct
ones
that
were
recommended
and
then,
if
they're
not
now,
we
can
have
that
conversation
where
it's
only
one
slight
fix.
Instead
of
recommending
an
entire
network
policy
and
going
back
and
forth
a
couple
times
right
so
nice,
that's
it's
it's
still
in
the
works
in
terms
of
how
best
to
implement
it.
C
B
C
People
run
weird
tests
right,
like
sometimes
they're,
using
weird
ports
to
test
their
application,
and
you
don't
know-
and
you
say:
hey,
here's
a
network
policy
and
it
shuts
down
all
their
tests.
And
then
you
know
you
have
this
weird
back
and
forth,
and
so
it's
just
about
eliminating
that
that
friction
and
doing
in
a
way
that
the
developer
understands.
What's
going
on,
they're,
okay,
with
it
giving
you
that
flexibility.
A
Yeah,
it's
allowing
people
to
move
fast
and
securely.
At
the
same
time,
that's
pretty
awesome.
I
I
have
a
quick
question.
Do
you
know
like
so
kyberno
right
like
it
seems
to
be
like
the
the
mainstream
topic
right
now
on
like
a
lot
of
the
network
policy
replacement,
but
that
type
of
like
admission,
controller
type,
interaction,
keeping
things
from
you
know
not
using
the
latest
tag.
So
I
know
acs
has
some
of
that
capability.
C
I
would
say
that
you
would
need
so
acs
is
probably
the
best
open
source
full
stack
security
solution
for
kubernetes
period.
You
need
something
like
a
kyverno
and
a
falco.
Maybe
mixed
with
you
know
a
claire
scanner
right
to
really
get
that
terms
in
terms
of
total
functionality,
you're
going
to
need
all
those
pieces
brought
together,
and
that's
really
the
differentiation
between
acs
and
something
like
caverno,
there's,
there's
policies
and
then
like
policy
is
code
aspect
but
you're
missing
the
runtime
security,
and
I,
as
I
can
go
into
it.
B
C
Packet
trace,
not
exactly,
I
think
you
need
a
very,
very
detailed
tool,
so
something
like
istio
right.
I
know
that
red
hat,
open
chef,
use,
istio
and
istio
has
that
capability.
If
you
want
to
turn
it
on
and
enable
it
in
a
certain
way,
I
remember
seeing
actually
a
write-up.
I
don't
know
if
it
was
from
you,
andrew,
but
partially
when
we
first
got
onboarded.
C
Last
year
we
were
looking
at
some
of
the
overlap
of
what
we
have
in
terms
of
feature
and
what
openshift
already
brings,
and
that
was
one
of
them,
and
it
was
if
you
really
need
that
sort
of
network
capability.
You
should
be
using
another
tool,
because
if
we
brought
that
into
acs,
that
would
be
very,
very
heavy
right,
you're
going
to
need
something
like
a
sidecar
architecture
or
you're
going
to
need
a
a
network
controller
that
that
manages
a
lot
more
in
the
cluster
and
we
weren't
really
ready
to
take
on
that.
Yet.
B
Yeah
I
I
would
tend
to
agree
that
something
like
service
mesh,
which
is
designed
to
be
deployed
and
exist
right
alongside
all
of
those
pods
and
really
manage
and
inspect
that
traffic.
You
know
jager
et
cetera
for
and
I
see
khalid
mentioning
jaeger
for
service
mesh,
but
you
know
for
doing
that
analysis
right
and
and
collecting
all
that
information
et
cetera.
So
we
we
johnny-
and
I
we've
talked
about
bringing
ortwin
back
on
ortwin-
is
the
service
message
sme,
so
he.
C
Yeah,
in
terms
of
I
wouldn't
say,
trace
packets,
but
I
think
process
discovery
is
the
biggest
thing
right,
because
really,
if
you're
going
to
be
getting
to
the
packets,
you
probably
want
to
help.
You
probably
want
to
set
up
some
shop
on
the
border
to
stop
some
malicious
processes
from
getting
through,
but
once
they're
in
and
in
your
cluster,
it's
really
going
to
be
the
process
to
see
who's
doing
what
having
that
audit
log,
I
think
it's.
C
The
easiest
thing
to
capture
and
export
products
like
falco
can
do
a
little
bit
more
in
terms
well,
so
falco's,
one
of
the
we
have
a
fork
of
falco
that
we
use
in
acs
and
stack
rocks,
but
you
can
get
a
little
bit
more
fine
grained
if
you
interact
with
falco
directly
and
use
their
config
files.
But
that
is
a
massive
and,
to
be
honest,
you
had
to
do
this
for
the
cks.
It
is
very
intense
and
lengthy
if
you
want
to
do
that,
I
think
you're
way
better
off
getting
a
like
full
stack.
B
C
B
C
B
A
B
B
C
C
C
It's
very
it's.
It's
always
nice
to
see
how
people
are
using
security
tools.
I
just
want
to
go
through
and
showcase
a
policy.
So
actually,
let's
talk
about
risk
really
quickly
before
I
jump
into
policy
risk.
Is
the
the
tricky
word
that
nobody
likes
to
touch
in
security,
because
everybody's
definition
of
risk
is
different
right
now
our
definition
of
risk
in
kubernetes
focuses
around
vulnerabilities
and
the
configuration
of
your
container
right
to
actually
get
an
assessment
of
what
is
the
riskiest
and
so
really
what
we're
looking
at
is
policy
violations.
C
So
we
have
some
critical
policy
violations.
We
have
some
deployment
details
where
we
haven't
dropped.
Any
capabilities
where
we
were
talking
about
the
secure
contacts
earlier-
and
maybe
there
have
a
privileged
container
as
well,
could
also
be
paired
with
some,
let's
say:
app:
get
commands
right
in
the
in
the
processor,
so
somebody's
in
the
container
they're
running
out
of
get
they're
trying
to
install
something.
That's
going
to
be
one
of
your
riskier
deployments
that
you're
going
to
want
to
to
check
out
now.
C
Yeah
so,
for
example,
here's
one
where
the
visa
process,
where
netcat
execution
was
detected
right
and
you
can
set
a
policy
specifically
just
for
that
runtime.
Let's
say
you
have
a
container
that
you're
very,
very
worried
about,
and
you
say
I
know
I'm
installing
that
cat
in
here
and
I
want
to
know
whenever
it's
there,
because
I'm
only
using
it
for
debugging.
Well,
you
can
get
a
policy
to
say,
hey
notify
me
this.
Whenever
this
happens
and
then
I
can
ping,
you
know
my
co-worker
sheila
or
tom,
or
whoever
and
be
like
hey.
C
Are
you
in
the
cluster
right
now,
I'm
getting
a
notification?
No,
that's
not
me
all
right!
All
right!
Let's
go!
Let's
go
shut!
This
down.
You
can
get
very
fine
grain
in
that
detail.
So
but
yeah,
that's
it's
it's!
Taking
that
runtime
information
that
configuration
information
and
the
vulnerability
to
give
you
an
overall
assessment
of
risk
which
is
lacking,
and
I
don't
want
to
put
down
other
tools,
but
you
need
multiple
tools
to
sort
of
get
that
full
picture
and
then
for
go
ahead
andrew.
I.
B
C
B
C
I
think
so
yeah
anyways,
so
for,
but
we
talk
about
all
these
policies.
We
have
a
bunch
of
policies
that
are
shipped
as
a
default
like
the
log
for
shell
spring
for
shell,
but
you
might
want
to
get
you
know
very
specific
with
it.
Now
you
can
create
one
you
can
also.
My
favorite
is
just
to
clone
policies.
So
let's
say
we
have
the.
C
Let
me
scroll
down.
I
probably
could
have
just
searched
this,
but
we
have
the
log
for
shell
here.
It's
critical
we
can
enforce
in
the
build
and
deploy
so
part
of
it
is,
we
could
say,
we're
going
to
enforce
in
build
we're
going
to
force
it,
deploy
we're
also.
We
can
enforce
it
runtime
as
well,
although
that
one
has
to
be
turned
on.
C
Let's
call
the
policy
always
recommend
cloning,
the
defaults
just
so
that
every
update
you're
getting
the
correct
updates
and
I
think,
by
default
now
we
don't
allow
you
to
delete
the
defaults
yeah.
So,
for
example,
this
is
a
log
for
shell.
We
have
critical,
we
have
it
in
vulnerability,
management
and
a
specific
description
and
rationale
so
part
of
if
this
breaks
the
build
process,
you're
going
to
see
exactly
the
guidance
and
the
rationale
to
the
developer
of
what
they
need
to
fix,
hey.
This
is
what's
going
on.
C
This
is
super
super
important
you're
not
going
to
get
anywhere
unless
you
fix
this.
These
are
the
things
you
have
to
do.
These
are
the
updates
that
you
have
to
make
and
we
also
map
to
the
miter
attack
framework.
So
if
you
are
creating
something-
and
you
want
to
say,
hey
this
actually,
maps
towards
initial
access
is
helping
us
with
our
miter
framework
compliance.
C
We
can
do
that
as
well
and
again
you
can
pick
the
lifestyle
life
cycle,
stages,
inform
and
enforce,
so
we
can
decide
hey.
We
just
want
to
send
the
information
or
we're
going
to
shut
down
the
build
process.
If
this
policy
breaks
and
then
we
can
set
scopes
so
part
of
those
cvs
is,
we
could
say
log
for
show,
and
maybe
we
want
instead
of
having
two
policies.
We
want
to
group
log
for
shell
and
spring
for
shell
together
right
or
something
that
is
very
similar.
We
can
do
that.
C
We
can
do
an
or
and
an
and
we
can
allow
certain
vulnerabilities
to
come
in.
We
can
say
we
don't
really
care
that
much
about
this
won't
really
let
it
through.
So
we
have
a
little
bit
more
fine
grade
detail
there,
and
then
we
can
restrict
by
scope
so
specific
groups
that
we
create,
or
name
space
or
labels.
We
could
say:
hey,
you
know
we're
not
going
to
enforce
against
this
application,
because
it's
the
it's
the
mlai
team
and
they're
in
a
detached
environment,
and
we
don't
really
care
about
them.
C
A
C
I
believe
they're
all
in
json
they
can
be
exported
using
the
the
api.
The
stack
acs
api.
You
can
take
all
those
objects
out
when
you
update-
or
let's
say
you
know,
your
application
crashes,
you
need
to
reinstall
it.
You
could
just
push
all
of
those
policies
directly
back
to
the
ai
and
you
bring
up
the
exact
same
cluster
and
you
can
do
backups
on
the
on
the
database
as
well
to
s3
buckets
and
I
think
another
couple
bunch
of
different
storage
solutions.
C
All
right
I'll
get
to
this
last
bit,
so
I've
installed
red
hat,
openshift
pipelines
and
created
a
just
small
pipeline
check
in
this
pipeline
demo.
As
you
can
see,
I
ran
it
just
before
the
show
to
make
sure
that
everything
went
off
without
a
hitch
and
I
can
go
if
I
want
to
start
it.
I
can
just
drop
in
whatever
container
I
want
to
run
so
if
you're
doing
a
build
process,
you
would
change
the
specific
variables.
C
C
Container
file,
that's
right,
so
it's
checking
and
looking
at
all
the
vulnerabilities
associated
with
the
packages
in
that
container
file,
and
then
what
it's
doing
is
it's
taking
that
pinging
rock
ctl
and
saying
based
off
of
these
vulnerabilities.
Does
this
violate
a
policy
and
you're
going
to
come
back
with?
Yes,
five
policies
have
been
violated.
C
Things
like
containers
should
run
as
a
non-root
user.
So
in
that
docker
file,
it's
saying
I
want
a
res
root
and
if
I
scroll
to
the
top,
you
can
see
that
the
log
for
shell
remote
code,
execution
vulnerability
is
there.
It
breaks
does
not
does
not
say
it
breaks
the
build,
but
as
part
of
this
pipeline,
we
have
it's
that
a
violation
breaks
the
build.
So
there's
multiple
aspects
there,
you
can
do
it
so
that
the
pipeline
doesn't
override
you
if
you're
a
security
person.
You
want
to
allow
that.
C
C
Yeah,
we
have
a
question
there,
it
says:
can
I
validate
boms
and
salsa
too?
Nothing
really
validates
salsa
right
now,
there's
a
couple
startups
that
are
in
the
works,
starting
that
are
just
starting
to
get
into
that
one
of
the
issues
with
billet
materials
and
salsa.
Is
there
really
is
no
well
spilled?
Interior,
as
I'll
say,
is:
there's
no
agreement
on
how
build
of
materials
is
going
to
look
and
be
validated.
C
That
being
said,
we
do
have
sig
store
and
recore
validation,
so
if
you
have,
if
you
have
cosine
and
you're
signing
your
containers,
acs
can
validate
those
containers
as
part
of
the
3.70
launch.
I
believe
so.
If
you
turn
enforcement
on
and
you
integrate
into
sig
store
and
cosine,
we
can
enforce
based
off
of
if
that
signature
changes
at
all
with
acs,
yeah.
A
C
B
C
C
I
did
see
a
startup
in
open
source
in
the
open
source
summit
where
they
were
looking
at
mapping
the
bill
of
materials,
the
github
account
and
the
users
for
a
measure
of
authenticity
or
like
a
how
well
can
you
trust
these
people,
if
they're
open
source
contributors
for
10
years,
and
they
have
a
community
of
10
people
in
the
github
account
and
they
have
a
bill
of
materials?
Well
then,
it's
like
okay
they're
trustworthy.
If
it's
two
people
running
a
a
small
package
out
of
you
know,
somewhere.
A
B
It's
like
the
google
search
algorithm
right
and
how
it
how
it
assigns
you
know
credence
or
authority
to
various
sources
based
off
of
who's
linking
and
like
all
of
that
other
stuff.
It's
this
kind
of
ephemeral
or
not
ephemeral,
but
mystical
type
of
thing
of
how
do
you
judge
somebody's,
not
not
worthiness,
but
credibility.
Right,
trustability,
based
off
of
other
things
in
a
reliable
and
consistent
way,
is
really
hard.
B
A
Yeah,
it's
it's
interesting
because
you
know,
like
a
lot
of
people,
are
moving
towards
the
six
store
framework
right
or
the
six
store.
You
know
signing
everything
essentially
like
github,
just
I
think,
they're
making
an
effort
now
to
start
you
know
enforcing
signing,
repos
and
stuff
like
that.
So
that
way
you
know
you
know
somebody
can't
go
in
and
change
a
character
or
add
some.
You
know
frivolous
character
at
the
end
of
a
repo
name
to
you
know,
get
somebody
to
typo
and
you
know
get
misdirected
or
whatever.
A
So
I
I
think
that's
pretty
cool
cosign
is
it's
interesting
and
I'm
I'm
happy
that
it's
like
that.
There's
a
lot
of
progress
with
it
and
I'll
be
glad
to
see
it
like
when
it's
just
it's
just
part
of
everything
you
don't
have
to
do
all
this
extra
crap
to
get
it
working.
It
just
kind
of
goes,
and
you
know
it's
all
just
part
of
the
product
or
whatever.
C
For
those
interested,
I
will
be
at
six
store
con
in
detroit
kubecon,
north
america.
It's
the
inaugural,
it's
the
first
day
that
they're
doing
this,
I
don't
know
exactly
who's
speaking,
but
I
figured
probably
somebody
in
the
six
store
community
that
red
hat
knows
that
we'll
be
chatting
there.
So
if
you're
interested
come
by
and
check
it
out
and
say,
hi.
B
C
B
Yeah
kubecon's
coming
up
it's
two
months
away
or
so
now
so,
let's
see,
let's
revisit
some
questions
so
quickly.
Just
anybody
who
has
any
questions
we,
we
usually
try
and
stay
in
the
75
to
80
minute
range,
so
we're
coming
up
on
the
end
of
that.
So
if
you
have
any
questions
anything
that
we
haven't
gotten
to
anything
that
we
might
have
missed,
although
we
I
hope
we
didn't
miss
anything,
any
questions
that
you've
been
holding
off
on.
B
Please
go
ahead
and
send
those
over
now
we'll
do
our
best
to
answer
all
those
questions
and,
of
course
you
can
always
reach
out
to
us
afterwards
and
we'll
we'll
go
over
socials
and
all
that
other
stuff
here
at
the
end,
muhammad.
What
is
the
best
way
to
become
an
open
shift,
admin
from
rhcsa
or
rhce,
so
there's
no
kind
of
clear-cut
or
single
path.
I
think
that
folks
take
because
it
depends
on
your
experience
in
particular
with
kubernetes
compared
to
you,
know
traditional
rail
and
stuff
like
that.
B
I
won't
say
it's
easy,
but
it
is
easier
than
if
you're
coming
in
cold
with
no
kubernetes
experience
or
anything
like
that.
So
my
suggestion
for
everyone,
kind
of
blanket
out
of
the
box
is
to
look
for
the
do080
course
on
red
hat
learning.
So
it
is
a
free
course.
Anybody
can
do
it.
You
can
go
and
register
it's.
B
Openshift
is
included
with
the
developer
entitlement.
So
if
you
register
for
a
red
hat
developer
account,
you
have
access
to
up
to
16
entitlements,
16
nodes
of
openshift
that
you
can
use
for
single
user
non-production
use
to
learn
all
of
the
things,
but
yeah
there's
there's
a
bunch
of
different
resources
available.
I
think
stephanie
also
linked
that
the
level
up
folks
are
going
to
be
doing
a
yeah,
the
director
of
training
and
certification.
C
C
It
was
originally
designed
specifically
with
that
in
mind,
so
it
covers
both
use
cases.
Obviously,
if
you
have
an
acs
central,
it's
an
air
gap
environment,
then
you
have
an
external
cluster
you're
going
to
need
two
instances
of
acs
because
they
will
not
be
talking
with
each
other.
But
yes,
awesome.
We've
been
in
some
cool
environments.
I'll
say
that
I
don't
know
how
much
I
can
allude
to,
but
the
disconnected
nature
of
kubernetes
and
it's
been
pretty
interesting.
A
B
It
uses
rel
core
os,
which
is
a
flavor
of
rel
in
the
same
way
that
like
rel
for
edge
and
all
that
so
but
the
the
spirit
of
what
you're
saying
is
absolutely
true
and
that
you
don't
ssh
into
the
node
and
administer
it
in
the
same
way
that
you
would
a
rel
node
you
you
administer
it
the
openshift
way
using
you
know,
machine,
config
and
all
that
other
stuff.
So
very
good
point
dave
and
thank
you
for
bringing
that
up.
C
Just
as
part
of
an
openshift
security
mention,
you
know
we
saw
that
dash
with
all
those
vulnerabilities,
but
when
you
have
that
ubi
right
like
something
like
a
core
os
or
something
you're
using
for
developers
where
that
base
image
is
a
lot
the
same.
Not
only
do
you
catch
specific
images,
a
lot
quicker
right,
but
everybody's
playing
at
the
same
baseline,
so
you're
able
to
triage
and
sort
accordingly
when
certain
applications
go
off
the
rails,
like
so
just
think
about
when
you're,
using
that
universal
base
image
and
the
developer's
like.
C
B
Yeah
having
shipped
products
at
previous
employers
before
and
gone
through
that
security,
certification
process
and
oh
you
didn't
use
our
pre-certified
linux
distro
for
this,
and
you
know
here's
the
gosh.
Well,
I
think
we
had
to
go
through
something
like
4,
000,
different
items
and
go
through
and
a
human
had
to
go
through
and
validate.
You
know
either
this
doesn't
affect
or
this
doesn't
apply
or
you
know
it
was
like
weeks
right,
the
mythical
man
month.
You
know,
weeks
of
effort
by
half
the
team
to
go
through
and
well.
B
B
So
I
I
you
know
fun
is
fun,
is
subjective.
Some
people
would
argue
that
nothing
about
kubernetes
is
fun
because
it's
yaml
and
who
likes
yaml
but
yeah.
I
I
don't
know
I
think
they're
fun
to
use.
I
find
it.
I
I
I
think
it's
fun
for
me,
because
I
enjoy
learning
new
things
and
and
addressing
those
challenges.
As
I
said
at
the
beginning,
I
spent
like
what
four
hours
yesterday
troubleshooting
or
I
think
we
were
talking
about
this
before
we
started.
B
C
I
remember
when
I
first
started
networking
and
setting
up
my
own
server
at
home,
and
I
started
with
terraform
thinking
like
that,
would
be
great
for
a
home
server,
nope.
Okay,
you
need
ansible
and
then
once
you
get
that
configuration
right
and
being
able
to
to
spin
it
up
and
tear
it
back
down,
it's
like
yes
and
then
you
do
the
same
thing
with
kubernetes
and
you
figure
it
out
it
it
it's
that
learning
curve.
It's
definitely
there
in
kubernetes
yeah,
but
it
is
very
rewarding.
A
It
is
awesome,
I
think
it's
all
fun
too.
I
mean
like
especially
when
you
take
the
like
the
diversity
of
what
you
can
do
with
either
kubernetes
and
openshift,
or
you
know
or
openshift.
You
know,
like
the
I
think,
initially,
like
just
figuring
out
disconnected
openshift
was
just
you're
like
what
is
happening,
and
then
you
finally
get
it
you're
like.
Oh,
my
god.
This
is
magic.
It's
awesome.
C
C
B
Yeah,
I
know
I'm
I
was
thinking
back
of.
You
know
how
to
make
it
fun.
I
don't.
When
was
it?
It
had
to
be
like
dockercon,
2015
2016,
something
like
that
when
they
had
the
minecraft
demo,
where,
like
each
container
running
on
the
host,
was
a
minecraft
block
and
you
could
go
and
destroy
the
block
and
watch
it.
Maybe
it
was
a
kubecon
early,
kubecon
demo.
C
B
I
think
I
saw
the
demo
you're
talking
about.
I
remember
that
one,
I'm
thinking
now
we
just
need
to
like
challenge
the
developer,
evangelism
team
or
something
like
that.
Like
can
you?
Can
you
create
this
thing?
Where
you
know
I
can,
I
can
create
open
shift
objects,
kubernetes
objects
using
some
sort
of
game
interface
like
quake
or
doom.
I
don't
know
how
that
would
work,
though,
but
oh
my.
B
They
do
so
the
eric
d'andra
he
just
recently
updated
the
quarkus
superheroes
thing,
which
is
a
really
cool
app.
That's
a
it's
a
lot
of
fun
to
play
with
so
I'll
have
to
I'll
see
if
I
can
dig
up
the
link
for
that,
but
it's
a
demo
app
that
they
use
and
he'll
customize
it
based
on,
like
the
the
customer
of
the
industry
that
he's
talking
to,
and
it's
like
two
things
that
have
different
properties,
that
battle
each
other
and
the
default
is
using
superheroes.
So
it's
like
you
know.
B
C
B
C
Aaron
actually
has
a
good
point.
This
is
something
that
we've
discussed
when
you
first
turn
on
acs.
The
number
of
findings
can
be
scary.
Many
of
them
relate
to
ocp
services
and
pods.
How
do
you
handle
all
those
correct
I'll
give
you
an
example?
Actually,
if
we
could
pull
my
screen
up
real
quick,
because
I
was
looking
at
one
where
to
do
if
we
go
to
risk,
we
find
one,
that's
an
acs.
C
Yes,
we're
getting
a
lot
of
cves
now,
there's
always
gonna
be
a
ton
of
cvs,
no
matter
where
you
go,
a
lot
of
them
are
low
or
not
important,
and
the
reason
is
like
the
developers,
don't
really
fix
those
they're,
very
specific
and
typically
they're
not
going
to
impact
you
unless
you're
publicly
facing
you
have
some
sort
of
crazy
environment
set
up.
So
you
really
kind
of
want
to
look
and
triage
each
one,
but
I'll
give
you
an
example.
C
So
this
registry,
red
hat
openshift
pipelines,
one
there's
three
fixable
out
of
97
ces
and
it's
saying
it's
a
risky
image
partially,
because
I
don't
have
anything
on
the
cluster
right
now
and
then
the
other
aspect
is
there.
I
haven't
set
up
vault,
so
I
injected
environment
variables
as
secrets.
So
that's
going
to
flag
something
right
it.
It
could
be
used
for
something
the
point
being
is.
C
If
I
were
to
go
and
look
at
this
and
I'm
looking-
and
I
say,
the
visa
process
has
332
fixable
vulnerabilities
and
this
registry
red
hat
one
is
three:
I
should
probably
adjust
my
risk
assessment
right
and
part
of
the
reason
why
we
do
show
you
all
of
those
acs
vulnerabilities
and
issues
and
not
ecs
red
hat
ones.
Is
we
want
you
to
know
exactly
what
we're
doing
so
that
you
can
look
and
say
we're
doing
everything
we
can
to
keep
those
cvs
to
a
minimum
in
all
of
our
applications
right?
C
I
forget
exactly
where,
but
you
can
turn
it
off
or
you
could
set
policies
to
ignore
the
acs,
specific
or
red
hat
specific
components.
Is
that
great?
No,
I
think
that
if
red
hat
pushes
something
into
your
cluster,
maybe
it's
like
a
git,
ops
or
pipelines,
or
something
like
that,
and
they
introduce
a
vulnerability
to
your
environment.
You
should
be
able
to
know
that
you
should
want
to
see
that
right.
C
As
for
seeing
a
lot
of
vulnerabilities
in
general
yeah.
That's
that's
one
of
the
pains
of
security
right
part
of
this
tool
is
being
able
to
triage
and
say
these
are
the
three
or
four
things
that
I
really
really
care
about
and
I
actually
got
on
a
call
at
open
source
call
and
they
had
they
expressed
the
same
issue,
but
they
really
hadn't
set
up
their
architecture
where
it
was
an
automated
point
so
that
they
were
cutting
down
on
the
important
ones.
C
Because
really
you
get
this
mass
amount
of
vulnerabilities,
the
first
time
you
walk
in
and
then
you
spend
two
weeks
and
it's
okay,
let's
cut
down
the
serious
ones
and
let's
automate
it,
so
they
don't
come
back.
Okay,
that's
done
now
we
went
from
a
thousand
vulnerabilities
to
950..
Okay.
Let's
do
that
again
right
now
we
went
from
950
to
900.
C
A
C
C
You
know
helping
you
with
those
concerns
the
best
open
source
way
to
get
free
advice.
I
would
say:
go
to
the
stackrock's
cncf
chat.
If
you
go
to
stackrocks.io,
that's
the
open
source
page
to
give
you
all
the
information
for
getting
started.
I'm
there
some
x
solutions,
architects!
Are
there
any
questions
that
you
have,
that
won't
be
filtered
or
don't
need
to
sign
up?
That's
the
place
to
go.
B
C
B
C
And
somebody
quote,
perhaps
acs
should
exclude
the
name
spaces
we
can.
I
think
that
that
is
one
of
the
rfes
to
have
like
a
little
toggle
to
do
it.
One
of
the
other
things
too
that
I
like
is
this
risk
assessment
risk
acceptance,
so
we
can
say
there's
a
specific
amount
of
risk
associated
with
this
namespace
that
we're
willing
to
allow
if
certain
amounts
of
cves
come
up
flag
it
right
and
we
can
write
that
out,
so
it
won't
show
up
on
the
dash,
but
it
won't
show
up
in
our
searches.
B
C
I
think
we
we
try
to
hold
ourselves
to
a
higher
standard.
I've
been
on
multiple
calls
with,
let's
say
essays,
who
are
showcasing
acs
and
you
get
in
for
the
first
time,
and
these
are
the
vulnerabilities
they
see
and
it's
like
well
one.
They
haven't
deployed
any
other
application,
because
I
guarantee
those
would
be
riskier
right
and
then
yeah
two
you
don't
want
to
go
in
there
and
say
wait.
Red
hat
is
perfect.
We
don't
have
any
flaws,
we
don't
have
any
low
to
medium
vulnerabilities.
C
I
mean
we
use
open
source
packages
right
with
some
of
the
developers
who
don't
even
work
at
red
hat.
So
our
job
is
to
make
sure
that,
when
we're
consuming
them
upstream
that
they're
passing
the
security
checks
that
we're
keeping
them
low
to
medium
at
worst
case
and
that
if
they
are
somewhat
serious,
we're
giving
you
all
the
context
to
be
able
to
fix
that
right.
A
B
A
B
Like
in
the
in
the
vulnerability
or
the
violation
reporting
here,
does
it
take
into
account
mitigations
that
openshift
and
red
hat
bring
so
I'm
thinking
of
like,
for
example,
a
privilege
escalation
vulnerability?
That
is
basically
mitigated
through
things
like
you
know,
sc,
linux
and
sccs
and
stuff
that
are
default
and
enforced
inside
of
openshift.
C
Yes,
so,
for
example,
if
you
have
a
privilege
escalation
vulnerability,
but
then
you
have
a
drop
all
on
the
container
you'll
actually
see
it
a
lot
less
risky
of
a
deployment
it
won't
show
up.
The
vulnerability
will
still
be
there
and
it
might
not
be
one
of
the
best.
Things
is
like
if
it's
not
fixable
the
first
thing
you
should
go
and
do
and
say:
okay,
what
are
my
capabilities,
and
so
what
we
tend
to
do
is
if
it's
not
fixable
and
it's
high
vulnerability
and
your
configuration
is
allowing
for
capabilities
to
be
added.
C
That's
gonna
be
one
of
your
riskiest
deployments
and
it's
to
be
flagged
right
away,
right,
very
cool.
So
yeah
again,
like
a
lot
of
these,
you
see
these
vulnerabilities,
but
then,
when
you
get
into
the
actual
configuration
of
the
container,
you
realize
this
is
not
as
scary.
We
can.
You
know,
use
secure
security
context
to
to
make
sure
that
these
don't
really
have
an
impact.
B
C
C
If
most
of
your
images
are
in
the
30
to
90
days,
your
risk
of
exploitation
is
very,
very
low
right,
because
containers
develop
so
fast
and
you
think
about
the
way
an
exploit
happens,
and
then
somebody
puts
a
proof
of
concept
in
github
and
then
a
hacker
goes
around
and
really
it's
about
people,
not
updating
their
environments
and
then,
a
year
later
they
get
exploited
by
something
that
they
just
left
running.
In
the
background
right
so
yeah,
I
know
it's
the
this
is.
C
C
So
if
acm
you
have
this
policy
at
the
cluster
level,
where
your
clusters
are
being
deployed
and
they're
compliant
with
whatever
your
regulation
is,
you
can
make
it
so
it
automatically
goes
and
deploy
and
deploys
the
secured
cluster
resource
so
that
any
time
a
cluster
comes
online,
you're,
getting
security
information
back
to
the
hub
right,
and
you
know
that
the
the
cluster
itself
is
within
compliance.
And
now
we
just
need
to
make
sure
the
application's
on
that
new
cluster
within
compliance
as
well.
So
there's
a
lot
more
feature:
functionality,
integration.
There.
B
Yeah,
it's
interesting
to
see
how
the
two
you
know
work
together,
because
sure
I
can
go
either
join
or
deploy
a
cluster
using
acm.
It
automatically
has
the
policy
to
deploy
the
acs
components
which
then
bring
data
back
in
as
well
as
pushing
out
other
governance
policy
security
policies
as
needed,
so
yeah
going
back
to
that
whole
open,
hybrid
cloud.
Demo
thing
you
know
putting
putting
all
the
parts
and
pieces
together
in
order
to
show
how
they
work
together.
C
B
C
B
I
I
I
don't
want
to
disclose
just
how
much
you
know
as
you're
in
aws
I've
consumed
here
recently.
So
it's
a
lot
nice
all
right!
Well,
michael!
Thank
you
so
much
for
joining
us
today.
We
really
appreciate
you
coming
on
showing
acs.
It's
been
a
while,
since
I've
seen
it
so
I
I've
I've
learned
a
lot
in
addition
to
the
work
I've
been
doing
with
it
lately,
just
just
from
watching
you
and
listening
to
your
talk
here.
So
thank
you.
We
really
appreciate
it.
C
B
Yeah
yeah,
we
love
our
audience.
Our
audience
is
great.
We
really
appreciate
the
interactivity
and
johnny,
and
I
have
said
many
times
that
we
can
get
up
here
and
we
can
talk-
and
you
know
we,
I
wouldn't
say
we
enjoy
listening
to
ourselves-
talk,
but
that's
kind
of
what
we're
paid
to
do
right,
but
really
the
reason
we're
here
is
for
our
audience
and
and
getting
the
questions
chatting
with
you
all
is
is
what
makes
this
really
fun
and
enjoyable
for
us.
B
C
C
B
B
So
if
you're
interested
in
that,
as
well
as
any
of
the
other
topics
that
we've
got
coming
up,
please
subscribe
on
whatever
platform
you
happen
to
be
watching
us
on
so
youtube,
twitch,
etc.
That
way
you
can
get
notifications
when
we
come
live
and
all
of
that
being
said,
johnny
I'll
toss
it
over
to
you
for
last
thoughts
and
comments.
A
Yeah,
just
thanks
for
coming
on
mike.
This
is
awesome.
You
know
like
a
bunch
of
information
about
acs
and
you
know
where
it's
going
stuff
like
that,
so
really
really
thankful
for
you
coming
on
and
talking
about
it
with
us
and
then
stephanie.
Thank
you
for
being
in
the
background
and
working
your
magic
and
making
this
look.
You
know
legit
professionals,
so
you're
awesome!