Red Hat OpenShift OpenShift Coffee Break | Red Hat Livestreaming, 19 Jul 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: OpenShift Coffee Break: ACS for Kubernetes - DevSecOps way

Description

Get your espresso ready for the EMEA OpenShift Coffee Break as we celebrate the Advanced Cluster Security for Kubernetes Operator GA with a *LIVE* demo about DevSecOps together with Roberto Carratala and Rodrigo Alvares, OpenShift Specialist Solution Architects.

A

Good morning, good morning, everyone welcome to the open shift.

B

Madrid and I'm part of the emea specialist solution, architect, focusing in openshift and also in acs.

C

Yeah, I'm rodrigo alvarez, hello, hello, there, I'm based in dubai and now it's 41 degrees. So yes, as you can imagine, it's freaking hot and I'm part of the same emails as alberto so yeah today here to to talk about that and acs.

B

And it's based in stackbox that we acquired a couple of months ago, and uh we now have the you.

A

Know we're celebrating the ga of the acs operator.

C

A

B

Yeah I have a couple of likes talking about dexacorps in habit cloud with red hat and also why the hexagons is important and why this acs and the integrations with other a very nice products like openshift, guitars, opposite pipelines and so on, and we can go through the demo and I will share my screen.

B

Everything goes well, I don't know if you can see that my screen.

C

B

Yes, I can yeah okay perfect, so I will present us and we can uh speak about the dexecoption in hybrid cloud, with red hat and my favorite. My first question: it's uh what we need to answer. It's why the hexacopter is important. Why can this affect my business and my applications?

B

So the second allows it and security teams to tackle challenges across people processes and technologies and allows improving, for example, speed and efficiency or just consistency, making things repetitively and improving also collaboration, and the things is that security can no longer be only the concern of the only security teams and needs to be included in early conversations, for example, with the development and the devops teams, among others.

B

So security team needs to be part of this conversation in our devops team earlier, and also having the possibility to add security in the different process of development, deployment and runtime of our workloads and our business and, on the other hand, and devops.

A

B

Needs to have these appropriate tools that help the security management in the task, so it needs to have a very nice tools in order to improve the different layers of security in our pipelines and our processes as well.

B

The thing is that in most organizations focus only in the application itself in the application pipeline, but also it's important, sometimes to add security process across the entire lifecycle, using, for example, dexacorps, adding integrity of the library is used called the scanning we will show in the live demo the whole life cycle using also security steps in this dexicorps fiber and also other possibilities that we can discuss about, and we not.

B

We need to think that security must be continuous analystic, so dexacorps allows you to approach this security continuously and realistically across the application and infrastructure life cycle. David divided in different phases like, for example, build run manage other, but we need to think that this needs to be a continuous walkthrough and why method for devops? How can red hat help in the dexa corps result? Openshift platform have a vision to have a hybrid cloud platform for enterprises to build, deploy and run applications in securely at the scale.

B

So, for example, red hat delivers continuous security for containers and kubernetes with openshift platform, using, for example, I'm providing trusted content having this lifecycle of the the platform using also a strong role-based access control and having a network isolation and container isolations and so on and acs. And this is the good part- extends the security also to application layer, for example, as vulnerability analysis or the configuration app analysis, and also for, for example, using compliance assessment or risk profiling, or even in the runtime checking.

B

If there is any threats and making the incidence response as well so acs, red hat, advanced cluster security for kubernetes have and focus in three different parts. The secure supply chain, giving tools to the different developers in order to have more integration and have more tools in order to, for example, integrate and scan in the different pipelines also have the possibility to secure the infrastructure.

B

Giving the security posture management to, for example, identify identify if there is any threats or just remediate.

B

Any wrong configuration something like that and on the other hand, also in the random- and it is very, very important to secure the workload to maintain this third trust execution and do this workload protection as well, and we need to remember that advanced cluster security for kubernetes acs. It's the first kubernetes native security platform.

B

So it's the first and it's built for kubernetes and running in kubernetes and for this reason, have a very nice uh integrations, for example, using the image scanning that it's in the industry like claire at their own anchor, also the integrations with different registries and their registries in sas or itself with koio or other registries with hub, or something like that. Also the integration with chdd.

B

In this demo, we will show how well integrates acs with openshift pipelines, but could be also integrated with other cicd tools and obviously you need to know what's going on in your platform. So you can connect with devops notification and we can see also um the slack connection or the microsoft teams, um from some alerts that you can notify. If anything was wrong or something, and also the sign, for example, to.

A

B

These different logs or different activities, and and bring these different uh lock systems and activity threads to a splunk or a sumo logic, or also interact with another. Such tools like edward us security hub.

B

So the first thing is that, with all of that, we can secure the containers and shift the security left. What's this?

B

What's this security shift security left it's trying to give the different developers and the different teams tools in order to bring the security in the early stages, for example, when the developer is trying to build their code, giving them tools in order to identify with their pipelines if there is any vulnerability or if there is anything that goes wrong with the configuration and answering also securing the kubernetes platform, having, for example, and strong admission, and checking, for example, that no privilege spots can can run also if there is any critical vulnerabilities in the port, I won't allow to deploy these spots and also having this compliance and risk assessment in the different platforms and the different kubernetes and openshift clusters that we manage with acs and finally securing the container at one time, because this is very important how we can secure our workloads, how we can try to when we are running our applications, detect if there is anything wrong.

B

If there is any attack and try to isolate this attack in order to uh having, for example, microsoft, augmentation with network policies or very strict, um very, very strict, for example, um policies. In order to not running some crypto miners or an ambulance behavior, and if there is any threat, we can kill and enforce the port that offends and files the the violation itself and the pipeline.

B

We wanted to also show, in the demo, the integration with acs and also other open source tools that we bring, and there is more or less the chcd pipeline, using also and introducing also security steps, not only focusing and build and deploy our source code and building the images and deploying on openshift also having, for example, unit test code analysis, security scanning for detecting the vulnerabilities and so on.

B

Did it were very important in order to bring and add more steps of security to our um devops public itself and our demo of dexacorp's pipeline, and it's more or less with that. We will bring together the three things that, from my perspective, are awesome that are openshift pipelines based in texas.

B

On the other hand, openshift keytops as well, based in argo city and acs, as well with advanced cluster security for kubernetes. Also, we will use another tools like target server with basic box units. Sonar cube nexus. Surproxy and gatlin, all of them are open source and you can build your devops pipeline very easily, adding more and more to the snare.

B

So what do you think guys? We can check the pipelines if you wanted to.

A

Go for it, I I think.

C

Go ahead and just to it's nice for you to say as well, basically that today's demo is going to be focused on end to end uh from the developer point of view to the uh delivering the application itself, uh and we will not focus basically on just on acs. Okay, just it's gonna, be like the entire lifecycle.

B

So think that you are a developer and you want to deploy your pipeline and introduce and also integrate with acs, the first thing that we need to know it's.

B

What's um what we can uh do to install uh our different uh components. For example, I install I already install openshift key jobs.

B

That brings argo cd into our scenario and we can use githubs in a very nice way to the continuous deployment, also red hat openshift by blends that it's facing tactile and we will use this tecton pipeline and openshift pipelines itself based in in texas and also this guy. That is the advanced cluster security that this is the operator that, when ga on, I think in friday on saturday, the good thing is that, uh with this operator, it's a very nice way to install it.

B

You have also all the possibilities to install acs that in the past, you can have the possibility to install it with the gem itself or using the helm charts. But this is a very nice way and the most impressive thing is that you have also the channels- and you have the this approval, but it's automatic. So when a new acs release pops up, you can automatically have and upgrade your entire acs cluster without doing anything. So it's very awesome also. We can check.

B

For example, if we go to that stack rocks itself, we can check the uh central and we deploy it using the create central. So central, it's imagine that strength. Rule is the brain of acs and it's everything that er needs to have and uh needs to analyze it's uh going to the center, so you can install it in a very nice way, just um deploying the the sensor and afterwards the security manager of the different clusters.

B

So, first of all, you deploy the samsung and afterwards you deploy that manage security and the different um components like the sensor, and so on that we can explain nowadays, but this is the first thing that you can do after you install the acs operator.

B

So, for example, you have in here that you can control the admin password, also the exposure, and you can expose like um open c fruit that I did in in this demo, but also you can have the possibility to uh explore all the possibilities uh with lord valancia or node pause, something like that also use your own um certificate or, for example, if you want to have your scanner or not of basing in the stack logs.

B

Imagine that you are using the query, io scanner and you don't need it, so you can disable it as well, and also the good thing is that you can install acs in a fully disconnected way. So in this case you can control if your acs connects to the internet or not deploying your operator and deploying your cluster fully prep.

B

So it's very very easy and we install it like this way and after that install it. We have, and I will go to the developer view and in the developer view we have the different pieces. Did it's the central that it's the brain and also the scanner and the scanner db? That is the scanner and the vulnerability scanner. Like huevo, but from stack, rocks from acs and also the different pieces that are from specifically managed cluster.

B

So when you want to manage one cluster automatically, you can deploy from the operation and the different pieces that connects to the center. In this case, the mission.

B

B

And cluster, like the kubernetes and obg4, very in a very easy way, using this directly or using also the own operator, so in the own operator you can see. For example, let me go again to this. You can check also the secure clusters and you can add the secure clusters. Whatever you want, for example, you need to connect to the central endpoint and so on.

B

And we have also installed openshift githubs, opencv pipelines and acs- that are the three building blocks that we have in here, but also we need to check all the things that are very good stuff for our um developer dexicorps pipeline.

B

In this case, we have different things like cog servers, the trigger, and so on that we can explore when we launch. The first thing that we need to do is simulate that we are a developer. We are a developer that wants to launch our um pipeline. So what's the first thing that we need to do go to our git server, this git server, it's um basing box, but you can use whatever you want. So, for example, in this case, we have the source code that this is a sprint pet.

A

B

A very nice sp spring uh application, yeah.

A

That is a popular springboot, app.

B

Yeah, that's right! So all right we have in here we have our repo and also we have also the other repo. This repo represents and have the itops way. So we will have the deployment use, the customization the route and the service and everything that we need in order to have it.

A

B

A

Was a um in the world sorry to interrupt? There is a question in the chat.

B

A

You mentioned it so uh alos doug is asking: what's the difference between query or scanner and the one included in stack rooks? Are they complementary in some way they.

B

Are based and they are scanning amongst different vulnerabilities and different cpes, so you will receive um the different, for example, approaches for, but basically it's more or less the same. It's scanning the image for different vulnerabilities uh going through different sources, so it could be that have slightly difference between the scanning one image and another using stackbox scanner and koi, but basically do the same. uh The same thing that it's scan your image in order to check for vulnerabilities.

C

And also it's it's nice to highlight that you can integrate acs with glare, for example. So basically you have that that that could be integrating uh yeah. So can you can you show that yeah exactly.

B

C

Integrate with claire, you can basically integrate with red hat cray. I o okay, so it's quite er is simple to integrate, so you don't need to just rely on the stack rocks scanner, so you can basically integrate with existing ones.

B

Yeah, this is very nice because you can.

B

Awesome my pleasure also, we have in here the different deployment, for example, and we have um the deployment and so on that we will use in a very github's way. So we have our aqua seated in here and our ago city.

B

They think it's uh doing it if opener yeah it's uh having the next spring bed clinic- and this is in the environment- that having death and states using the customization to bring the githubs and also syncing the different things. But in this case it's thinking everything but not the deploy, because we are not building our image and the image is not available.

B

So we need to first of all introduce a change where we will introduce a change in the pet clinic, so in the pet clinic we will introduce a change, for example, if we log in or if we want to introduce a change in the rhythm like, for example, I will reproduce demo time and in this demo time we will introduce that, and there is a web hook and this webhook triggers our partner.

B

This pipeline goes through the different steps. In this case, we will source and clone the different um code that is in here for our application, also we'll go through the different code, analysis, unit, testing and dependency report. So we can check that effectively.

B

It's cloning, our application itself and afterwards, in parallel for saving time, we will run first of all the code analysis based in sonar cube. So we have also our sonar cube, also, our dependency reports for know the different dependencies that have our um spring application and also the unit test.

B

That is the unit test based in the unit. So in the details.

A

You can see.

B

The different things that are going through and after that we can check, because we have this um code analysis and dependencies reports in a very nice way to show the developers.

B

So we are introducing the static analysis of our code, providing tools to our developers also to having, for example, before than building the image and building the artifact. We are giving them the possibility to give us us so on static analysis of our code, also, the unit test as well and seeing the dependencies reports for, for example, checking if there is anything wrong or not.

B

This can be checked. Also, one is built the dependency report in a repos in an engine server that it's called a reapers repo that I've.

B

B

Because we rely on the different parallel things and this spins up different parts and the nice way that it's going with openshift pipelines is that you can parallelize and you can bring the different automation and kubernetes native um pipelines to do that.

B

For example, uh you can have also the exact same timeline using jenkins, but you need to rely in a central jenkins server and in a very nice way. Tectonic is doing that.

B

So when it is finished that it's um launching the different um unit tests, we will have our result that it's going through takes like 30 seconds more, but the thing that I want to show it's nice.

B

We have the build success and we run a lot of tests for t-test and everything is okay and afterwards we are using nexus for our two things. This nexus will have. First of all, for once we build our um jar, our artifact. We will push directly to the nexus for what reason, because we want to control where it's located the different jars, but also we will use um nexus as the maven thing, but meanwhile we can check the different sonar cube results.

B

So if we go to the sonar cube, we can check the different projects and in this case we.

A

B

The pet clinic itself, so we can check the code that have and we can check, also the vulnerabilities.

B

So this is important also to show and to have the proper tools to the different developers, because in this way you can give them the possibility to check the different analysis of their own code, also in the nexus that we showed, I will close some tabs, because if not, my computer will go okay in here.

B

After this releasing of this app and yeah this releasing of this app.

B

This will push directly to the nexus, so we will using nexus for building our proper job, and if we go to the snapshot itself, we can see in here that effectively we have our job in here with our artifact id and the version that we built so once we have it here and the developer knows that the code is okay or at least um have an static analysis of the different um phases and also have the dependency reports on the unit test.

B

We can build the image we built the image based in a java 11, but we know that this is a trusted source for what reason, because we know that this went from the register.io, that it's a secure registry and also we are using this, because we know that these images have an specific analysis and more information about that.

B

Once we have this information, we need to use also as a maven mirror. So we will use the nexus as our and we will build our public our image using the dependencies from the maven public and why? This? Because we want to ensure also where are the different and where.

B

Three, the three are awesome.

B

These three pieces that runs in parallel are the integrations from our openshift pipelines to acs, so we are and we will integrate and we will run an image scan using acs registry and afterwards we will analyze the different vulnerabilities and check if there is okay.

A

B

A

This stuff here be right. Back. Okay, now should be good. I'm sorry about this uh little issue, technical issue we have, and now we should everything should be fine. We have some issue on the on the obs side that we are using for for streaming and uh roberto yeah. I think we we just lost the one once that the the image scan, but.

B

Yeah the image is scanned. This is the the interesting one because we are um using this openshift pipeline and using the roxctl rockctl is a command line tool for integrating in every cict tool, and I'm going also, for example, in this case, we are scanning the application that we, the image that we built and also we after that um application build.

B

We can see directly a very nice report of our own image that we already checked, so we have in here a lot of information, and I love the themes of uh the different um information that we have of our application. So you can check in here that it's sprinkled clinic with the shop and we have the different cpes that we can get more information. For example, we have these cves and so on.

B

There is good stuff, but also we can check different things among the image that we already built for, for example, we don't want to anyone, have the package manager in the image and for this reason this system policy failed because detect that in one layer of the image that we already built have npm or yam or on the other hand, for example, have vulnerabilities that could be fixable with more than scoring of seven. So these vulnerabilities are defined in acs and are fully um I fully managed and on the other hand, we can check this.

B

This is from build and we can stop our build. Imagine that you don't want to uh in any way to build your image, so you can enforce this guy in order to if there is any cve detected in your image, build stop and fail the build, so you can prevent your developers to bring applications or bring or build different uh images containing cbds or containing the different things that you don't want to. Imagine that you are detecting a social, a cell shock or a helpless in your image.

B

You need to prevent to deploy this image and also in the deployment check you can check not only in build also, you can check the deployment of your own application. In this case, we are checking the different um deployment of kubernetes. In this case, we are checking amongst the different system policies, the different kubernetes checks.

B

In this case, for example, we can check what are the system policies, the system policies of acs divided in three layers in build in deploy, or in runtime, for example, the thing that we noticed before I as.

A

B

Team don't want that. My developers build any image that have cpes with scoring more than seven, so we can check and we can enforce that, and we can just, for example, uh give them a heads up in order to guys you are building images that have this type of series, please solve them, because, if not could be introducing some risks, but on the other way you can also have the possibility to enforce.

B

Why is enforced, so you can have the possibility to kill the pipeline itself. So when you are building the pipeline, if you are not complying with my policy, this checks and fails the bill and prevents that anyone builds the image or just deploys the image. So in this case, starcraft's acs will frame when the image match the condition, and if we rerun this we will see. Meanwhile, I will rerun this stop run.

B

You can see that effectively will fail in the pipeline, but if we go to the pipeline the last pipeline also, we can check other things because the magic of githubs happened and why the magic guitars happen, because we have in here one step that it's update deployment we automatically in this pipeline and in the gox server.

B

We pushed and we changed the image one specific shot. So now the image is pointing with vdd4. This is the image built in our process, the image that went through the different stages of security as well.

B

So it's good stuff because automatically you are pushing and you are changing the code without manual intervention, and this will notice and will spins up the different ago, cd application.

B

And if you go to argo now, we have in here have a very nice deployment that is already live and in this deployment, if you check the port itself, the port have the ddd4, the dd5, that it's the exact same application that we already built, but did everything. But it's okay. So if we go, for example, in um to our application and to our namespace, we.

C

B

See let me handle this in the next couples yeah, and we have in here our sprint pet cleaning application that we built in a very secure way and also in the topology and also in the pipeline. We introduce two steps more, that it's the performance test and this performance test. We are using coupling this cutling it's using and it's trying to load a lot of requests to our application. It's like a loading test and it's producing in a very nice way that we can check in the reports.

B

So we have these reports in here and if we pick the reports, we can check our application here and if we check this, we can check first of all the different dependencies and we can check the dependencies that we built already in the first place, but also we can check the cutling.

B

That is different requests that we try to reproduce in order to know if our application is okay or not, and afterwards. Finally, open testing appreciate testing for what, because when we have already built our application, we need to check from outside simulating different attacks and trying to contest our application in order to know, for example, if the hair bleed vulnerability, it's okay or not, or if we are using um any weak authentication method or anything else, with driving more information.

B

Returning to um the pipeline itself, we can see. ah Let me rerun that, because I'm time five, we can see the different system policies and the different topology. I will shut down this.

B

The good thing is that in the system policies also the system policies, we can integrate information with different modifiers.

B

In this case, I used slack so I used- and I integrated acs with slack in a very um easy way, and now that we have in here we can check. For example, if anything happens during the build, for example, I can check if one application or if one build, is against the different system policies, for example, in this case, I'm checking that this specific uh build of this container half not the specified frequency or limits, so they would think it's every system policy.

B

Every policy that we already deployed, we can integrate into our systems in this case, for example, it's very easy because we can integrate this policy automatically enabling notification with a slot, but they are already different like, for example, you can, if the build fails, open, ajira ticket or just integrating, with splunk, for seeing the different violations or just integrated with microsoft teams as well generating a channel.

B

So this is a very nice way to try to get the information that for your team and for your mothers in order to not receive 1 000 notification at a second.

B

Only the notifications, only the things that, for you already matches in a very nice way, for example you have in here- and they are already detected- that in the deployment your application have, for example, the um different things that includes and could include the nfm, the dnf or lpm or young, and also give you the remediation- and this is very nice because you can give the developer the different tools and the different um information.

B

In order to hey mr developer, you are building something that are not okay, but that are not complying with my different policies that we already defined.

A

It's a compliancy system where you can keep everything in place with the your definition system. Policies integration, I imagine, one cool integration- is going to be the ticketing system, no for enabling your process. uh What very cool yes.

C

And, uh to be honest, I think I think, when it comes to, like uh you know, educating the developers to think more in a security point of view. They're gonna start thinking about like the basic image right, so they need to be aware. They need start asking questions like is my base image updated.

C

So what type of tools are existing in that image? So do I have curve? Do I have w gap? So you don't need double gap on those images right, so how many vulnerabilities exist within that image, so uh the the acs allows the developers to be aware exactly what type of like uh you know, problems they can have in production, because you don't want to basically ship any.

C

You don't want to introduce new problems in your product environment right, so acs allows you to educate your developers like even before having problems in during the build phase.

B

Yeah, and also preventing, for example, and enforcing imagine that you in production, don't want anything that can be built with this evee or with the rpm or just uh not using request or limits. You can prevent that. You can check that your own deployment, the your own of dexacops, can have also the information about you.

B

Don't have this request or limits, and also the rationale for what and the remediation as well giving this information directly to the developer and shifting left and adding more security layers and more information and more power to developers to solve the problems, not only for the security teams to be uh sticking around and giving the heads up every time so that the different development teams did it very, very good and also you can enforce so you can prevent uh that if these checks and into the development team, um if this fails, you can prevent to deploy the different application or to fail and the ci itself.

B

So if we see that it's building the image, so in a couple of minutes, we can see that effectively. This, when reached the image check, fails one specific system policy, but we define it specific with cvss because we define it in here and we enforced so in this enforcement.

B

If this policy don't pass fail, this policy against our image, because our image checked- and we noticed that we have any cve that goes more than seven on unesco- will fail automatically the ci and will prevent anybody.

C

This is during the build phase right, so, if you want to protect like production, you should you know set on the deploy as well. So that's going to basically block any creation of the deployment with that that, like uh problematic image.

A

We have a question from the chat. There's a m asking: can you create a custom violation? So is there any integration with open policy agent.

B

This is a very good question. You can define it wherever you want, and it's very very, very easy to define new policies to define the severity and also the life cycle stage. For example, you don't want to prevent you want to prevent to specific cve to pops up, so you can preventing the deployment goes to the description and after that, for example, you can restrict and also enable the notification with that you can define whatever you want in this case, for example, with a lot of things that affects inbuilt in deploy and in a runtime.

B

Imagine that you want to you, don't want to have the possibility to the developers to deploy one image that have a cv, so you can define the specific cbt in this case, for example, um whatever you want in this case, we can use the example cbe that it's called um one one.

B

Sorry, two eight.

C

Well, the the nice thing, as you can see here, so it's very user friendly, so yeah, it's basically drag and drop, and basically you can build your policy criteria based on on drag and drop. So.

B

Yeah and you can, for example, um prevent that anyone deploys a privileged container, uh adding uh certain capabilities. For example, I can define it that no one can deploy one port or one deployment with a certain capabilities, and I don't want to allow it, or at least just in ford in informant and when we have it here, we can define it the enforcement.

B

So if this, if anyone tries to in production on in whatever you want to deploy in specific uh deployment with a port without certain capability or with a certain cve, we can prevent and automatically acs through an admission control. The policy and mission control will fail that it's more or less the the same thing that it's uh having with opa but in a very, very nice way, because with here you can drag and drop, as perfectly said, and we can, for example, define a lot of situations like cepcom privilege, containers and so on.

B

It's a very nice way to define it and to control your different policies, so you can define your own policies.

C

And uh at this stage I don't think there is any integration with opa and acs. I think it's going to be something similar to acm right.

B

This uh checking with the pms and in the future we'll have different things. Sorry, okay and finally, we have in here that effectively we define it the image check, so the image check. We have a violated policy, because this have an enforcement.

B

So if we have it and if we check the fixable css, we see that we have these polyphones for policy enforcement that cause the failure of the whole um cicd pipeline automatically because doesn't feel and doesn't pass our compliance, because I don't want to anyone, put any cve building my my image and also you have more information because in the image check, the developer can have the possibility to check okay. This image fails, but for what reason I need to have more information.

B

I need to check so we can bring this. We can bring this this cve and automatically to which components are affecting to which deployments are affecting as well and also having more information going directly to the information source- and this is a very nice way to do that.

B

So you can control in a very nice way the different things that you have given the possibility and giving to the developers more tools in order to control in the full pipeline, even having the possibility to full control the uh private of your developers and enforce your compliance security policies and that's all for our site.

A

Wow, uh oh I mean it was super lots of uh stuff. I think you know what I think this reserve also a second session. Where we go into more details. We had some I'm sorry for our attendees. We had a little issue on the streaming, so the stream gets split into, um but uh we will make sure to uh come to to join the two recording. uh So sorry about that, but uh we were able today to see a complete devsecops uh demo, uh really congratulations, roberto rodrigo!

A

That is awesome and actually I know, there's a repository if people want to.

B

Yeah sure I'm going to show the repository as well.

A

I think if it's the one that that's a cops demo, one, the one you shared with me, yeah, that's like that's.

B

C

So I was, I was expecting to have time to show how to apply acs on crc, for example. uh There are some some tweaks that you can do with your resource that basically, you can have acs running on your laptop using crc, but.

A

That's maybe an exercise interesting. Let's do this folks. It was so interesting that I think in the server series adapts a cop series. We can have some kind of we did this introduction for the next time we're going to do a series where we're going to crc or local development with acs, and I would like to see also the penetration testing, the vulnerability assessment. We we have seen the wall pipeline today.

A

Maybe we can focus more on the vulnerability assessment of live uh violation like I have my application running, uh this application is doing a live violation, so we have seen the ci part uh what is- and uh we are talking about the cd part with the argo I was wondering if we have something to say also on you know, running processes, yeah.

B

C

B

A lot of things with the running and detecting also the violations for, for example, preventing if anything, uh goes or if anybody do a net card or an air map inside of our container, prevent to do that and itself also kill the pot. If this will enforce it or not. So we can have this this series for sure fantastic.

A

I'm looking forward to it because uh it's so interesting, I think people really enjoyed also in the chat. There was lots of interaction. I just shared the demo, uh so the demo was made by roberto rodrigo that worked in this fantastic demo. I I really recommend to try it out. You know what you can try on uh crc, for instance, which is the a local development for openshift, and you can try on any of all your openshift cluster available that I'm putting in the chat.

A

The link to you know start trying over shift start trying acs, which is now ga, and you can deploy the demo that uh roberto rodrigo today made for us. So you know I would like to really thank you for this awesome demo um recording will be uh available on the openshift uh youtube channel and um you know what we will uh see uh again here at openshift coffee break with uh with a new devsecop series, because it's so cool so interesting. I really enjoyed so thanks, roberto and rodrigo for joining us.

C

A

C

See you next time.

A

See you next time and uh for.

B

A

Folks, uh let's uh you can stay today on openshifttv, we we have our regular schedule if you would like to stay uh that goes into uh uh from uh from you know a mia afternoon time, and then it goes into the normal shell shadow. If you go to open shift tv, you you see all the um all the shadow that that we have. Let me put the link, so you can follow with next things. uh Today we have lots of uh also episode.

A

uh We our recurring series and uh we see each other uh for our next appointment. That will be uh july. The 28th we will come back with a pipeline as a code topic together with jafar and some people from the engineering talking about the tecton pipelines uh as a code. So uh thank you very much for joining today. Thank you for attending uh look forward to see you on the next openshift coffee break episode, ciaos.

C

A