Red Hat OpenShift Security | OpenShift, 23 Mar 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: CyberArk Secrets Management in Red Hat OpenShift

Description

Overview and demo on Secretless which simplifies Kubernetes security at scale by centralizing secrets management across hybrid clouds with Red Hat OpenShift and CyberArk.

Presented by Dave Meurer, Principal Solution Architect for Red Hat.

Learn more at openshift.com

A

Well, hello, everyone and welcome to another video of red hat openshift container platform.

A

I'm dave muir, I'm a principal solution, architect at red hat and I'm focused on our security, isv partners, and so in this demo I plan to show an integration between cyberark and red hat openshift.

A

This can help organizations strengthen security in kubernetes clusters across production and development environments and whether that's in multiple clouds, public and private, and this all is implemented without impeding your devops velocity.

A

So in this demo, we'll look at a quick solution, overview and I'll show a couple architecture, slides and then I'll give a demo around cyberarks secret list capability, so managing secrets across kubernetes clusters in a hybrid multi-cloud environment can be very challenging, especially risky can quickly lead to secret sprawl and greatly expand the attack surface for bad actors to exploit.

A

So, if you're looking at this diagram, there's many different integration points where secrets are needed and you can see that secret sprawl can get at hand pretty quickly and so building on the security feature is baked into red hat openshift, cyberark, centralizes secrets management in a secure, vault, automatically issuing and rotating secrets across containers and clusters and any type of cloud either public or private, and the value of this joint solution can be summed up with three key points.

A

First, it's secure it centrally manages and secures secrets according to your policies across multiple clusters and clouds, this eliminates that secret sprawl and shrinks the attack vector.

A

Second, it's simple: this enables developers to secure manage rotate secrets with really no need to write code or make script changes and, third, it's a comprehensive approach, allowing you to consistently secure secrets used by your containers, your automation, scripts, as well as your people accessing platforms and management consoles.

A

Now, if we take a quick look at the cyberark secrets manager on red hat openshift architecture, there's three parts to call out first is the conjurer leader which is deployed outside of openshift and holds the repository of secrets, policies and all conjured services.

A

Then, within openshift conjure, followers are running in one or more pods. These are read-only replicas of the leader and finally, you have a handful of options to implement authentication to the conjure follower and retrieve secrets for your application. One option is actually to retrieve secrets directly from the cyberark secrets manager using rest api calls.

A

A less intrusive option is secrets injection. This provides secrets as dynamically created environment variables, rather than requiring the application to retrieve its own secrets. Cyberark provides an open source solution, called summon, which runs in an application, image and retrieves secrets for your applications, but the most secure and least intrusive approach for handling secrets is with secret lists.

A

This solution uses a secretless broker. It's a container that authenticates the pod, it retrieves the credentials and establishes connections to the databases, web servers or ssh servers without the application ever having to access those credentials.

A

Secret list further strengthens security by reducing the attack surface because those secrets are not exposed to the application code or to the developers.

A

It also simplifies life for your developers in your operations staff, because there's no no longer a need for developers to directly integrate with a secrets, management solution or learn how to code to its apis and, moreover, operations can provision and remove access more easily, because there's no need for each application to interact with a secrets, management solution.

A

Alrighty, let's jump over to the demo.

A

If you're interested in learning more about this demo or following along you can head over to demo.openshift.com and choose the cyber arc secrets management for openshift workshop navigation item, that'll show you a page with a link to this lab guide and if you're interested in doing a workshop within your organization, feel free to contact either cyberark or red hat and we'd be happy to provide it for you, I'm going to show you one of the labs of this workshop. It's the fourth lab around secret list.

A

And everything you need to do within the lab is contained within your within the installation. So if I go to my user project here that I'm logged into- and I check out the workloads, I can see there's a lab admin pod running. This provides all the documentation and scripts. You need to run this demo.

A

So if I go in here and go to the terminal, I'm just going to go ahead and expand it right out of bash command.

A

That enters me into this container, and you can see one two, three, four five, these different labs that you can or in demos that you can walk through, so I'm gonna cd into the secret list directory.

A

If we take a look at that directory, you can see a bunch of yaml, that's created, so the one of the first steps that you would run is uh use this lab cuddle command line, so lab cuddle helps to has various options. It can create the ammos you need for the actual demo, so I'm just going to create the yaml files again and let's just take a look at the app secret list policy. This policy loads into cyberark that you're going to use this secret list broker that we just talked about.

A

So let me go ahead and run the load policy for my user.

A

You can see this created the role now. I want to take a look at the secret list yaml- and this is really the key part of the demo- and you can see here that by using secret lists, you're not storing any sort of sensitive information within configuration files, so username and password all all parameterized, and then they use that keyword to grab the secrets. The application, the container the developer have no idea what the what the credentials here at this point.

A

So in this case I'm going to create a config map with this secret list. Information. If I do that it goes ahead and creates it and then we'll take a look at the app that we're going to create.

A

So this app is a simple app that connects to a mysql database and and it'll be running as a pot as well, and it's going to use that those secretless credentials.

A

So let me go ahead and create this.

A

A

All right, so, if we go ahead and take a look at the pods that have been created, you can see that we have lab admin which we're in right now and then the secret list app that was just created.

A

So, in fact, let me just jump over into the ui and show you those two pods running: here's that app secret list pod by the way I'll take a look real, quick at the config map. This was created as well. You can see those keywords there that grab the secret list information, but let's go into the app pod here and that comes pre-loaded which, with a bunch of scripts as well.

A

So in this case we are actually going to take a look at the mysql.

A

Secret list script: it's pretty simple: it just tries to connect to the sql database. So let's go ahead and run.

A

It if you think about what's happening in the background that is actually connecting to a mysql database without understanding or knowing what the actual secrets are to connect to that database.

A

So, let's go ahead and just show the database. This is here just to show you that we are connected to a mysql database and really that's it. It's a pretty straightforward lab, but it shows you the power of secretless approach within cyber arc.

A

All right I'd like to thank everyone for watching how cyborg and red hat openshift can simplify secrets management across your hybrid and multi-cloud environments and to learn more about this demo. Please, head on over to.

A

Demo.Openshift.Com.