VMware TGI Kubernetes, 19 Nov 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: TGI Kubernetes 175: Cloudnative WAF with Curiefense

Description

Join Ricardo, as we explore Curiefense, a sandbox CNCF project that proposes to be the open source cloud native application security platform that protects all forms of web traffic.

We will try to install it, simulate some scenarios and have some fun!

A

Okay, so we are live good evening good morning for the pacific folks, good evening, good afternoon. Whatever time zone you are for facing masters from six cli, uh my name is ricardo. I will be your host for this second session. I welcome everyone for this session, which is going to be about kirya fans uh fans. It's a really cool project that started.

A

I guess see one year past one year I have justin here with me. Justin is gonna, tell a bit more about the the history and provide you some better information, some better data and before starting. I would like to uh welcome justine so welcome. Justine, welcome.

B

Everybody thank.

A

You for having me yeah sure, I'm really excited about this. This episode welcome everybody. That's on youtube. I can. I can see engine uh martin from netherlands- oh that's! That's later, that's almost even in on netherlands. So welcome pushkar.

A

um Thank you everybody for having me so I'm gonna start with the week on review and then we can jump into the kiriefen's episode, okay, cool. So let me just put my screen here. uh You can tell me on on the youtube comments. If my screen my I need to increase my letters, my the size of my screen.

A

Otherwise, let's get started so the notes they are right here. You can see them on uh on tgik, dot, io notes. This episode is going to be recorded so uh and we've got actually another episode today. So, first of all welcome back for you all that, where, on our episode that uh uh I guess 9 p.m, pacific time uh this is the second episode uh we are trying to make uh episodes on a more friendly uh on a more friendly time for people at uh europe, asia and middleweight, pacific et cetera.

A

So I don't know how this is going to be, but uh this is an experience. Pushkar was uh earlier today uh doing uh the first episode about uh about connect and then I'm gonna take a look into key reference right.

A

So the recording in case you missed this here in tgik, dot, io, slash 174, so that we can review before starting hey, hi joca from finland, a lot of people from from europe cool.

A

So, first of all, kubernetes version, 123 is almost there. We've got an announcement from a code freeze, so right now only patches npr's that are block blocking the release will be accepted. If you've got your patch for 123. Look you! If not, we are going to wait until the code and freeze unwanted 24..

A

uh Also, we've got an announcement from my huge friend adult for puerco about kubernetes patch release. So let me increase the screen here, yeah uh for you that that, for you, that are running version, 120 121 on r122, uh we have a new patch releases that fixes a lot of bugs. So please fix them for those of you that are not running a supported version.

A

Please do so. Don't don't don't wait until your apis all get deprecated before updating your kubernetes cluster right and the news about this release is actually that uh we have uh some supply chain level for software artifacts. So uh sig release is focusing on on making some supply chain uh security improvements, and I really recommend you all to uh to take a look into this twitter thread and and take a look also into this subject, which is uh which is really rising and was uh part of our tjk earlier today as well.

A

Okay, uh next uh go version, 1 18 is almost there and there is a cool twitter thread here.

A

If you want to take a look, so uh so daniel marty, which is one of the go developers, put a huge list about all of the changes and besides this version being not like a major release like go to, we are getting a lot of uh new stuff like generics, fuzzing tests, some workspace mode, and I really hope that this workspace mode solves an annoying problem for people using vs code, for example, which is when you open something with a lot of things inside it.

A

Vs code doesn't recognize the workspace, but I may be saying something wrong anyway.

A

Take a look and also other other other improvements that are pretty pretty cool, so uh we've got uh some some new, even some new strings and bytes functions to do could to cut the string right uh yeah what else and the new net ip package so probably the net packaging some methods of the net package.

A

They are going to be deprecated, but as go, have this contract of never removing or having never doing a break, a breaking change when you are uh using like from one version to the same version like version, one deprecation means that those functions they are not gonna be maintained anymore, but they are not gonna be removed from from go one cool.

A

uh This this thread is really cool next one yeah this is this is really nice as well. So uh for those who don't for those who don't know about gatekeeper, gatekeeper is a project. uh That's now that's a super project from open policy agent, but was like a split project and then got got incorporated by by open police agent which implements an admission web hook for kubernetes.

A

That allows you to write rego policies to to to protect your cluster. So imagine that you don't want users to create uh to use images in pods that are going that are using latest tag, for example. So gatekeeper helps on that a lot and gatekeeper uh had some lack of mutation web hooks, which means uh actually you accepting something but then changing uh the value that users put so users adding latest or users using docker hub, and you changing to your internal to your internal docker registry, for example, because of uh uh quality of services.

A

The the the rate limiting of docker right. So uh gatekeeper got this mutation web hook and as an alpha version on the earlier release, and now, let's move it to beta.

A

So it's really nice to see this, this tool evolving and also it got a new cli. And why is this so important because right in um writing, gatekeeper rules and having to add them on your kubernetes cluster, the constrainting plates? And then the constraint was really really really annoying right. So you have to you need to have like a kubernetes cluster or at least an api server running and now.

A

Actually, you have to you need to to have a kubernetes cluster too, because the controller needs to run as well, and then you need to apply something and see if it works and if it doesn't work, you need to do another rule. So now that you have a cli, things are going to be, I hope, easier to to write a gatekeeper rules.

A

An old but gold subject, and that's gonna, that's again in in our table- is that docker shim is deprecated, so we all know about the deprecation of docker shim, but right now the kashim is getting removed from 124 right so uh signal this collecting some feedbacks and I I they expect users from the question to feel this.

A

uh This form this this feedback, so please feel free to to open this blog post and also to fill the the the research um the last news for today of the weekend review. But if someone remembers something just go ahead and put on the comments here on the chat uh is that part security mission is moving to beta and will be enabled by default on 123..

A

So uh there is a tweet here from tim mulclair with some useful links and uh for those who don't know what security policies is getting on a deprecated path right, so deprecation in kubernetes takes to remove a removal later, but there is a new feature which is called security admission that helps on at least protecting your pods. So take a look into this.

A

There is a thread I guess from luckily from microsoft, which he teaches how to enable pod security admission in kind in kind cluster as well and probably let me take a look and see if I can find and put here later, fine twitter thread.

A

So anyone willing to test this uh is gonna have some some some way to test without uh breaking your production clusters right uh so yeah. Now we have uh jose from chile also alex from north california.

A

Engine is happy about strings.com because that's at least like five less lines in our go codes right: phillip, hey, philippe and yoshi yogi yoshi. Sorry, if I don't know how to to speak but welcome from singapore uh far from here and time zone is, is pretty it's pretty late in singapore, probably because it's already late here in brazil.

A

So welcome and thank you thank you for joining us, and so let's get started talking about curio fans right so uh uh before asking justin to tell a bit about kyrie offense and I'm gonna, I'm gonna put justin on the screen here. uh So I I have. I had my my first contact with clear fans when it was released. Well, I guess wasn't version 0.1 for some of you. That may not know I am uh one one of the ingredients maintainers and- and I also work at a lot with aj proxy ingress.

A

uh The aj proxy ingress maintainer, which is which is juan, also works at vmware, and we work it together on our best company. So we were a lot of time like seeking into some way to protect our uh our environment right. So the idea was like we needed some web application firewall and we need at least to have some some protection about uh about, like the main uh uh vuener abilities like sql injection, remote code execution and etc, because even running stuff inside containers.

A

You know that this might be dangerous and I I I want to show a bit about this right now. At least, how can I use that to like bet developed web applications to break something and we've been using a lot of mod security? A lot and mod security is an amazing project, so uh that's really cool, but uh but wasn't uh enough for us.

A

Even we we looked into that and I think it's an amazing project that uh was like the pioneer and all of that that so uh one year ago, one year and a half like kirithins raised it as like a cool envoy uh project for web application, firewalls and then we I started to look into that and say hey.

A

This seems really cool. This seems to be something that we are looking for and from that time to now I just forgot everything, so I didn't touch it again, uh curious fans right. So let me put justin back here again and then and then uh we were discussing inside vmware like hey. We should probably make some tjk of something new or some things unbox it and, I said, hey. I guess that's now the time to come back to curie offense and see how things they are going so hey.

A

I I want to present you justin, and I want to to to welcome justin and justin can tell a bit about hiring fans story before we start jumping and breaking stuff, because the idea of tjk, after all, is breaking stuff finding that we cannot do the things alone and and and ask for some help later, like hey, explore new technologies right. So welcome, justine and welcome andrew andrew andrew is from my team at vmware and he's like he's like here watching watching as well. So hi andrew.

B

A

B

Yes, thank you, ricardo um yeah, so basically we're carrying fence started about a year ago and the back story is, you know: zuri uh baryokai, uh who founded uh a company called reblaze they've, been doing web application security for close to a decade, um and there was a really you know with envoy becoming more and more popular.

B

There was a a need for a web application firewall um and that's something that he and matt klein were talking about and that's where curie fence came into play because you know the the cloud native space is growing.

B

um You know you can't you can't ignore it anymore, and uh we just saw you know he saw a really good opportunity and we he decided uh that we should submit it to the cloud native uh computing foundation. Cncf and the beauty with that is. You know all sandbox projects, the newest projects that come in they're built.

B

It's it's to try to get it to a stage of either incubation or graduation to build on top of other graduated projects, and that is why we're in the cncf in going all in and making sure that uh we get direct feedback from the cncf and cloud native communities, because that's what we're building it for so uh yeah, that's kind of like the gist I mean obviously there's more uh history there, but that's kind of just the overview. That's that's! What made me want to join the company to work on curie fence.

B

Full time is just this. You know there's this need uh for security, uh especially with the rise and of uh envoy, but we also know that nginx is still a really big player, even in the cloud native space. So you know having just basically adding that a couple months ago into the 140 release to uh have nginx support and uh yeah. I think uh overall, we're just uh really excited with the amount of activity. uh I I monitor the staff.

B

Every day we have 54 active members, uh whether it's on github or slack and a few other places but yeah it's it's growing um and we just want to see it battle tested and who better than ricardo.

A

Yeah, I am good breaking stuff, so cool, I love it yeah cool, and uh so, uh if, if you can later just put on on, maybe on youtube comments about like the slack and the twitter of curia fans- and I will add as well on the on on the meeting meeting notes, I'm sorry on the tjk notes, so people can tickle yeah, but that yeah really cool uh all right. So, let's start having some fun here.

A

uh Let me add: where is my screen? My screen is.

B

A

Here so here we are with my screen again, so I I have before starting I. I added some links here uh for people willing to learn a bit about uh learn about about, learn a bit about uh web vendor abilities and etc. There are some cool projects uh like the damn venerable web application, web gold from mobile asp and juice shop, and they they are vulnerable applications that teaches you actually how to break and how to protect those applications right and why I am adding those here, because I want something broken right.

A

I really want something vulnerable, because I want to explore how curiou fans can protect me. So I I decided to use dv wa, which is easier and because I have no tabita state stereo or the fin or anyone that's good at those vulnerability stuff. So I just wanted something that me that I could break, but those are cool projects to learn a bit about web application security. So yeah take a look into those.

A

So I I I've got this uh dvwa and I created a dvwa container because the dvwa container- it's pretty old, so I will right now. uh Bootstrap is in my machine, so we can at least take a look. How how it looks like how how it looks like a web vendor ability before we start trying to add curie offense on front of it right so and please folks, don't run this in production. Don't run this on on your uh on your production, cluster or something public.

A

So mostly uh this script, uh it does like create a docker compose and with like uh triple seven permission, which is bad but anyway. So, let's, let's do a docker compose docker compose up here and see what happens right?

A

A

I forgot to do some docker pull, so we are all gonna. Wait, my internet to work like to have some speed here.

A

A

A

uh While it runs here, let's go back to the curio fans uh website, which is good and the the starting point that I want to take. A look is the overview and the documentation right, because we all need to start, we don't ever, but we should start via the documentations, and here I want to take a look into the architecture of curious fans, so uh they state that curifence is an api first devops oriented web defense, http filter adapter for envoy and nginx, and provides a lot of security technologies, and it's really comfortable controllable programming.

A

Programmatically yeah, my english is cool right.

A

So uh uh back in time, when I was looking into curios, I remember that uh what it does is actually it does have an api server and you can like configure some stuff, which I don't remember anymore and those stuff they got published into a cloud storage which is a bucket right justin. So what's what's the idea about that? Like it's? Like other configuration, they get started into an s3 like or like.

B

Yeah, uh they think the idea there was like, like a get ops type uh mentality um where you don't need to have it like in s3 or a git repository. um You can have it as local storage as well so um yeah, but the idea was, you know if we're going all in with the cloud native ecosystem then have that supported.

B

I hope that answers your question.

B

If it didn't. Let me know.

A

Yeah yeah yeah it does it does uh so. Jeremy complained about the screen. I'm sorry! Sometimes I I forgot because my screen is pretty big, so let me know jeremy, if uh viewing it's yeah, it's better. Okay and thank you. Thank you, justin, okay, cool. So uh taking a look into this, we can see what what in total so that's like. We we've got a web console and a config server and it publishes on a cloud storage. So this is something uh you can say that uh key reference, uh like the proxies they keep running.

A

Even if the cloud storage is, is offline right. So we should probably try to remove something and and see how it goes and it's cool this architecture. So you may have like some metrics, some some elastic search to take a look into the logs and some dashboards so yeah. I want to jump into it soon, cool. So here my my my uh my venerable application is running and I just want to make sure that uh it's really broken right.

A

So let me improve my screen here and try some admin password yay.

A

Is it working yeah, login cool, so dvwa is an application that it's vulnerable by definition and it allows you to do things like. I want, for example, to do a common injection, so this is a pink device and I want to ping my my router here. So if I do something like this, it should it's not working because of some something, but it should, but anyway, pink is not getting that.

A

But if I do something like this.

A

Yeah, so it doesn't have any string sanitization right, so I can do a cad, etc lwd, and what, if I run this inside kubernetes if this application is running inside kubernetes, so I can, for example, exfiltrate my service account and if I exfiltrate my service account, I may have some more privileges that I that I should right. So the idea here is: I want to try curiou fans to protect this, because this was like a pretty developed application and it allows me to run anything inside my container.

A

Let's take a look into some other stuff right, so uh I have this file inclusion, which is including something here, I'm sorry about my bar here, because I can't I can't increase the size of this one. Let me see if I can do yeah hey. This is new to me cool.

A

So if I try to do something like this and put.

A

A

It doesn't open because www.google doesn't exist, but if I try something like this wait, so yeah this is allowing me to this is allowing me to to to include something remote. So I can do whatever I want right. So this is bad, so I wanna I wanna try to protect myself of this as well and late lace. The last thing is like, if I can add some some cross-site scripting here and say: hey my name is ricardo and my message is creeped.

A

Who doesn't love javascript right.

A

What's going on here, it doesn't allow me to do that, so it doesn't love me better script. What happens? If I do this hey look. I can do something here like redirect my window to something vulnerable right, so yeah. I want to protect myself of this as well. So I want to see how key reference can help me on that. I want.

A

I need a non-web application fire because I can't always rely on security development, so hey what's up siam, what's up carlos, uh so let's take a look into this, so we already passed it into the architecture here and like we know that we have a server here, uh represents a research protected by curia fans. So this is what we actually want to protect right and- uh and we have elasticsearch and a lot of stuff and a web console cool config server, which uh puts the configuration called storage.

A

I wanna, I really wanna, take a look into that and yeah. So there is some installation thing here. Let me open and some getting started. So probably I wanna jump into the getting started because keep reading documents you can you can do that right.

A

Yeah, so we have all of these, I just wanna get started so, let's, let's do this cool.

A

uh Hey there is a lot of stuff here, so let's begin yeah uh apt blah blah blah. I have docker here in my machine and I probably have key reference here on my terminal as well.

A

A

Yeah, so how can I deploy compose? I love docker, compose docker, compose.

A

So I I remember that probably this is gonna download half of the internet right justin.

A

It takes like a lot of things, but what's most like the things that are like downloading, it's like elasticsearch, which is heavier.

B

Yeah, it's very dependency, heavy, uh I'm not gonna. It's not gonna pretend that but um yeah it. It takes a bit to get up and running. But you know once it is it's very fast to start and you know go down, but yeah I mean you got to think. Like you know, we have so many dependencies like just the the co-dependencies that elastic search needs, and you know it's just it's a lot. I'm not going to.

A

I I don't want to say it's bad. Okay, that's! uh I was just saying hey I I remember like yesterday I was doing some not some dry run, but just looking if I still know how to use linux- and I was like hey- I am out of out of uh out of space here on my disk so uh was like, but just just having some fun but yeah uh just kidding. But that's that's that's cool! So, let's, let's wait until this is running here and take a look.

A

So is it possible right now to deploy qdfns uh directly in kubernetes? Yes, like yes,.

B

We don't have it, we don't have it well documented, um but that's definitely something we have to work on. That's and to be honest, it's something that we're getting a lot in our uh slack channel. A lot is hey. I want to do this, but there's no way to you know: there's no documentation about it. So it's a lot of great feedback. We've been getting for the past two weeks, so we believe by one five. Zero, we'll have like a lot better use cases, because you know what's really interesting.

B

Is you know you you build software and then you don't realize what people are going to actually learn use cases. So you know you think like. Oh, this is how they're going to use it they're just going to use it with sdo, and you know.

B

No, that's not that's, not good people. Some people can't use doctor they're, like I can't use docker. I needed to run it like. You know, on a sidecar or whatever, and it's just like. Oh, we thought you know everyone would just use docker. Why would you know so? It's just.

A

B

It's just it's. The growing pains of of opens having an open source project is just finding these different use cases that are just beyond your imagination. Oh oh, we're, starting.

A

Yay yeah, I see.

B

A

Yeah, let me see if everything starts, yeah.

B

I gotta give carlos some props. That made me laugh if people complained about epm and stuff.

A

Oh maven right, yeah, cool, hey, what's up hobo, who was a friend of mine from israel, uh it's pretty late in israel as well, so yeah welcome. Thank you. Thank you for joining me.

A

So carlos is telling me there is a page in the docs installed with helm. Is that not the way to install them in kubernetes, we may take a look yeah. Definitely.

B

Yeah, I guess it's just like certain people like can't use like they. They want to use, link rd um and I'm not sure if that I don't know.

B

I don't want to use this.

A

For example, I just wanted to use like a stand-alone deployment, maybe deploys this tio yeah. We definitely should take a look yeah. So that's online and uh okay. Let me add this to my etc host. Here.

A

Did I control c something no.

A

A

A

Yeah, so, okay, so I want to jump into the admin interface.

A

First, oh cool, so we have this admin interface and probably I want to take a look into the getting started thing because it tells me what to do right.

A

I don't know what carlos mean by so smooth and so relaxed. I definitely am not but yeah thanks uh so cool. So we have this uh api echo web server, which is something running uh behind. I guess so. If I try to do this in my terminal.

A

Yeah cool, so that's an echo server, and why would I use this echo server, probably trying to protect it right, so I want to know how to do that with my vulnerable docker compose application as well cool, so we've been here already, so we have some containers, some cool containers here, the curio proxy is like- and I imagine that's an envoy, an envoy server.

B

Exactly right, yeah, we include it in.

A

Cool uh something that syncs, something that runs: periodic maintenance, uh logger configuration server, ui server, so yeah there is a lot of containers here and uh here is how it stores the configs and yeah.

A

This is where I wanna get right, so I want I want to try to put some rate limiting some static, filtering and see how how can I protect it so cool, I I? Where is it so? I have this machine here. Let me increase the size.

A

So yeah so carlos carlos wrote that it looks heavy and my my answer to him is: I'm just kidding okay folks, but what security stuff doesn't look heavy with a lot of firewalls and a lot of web application, firewalls and stuff right so, but to be honest, I think uh this is if you, if you try to take a look into like let's say uh the idea of of curiosity. In my opinion, it's cool because uh the the heavy part of anything is the management part right.

A

So I remember like dealing with greylock, for example, and the heavy part of greylog was like the java application and the elasticsearch thing, and maybe uh everything that deals with with management. The management side usually is heavy, but I mean what needs to be light, and I hope so is the proxy right. So I I don't want to have any kind of latency for my users, because I am applying a lot of rules.

A

So this is this is what matters in my opinion uh right, so it's open so uh in the left, sidebar, select policy and rules, if not already selected, so policy rules yeah. I am here. I'm definitely here and at the top left of the page in the second pulldown control global filters, global filters cool. So what's that about so what's global filters, global filters tags to request a session, so a global filter is a way to mark. Something. Is that right, like I want to mark some traffic.

B

Exactly yeah, it's like basically yeah. It's like a tagging system. Okay,.

A

So I want to create, like a new global filter, uh on what I need to do here uh next in the tags header test, so tags under test. I want to call this: let's say: ricardo's filter right, uh create blah blah blah, then, at the top of the current gameplay empty list to the right. Another new entry by selecting create a new section.

A

Where is it okay here?

A

So I need to say that this is a header right or is it okay? That's a header, and that's all we have created simple: where is it header? Who is the name test? Is the value.

B

A

Test should I click on the save button, add and save yeah cool, so.

A

It looks like this, so we have created every request that contains the header name in full will match the rejects tc and we receive a tag of header test. Now save the configuration and where is the publish?

A

I have saved, publish changes right here. Okay,.

A

uh There are some questions while that justin uh so isn't void. The only component in the data plane like between the traffic.

B

uh These are great questions and I am completely embarrassed just to say, like I'm more like the evangelist behind everything. um What I can say is all these questions I can answer and deliver them or get answered and deliver them back again. I I apologize. We, I tried to get two of our uh engineers on and they just they had conflicting things so apollo. I apologies uh carlos.

A

B

Questions I just I just wish. I could answer that, but I don't want a bs. You know.

A

Hey uh just uh don't worry about that, you told me I was just like I was just asking so uh but yeah we probably want to take a look into into that later. Maybe try to.

B

Remove yeah what we could do is we could put these questions in the show notes, and then I can get them. I can get answers and then that will just be distributed. uh You know, through uh the tgik's, um like uh channels.

A

Yeah, amazing, I don't want to embarrass you. Sorry, sorry justine.

B

No, no, no! No! No! I just didn't want to you know, make things up to to you know: no, no, no, carlos you're, fine,.

A

Yeah you're, just just me.

B

Being insecure about myself,.

A

B

Keep asking questions through great questions and I will get them answered. It just won't be right away, because uh my team is like asleep right now.

A

Cool so uh it was published- let's, let's play a bit here- and we are all learning here folks. So this is this is tjk right, so I can't do something wrong. I can't even use my terminal, I'm sorry about that. Okay, so I am doing this. Curio demo no hit no header, and then I will do this passing my header full and value test. Let's see what's doing here so both of the requests they are the same but yeah they are the same right.

A

The only difference is that I am passing this header here, so I should navigate right now to kibana.

A

So let's take a look into kibana.

A

B

A

No, I don't wanna enable security, sorry about that. We are just playing with security here uh and what should I look at so this shows the two requests just sent in order of receipt. So my request- they are here really: where are they access log agent?

A

If I do something like this should say, show me something else time stamp: blah blah blah blah blah blah agent name file bit.

A

I can't see nothing.

A

Downstream directory mode, what this should do, this should add something right: where is it reason specified keyword with header.

A

I should be looking to something.

B

A

Me remove reduce a bit my screen just to find.

A

Couldn't find something, let me see what I am missing.

A

uh This show the two requests. You just send an order, click on the spam button and you should look acl name into the tags.

A

So where are those tags? I wanna see only the text here: tags text.

A

A

Is it isn't here.

A

The full ow blah what it should show me: it's not showing me nothing, I'm missing something. Probably I did something wrong. Let me see policies and I want to see global filters and I have where is my filter?

A

What's the name of that filter ricardo's filter full? Oh maybe it is case sensitive.

A

A

B

Again, something.

A

Else, header full test, okay, add and we should remove. Oh that's the same thing.

A

So I should that's active okay and let's save it and let's publish again and see what.

B

A

A

And uh is it published yeah.

B

A

Let's try again.

A

I will do a bunch of requests just to see if they appear.

A

Here so let's go back here and see if I can see something else here. So those are my requests and I have this agent id not blocked.

A

I don't want all of those docker stuff thing metadata.

A

Fax stream keyword, okay, security policy default entry- header, oh cool, so here it is, so that's getting tagged nice! So right now we are just tagging our traffic right. So let me see I want to try to block so in this case we are going to block all the requests with header tests so in the left, menu navigate to the policy rules.

A

So policy rules, acl profiles, is it's that right, enter into the deny column, enforce, deny or deny so hdr test. Oh nice, it! Oh, it feels automatically so cool. So so I set the traffic and then I blocked. Those is that right is the idea.

A

So, let's take a look into this, uh save your changes then publish so I wanna save and then I wanna publish my changes and publish it.

A

And let's wait a bit.

A

A

It wasn't blocked should be blocked.

A

Take some time to get blocked right.

A

Or I should add that to enforce deny. Maybe let's see policy aci default seo hdr test deny.

A

Why is it being blocked.

A

Oh, it should still work so.

A

And security profiles are in report, monitor mode ah cool, so I should read the documentation right. Information is also visible in logs. So if I refresh here.

A

I should see right now, don't show me again that this is block it. Where is the blockade? Yay cool, oh cool, nice and the response code? So if I want to activate these policy rules, security policies, security policies and then where is it? Oh, I keep losing my docs here.

A

Security you can assign policy on any scale. Just show me how to do that. Export the default profile expand it, and I need to do what then activate by checking the active mode. Checkbox aci.

A

Save one thing that I think it's nice here that I I was seeing it's a lot a lot of like uh a lot of like look like into uh github stuff right, so you have the fork thing and then you have the, and when I do the publish I I can see, I have versioning. So it's it's cool the idea of maybe so this version control I can just publish all of my control into a github, for example. I should try that.

A

Let me see if I can link into my there is one branch and they commit. So how can I link this into my github? It would be cool to have this.

B

You're right- and that is a feature request right now. What we did was we built it in. We built git into carryfence, um so we would have like a you know, get ops by default, um but there are people, as I said earlier, you know when you start a project you're like oh. This is how people are going to want it and then they're like no. I want to connect my own. I want to get my private uh github repo, we're just like yeah. That would make sense. So it's something.

A

B

Yeah, it's definitely something that's on the roadmap, but um right now it is just built in it's built on top of git inside of um uh fury fans.

A

Cool yeah, that's cool.

B

Yeah, exactly carlos.

A

uh I I closed the diamond.

A

I will just open again.

A

Cool nice, so right now I have block it, so it should block right, hey nice, nice, so if yeah it works, but I want to break things. Everything is working. Fine. I need to break stuff, it's the response, something right. That's the response code response response, headers, yeah, cool amazing. uh Let's move forward! I just played a bit with this, so that's forbidden- and I have all of this, so we have some rate limiting. I just don't want to play with rate limit.

A

uh I want to take a look if I can, for example, use some rules like owasp rules to block something right, so I want to block my sql injections. So let me take a look into here. I have this deployment in deep, but right now I don't think I want to take a look into this. I want to look into maybe web application firewall policies so what it does.

A

Above profile set of security, every deployment includes default every the request was blocked before filtering, so I want, for example, uh content filtering parameters constraint.

A

uh I just want to block things I like to block things nice, so let me see here I have these policies and rules, and I want to take a look into.

A

Don't know I think, acl profiles.

A

What should I do here, security profiles, yes here and I want to contain- where.

B

A

A

Content filter, yeah.

A

So I want content filter rules here, and this is what is this? Oh, I have like a lot of rules that are those like the same rules of maybe uh uh not security. That's the osp rules here.

B

uh Yeah so dowse actually came from uh reblazes uh commercial product. uh Why they're not properly named, not sure, but basically, as I said before, all everything that came from curie fence was like came from that uh proprietary uh product and kind of just everything, they've learned over the years has is slowly just trickling into uh curie fence. But, uh as you can see, you know there are some issues, uh some human readable issues uh but yeah there's multiple uh policies that have been used by customers in the past.

A

Cool yeah, that's, in my opinion, that's acceptable. That's a sandbox project anyway right, so we are just examining here, yeah, so cool, let's, let's, let's just let's just break things. So uh I have this default content filter here and I have these contain filter rules. So I want to apply those content filter rules into this content filter profile.

A

uh Should I do something else here? I don't think so right! Let me let me see if I am breaking so I have this rules here and I want just to apply this into my maybe my uh security profile, the default one and I want to I wanna active ah cool right. So, let's save and see. If I can simulate something here right engine is asking us to make some try on aggress blocking too I can try it like some data loss protection- maybe some pyy right.

A

So I want to block something that contains something something that contains something was beautiful, sorry, something some traffic that contains like uh protected data, so yeah. We we can try that carlos asked why it's not a crd. Do you have an idea justine like something integrated with kubernetes like an operator, something like that.

B

I don't, but I have a markdown file on my on my uh text, editor that I will be getting all these answers for it's a great question. I just I'm not sure yeah.

A

Maybe it's just a matter of like creating an operator that integra integrates with q reference api calls, so we could make that, for example, we could have some fun on that right.

A

Let's take a look into some rule: some nice rule that I wanna that I can block uh statement injection. So I remember there was something with windows or something like that. uh Come on, I lost that javascript, no.

A

Ht access, yeah, ht, ht access is a good one to test right. So let's see ht access.

A

Oh, it pass it why it.

B

Pass it, I think you have to hit um a publish or save in the top right corner.

A

B

uh I did oh, you did.

A

B

Oh my bad, I thought I thought it was sorry.

A

No, no, no worries, I'm just trying to figure out uh why it is not so there is this global filter. Maybe no. This is the one that just adds the traffic stuff security policies.

A

It should be using specified blah blah blah blah blah. I have this: the fall off yeah, so I'll reject name. Oh maybe I should create some security policy that matches anything.

A

uh It does matches rate limit rules default, contain filter.

A

Save it, let me try to publish again and see what goes on, because web application file is separate from from that uh marking thing right, the rate limiting so should it be working like yeah.

B

B

Let's try it one more time now that it gets published.

A

Maybe I am just adding something wrong or doing this. Oh.

A

Let me try to figure out if there is some other cool rule that can be used like this. One is a good one.

B

A

It's passing maybe in kibana there is something.

B

Oh, that's uh go go back to um where you were here. uh No, the the other one, the one that you were on just previously yeah okay, so you chose that right. Can you hit? Did you hit the save button in the top right corner.

A

uh I didn't change anything in here, but I have saved it here. I guess here this one when I have enabled this content filter. Okay, I don't know- maybe I should add this into the content profile.

A

A

uh Restrict arguments.

A

I just want to make everything work.

A

Oh matching names default, so this matches anything.

A

uh Yuka asked: what's the configuration po interval like it's immediately, I I don't know if you know about that as well. Maybe, but but that's pretty fast right, I I was like trying. So maybe it's watching that.

B

Yeah, it should be pretty real time.

B

Okay, interesting.

A

Now, let me let me read here and see: if I can, I can see what the hell am I doing wrong, so there is flow control policy. uh This is like when you need a get before a post. All this this is nice.

A

uh So I have this global filter, which applies some filter into something, and you can apply. We we've been already there.

A

uh I want to see security policies, policies, overview, displays least, overland security policies assigned to the marine, coming reference, fines, components of security policy, host definitions, path, maps, okay, matching name and path, creating a security policy.

A

It's here we can do something new, but that's now I just want to use this one.

A

Path maps, so, what's the path maps, it's all active.

A

Create a new limit role, so I did save it, but let me save this again.

A

Of policy, even the name is different because this is like, but content filter profile probably is the same as waffle right web application firo, I would say this is like just a new version. Baby.

A

Yeah, at least.

B

Yeah the date that the docs are probably um out of date, that's something we have to address.

A

uh If it's green is active, so it's green, it's active content, filter.

A

Make sure that security pulse is not in the form between matching path, map activate.

A

Okay, create I wanna.

A

What is it specific? I should probably add something here.

A

Reasons why our filtering may not occur, they request us bucket. Before of no the applicable acl profile resulted in an action of bypass. The waf is not in active mode for this url.

A

That's not our case.

A

The full and incoming request will compare to. They were froze.

A

Maybe I need to do something like.

A

Content filter profiles and I should add something like this thing.

A

And do like curiou.demo is this right and I want to match.

A

Anything anything works, no.

A

That's a rejects.

A

What, if I try just to force this.

A

No yeah, so it's not worth two.

A

Maybe yeah, maybe we need to figure out what can be done, but I'll just save it and go back to.

A

This profile here and I'm missing something here here, existing rule, okay, we'll try once more and see- if maybe it needs, like the rate limiting rule.

A

Anyway, if it doesn't work at least, we know that I need to read better the documentation, because.

B

We are, you know.

A

Yeah exactly but the cool, but I mean I, I was looking into trying to use that uh with my kubernetes stuff, but I don't think we are going to have fine.

A

We spend a long time here. Maybe we should do another like episode just trying uh using in kubernetes, but uh I think that it's it's really cool anyway, the idea of creating rules and and deploying them in envoy, I'm just annoying that this is not working. So let me I'll just do like and see if the rate limit at least serves me.

A

A

A

Probably I need to add, like a a security profile here, a security policy that matches my my curia demo.

A

Let's see curiosity that demo and I want to enable everything- and I want to attach a rule here.

A

And save it and I think I forgot to add yeah, I didn't save the rule here. Amazing.

A

And publish at least I want to try to hit like the rate limit and see. So I don't know if you know justin, but is this race limiting uh also distributed between the envoy proxies like? uh Are? They uh is like one and by proxy aware of the other one. If I try to do something, because I know that in some cases like doing that, control that distributed global rate, limiting control is pretty hard.

B

Yeah, uh I'm I'm not 100 sure um you know one. One thing that I would do is probably do like a like a bash. You know a while true, you know curl and then done yeah. That's that's what I do to to check the.

A

B

A

A

B

Yeah perfect: let's see if it comes back, not getting.

A

A

Probably there is one single one small button saying I want to block everything.

B

Yeah yeah, it's just annoying.

A

Like this enforce, then I would be a tag I I should tag no right. It doesn't tag.

B

A

I mean this when, when I do this, when, when I hit some some rule here, does this get then I need to tag something not sure.

A

I'm not I'm really not sure yeah. I need to explore that more. Let me see inelastic search here if at least like this is getting tagged. So maybe it's some way. This is some way we can see right. So let me open this. I know that my screen is a bit small folks, but it's because uh requests.

A

I want to see my request downstream blah blah blah blah blah blah. Where is that blockade field? I pass it block it false.

A

Protocol input type, no rate limit.

A

Yeah it's! This is the my request. So what are the tags that I'm getting here?

A

uh So this is something acl name: the full ucl content, filter, name, the full content, filter security policy, entry default.

A

There is no block or anything right.

B

Yeah, I'm not seeing anything. uh If you tried I mean searching, maybe something would come up, but I mean the last commands that you're the last curl that you're running was something that was supposed to be blocked. So.

A

It's here it's just going.

B

On yeah yeah, exactly.

A

Let me see: let's, let's make one more try. Otherwise we should probably allow folks to to to go back to their families, but we should we we can yeah, but we can.

B

A

B

If we do this again, we'll definitely get an uh a contributor maintainer of the project that can, you know, do things in real time. It's just the the timing was off.

A

Yeah, let me add some header here.

A

uh What's the restrict thing had their name full and the value naming instead of being full test being full ricardo and save it, and I don't wanna.

A

This is something that actually masks the header. Let's see, publish.

A

Oh nice, we can. Oh, I missed this one that we could see like the.

B

A

You could set up any s3.

B

Compatible uh storage for publishing or you could do it locally. It's up to you, yeah.

A

I've missed this one. Let me publish here, let's see if this is going fine.

A

I need to maybe.

A

The header is here and that's not getting blocked, so yeah, not sure what we should do right now and because I can see by the logs that it's getting hit by that content, filter name the full config filter right. So it's getting at least on the right place, the full config filter and the header is here matching value, strict mask. I don't know if this should be something I will try to save it again, but cool yeah. I think that we've been like doing folks.

A

Do you want us to try to explore something else? That's not we. We should probably uh stop right now, but at least like I mean I am not I. I am happy at all with this, because it's really cool to see the evolution of the project and and how uh we get like web application file rules right now. Probably I'm just messing with something that I shouldn't.

A

So anybody wants to take a look into something else. I will keep trying a bit more just to see if I can break something at least I could see. I say that I would break something justin. I did probably my my own fault here, but.

A

Yeah, let me yeah go ahead.

B

No, no, I mean that's you're doing to me. Like my experience doing this, I don't know why it's why it's failing um it's probably something like I'm totally overlooking um but yeah. I.

A

I have disabled my my content filter here, just to take a look if this is still getting into the otherwise, I would say hey. This is getting blocked by by fed so engine asking us to take a look into graphene, and uh so let's, let's do this.

B

Grafana's good uh admin, admin.

A

Secure password right.

B

Exactly and then you can just skip or you can set something I don't know.

A

I usually use my cool, so I should go to the dashboard.

B

Yeah or go to playlist and we we created some playlists or some click.

A

B

Yeah, try that uh sorry yeah manage manage, manage, manage yeah and then provide and then yeah you can do uh the overview.

A

Nice, oh so, the the at least like the the memory footprint is really small right and we have like hey, like eight active connections and upstream network traffic, but to to have some some graphs about uh target site nice to have some graphs about maybe uh blockade stuff. Is this on the yeah.

B

Yeah we're looking to always, you know, improve the grafana uh dashboards because you know grafana's like what everyone's it's the go-to tool for graphing and um uh yeah for the for the alerts, I believe, is just done through uh grafana. um I haven't I've, never set any up myself. I don't. I don't run this in production uh myself, so um yeah so yeah. It uses prometheus and um grafana to do graph or visualizations yeah.

A

Some songs like using graphene or even prometheus alert manager. I guess that's called native compliant right.

B

Yeah exactly yeah.

A

B

A

That's yeah cool! That's that's a good! That's a good! That's a good dashboard for like a common center or something or a security operational center. Here, unfortunately, we just couldn't have anything blocked here right, let's, let's take a look into prometheus as well so prometheus.

A

uh I wanna take a look into the queries that exists.

A

Cool yeah you, you can still use prometheus, grab those metrics and send whatever you want right. So that's.

B

A

Something that should work all right, so I will. I will keep trying to break things here. Just let me go back to my uh kibana and see if my things they are still getting, but I guess that for now maybe we should be done and congratulations justin to you and the team. This is like this is a really cool project.

A

I mean as soon as we get like more tracking into that, and I and I and I want to motivate folks to take a look into that and provide feedback because uh any any of those projects. uh Actually they are like they are moved by the feedbacks right. So I think that we we've got a lot of those today and and- and this is security- is something more and more- that we need to take a look into that so uh yeah.

A

So I got the security policy here as well, and it's hitting the curia demo after I have removed that one, but that's still not not blocking not.

B

Sure why it's very weird, I I'm not sure what's going on, but now that we have this on video, we can our maintainers um we'll definitely go over it and see. What can you know change? I don't know when you're when you release your show notes, but if you can give me a couple of days to get those answered, I would love yeah. I want some accountability like I'm going to get these questions answered because they're really good. I just don't have answers at this moment.

B

A

uh Oh, I I have one more thing that I want to try before just saying: yeah, nothing works for me. What, if I try to change this to this, the full config filter? I don't know if this space is a problem shouldn't.

B

A

B

A

Shouldn't be, but I I am persistent on my my offense right so.

A

A

Ignore of an american put rules, let's publish and see the lesser thing folks, otherwise we should all go to our weekend. Let's, let's, let's make one more try.

A

Is it published uh yeah? Where is my yeah, no joy blocking blocking stuff? Maybe maybe I am missing something here.

B

One more one more thing: let's try this: let's go to it: let's shut down the servers, uh control c on those and and try bringing it up again, just.

A

B

A

Reason unspecified thing here.

B

Oh yeah see it's your.

A

Play yeah it's getting blocked. We should have take a look into the logs before like complaining about the invoice proxy.

B

A

Well, I mean yeah.

B

So, let's, let's try it now uh and see what oh okay, I saw some.

A

Yeah, it's still getting blocked, but uh I'm not getting you're.

B

Not getting stern response, okay,.

A

Yeah, uh it's it's like block, it falls and then getting like reason specified and authorized details. So that's that's not getting blocked. It's just getting logged here right. So I'm not sure I can. I can stop again and do a.

A

Like stop and see, what's what happens? Probably it's getting some timeouts.

A

Then a docker compose up and see if that's not getting rate limited as well.

A

Yeah no joy here I I I would put a bet that something is in here on on the profile that I am not sure what should be added here, but.

B

A

Anyway, we try it right.

B

uh Wait one more thing: one more thing go back to the previous screen you're on.

A

Acl profiles.

B

uh Not that one the uh flow.

A

Rate limit rate limits.

B

B

Maybe since it's at the bottom, it just has like a slash. um Just maybe you know entry match slash. Is you just go to the uh while true uh curl command right in your thing and then just remove uh slash password just to see? Okay? Yes, nothing! Okay! No! No! No! Dice! All right! Well, hey what.

A

Yeah, nothing so homologous say that probably it's in monitor mode, but that's that's not we. We. We have actually changed here in security profile. We we have enabled that so it's not in monitor mode.

B

A

That's a good good. Try if I disable the acl profile and just leave like did the full config. That's we can keep trying.

B

Yeah, it's just so weird I was like there's just got to be something I'm not like. I'm totally overlooking like I've done this a billion times like I don't know why it's not blocking.

A

I have no idea as well- hey, oh no. I thought it was blocking, but it's not.

A

I yeah no, no, that was like yeah. Probably it's like the version that I'm using it's one, three one, three yeah, that's the one in docker compose right, one: three.

B

Three, oh yeah, we should we should went with. I thought it was one four. We were.

A

B

Or that's the latest one, but I don't know maybe that doesn't matter in the end. I.

A

Am yeah I am on the like docker tag here. What's the docker tag, that's using?

A

Where is this getting from like this docker compose team.

B

A

I don't know where is this coming coming from image, docker tag.

A

B

I'm not sure anyway, uh yeah we'll we'll to be continued. If, if people are, you know still want to see this um happen, but yeah it's it's. uh Oh, it's.

A

B

It's on, oh okay, so it's the it's! The latest.

B

Okay, I got it yeah yeah, so you're just pulling it from head.

A

B

Okay, all right well, okay,.

A

uh So juka made the last question before we we we tear down. So that's if the configuration is human readable. uh If.

A

B

It's all it's all yaml I mean it's, you know the the go-to could uh cloud-native config.

A

B

A

Right, okay, so uh yeah cool. So today was like an amazing to me. It was like an amazing uh uh episode was really yeah yeah, not as well. At least we we've got. We've got like some some stuff working we've we've got like the the working. I I mean. Probably it's something really simple to solve that we've been missing, uh but anyway it was really really cool justin. I would like to thank you and uh I think that yeah.

B

Yeah thanks for having me and thanks for the audience for you know putting up with my you know: non-answers, but uh again we'll get these uh questions answered and carlos you just made my day you're the comic relief of this. So thank you.

A

Yeah, I would like to thank you all again and have a nice weekend. Folks, I will try. I I will see if I can make it work and maybe put on the on the notes as well and and and see what I was missing. Maybe something on docker compose or I don't know but again was really cool and and thank you all for joining us and have a nice weekend. You all see ya.

B

Bye y'all. Thank you.