Kubernetes Policy As Code usando WebAssembly | Flavio Castelli
•
0 likes•55 views
Mettere in sicurezza un cluster Kubernetes richiede l'uso di diverse strategie e di strumenti per attuarle. Tra queste, i Dynamic Admission Controllers giocano un ruolo fondamentale per garantire non solo la sicurezza di un cluster, ma anche la sua compliance. Infatti tramite di essi è possibile definire, ed applicare, regole personalizzate. Nonostante molte organizzazioni riconoscano l'importanza di abbracciare la "filosofia" Policy As Code, sono purtroppo poche le realtà in cui questa metodologia viene utilizzata in ambienti di produzione. Durante questo talk mostrerò come WebAssembly, una tecnologia nata originariamente per il Web, possa essere utilizzato per implementare strategie di Policy As Code in Kubernetes. Vedremo come l'adozione di WebAssembly semplifichi il processo di creazione, mantenimento e distribuzione di queste policy.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Kubernetes Policy As Code usando WebAssembly | Flavio Castelli
Similar to Kubernetes Policy As Code usando WebAssembly | Flavio Castelli (20)
Recently uploaded
Recently uploaded (20)
Kubernetes Policy As Code usando WebAssembly | Flavio Castelli
- 1. Copyright © SUSE 2021 Kubernetes Policy As Code usando WebAssembly N OVE M BE R 2021 Flavio Castelli Distinguished Engineer SUSE
- 2. Copyright © SUSE 2021 2 Kubernetes security: biggest concerns 1% 8% 12% 17% 19% 21% 23% Other Secrets management Unpatched CVE in Kubernetes distribution Control access to the cluster Securing container images inside CI/CD pipelines Securing workload at runtime Applying policies consistently Source: “The State of Kubernetes 2021” - VMware, June 2021
- 3. Copyright © SUSE 2021 — Role Based Access Control (RBAC) — Pod Security Policy (PSP) — Network Policy — Admission Controller 3 Kubernetes Policy As Code
- 4. Copyright © SUSE 2021 4 Admission Controller: overview JSON object Business logic Accept Reject Mutate
- 5. Copyright © SUSE 2021 5 Who is responsible for Kubernetes’ security? 27% 21% 18% 18% 15% DevOps Ops DevSecOps Security Developer Source: “State of Kubernetes Security” – Red Hat, June 2021
- 6. Copyright © SUSE 2021 6 Introducing Kubewarden A policy engine for Kubernetes. Its mission is to simplify the adoption of Policy As Code.
- 7. Copyright © SUSE 2021 Copyright © SUSE 2021 7 Feel immediately productive Policy Authors
- 8. Copyright © SUSE 2021 8 Validation
- 9. Copyright © SUSE 2021 9 Validation
- 10. Copyright © SUSE 2021 10 Validation
- 11. Copyright © SUSE 2021 Copyright © SUSE 2021 11 Leverage SDKs Policy Authors
- 12. Copyright © SUSE 2021 12 Mutation
- 13. Copyright © SUSE 2021 13 Policy configuration
- 14. Copyright © SUSE 2021 14 Validation of Policy configuration
- 15. Copyright © SUSE 2021 Copyright © SUSE 2021 15 Treat policies as regular code Policy Authors
- 16. Copyright © SUSE 2021 16 Reuse known tools
- 17. Copyright © SUSE 2021 17 Integrate into CI/CD systems
- 18. Copyright © SUSE 2021 Copyright © SUSE 2021 18 How is that done?
- 19. Copyright © SUSE 2021 19 What is WebAssembly? WebAssembly module (Wasm)
- 20. Copyright © SUSE 2021 20 What is WebAssembly? WebAssembly module (Wasm) Polyglot C Cpp Rust Javascript Go Swift … … … … Build
- 21. Copyright © SUSE 2021 21 What is WebAssembly? WebAssembly module (Wasm) Small Go 300 Kb Rust 1.5 Mb
- 22. Copyright © SUSE 2021 22 What is WebAssembly? WebAssembly module (Wasm) Portable x86_64 ARM64 ... Linux Windows macOS Browser Wasm runtime Run
- 23. Copyright © SUSE 2021 23 What is WebAssembly? WebAssembly module (Wasm) Secure
- 24. Copyright © SUSE 2021 24 What is WebAssembly? Secure Sandbox Sandbox Sandbox Host process — Memory safety — Control-flow integrity — Runtime isolation More details here
- 25. Copyright © SUSE 2021 Copyright © SUSE 2021 25 Integrate with existing processes and tools Kubernetes Operators
- 26. Copyright © SUSE 2021 26 Policy distribution Kubernetes Cluster Kubernetes Cluster Kubewarden native policy OCI Registry Container image
- 27. Copyright © SUSE 2021 27 Observability: tracing
- 28. Copyright © SUSE 2021 28 Observability: metrics
- 29. Copyright © SUSE 2021 Copyright © SUSE 2021 29 Provide flexibility, not complexity Kubernetes Operators, Policy Authors
- 30. Copyright © SUSE 2021 — First Policy engine for Kubernetes — Policies written using Rego 30 OPA and Gatekeeper policy.rego opa build –t wasm policy.wasm
- 31. Copyright © SUSE 2021 31 Kubewarden: the Universal Policy Platform Kubewarden native policy OCI Registry policy #1 Wasm runtime policy #2 Wasm runtime policy #3 Wasm runtime Kubewarden Policy Server Kubewarden OPA policy Kubewarden Gatekeeper policy
- 32. Copyright © SUSE 2021 Copyright © SUSE 2021 32 Live Demo
- 33. Copyright © SUSE 2021 — Main website: https://kubewarden.io — Policy Hub: https://hub.kubewarden.io — GitHub: kubewarden organization — Slack: "kubewarden" channel on Kubernetes workspace — Twitter: @kubewarden 33 How to get involved
- 34. Copyright © SUSE 2021 Thank You S E P T E M BE R 2021 © 2020 SUSE LLC. All Rights Reserved. SUSE and the SUSE logo are registeredtrademarks of SUSE LLCin the UnitedStates and other countries. All third-party trademarks are the property of their respective owners. For more information, contact SUSE at: +1 800 796 3700 (U.S./Canada) Maxfeldstrasse 5 90409 Nuremberg www.suse.com