Aysylu Greenberg, profile picture
Uploaded byAysylu Greenberg
PDF, PPTX1,955 views

Binary Authorization in Kubernetes

The document discusses the importance of binary authorization in Kubernetes to enhance security by ensuring that only trusted images are deployed in a cluster. It introduces the Kritis tool as an admission controller for policy enforcement, limiting image deployment based on security criteria and vulnerability assessments. Additionally, it covers the Grafeas metadata store for managing vulnerabilities and attestation authorities, along with examples of image security policies.

Embed presentation

Download as PDF, PPTX
Aysylu Greenberg, Google Liron Levin, Palo Alto Networks Binary Authorization in Kubernetes
Who are we Aysylu Greenberg Sr Software Engineer @ Google Eng Lead of open-source Grafeas and Kritis @aysylu22 Liron Levin Chief software architect @ Prisma Cloud Compute Grafeas and Kritis contributor
Today ● Why we need binary authorization
Today ● Why we need binary authorization ● Improve the security posture of your k8s cluster
Today ● Why we need binary authorization ● Improve the security posture of your k8s cluster ● Learn about exciting open source security technologies
Today ● Why we need binary authorization ● Improve the security posture of your k8s cluster ● Learn about exciting open source security technologies ● Have fun and see cool demos
Software supply chain Code
Software supply chain Build & Test (CI/CD) Code
Software supply chain Build & Test (CI/CD) Code Deploy
Software supply chain - reality
Software supply chain - reality ● Which images are deployed right now?
Software supply chain - reality ● Which images are deployed right now? ● Did all deployed images pass required QA tests
Software supply chain - reality ● Which images are deployed right now? ● Did all deployed images pass required QA tests ● Does vulnerability CVE-2017-5638 (Equifax, apache struts RCE) impact production images?
Software supply chain Build & Test (CI/CD) Code Deploy
Software supply chain Build & Test (CI/CD) Code DeployAuthorize
Binary authorization - use cases ● Require images to be signed by trusted authorities: ○ QA ○ DevOps ○ Security tools https://github.com/grafeas/kritis/blob/master/docs/binary-authorization.md
Binary authorization - use cases ● Require images to be signed by trusted authorities: ○ QA ○ DevOps ○ Security tools ● Require images to pass some restrictive security criteria (e.g., no critical severity unpatched vulnerabilities) https://github.com/grafeas/kritis/blob/master/docs/binary-authorization.md
Binary authorization - use cases ● Require images to be signed by trusted authorities: ○ QA ○ DevOps ○ Security tools ● Require images to pass some restrictive security criteria (e.g., no critical severity unpatched vulnerabilities) ● Continuously monitor our inventory https://github.com/grafeas/kritis/blob/master/docs/binary-authorization.md
Open source
Open source
Open source
Pod lifecycle Kubernentes API
Pod lifecycle Kubernentes API Create a pod
Pod lifecycle ● Kritis - Admission controller for policy enforcement Kubernentes API Kritis Create a pod
Pod lifecycle ● Kritis - Admission controller for policy enforcement Kubernentes API Validation webhook Kritis Create a pod Validate pod Admission webhooks receive admission requests and do something with them.
Pod lifecycle ● Kritis - Admission controller for policy enforcement Kubernentes API Validation webhook Image security validator Kritis Create a pod Validate pod
Pod lifecycle ● Kritis - Admission controller for policy enforcement Kubernentes API Validation webhook Image security validator Kritis Fetch policy (CRD) Create a pod Validate pod
Pod lifecycle ● Kritis - Admission controller for policy enforcement Kubernentes API Validation webhook Image security validator Kritis Fetch policy (CRD) Create a pod Validate pod Kritis policy is a CRD.
Example policy apiVersion: kritis.grafeas.io/v1beta1 kind: ImageSecurityPolicy metadata: name: my-isp namespace: default spec: attestationAuthorityNames: - kritis-authority imageAllowlist: - gcr.io/my/image packageVulnerabilityRequirements: maximumSeverity: HIGH # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL maximumFixUnavailableSeverity: ALLOW_ALL # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL allowlistCVEs: - providers/goog-vulnz/notes/CVE-2017-1000082 - providers/goog-vulnz/notes/CVE-2017-1000081
Example policy apiVersion: kritis.grafeas.io/v1beta1 kind: ImageSecurityPolicy metadata: name: my-isp namespace: default spec: attestationAuthorityNames: - kritis-authority imageAllowlist: - gcr.io/my/image packageVulnerabilityRequirements: maximumSeverity: HIGH # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL maximumFixUnavailableSeverity: ALLOW_ALL # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL allowlistCVEs: - providers/goog-vulnz/notes/CVE-2017-1000082 - providers/goog-vulnz/notes/CVE-2017-1000081 The Custom Resource Definition. Supported values: ImageSecurityPolicy GenericAttestationPolicy
Example policy apiVersion: kritis.grafeas.io/v1beta1 kind: ImageSecurityPolicy metadata: name: my-isp namespace: default spec: attestationAuthorityNames: - kritis-authority imageAllowlist: - gcr.io/my/image packageVulnerabilityRequirements: maximumSeverity: HIGH # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL maximumFixUnavailableSeverity: ALLOW_ALL # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL allowlistCVEs: - providers/goog-vulnz/notes/CVE-2017-1000082 - providers/goog-vulnz/notes/CVE-2017-1000081 Allow deploying images signed by ‘kritis-authority’ to allow previously admitted images be re-admitted on pod restart
Example policy apiVersion: kritis.grafeas.io/v1beta1 kind: ImageSecurityPolicy metadata: name: my-isp namespace: default spec: attestationAuthorityNames: - kritis-authority imageAllowlist: - gcr.io/my/image packageVulnerabilityRequirements: maximumSeverity: HIGH # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL maximumFixUnavailableSeverity: ALLOW_ALL # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL allowlistCVEs: - providers/goog-vulnz/notes/CVE-2017-1000082 - providers/goog-vulnz/notes/CVE-2017-1000081 Allow specific external/infrastructure images
Example policy apiVersion: kritis.grafeas.io/v1beta1 kind: ImageSecurityPolicy metadata: name: my-isp namespace: default spec: attestationAuthorityNames: - kritis-authority imageAllowlist: - gcr.io/my/image packageVulnerabilityRequirements: maximumSeverity: HIGH # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL maximumFixUnavailableSeverity: ALLOW_ALL # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL allowlistCVEs: - providers/goog-vulnz/notes/CVE-2017-1000082 - providers/goog-vulnz/notes/CVE-2017-1000081 Constraint on vulnerability: vuln severity <= policy severity
Example policy apiVersion: kritis.grafeas.io/v1beta1 kind: ImageSecurityPolicy metadata: name: my-isp namespace: default spec: attestationAuthorityNames: - kritis-authority imageAllowlist: - gcr.io/my/image packageVulnerabilityRequirements: maximumSeverity: HIGH # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL maximumFixUnavailableSeverity: ALLOW_ALL # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL allowlistCVEs: - providers/goog-vulnz/notes/CVE-2017-1000082 - providers/goog-vulnz/notes/CVE-2017-1000081 Carefully whitelist specific vulnerabilities
Pod lifecycle Kubernentes API Validation webhook Image security validator Kritis Fetch policy (CRD) Create a pod Validate pod
Pod lifecycle Kubernentes API Validation webhook Image security validator Kritis Fetch policy (CRD) Create a pod Validate pod Grafeas
Pod lifecycle Kubernentes API Validation webhook Image security validator Kritis Fetch policy (CRD) Create a pod Validate pod Grafeas Uniform way to audit your software supply chain
Grafeas metadata store ● Notes - High level piece of metadata { "name" : "projects/provider_example/notes/test" , "shortDescription" : "A brief description of the note" , "longDescription" : "A longer description of the note" , "kind": "VULNERABILITY" , "vulnerability" : { "details": [ { "package": "libexempi3", "cpeUri": "cpe:/o:debian:debian_linux:7" , "minAffectedVersion" : { "name": "2.5.7", "revision": "1", "kind": "NORMAL" }, }] } }
Grafeas metadata store { "name" : "projects/provider_example/notes/test" , "shortDescription" : "A brief description of the note" , "longDescription" : "A longer description of the note" , "kind": "VULNERABILITY" , "vulnerability" : { "details": [ { "package": "libexempi3", "cpeUri": "cpe:/o:debian:debian_linux:7" , "minAffectedVersion" : { "name": "2.5.7", "revision": "1", "kind": "NORMAL" }, }] } } ● Notes - High level piece of metadata - Vulnerability: CVE description
Grafeas metadata store { "name" : "projects/provider_example/notes/test" , "shortDescription" : "A brief description of the note" , "longDescription" : "A longer description of the note" , "kind": "VULNERABILITY" , "vulnerability" : { "details": [ { "package": "libexempi3", "cpeUri": "cpe:/o:debian:debian_linux:7" , "minAffectedVersion" : { "name": "2.5.7", "revision": "1", "kind": "NORMAL" }, }] } } ● Notes - High level piece of metadata - Vulnerability: CVE description & details
Grafeas metadata store { "name" : "projects/provider_example/notes/test" , "shortDescription" : "A brief description of the note" , "longDescription" : "A longer description of the note" , "kind": "VULNERABILITY" , "vulnerability" : { "details": [ { "package": "libexempi3", "cpeUri": "cpe:/o:debian:debian_linux:7" , "minAffectedVersion" : { "name": "2.5.7", "revision": "1", "kind": "NORMAL" }, }] } } ● Notes - High level piece of metadata - Vulnerability: CVE description & details
Grafeas metadata store { "name": "projects/image-signing/notes/product ion", "shortDescription": "Production image signer", "longDescription": "Production image signer", "kind": "ATTESTATION_AUTHORITY" , "attestationAuthority": { "hint": { "humanReadableName": "production" } } } ● Notes - High level piece of metadata - Vulnerability: CVE description & details - Attestation: attestation authority
Grafeas metadata store { "name" : "projects/provider_example/notes/test" , "shortDescription" : "A brief description of the note" , "longDescription" : "A longer description of the note" , "kind": "VULNERABILITY" , "vulnerability" : { "details": [ { "package": "libexempi3", "cpeUri": "cpe:/o:debian:debian_linux:7" , "minAffectedVersion" : { "name": "2.5.7", "revision": "1", "kind": "NORMAL" }, }] } } ● Notes - High level piece of metadata - Vulnerability: CVE description & details - Attestation: attestation authority - Deployment - Build history - And more!
Grafeas metadata store ● Notes ● Occurrences - Instantiation of a note { "name": "projects/occurrence_example/occurrences/test", "resource": { "uri": "https://gcr.io/project/image@sha256:foo", }, "noteName": "projects/provider_example/notes/test", "kind": "VULNERABILITY", "vulnerability": { "packageIssue": [ { "affectedLocation": { "cpeUri": "7", "package": "a", "version": { "name": "v1.1.1", "kind": "NORMAL", "revision": "r" } }, "fixedLocation": { "cpeUri": "cpe:/o:debian:debian_linux:7", "package": "a", "version": { "name": "namestring", "kind": "NORMAL", "revision": "1" } } } ] } }
Grafeas metadata store { "name": "projects/occurrence_example/occurrences/test", "resource": { "uri": "https://gcr.io/project/image@sha256:foo", }, "noteName": "projects/provider_example/notes/test", "kind": "VULNERABILITY", "vulnerability": { "packageIssue": [ { "affectedLocation": { "cpeUri": "7", "package": "a", "version": { "name": "v1.1.1", "kind": "NORMAL", "revision": "r" } }, "fixedLocation": { "cpeUri": "cpe:/o:debian:debian_linux:7", "package": "a", "version": { "name": "namestring", "kind": "NORMAL", "revision": "1" } } } ] } } ● Notes ● Occurrences - Instantiation of a note
Grafeas metadata store { "name": "projects/occurrence_example/occurrences/test", "resource": { "uri": "https://gcr.io/project/image@sha256:foo", }, "noteName": "projects/provider_example/notes/test", "kind": "VULNERABILITY", "vulnerability": { "packageIssue": [ { "affectedLocation": { "cpeUri": "7", "package": "a", "version": { "name": "v1.1.1", "kind": "NORMAL", "revision": "r" } }, "fixedLocation": { "cpeUri": "cpe:/o:debian:debian_linux:7", "package": "a", "version": { "name": "namestring", "kind": "NORMAL", "revision": "1" } } } ] } } ● Notes ● Occurrences - Instantiation of a note
Grafeas metadata store { "name": "projects/occurrence_example/occurrences/test", "resource": { "uri": "https://gcr.io/project/image@sha256:foo", }, "noteName": "projects/provider_example/notes/test", "kind": "VULNERABILITY", "vulnerability": { "packageIssue": [ { "affectedLocation": { "cpeUri": "7", "package": "a", "version": { "name": "v1.1.1", "kind": "NORMAL", "revision": "r" } }, "fixedLocation": { "cpeUri": "cpe:/o:debian:debian_linux:7", "package": "a", "version": { "name": "namestring", "kind": "NORMAL", "revision": "1" } } } ] } } ● Notes ● Occurrences - Instantiation of a note - Package where vulnerability was found
Grafeas metadata store { "name": "projects/occurrence_example/occurrences/test", "resource": { "uri": "https://gcr.io/project/image@sha256:foo", }, "noteName": "projects/provider_example/notes/test", "kind": "VULNERABILITY", "vulnerability": { "packageIssue": [ { "affectedLocation": { "cpeUri": "7", "package": "a", "version": { "name": "v1.1.1", "kind": "NORMAL", "revision": "r" } }, "fixedLocation": { "cpeUri": "cpe:/o:debian:debian_linux:7", "package": "a", "version": { "name": "namestring", "kind": "NORMAL", "revision": "1" } } } ] } } ● Notes ● Occurrences - Instantiation of a note - Package where vulnerability was found - Remediation
Pod lifecycle Kubernentes API Validation webhook Image security validator Kritis Fetch policy (CRD) Create a pod Validate pod Grafeas Image security validator Fetch metadata API
Pod lifecycle Kubernentes API Validation webhook Image security validator Kritis Fetch policy (CRD) Create a pod Validate pod Grafeas Image security validator Fetch metadata API DB
Pod lifecycle Kubernentes API Validation webhook Image security validator Kritis Fetch policy (CRD) Create a pod Validate pod Grafeas Image security validator Fetch metadata API DB Who pushes security data to Grafeas?
Pod lifecycle Kubernentes API Validation webhook Image security validator Kritis Fetch policy (CRD) Create a pod Validate pod Grafeas Image security validator Fetch metadata API DB
Demo https://github.com/grafeas/kritis/tree/master/docs/st andalone
Roadmap ● Grafeas
Roadmap ● Grafeas ○ New metadata kinds contributed by the community
Roadmap ● Grafeas ○ New metadata kinds contributed by the community License Test StaticAnalysis InTotoLinkAttestation
Roadmap ● Grafeas ○ New metadata kinds contributed by the community ○ Server v1.0
Roadmap ● Grafeas ○ New metadata kinds contributed by the community ○ Server v1.0 ○ Move towards larger community ownership
Roadmap ● Grafeas ○ New metadata kinds contributed by the community ○ Server v1.0 ○ Move towards larger community ownership ■ Designate client owners for each language
Roadmap ● Grafeas ○ New metadata kinds contributed by the community ○ Server v1.0 ○ Move towards larger community ownership ■ Designate client owners for each language ■ Maintenance of the reference server v1.0
Roadmap ● Grafeas ○ New metadata kinds contributed by the community ○ Server v1.0 ○ Move towards larger community ownership ● Kritis
Roadmap ● Grafeas ○ New metadata kinds contributed by the community ○ Server v1.0 ○ Move towards larger community ownership ● Kritis ○ Production-ready, high-availability Kritis
Roadmap ● Grafeas ○ New metadata kinds contributed by the community ○ Server v1.0 ○ Move towards larger community ownership ● Kritis ○ Production-ready, high-availability Kritis ○ Interoperability between BinAuthz and Kritis
Roadmap ● Grafeas ○ New metadata kinds contributed by the community ○ Server v1.0 ○ Move towards larger community ownership ● Kritis ○ Production-ready, high-availability Kritis ○ Interoperability between BinAuthz and Kritis ○ More expressive policies based on stored metadata
References ● Deploy standalone Kritis + Grafeas in GKE ● Grafeas: github.com/grafeas/grafeas ● Kritis github repo: github.com/grafeas/kritis ● Mailing lists @googlegroups.com: ○ grafeas-users ○ grafeas-dev ○ kritis-users ● @Grafeasio

More Related Content

PDF
Platform Engineering - a 360 degree view
byGiulio Roggero
 
PPTX
Introduction to openshift
byMamathaBusi
 
PDF
Sw update elce2017
byStefano Babic
 
PDF
Designing a complete ci cd pipeline using argo events, workflow and cd products
byJulian Mazzitelli
 
ODP
Introduction to Swagger
byKnoldus Inc.
 
PPTX
Splunk for Industrial Data and the Internet of Things
bySplunk
 
PPTX
Software Composition Analysis Deep Dive
byUlisses Albuquerque
 
PDF
Swagger
byNexThoughts Technologies
 
Platform Engineering - a 360 degree view
byGiulio Roggero
 
Introduction to openshift
byMamathaBusi
 
Sw update elce2017
byStefano Babic
 
Designing a complete ci cd pipeline using argo events, workflow and cd products
byJulian Mazzitelli
 
Introduction to Swagger
byKnoldus Inc.
 
Splunk for Industrial Data and the Internet of Things
bySplunk
 
Software Composition Analysis Deep Dive
byUlisses Albuquerque
 
Swagger
byNexThoughts Technologies
 

What's hot

PDF
Gitlab, GitOps & ArgoCD
byHaggai Philip Zagury
 
PPTX
Introduction to Docker - 2017
byDocker, Inc.
 
PDF
flutter.school #HelloWorld
byFrederik Schweiger
 
PPTX
Flutter
byToma Velev
 
PDF
Gitops: the kubernetes way
bysparkfabrik
 
PDF
WTF is GitOps and Why You Should Care?
byWeaveworks
 
PPTX
Flutter
byShyju Madathil
 
PPT
CI and CD with Jenkins
byMartin Málek
 
PPTX
A flight with Flutter
byAhmed Tarek
 
PDF
The Kubernetes WebLogic revival (part 2)
bySimon Haslam
 
PPTX
Istio a service mesh
byChandresh Pancholi
 
PDF
Cloud Native In-Depth
bySiva Rama Krishna Chunduru
 
PPTX
Docker Kubernetes Istio
byAraf Karsh Hamid
 
PDF
Ansible_Basics_ppt.pdf
byPrabhjotSingh976002
 
PPTX
Leveraging Nexus Repository Manager at the Heart of DevOps
bySeniorStoryteller
 
PDF
CI/CD 101
bydjdule
 
PDF
Technology Stack
bySV.CO
 
PDF
Api management best practices with wso2 api manager
byChanaka Fernando
 
PPTX
Canary Releases on Kubernetes w/ Spinnaker, Istio, and Prometheus
byKublr
 
PPTX
What Is A Docker Container? | Docker Container Tutorial For Beginners| Docker...
bySimplilearn
 
Gitlab, GitOps & ArgoCD
byHaggai Philip Zagury
 
Introduction to Docker - 2017
byDocker, Inc.
 
flutter.school #HelloWorld
byFrederik Schweiger
 
Flutter
byToma Velev
 
Gitops: the kubernetes way
bysparkfabrik
 
WTF is GitOps and Why You Should Care?
byWeaveworks
 
Flutter
byShyju Madathil
 
CI and CD with Jenkins
byMartin Málek
 
A flight with Flutter
byAhmed Tarek
 
The Kubernetes WebLogic revival (part 2)
bySimon Haslam
 
Istio a service mesh
byChandresh Pancholi
 
Cloud Native In-Depth
bySiva Rama Krishna Chunduru
 
Docker Kubernetes Istio
byAraf Karsh Hamid
 
Ansible_Basics_ppt.pdf
byPrabhjotSingh976002
 
Leveraging Nexus Repository Manager at the Heart of DevOps
bySeniorStoryteller
 
CI/CD 101
bydjdule
 
Technology Stack
bySV.CO
 
Api management best practices with wso2 api manager
byChanaka Fernando
 
Canary Releases on Kubernetes w/ Spinnaker, Istio, and Prometheus
byKublr
 
What Is A Docker Container? | Docker Container Tutorial For Beginners| Docker...
bySimplilearn
 

Similar to Binary Authorization in Kubernetes

PDF
Software Supply Chain Management with Grafeas and Kritis
byAysylu Greenberg
 
PPTX
Securing microservices continuous delivery using grafeas and kritis
byVishal Banthia
 
PDF
CRA_ Secure Your Future before CRA Hits.pdf
byMario Fahlandt
 
PPTX
Code Security with GitHub Advanced Security
byLuis Fraile
 
PDF
Software Supply Chain Observability with Grafeas and Kritis
byAysylu Greenberg
 
PPTX
Clair, A Container Image Security Analyzer
byCoreOS
 
PDF
Introduction to the European Union Cyber Resilience Act (CRA)
byShane Coughlan
 
PDF
ISACA SV Chapter: Securing Software Supply Chains
byJim Bugwadia
 
PDF
Hardening Your CI/CD Pipelines with GitOps and Continuous Security
byWeaveworks
 
PDF
Software Supply Chain Management with Grafeas and Kritis
byAysylu Greenberg
 
PDF
Security Patterns for Microservice Architectures - London Java Community 2020
byMatt Raible
 
PDF
A Developer’s Guide to Kubernetes Security
byGene Gotimer
 
PPTX
CodeOne SF 2018 "Are you deploying and operating with security in mind?"
byDaniel Bryant
 
PDF
Software Supply Chains for DevOps @ InfoQ Live 2021
byAysylu Greenberg
 
PDF
Protecting your organization against attacks via the build system
byLouis Jacomet
 
PDF
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
byDenim Group
 
PDF
Security Patterns for Microservice Architectures - Oktane20
byMatt Raible
 
PDF
Security Patterns for Microservice Architectures - ADTMag Microservices & API...
byMatt Raible
 
PPTX
Template_for_Presentation_PhD Visveswarya Scheme (1).pptx
bysinglesrihari
 
PPTX
OpenStack Security Project
byTravis McPeak
 
Software Supply Chain Management with Grafeas and Kritis
byAysylu Greenberg
 
Securing microservices continuous delivery using grafeas and kritis
byVishal Banthia
 
CRA_ Secure Your Future before CRA Hits.pdf
byMario Fahlandt
 
Code Security with GitHub Advanced Security
byLuis Fraile
 
Software Supply Chain Observability with Grafeas and Kritis
byAysylu Greenberg
 
Clair, A Container Image Security Analyzer
byCoreOS
 
Introduction to the European Union Cyber Resilience Act (CRA)
byShane Coughlan
 
ISACA SV Chapter: Securing Software Supply Chains
byJim Bugwadia
 
Hardening Your CI/CD Pipelines with GitOps and Continuous Security
byWeaveworks
 
Software Supply Chain Management with Grafeas and Kritis
byAysylu Greenberg
 
Security Patterns for Microservice Architectures - London Java Community 2020
byMatt Raible
 
A Developer’s Guide to Kubernetes Security
byGene Gotimer
 
CodeOne SF 2018 "Are you deploying and operating with security in mind?"
byDaniel Bryant
 
Software Supply Chains for DevOps @ InfoQ Live 2021
byAysylu Greenberg
 
Protecting your organization against attacks via the build system
byLouis Jacomet
 
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security ...
byDenim Group
 
Security Patterns for Microservice Architectures - Oktane20
byMatt Raible
 
Security Patterns for Microservice Architectures - ADTMag Microservices & API...
byMatt Raible
 
Template_for_Presentation_PhD Visveswarya Scheme (1).pptx
bysinglesrihari
 
OpenStack Security Project
byTravis McPeak
 

More from Aysylu Greenberg

PDF
Zero Downtime Migrations at Scale
byAysylu Greenberg
 
PDF
Zero Downtime Migration
byAysylu Greenberg
 
PPTX
PWL Denver: Copysets
byAysylu Greenberg
 
PDF
Distributed systems in practice, in theory (ScaleConf Colombia)
byAysylu Greenberg
 
PDF
MesosCon Asia Keynote: Replacing a Jet Engine Mid-flight
byAysylu Greenberg
 
PDF
Distributed systems in practice, in theory (JAX London)
byAysylu Greenberg
 
PPTX
Building A Distributed Build System at Google Scale (StrangeLoop 2016)
byAysylu Greenberg
 
PDF
QCon NYC: Distributed systems in practice, in theory
byAysylu Greenberg
 
PDF
Building a Distributed Build System at Google Scale
byAysylu Greenberg
 
PDF
(+ Loom (years 2))
byAysylu Greenberg
 
PDF
Distributed systems in practice, in theory
byAysylu Greenberg
 
PDF
Probabilistic Accuracy Bounds @ Papers We Love SF
byAysylu Greenberg
 
PDF
Benchmarking (JAXLondon 2015)
byAysylu Greenberg
 
PPTX
Loom & Functional Graphs in Clojure @ LambdaConf 2015
byAysylu Greenberg
 
PDF
Benchmarking (DevNexus 2015)
byAysylu Greenberg
 
PDF
Benchmarking (RICON 2014)
byAysylu Greenberg
 
PDF
Benchmarking: You're Doing It Wrong (StrangeLoop 2014)
byAysylu Greenberg
 
PDF
PWL: One VM to Rule Them All
byAysylu Greenberg
 
PDF
Loom at Clojure/West
byAysylu Greenberg
 
PDF
Clojure class
byAysylu Greenberg
 
Zero Downtime Migrations at Scale
byAysylu Greenberg
 
Zero Downtime Migration
byAysylu Greenberg
 
PWL Denver: Copysets
byAysylu Greenberg
 
Distributed systems in practice, in theory (ScaleConf Colombia)
byAysylu Greenberg
 
MesosCon Asia Keynote: Replacing a Jet Engine Mid-flight
byAysylu Greenberg
 
Distributed systems in practice, in theory (JAX London)
byAysylu Greenberg
 
Building A Distributed Build System at Google Scale (StrangeLoop 2016)
byAysylu Greenberg
 
QCon NYC: Distributed systems in practice, in theory
byAysylu Greenberg
 
Building a Distributed Build System at Google Scale
byAysylu Greenberg
 
(+ Loom (years 2))
byAysylu Greenberg
 
Distributed systems in practice, in theory
byAysylu Greenberg
 
Probabilistic Accuracy Bounds @ Papers We Love SF
byAysylu Greenberg
 
Benchmarking (JAXLondon 2015)
byAysylu Greenberg
 
Loom & Functional Graphs in Clojure @ LambdaConf 2015
byAysylu Greenberg
 
Benchmarking (DevNexus 2015)
byAysylu Greenberg
 
Benchmarking (RICON 2014)
byAysylu Greenberg
 
Benchmarking: You're Doing It Wrong (StrangeLoop 2014)
byAysylu Greenberg
 
PWL: One VM to Rule Them All
byAysylu Greenberg
 
Loom at Clojure/West
byAysylu Greenberg
 
Clojure class
byAysylu Greenberg
 

Recently uploaded

PDF
How Fireworks AI Achieves 1TB_s+ Throughput for Model Deployment Across Multi...
byAlluxio, Inc.
 
PDF
828275126-INTUNE-Instructor-Handout-Part2.pdf
byamdusias67
 
PPTX
Instrumentation.Instrumentation.Instrumentation.pptx
byDavid Kurtz
 
PDF
Hack&Verse Kick-off and infor session Event ppt
bysanidhyasahu1120
 
PDF
A Complete Guide to Progressive Web App and Their Development
byMaxtra Technologies
 
PDF
Salesforce Careers in 2026_ Trends, Certifications, and Must-Have Skills
byDele Amefo
 
PDF
The Future of Microsoft Project Management Tools - Connecting Teams, Work, an...
byOnePlan Solutions
 
PDF
Postmates Clone App Delivery Service Business Solution.pdf
byV3CUBE TECHNOLABS
 
PPTX
Architectural Styles in Software Engineering
byM Munim
 
PPTX
Performance Engineering: New and Conflicting Trends
byAlexander Podelko
 
PPTX
Orion Context Broker introduction 20260114
byFermin Galan
 
PDF
Princeton RSE: What's new in Python π (3.14)
byHenry Schreiner
 
PDF
Cloud Automotive Software: Cost, Speed & Scalability
byShiv Technolabs Pvt. Ltd.
 
PPTX
NetworkMediaWireless (1).pptxunsnsndjdjdjjdnd
byre7022
 
PDF
Princeton 2026: Tools That Help You
 Write Better Code
byHenry Schreiner
 
PPTX
Business Central and Copilot pitch deck ppt
byjonbravetti
 
PDF
Shaping Your 2026 Testing Strategy | Applitools Product Pulse - January 2026
byApplitools
 
PPTX
Introduction to Software Development and Modern Practices
byM Munim
 
PDF
our environment ppt made by many people name rarang yadav
byrarang180
 
PDF
Cybernetic Global Intelligence Securing Businesses in a Digital-First World.pdf
byCybernetic Global Intelligence
 
How Fireworks AI Achieves 1TB_s+ Throughput for Model Deployment Across Multi...
byAlluxio, Inc.
 
828275126-INTUNE-Instructor-Handout-Part2.pdf
byamdusias67
 
Instrumentation.Instrumentation.Instrumentation.pptx
byDavid Kurtz
 
Hack&Verse Kick-off and infor session Event ppt
bysanidhyasahu1120
 
A Complete Guide to Progressive Web App and Their Development
byMaxtra Technologies
 
Salesforce Careers in 2026_ Trends, Certifications, and Must-Have Skills
byDele Amefo
 
The Future of Microsoft Project Management Tools - Connecting Teams, Work, an...
byOnePlan Solutions
 
Postmates Clone App Delivery Service Business Solution.pdf
byV3CUBE TECHNOLABS
 
Architectural Styles in Software Engineering
byM Munim
 
Performance Engineering: New and Conflicting Trends
byAlexander Podelko
 
Orion Context Broker introduction 20260114
byFermin Galan
 
Princeton RSE: What's new in Python π (3.14)
byHenry Schreiner
 
Cloud Automotive Software: Cost, Speed & Scalability
byShiv Technolabs Pvt. Ltd.
 
NetworkMediaWireless (1).pptxunsnsndjdjdjjdnd
byre7022
 
Princeton 2026: Tools That Help You
 Write Better Code
byHenry Schreiner
 
Business Central and Copilot pitch deck ppt
byjonbravetti
 
Shaping Your 2026 Testing Strategy | Applitools Product Pulse - January 2026
byApplitools
 
Introduction to Software Development and Modern Practices
byM Munim
 
our environment ppt made by many people name rarang yadav
byrarang180
 
Cybernetic Global Intelligence Securing Businesses in a Digital-First World.pdf
byCybernetic Global Intelligence
 

Binary Authorization in Kubernetes

  • 2.
    Aysylu Greenberg, Google LironLevin, Palo Alto Networks Binary Authorization in Kubernetes
  • 3.
    Who are we AysyluGreenberg Sr Software Engineer @ Google Eng Lead of open-source Grafeas and Kritis @aysylu22 Liron Levin Chief software architect @ Prisma Cloud Compute Grafeas and Kritis contributor
  • 4.
    Today ● Why weneed binary authorization
  • 5.
    Today ● Why weneed binary authorization ● Improve the security posture of your k8s cluster
  • 6.
    Today ● Why weneed binary authorization ● Improve the security posture of your k8s cluster ● Learn about exciting open source security technologies
  • 7.
    Today ● Why weneed binary authorization ● Improve the security posture of your k8s cluster ● Learn about exciting open source security technologies ● Have fun and see cool demos
  • 8.
  • 9.
    Software supply chain Build& Test (CI/CD) Code
  • 10.
    Software supply chain Build& Test (CI/CD) Code Deploy
  • 11.
  • 12.
    Software supply chain- reality ● Which images are deployed right now?
  • 13.
    Software supply chain- reality ● Which images are deployed right now? ● Did all deployed images pass required QA tests
  • 14.
    Software supply chain- reality ● Which images are deployed right now? ● Did all deployed images pass required QA tests ● Does vulnerability CVE-2017-5638 (Equifax, apache struts RCE) impact production images?
  • 15.
    Software supply chain Build& Test (CI/CD) Code Deploy
  • 16.
    Software supply chain Build& Test (CI/CD) Code DeployAuthorize
  • 17.
    Binary authorization -use cases ● Require images to be signed by trusted authorities: ○ QA ○ DevOps ○ Security tools https://github.com/grafeas/kritis/blob/master/docs/binary-authorization.md
  • 18.
    Binary authorization -use cases ● Require images to be signed by trusted authorities: ○ QA ○ DevOps ○ Security tools ● Require images to pass some restrictive security criteria (e.g., no critical severity unpatched vulnerabilities) https://github.com/grafeas/kritis/blob/master/docs/binary-authorization.md
  • 19.
    Binary authorization -use cases ● Require images to be signed by trusted authorities: ○ QA ○ DevOps ○ Security tools ● Require images to pass some restrictive security criteria (e.g., no critical severity unpatched vulnerabilities) ● Continuously monitor our inventory https://github.com/grafeas/kritis/blob/master/docs/binary-authorization.md
  • 20.
  • 21.
  • 22.
  • 23.
  • 24.
  • 25.
    Pod lifecycle ● Kritis- Admission controller for policy enforcement Kubernentes API Kritis Create a pod
  • 26.
    Pod lifecycle ● Kritis- Admission controller for policy enforcement Kubernentes API Validation webhook Kritis Create a pod Validate pod Admission webhooks receive admission requests and do something with them.
  • 27.
    Pod lifecycle ● Kritis- Admission controller for policy enforcement Kubernentes API Validation webhook Image security validator Kritis Create a pod Validate pod
  • 28.
    Pod lifecycle ● Kritis- Admission controller for policy enforcement Kubernentes API Validation webhook Image security validator Kritis Fetch policy (CRD) Create a pod Validate pod
  • 29.
    Pod lifecycle ● Kritis- Admission controller for policy enforcement Kubernentes API Validation webhook Image security validator Kritis Fetch policy (CRD) Create a pod Validate pod Kritis policy is a CRD.
  • 30.
    Example policy apiVersion: kritis.grafeas.io/v1beta1 kind:ImageSecurityPolicy metadata: name: my-isp namespace: default spec: attestationAuthorityNames: - kritis-authority imageAllowlist: - gcr.io/my/image packageVulnerabilityRequirements: maximumSeverity: HIGH # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL maximumFixUnavailableSeverity: ALLOW_ALL # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL allowlistCVEs: - providers/goog-vulnz/notes/CVE-2017-1000082 - providers/goog-vulnz/notes/CVE-2017-1000081
  • 31.
    Example policy apiVersion: kritis.grafeas.io/v1beta1 kind:ImageSecurityPolicy metadata: name: my-isp namespace: default spec: attestationAuthorityNames: - kritis-authority imageAllowlist: - gcr.io/my/image packageVulnerabilityRequirements: maximumSeverity: HIGH # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL maximumFixUnavailableSeverity: ALLOW_ALL # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL allowlistCVEs: - providers/goog-vulnz/notes/CVE-2017-1000082 - providers/goog-vulnz/notes/CVE-2017-1000081 The Custom Resource Definition. Supported values: ImageSecurityPolicy GenericAttestationPolicy
  • 32.
    Example policy apiVersion: kritis.grafeas.io/v1beta1 kind:ImageSecurityPolicy metadata: name: my-isp namespace: default spec: attestationAuthorityNames: - kritis-authority imageAllowlist: - gcr.io/my/image packageVulnerabilityRequirements: maximumSeverity: HIGH # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL maximumFixUnavailableSeverity: ALLOW_ALL # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL allowlistCVEs: - providers/goog-vulnz/notes/CVE-2017-1000082 - providers/goog-vulnz/notes/CVE-2017-1000081 Allow deploying images signed by ‘kritis-authority’ to allow previously admitted images be re-admitted on pod restart
  • 33.
    Example policy apiVersion: kritis.grafeas.io/v1beta1 kind:ImageSecurityPolicy metadata: name: my-isp namespace: default spec: attestationAuthorityNames: - kritis-authority imageAllowlist: - gcr.io/my/image packageVulnerabilityRequirements: maximumSeverity: HIGH # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL maximumFixUnavailableSeverity: ALLOW_ALL # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL allowlistCVEs: - providers/goog-vulnz/notes/CVE-2017-1000082 - providers/goog-vulnz/notes/CVE-2017-1000081 Allow specific external/infrastructure images
  • 34.
    Example policy apiVersion: kritis.grafeas.io/v1beta1 kind:ImageSecurityPolicy metadata: name: my-isp namespace: default spec: attestationAuthorityNames: - kritis-authority imageAllowlist: - gcr.io/my/image packageVulnerabilityRequirements: maximumSeverity: HIGH # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL maximumFixUnavailableSeverity: ALLOW_ALL # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL allowlistCVEs: - providers/goog-vulnz/notes/CVE-2017-1000082 - providers/goog-vulnz/notes/CVE-2017-1000081 Constraint on vulnerability: vuln severity <= policy severity
  • 35.
    Example policy apiVersion: kritis.grafeas.io/v1beta1 kind:ImageSecurityPolicy metadata: name: my-isp namespace: default spec: attestationAuthorityNames: - kritis-authority imageAllowlist: - gcr.io/my/image packageVulnerabilityRequirements: maximumSeverity: HIGH # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL maximumFixUnavailableSeverity: ALLOW_ALL # LOW|MEDIUM|HIGH|CRITICAL|BLOCK_ALL|ALLOW_ALL allowlistCVEs: - providers/goog-vulnz/notes/CVE-2017-1000082 - providers/goog-vulnz/notes/CVE-2017-1000081 Carefully whitelist specific vulnerabilities
  • 36.
    Pod lifecycle Kubernentes API Validation webhook Imagesecurity validator Kritis Fetch policy (CRD) Create a pod Validate pod
  • 37.
    Pod lifecycle Kubernentes API Validation webhook Imagesecurity validator Kritis Fetch policy (CRD) Create a pod Validate pod Grafeas
  • 38.
    Pod lifecycle Kubernentes API Validation webhook Imagesecurity validator Kritis Fetch policy (CRD) Create a pod Validate pod Grafeas Uniform way to audit your software supply chain
  • 39.
    Grafeas metadata store ●Notes - High level piece of metadata { "name" : "projects/provider_example/notes/test" , "shortDescription" : "A brief description of the note" , "longDescription" : "A longer description of the note" , "kind": "VULNERABILITY" , "vulnerability" : { "details": [ { "package": "libexempi3", "cpeUri": "cpe:/o:debian:debian_linux:7" , "minAffectedVersion" : { "name": "2.5.7", "revision": "1", "kind": "NORMAL" }, }] } }
  • 40.
    Grafeas metadata store { "name": "projects/provider_example/notes/test" , "shortDescription" : "A brief description of the note" , "longDescription" : "A longer description of the note" , "kind": "VULNERABILITY" , "vulnerability" : { "details": [ { "package": "libexempi3", "cpeUri": "cpe:/o:debian:debian_linux:7" , "minAffectedVersion" : { "name": "2.5.7", "revision": "1", "kind": "NORMAL" }, }] } } ● Notes - High level piece of metadata - Vulnerability: CVE description
  • 41.
    Grafeas metadata store { "name": "projects/provider_example/notes/test" , "shortDescription" : "A brief description of the note" , "longDescription" : "A longer description of the note" , "kind": "VULNERABILITY" , "vulnerability" : { "details": [ { "package": "libexempi3", "cpeUri": "cpe:/o:debian:debian_linux:7" , "minAffectedVersion" : { "name": "2.5.7", "revision": "1", "kind": "NORMAL" }, }] } } ● Notes - High level piece of metadata - Vulnerability: CVE description & details
  • 42.
    Grafeas metadata store { "name": "projects/provider_example/notes/test" , "shortDescription" : "A brief description of the note" , "longDescription" : "A longer description of the note" , "kind": "VULNERABILITY" , "vulnerability" : { "details": [ { "package": "libexempi3", "cpeUri": "cpe:/o:debian:debian_linux:7" , "minAffectedVersion" : { "name": "2.5.7", "revision": "1", "kind": "NORMAL" }, }] } } ● Notes - High level piece of metadata - Vulnerability: CVE description & details
  • 43.
    Grafeas metadata store { "name": "projects/image-signing/notes/product ion", "shortDescription":"Production image signer", "longDescription": "Production image signer", "kind": "ATTESTATION_AUTHORITY" , "attestationAuthority": { "hint": { "humanReadableName": "production" } } } ● Notes - High level piece of metadata - Vulnerability: CVE description & details - Attestation: attestation authority
  • 44.
    Grafeas metadata store { "name": "projects/provider_example/notes/test" , "shortDescription" : "A brief description of the note" , "longDescription" : "A longer description of the note" , "kind": "VULNERABILITY" , "vulnerability" : { "details": [ { "package": "libexempi3", "cpeUri": "cpe:/o:debian:debian_linux:7" , "minAffectedVersion" : { "name": "2.5.7", "revision": "1", "kind": "NORMAL" }, }] } } ● Notes - High level piece of metadata - Vulnerability: CVE description & details - Attestation: attestation authority - Deployment - Build history - And more!
  • 45.
    Grafeas metadata store ●Notes ● Occurrences - Instantiation of a note { "name": "projects/occurrence_example/occurrences/test", "resource": { "uri": "https://gcr.io/project/image@sha256:foo", }, "noteName": "projects/provider_example/notes/test", "kind": "VULNERABILITY", "vulnerability": { "packageIssue": [ { "affectedLocation": { "cpeUri": "7", "package": "a", "version": { "name": "v1.1.1", "kind": "NORMAL", "revision": "r" } }, "fixedLocation": { "cpeUri": "cpe:/o:debian:debian_linux:7", "package": "a", "version": { "name": "namestring", "kind": "NORMAL", "revision": "1" } } } ] } }
  • 46.
    Grafeas metadata store { "name":"projects/occurrence_example/occurrences/test", "resource": { "uri": "https://gcr.io/project/image@sha256:foo", }, "noteName": "projects/provider_example/notes/test", "kind": "VULNERABILITY", "vulnerability": { "packageIssue": [ { "affectedLocation": { "cpeUri": "7", "package": "a", "version": { "name": "v1.1.1", "kind": "NORMAL", "revision": "r" } }, "fixedLocation": { "cpeUri": "cpe:/o:debian:debian_linux:7", "package": "a", "version": { "name": "namestring", "kind": "NORMAL", "revision": "1" } } } ] } } ● Notes ● Occurrences - Instantiation of a note
  • 47.
    Grafeas metadata store { "name":"projects/occurrence_example/occurrences/test", "resource": { "uri": "https://gcr.io/project/image@sha256:foo", }, "noteName": "projects/provider_example/notes/test", "kind": "VULNERABILITY", "vulnerability": { "packageIssue": [ { "affectedLocation": { "cpeUri": "7", "package": "a", "version": { "name": "v1.1.1", "kind": "NORMAL", "revision": "r" } }, "fixedLocation": { "cpeUri": "cpe:/o:debian:debian_linux:7", "package": "a", "version": { "name": "namestring", "kind": "NORMAL", "revision": "1" } } } ] } } ● Notes ● Occurrences - Instantiation of a note
  • 48.
    Grafeas metadata store { "name":"projects/occurrence_example/occurrences/test", "resource": { "uri": "https://gcr.io/project/image@sha256:foo", }, "noteName": "projects/provider_example/notes/test", "kind": "VULNERABILITY", "vulnerability": { "packageIssue": [ { "affectedLocation": { "cpeUri": "7", "package": "a", "version": { "name": "v1.1.1", "kind": "NORMAL", "revision": "r" } }, "fixedLocation": { "cpeUri": "cpe:/o:debian:debian_linux:7", "package": "a", "version": { "name": "namestring", "kind": "NORMAL", "revision": "1" } } } ] } } ● Notes ● Occurrences - Instantiation of a note - Package where vulnerability was found
  • 49.
    Grafeas metadata store { "name":"projects/occurrence_example/occurrences/test", "resource": { "uri": "https://gcr.io/project/image@sha256:foo", }, "noteName": "projects/provider_example/notes/test", "kind": "VULNERABILITY", "vulnerability": { "packageIssue": [ { "affectedLocation": { "cpeUri": "7", "package": "a", "version": { "name": "v1.1.1", "kind": "NORMAL", "revision": "r" } }, "fixedLocation": { "cpeUri": "cpe:/o:debian:debian_linux:7", "package": "a", "version": { "name": "namestring", "kind": "NORMAL", "revision": "1" } } } ] } } ● Notes ● Occurrences - Instantiation of a note - Package where vulnerability was found - Remediation
  • 50.
    Pod lifecycle Kubernentes API Validation webhook Imagesecurity validator Kritis Fetch policy (CRD) Create a pod Validate pod Grafeas Image security validator Fetch metadata API
  • 51.
    Pod lifecycle Kubernentes API Validation webhook Imagesecurity validator Kritis Fetch policy (CRD) Create a pod Validate pod Grafeas Image security validator Fetch metadata API DB
  • 52.
    Pod lifecycle Kubernentes API Validation webhook Imagesecurity validator Kritis Fetch policy (CRD) Create a pod Validate pod Grafeas Image security validator Fetch metadata API DB Who pushes security data to Grafeas?
  • 53.
    Pod lifecycle Kubernentes API Validation webhook Imagesecurity validator Kritis Fetch policy (CRD) Create a pod Validate pod Grafeas Image security validator Fetch metadata API DB
  • 54.
  • 55.
  • 56.
    Roadmap ● Grafeas ○ Newmetadata kinds contributed by the community
  • 57.
    Roadmap ● Grafeas ○ Newmetadata kinds contributed by the community License Test StaticAnalysis InTotoLinkAttestation
  • 58.
    Roadmap ● Grafeas ○ Newmetadata kinds contributed by the community ○ Server v1.0
  • 59.
    Roadmap ● Grafeas ○ Newmetadata kinds contributed by the community ○ Server v1.0 ○ Move towards larger community ownership
  • 60.
    Roadmap ● Grafeas ○ Newmetadata kinds contributed by the community ○ Server v1.0 ○ Move towards larger community ownership ■ Designate client owners for each language
  • 61.
    Roadmap ● Grafeas ○ Newmetadata kinds contributed by the community ○ Server v1.0 ○ Move towards larger community ownership ■ Designate client owners for each language ■ Maintenance of the reference server v1.0
  • 62.
    Roadmap ● Grafeas ○ Newmetadata kinds contributed by the community ○ Server v1.0 ○ Move towards larger community ownership ● Kritis
  • 63.
    Roadmap ● Grafeas ○ Newmetadata kinds contributed by the community ○ Server v1.0 ○ Move towards larger community ownership ● Kritis ○ Production-ready, high-availability Kritis
  • 64.
    Roadmap ● Grafeas ○ Newmetadata kinds contributed by the community ○ Server v1.0 ○ Move towards larger community ownership ● Kritis ○ Production-ready, high-availability Kritis ○ Interoperability between BinAuthz and Kritis
  • 65.
    Roadmap ● Grafeas ○ Newmetadata kinds contributed by the community ○ Server v1.0 ○ Move towards larger community ownership ● Kritis ○ Production-ready, high-availability Kritis ○ Interoperability between BinAuthz and Kritis ○ More expressive policies based on stored metadata
  • 66.
    References ● Deploy standaloneKritis + Grafeas in GKE ● Grafeas: github.com/grafeas/grafeas ● Kritis github repo: github.com/grafeas/kritis ● Mailing lists @googlegroups.com: ○ grafeas-users ○ grafeas-dev ○ kritis-users ● @Grafeasio