Moby SIG Orchestration Security Summit Presentation
•
1 like•1,128 views
My talk at the Moby SIG Orchestration Security Summit Presentation. https://diogomonica.com
![[SIG] Orchestration Security 🔒
@diogomonica](https://image.slidesharecdn.com/sigorchestrationsecurity-170619201711/85/Moby-SIG-Orchestration-Security-Summit-Presentation-1-320.jpg)
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Moby SIG Orchestration Security Summit Presentation
Similar to Moby SIG Orchestration Security Summit Presentation (20)
More from Diogo Mónica
More from Diogo Mónica (12)
Recently uploaded
Recently uploaded (20)
Moby SIG Orchestration Security Summit Presentation
- 1. [SIG] Orchestration Security 🔒 @diogomonica
- 2. Current Initiatives 1.External Secrets 2.Service Identities 3.Entitlements
- 4. Secure Node Introduction swarmKit SWMTKN-1-mx8suomaom825bet6-cm6zts22rl4hly2 Known Prefix Token Version Hash of Root CA Random Secret
- 7. Worker Manager Raft Store Worker Manager Raft Store Worker Manager Raft Store swarmKit Least-privilege Secret Distribution
- 8. Transparent Root Rotation swarmKit Worker Worker Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Add Remove Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Renew 1 2 34
- 9. Transparent Root Rotation swarmKit Worker Worker Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Add Remove Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Renew 1 2 34
- 10. Transparent Root Rotation swarmKit Worker Worker Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Add Remove Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Renew 1 2 34
- 11. Transparent Root Rotation swarmKit Worker Worker Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Add Remove Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Renew 1 2 34
- 12. External Secrets
- 13. External Store Worker Manager Raft Store Swarm Plugin Secrets stored in Raft by default
- 14. Dynamic generation of secrets External Store Worker Manager Raft Store Swarm Plugin
- 15. Secure last-mile delivery of secrets External Store Worker Manager Raft Store Swarm Plugin
- 18. One Node, One ID
- 19. One App Instance, One ID
- 20. Every service call is authorized and authenticated CN=api01 OU=web-api O=production CN=db01 OU=credit-card-db O=production
- 21. mTLS Nginx ClientHello ServerHello Certificate Client Cert Req ServerHello Done Certificate Cert Verify Nginx
- 22. mTLS - the good 1.Key-material stays secret 2.Supported everywhere 3.Authentication and Encryption
- 23. mTLS - the bad 1.A LOT of certs 2.Confusing for developers 3.No good revocation story 4.Running a PKI is hard 5.Unforgiving
- 24. Least-privilege resource access [ { "permission": { "method": "GET", "resource": "/user" }, "allow": ["web", "fulfillment", "payments"] }, { "permission": { "method": "POST", "resource": "/user" }, "allow": ["signup", "web"] }, { "permission": { "method": "DELETE", "resource": "/user/.*" }, "allow": ["web"] }]
- 26. Entitlements
- 28. • Namespace Isolation • Cgroups runC PID Namespaces MNT IPC NET Cgroups … CPU BLKIO MEM PIDS …
- 30. Seccomp-bpf runC Debian Alpine { "defaultAction": "SCMP_ACT_ERRNO", "architectures": [ "SCMP_ARCH_X86_64", ], "syscalls": [ { "name": "accept", "action": "SCMP_ACT_ALLOW", "args": [] }, { "name": "accept4", "action": "SCMP_ACT_ALLOW", "args": [] }, ... ] }
- 31. A better way Debian Alpine libentitlement is designed to be a library managing container security profiles. It provides a way to register specific grants that add or remove constraints on those profiles. https://github.com/docker/libentitlement
- 32. Future Initiatives 1.Service Mesh 2.Untrusted Managers
- 33. Join us! 1.#orchestration-sec on Slack 2.Monday meetings 10am PST