Hardening Your CI/CD Pipelines with GitOps and Continuous Security
•
2 likes•417 views
Join us for a webinar on how to secure your CI/CD pipeline for Kubernetes with GitOps best practices and continuous runtime protection. As modern developers and DevOps teams are embarking on a quest for speed and reliability through automated CI/CD pipelines for Kubernetes, enterprises still need to ensure security and regulatory compliance. Together with Deepfence, the Weaveworks team will explain and demonstrate how GitOps continuous delivery pipelines, combined with continuous security observability, improves the overall security of your development workflow - from Git to production. In this webinar we will demonstrate: Deepfence container scanning Git-to-Kubernetes using FluxCD Deepfence continuous runtime security
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Hardening Your CI/CD Pipelines with GitOps and Continuous Security
Similar to Hardening Your CI/CD Pipelines with GitOps and Continuous Security (20)
More from Weaveworks
More from Weaveworks (20)
Recently uploaded
Recently uploaded (20)
Hardening Your CI/CD Pipelines with GitOps and Continuous Security
- 1. Hardening Your CI/CD Pipelines with GitOps and Continuous Security Owen Garrett, Deepfence Matt Kryshak, Deepfence Richard Case, Weaveworks May, 2021
- 2. Webinar Platform - FAQs Using Zoom Questions? • You are in listen only mode • Q&A session will follow the presentation, please use the Q&A panel to submit questions • Hit escape to exit full screen Technical Issues - please visit Zoom Help https://support.zoom.us/hc/en-us/articles/206175806-Top-Questions
- 3. 3 Speaker Introduction Owen Garrett, Head of Product and Community, Deepfence Owen joined Deepfence in May 2021, having previously managed the NGINX open source project and NGINX’s microservices and Kubernetes-centric solutions. During his time at NGINX, the NGINX open source project rose from relative obscurity to become the most widely-deployed of any webserver in the world. Owen is fascinated by the application of technology, particularly microservices and Kubernetes, and is determined to assist developers to build safe and secure applications. Twitter: @owengarrett Richard Case, Tech Lead / Solution Architect, Weaveworks Richard is tech lead for Kubernetes on Baremetal at Weaveworks. Previously he worked in customer success and helped to design and build GitOps/Cloud Native solutions for Weaveworks customers. Richard is also a maintainer of Cluster API Provider AWS. Twitter: @fruit_case
- 5. 5 GitOps is... An operation model
- 6. 6 GitOps is... An operation model Derived from CS and operational knowledge
- 7. 7 GitOps is... An operation model Derived from CS and operational knowledge Technology agnostic (name notwithstanding)
- 8. 8 GitOps is... An operation model Derived from CS and operational knowledge Technology agnostic (name notwithstanding) A set of principles (Why instead of How)
- 9. 9 GitOps is... An operation model Derived from CS and operational knowledge Technology agnostic (name notwithstanding) A set of principles (Why instead of How) Although Weaveworks can help with how
- 11. 11 GitOps is... An operation model Derived from CS and operational knowledge Technology agnostic (name notwithstanding) A set of principles (Why instead of How) A way to speed up your team
- 13. 13 GitOps ON Kubernetes Kubectl / Direct access Kubernetes Cluster
- 15. 15 GitOps ON Kubernetes Image Repository 1 The entire system is described declaratively.
- 16. 16 GitOps ON Kubernetes Image Repository 2 The desired system state is versioned
- 17. 17 GitOps ON Kubernetes Image Repository 3 Approved changes to the desired state are automatically applied to the system
- 18. 18 GitOps ON Kubernetes Image Repository 4 Software agents ensure correctness and alert on divergence
- 19. 19 GitOps ON Kubernetes Security Boundary In-cluster / pull based
- 20. The entire system is described declaratively The canonical desired system state is versioned in git Approved changes can be automatically applied to the system Software agents ensure correctness and alert (diffs & actions) 20 Principles of GitOps Operate an agile cloud native platform with GitOps
- 21. GitOps – An Operating Model for Cloud Native Provides Separation of Concerns between the Development process and the Deployment process Transparency and Auditability at All Levels is Automatic Authentication & Authorization Isolated Between Concerns Risk Reduction: Complete Application Rollback and Logging 21 Deployment (clusters, apps) Monitoring Logging (Observability) Management (operations) Git Build GIT Test IDE “Immutability Firewall” Kubernetes GitOps Continuous Integration
- 22. Secured Deployment with GitOps
- 23. Typical CICD pipeline Continuous Integration Kubernetes Continuous Delivery/Deployment Container Registry CI Code Repo Dev RW CI creds Git creds RW CR creds3 RO RW API creds CR creds1 Shares credentials cross several logical security boundaries. Boundary RO RW CR creds2
- 24. Kubernetes GitOps pipeline Container Registry CI Code Repo Dev RO CR creds2 CI creds Git creds RO Deploy CR creds3 RO RO Config repo creds CR creds1 Credentials are never shared across a logical security boundary. RW RW RW Canonical desired state store Config Repo
- 25. Kubernetes GitOps pipeline Container Registry CI Code Repo Dev RO CR creds2 CI creds Git creds RO Deploy CR creds3 RO RO Config repo creds CR creds1 Credentials are never shared across a logical security boundary. RW RW RW Operator RW Config Repo
- 26. Operator Kubernetes GitOps pipeline Container Registry CI Code Repo Dev RO CR creds2 CI creds Git creds RO Deploy CR creds3 RO RO Config repo creds CR creds1 Credentials are never shared across a logical security boundary. RW RW RW RW Config Repo Process & constraints enforcement
- 27. Operator Kubernetes GitOps pipeline Container Registry CI Code Repo Dev RO CR creds2 CI creds Git creds RO Deploy CR creds3 RO RW Config repo creds CR creds1 Credentials are never shared across a logical security boundary. RW RW RW RW Config Repo Exceptional auditing and attribution*
- 28. Operator Kubernetes GitOps pipeline Container Registry CI Code Repo Dev Deploy Various points to integrate extra security measures. Config Repo ← Image and code scanning → Artifact scanning (conftest, kube-sec) Policy enforcement (OPA, Kyverno) Runtime scanning (continuous)
- 30. Copyright 2021 Deepfence, Inc. Copyright 2021 Deepfence, Inc. The apps we build are deeply interconnected 528 open-source components (2020 average) The typical commercially-developed application uses 528 open-source components. This includes direct and indirect dependencies. Source: Synopsis OSSRA Report 2021 > 10% # of open-source components with known vulnerabilities 10.4% of Java components from Maven Repository had at least one known vulnerability. Almost 40% of npm packages rely on code known to be vulnerable. Source: Sonatype 2020, University of Darmstadt 2019 Equifax Undetected Apache Struts vulnerability led to the leak of 143m customer details. $1.4bn – cost to remediate security. Capital One Misconfiguration of ModSecurity enabled an anomalous request flow. 106m customer details leaked. British Airways Hack of third-party javascript led to 380,000 stolen payment card records. $257m fine (reduced to $26m on appeal) npm left-pad: When an unregarded, 11-line module with 10 GH stars was removed from npm, the blast radius was huge. Medium Direct and Transitive Dependencies per repo Source: GitHub State of the Octoverse 2020 Direct Dependencies Transitive Dependencies PHP 9 70 JavaScript 10 683 Python 9 19 Ruby 9 68 PHP 9 70
- 31. Copyright 2021 Deepfence, Inc. Copyright 2021 Deepfence, Inc. Vulnerabilities lie undetected for 4 years (average) GitHub 2020 Octoverse Report: On average, vulnerabilities in open-source software lie undetected for over 4 years. Once alerted, it takes 4.4 weeks to find a fix and 10 weeks to publish. Sonatype 2020 State of the Software Supply Chain 49% of organizations remediate an OSS dependency vulnerability within 1 week. Source: The 2020 State of the Octoverse, GitHub, Inc. The full lifecycle of a Vulnerability (GitHub) Applications contain a timebomb of to-be-announced vulnerabilities, and security teams need to be ready to move fast!
- 32. Deepfence provides a full-lifecycle security solution. It observes and secures your application from development to production.
- 33. Copyright 2021 Deepfence, Inc. Copyright 2021 Deepfence, Inc. Continuous Integration Dev Commit Build Test Push to Repo Continuous Delivery Devops Review Deploy Production Prod 2 DR 1 Staging Prod 1 Users Insert Security all stages of the lifecycle Lightweight DF agents Operations Ops Monitor Logs Deepfence Management Console
- 34. Let’s see Flux and Deepfence in action..
- 35. Copyright 2021 Deepfence, Inc. Copyright 2021 Deepfence, Inc. Once in production, Deepfence’s security monitoring takes over 1. Audits containers and hosts to detect file system, process and network related misconfigurations 2. Performs detailed inspection of network traffic, system and application behavior, and correlates suspicious events 3. Supports manual triage or automated quarantine of tainted workloads
- 36. Runtime Threat and Anomaly Scanning
- 37. Questions?
- 38. Thank you!