preventing kubernetes misconfiguration: static matt johnson · 2020. 12. 9. · matt johnson...
TRANSCRIPT
![Page 1: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/1.jpg)
M att J o h n s o nD e v e l o p e r A d v o c a t e L e a d
Preventing Kubernetes Misconfiguration: Static Analysis and Beyond
![Page 2: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/2.jpg)
2
Misconfiguration challenges
Write policy as code
AGENDAAutomate in our CI Pipeline
Runtime analysis of k8 cluster
Helm chart analysis
![Page 3: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/3.jpg)
3
Matt Johnson
@Metahertzmetahertz
![Page 4: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/4.jpg)
4
As an engineerI want to move fast
![Page 5: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/5.jpg)
5
I DO NOTwant to break things
![Page 6: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/6.jpg)
6
The thing I have love/hate relationship with is…
![Page 7: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/7.jpg)
7
![Page 8: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/8.jpg)
8
![Page 9: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/9.jpg)
9
![Page 10: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/10.jpg)
10
![Page 11: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/11.jpg)
11
And this is where our story begins…
![Page 12: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/12.jpg)
12
![Page 13: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/13.jpg)
13
So let’s open our eyes and look at some…
![Page 14: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/14.jpg)
14
…data
![Page 15: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/15.jpg)
15
0 10 20 30 40 50 60 70
Ensure Kubernetes Clusters are configured with Labels
Ensure a client certificate is used by clients to authenticate to Kubernetes…
Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters
Ensure Network Policy is enabled on Kubernetes Engine Clusters
Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters…
Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters
Ensure 'Automatic node repair' is enabled for Kubernetes Clusters
Ensure Amazon EKS public endpoint disabled
Ensure Amazon EKS control plane logging enabled for all log types
Ensure EKS Cluster has Secrets Encryption Enabled
Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0
Top Failing Kubernetes checks
![Page 16: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/16.jpg)
16
Infrastructure as code (IaC) presents a new risk and a new opportunity
![Page 17: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/17.jpg)
17
![Page 18: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/18.jpg)
18
https://github.com/bridgecrewio/checkov
![Page 19: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/19.jpg)
19
• Released publicly in December 2019
• Apache 2.0 license• 50+ contributors• >800K downloads • >1400 stars• Written in Python
![Page 20: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/20.jpg)
20
Checkov statically analyzes for known best practices
implemented in IaCmanifests like k8s YAML
![Page 21: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/21.jpg)
21
• Version controlled• Peer reviewed• Can utilize inheritance and
have code reuse (python)• Part of SDLC• Continuous integration
Policy as code
![Page 22: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/22.jpg)
22
Policy as code
![Page 23: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/23.jpg)
23
Brace for live demo
![Page 24: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/24.jpg)
24
Destination Account
ChangeRequest
Infrastructure security tests
Deployment Trigger
Deploy/ Apply changes
1
2
3
4
![Page 25: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/25.jpg)
25
Brace for live demo
![Page 26: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/26.jpg)
26
![Page 27: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/27.jpg)
27
Another one!
![Page 28: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/28.jpg)
28
Keep your manifests secure
Monitor both Build-time and Runtime
Have a fast feedback loop on configuration changes
Runtime analysis of K8s cluster
Version control your policies
![Page 29: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/29.jpg)
29
Destination Account
ChangeRequest
Infrastructure security tests
Deployment Trigger
Deploy/ Apply changes1
2
3
Runtime Config Analysis
Notify
5
6
4
![Page 30: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/30.jpg)
30
Pre-commit Continuous Integration
RunningCluster
Misconfig Analysis
![Page 31: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/31.jpg)
31
Infrastructure is developed and secured in the same place
Issues are automatically prevented from being deployed
Security is a business enabler rather than a hindrance
A WORLD WHERE:
![Page 32: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/32.jpg)
32
Keep your Kubernetes manifests and Helm charts secure
Monitor both build-time and runtime
Have a fast feedback loop on configuration changesTAKEAWAYS
Version control your policies
![Page 33: Preventing Kubernetes Misconfiguration: Static Matt Johnson · 2020. 12. 9. · Matt Johnson Developer Advocate Lead Preventing Kubernetes Misconfiguration: Static Analysis and Beyond](https://reader036.vdocuments.site/reader036/viewer/2022071421/611b15581322bc2e817494de/html5/thumbnails/33.jpg)
33
Tr y C h e c k o v a n d j o i n o u r S l a c k s l a c k . b r i d g e c r ew. i o
C O N TA C T M E ma t t@b r i d g e c r ew. i o