Sofuware Supply Chain Management with Grafeas and Kritis Aysylu - PowerPoint PPT Presentation

Kritis: Admission Flow k8s Kritis 1. Admission WebHook kubectl Request apply 2. review Pod site.yaml Policies spec Image Security Validator ns:qa ns:prod ns:prod Image 3. Fetch Image Image Security Grafeas metadata Security Security Policy Policy Policy CRD CRD CRD vuln Pod Pod Pod Pod

A new vulnerability is found during scale up... CVE-2019-9919

Kritis: Admission Flow k8s Kritis 1. Admission WebHook kubectl Request apply 2. review Pod site.yaml Policies spec Image Security Validator ns:qa ns:prod ns:prod Image 3. Fetch Image Image Security Grafeas metadata Security Security Policy Policy Policy CRD CRD CRD CVE-2019-9919 vuln Pod Pod Pod Pod

Kritis atuestations to the rescue...

Kritis: Admission Flow k8s Kritis 1. Admission WebHook kubectl Request apply 2. review Pod site.yaml Policies spec Image Security Validator ns:qa ns:prod ns:prod Image 3. Fetch Image Image Security Grafeas metadata Security Security Policy Policy Policy CRD CRD CRD 4 b) admitted 4 b) admitted vuln Pod

Kritis: Admission Flow k8s Kritis 1. Admission WebHook kubectl Request apply 2. review Pod site.yaml Policies spec Image Security Validator ns:qa ns:prod ns:prod Image 3. Fetch Image Image Security Grafeas metadata Security Security Policy Policy Policy CRD CRD CRD 4 b) admitted 4 b) admitted Attestation Attestor Authority CRD vuln Pod

Kritis: Admission Flow k8s Kritis 1. Admission WebHook kubectl Request apply 2. review Pod site.yaml Policies spec Image Security Validator ns:qa ns:prod ns:prod Image 3. Fetch Image Image Security Grafeas metadata Security Security Policy Policy Policy CRD CRD CRD 5. Store attestations for admitted images 4 b) admitted 4 b) admitted Attestation Attestor Authority CRD vuln Pod

Kritis: Admission Flow k8s Kritis 1. Admission WebHook kubectl Request apply 2. review Pod site.yaml Policies spec Image Security Validator ns:qa ns:prod ns:prod Image 3. Fetch Image Image Security Grafeas metadata Security Security Policy Policy Policy CRD CRD CRD 5. Store attestations for admitted images 4 b) admitted 4 b) admitted Attestation Attestor Authority CRD attestation vuln Pod

Kritis: Admission Flow k8s Kritis 1. Admission WebHook kubectl Request apply 2. review Pod site.yaml Policies spec Image Security Validator ns:qa ns:prod ns:prod Image 3. Fetch Image Image Security Grafeas metadata Security Security Policy Policy Policy CRD CRD CRD 5. Store attestations for admitted images 4 b) admitted 4 b) admitted Attestation Attestor Authority CRD attestation vuln Pod Pod

Kritis: Admission Flow k8s CVE-2019-9919 Kritis 1. Admission WebHook kubectl Request apply 2. review Pod site.yaml Policies spec Image Security Validator ns:qa ns:prod ns:prod Image 3. Fetch Image Image Security Grafeas metadata Security Security Policy Policy Policy CRD CRD CRD 5. Store attestations for admitted images 4 b) admitted 4 b) admitted Attestation Attestor Authority CRD attestation vuln Pod Pod

Kritis: Admission Flow k8s CVE-2019-9919 Kritis 1. Admission WebHook kubectl Request apply 2. review Pod site.yaml Policies spec Image Security Validator ns:qa ns:prod ns:prod Image 3. Fetch Image Image Security Grafeas metadata Security Security Policy Policy Policy CRD CRD CRD 5. Store attestations for admitted images 4 b) admitted 4 b) admitted 6. Fetch Attestation Attestor Authority CRD attestations for admitted attestation image vuln Pod Pod

Kritis: Admission Flow k8s CVE-2019-9919 Kritis 1. Admission WebHook kubectl Request apply 2. review Pod site.yaml Policies spec Image Security Validator ns:qa ns:prod ns:prod Image 3. Fetch Image Image Security Grafeas metadata Security Security Policy Policy Policy CRD CRD CRD 5. Store attestations for admitted images 7. admitted 4 b) admitted 4 b) admitted 6. Fetch Attestation Attestor Authority CRD attestations for admitted attestation image vuln Pod Pod Pod Pod

Discovering new vulnerabilities in admitued containers ...

Kritis: Background Cron k8s Kritis 1. Admission WebHook kubectl Request apply 2. review Pod site.yaml Policies spec Image Security Validator ns:qa ns:prod ns:prod Image 3. Fetch Image Image Security Grafeas metadata Security Security Policy Policy Policy CRD CRD CRD 5. Store attestations for admitted images 7. admitted 4 b) admitted 4 b) admitted 6. Fetch Attestation Attestor Authority CRD attestations for admitted attestation image vuln Pod Pod Pod Pod

Kritis: Background Cron k8s Kritis 1. Admission Background WebHook kubectl Request Cron apply 2. review Pod site.yaml Policies spec Image Security Validator ns:qa ns:prod ns:prod Image 3. Fetch Image Image Security Grafeas metadata Security Security Policy Policy Policy CRD CRD CRD 5. Store attestations for admitted images 7. admitted 4 b) admitted 4 b) admitted 6. Fetch Attestation Attestor Authority CRD attestations for admitted attestation image vuln Pod Pod Pod Pod

Kritis: Background Cron k8s Kritis 1. Admission Background WebHook kubectl Request Cron apply 2. review Pod site.yaml Policies spec Image Security Validator ns:qa ns:prod ns:prod Image 3. Fetch Image Image Security Grafeas metadata Security Security Policy Policy Policy CRD CRD CRD 5. Store attestations for admitted images 7. admitted 4 b) admitted 4 b) admitted 6. Fetch Attestation Attestor Authority CRD attestations for admitted attestation image vuln Pod Pod Pod Pod

Kritis: Background Cron k8s Kritis 1. Admission Background WebHook kubectl Request Cron apply 2. review Pod site.yaml Policies spec Image Security Validator ns:qa ns:prod ns:prod Image 3. Fetch Image Image Security Grafeas metadata Security Security Policy Policy Policy CRD CRD CRD 5. Store attestations for admitted images 7. admitted 4 b) admitted 4 b) admitted 6. Fetch Attestation Attestor Authority CRD attestations for admitted attestation image vuln Pod Pod Pod Pod

Kritis Terminology ● Grafeas metadata API ○ Retrieve vulnerability data for images ○ Store and retrieve attestations

Kritis Terminology ● Grafeas metadata API ○ Retrieve vulnerability data for images ○ Store and retrieve attestations ● Custom Resource Definitions (CRDs) ○ Extension of k8s API ○ Used to store enforcement policies as k8s objects

Kritis Terminology ● Grafeas metadata API ○ Retrieve vulnerability data for images ○ Store and retrieve attestations ● Custom Resource Definitions (CRDs) ○ Extension of k8s API ○ Used to store enforcement policies as k8s objects ● Validating Admission Webhook ○ HTTP callbacks receive admission request: accept/reject to enforce custom admission policies

GenericAtuestationPolicy CRD apiVersion: kritis.grafeas.io/v1beta1 kind: GenericAttestationPolicy metadata: name: my-gap spec: attestationAuthorities: - my-attestor - deploy-attestor

AtuestationAuthority CRD apiVersion: kritis.grafeas.io/v1beta1 kind: AttestationAuthority metadata: name: my-attestor spec: privateKeySecretName: my-kubernetes-secret publicData: “-----BEGIN PGP PUBLIC KEY BLOCK----- mQENBFvJLhwBCADCiNJAJkFUwYrH=vmny ... -----END PGP PUBLIC KEY BLOCK-----” noteReference: v1beta1/projects/my-project

ImageSecurityPolicy CRD apiVersion: kritis.grafeas.io/v1beta1 kind: ImageSecurityPolicy metadata: name: my-isp spec: imageWhitelist: - gcr.io/kritis-int-test/nginx-digest-whitelist:latest packageVulnerabilityRequirements: maximumSeverity: MEDIUM whitelistCVEs: - providers/goog-vulnz/notes/CVE-2017-1000082 - providers/goog-vulnz/notes/CVE-2017-1000081

Kritis Open source , built with the community Plugs into the k8s admission controller Ensure vulnerability scanning before deployment Attest images and verify before deployment Apply consistent deploy policy across k8s github.com/grafeas/kritis environments kritis-users@googlegroups.com

In This Talk 1 2 3 4 Kritis & Software Grafeas Kritis Grafeas 0.1.0 Supply Chain Management

In This Talk 1 2 3 4 Kritis & Software Grafeas Kritis Grafeas 0.1.0 Supply Chain Management

Grafeas Write code Code Checkin Build Image Test & Verifjcation QA github.com/grafeas/grafeas Deploy to Production

Grafeas: Aruifact Metadata API

Grafeas: Aruifact Metadata API = images, binaries, packages...

Grafeas: Aruifact Metadata API = build, deployment, vulnerability, ...

Grafeas: Aruifact Metadata API = store & retrieve metadata about artifacts

Grafeas: Terminology ● Notes: high-level description of types of metadata ○ e.g. Common Vulnerabilities and Exposures (CVE) as Vulnerability Note

Grafeas: Terminology ● Notes: high-level description of types of metadata ○ e.g. Common Vulnerabilities and Exposures (CVE) as Vulnerability Note ● Occurrences: instance of note in an artifact ○ e.g. CVE presence in an image

Grafeas: Terminology ● Notes: high-level description of types of metadata ○ e.g. Common Vulnerabilities and Exposures (CVE) as Vulnerability Note ● Occurrences: instance of note in an artifact ○ e.g. CVE presence in an image ● Providers and Consumers

Grafeas: Terminology ● Notes: high-level description of types of metadata ○ e.g. Common Vulnerabilities and Exposures (CVE) as Vulnerability Note ● Occurrences: instance of note in an artifact ○ e.g. CVE presence in an image ● Providers and Consumers

Grafeas: Providers and Consumers Grafeas

Grafeas: Providers and Consumers Vulnerability Scanning Grafeas

Grafeas: Providers and Consumers Vulnerability Scanning Store vulnerability Notes (CVEs) Grafeas

Grafeas: Providers and Consumers Vulnerability Scanning Store Store vulnerability vulnerability Notes (CVEs) Ocurrences for containers Grafeas

Grafeas: Providers and Consumers Vulnerability Kritis Scanning Store Store vulnerability vulnerability Notes (CVEs) Ocurrences for containers Grafeas

Grafeas: Providers and Consumers Vulnerability Kritis Scanning Store Store vulnerability vulnerability Read vulnerability Notes (CVEs) Ocurrences for Occurrences for containers container Grafeas

Grafeas: Terminology (cont'd) ● Resource URL: identifier for artifact in Occurrence

Grafeas: Terminology (cont'd) ● Resource URL: identifier for artifact in Occurrence

Grafeas: Terminology (cont'd) ● Resource URL: identifier for artifact in Occurrence ● Kind specific schemas

Grafeas: Deployment Note // An artifact that can be deployed in some runtime. message DeploymentNote { // Required. Resource URI for the artifact being deployed. repeated string resource_uri = 1; }