GitLab Commit: Enhance your Compliance with Policy-Based CI/CD

•

0 likes•610 views

Whether you want to get started with Governance or improve your current process, this talk will show you how to improve your compliance by implementing policy-based CI/CD (Continuous Integration / Continuous Delivery) with GitLab CI and Open Policy Agent. Philippe and Nico will tell you all the details about Open Policy Agent and how you can easily integrate it into your existing CI/CD pipelines. Join our session to learn how to improve compliance, from gating your dependencies to controlling your infrastructure.

Technology

1
#GitLabCommit
Enhance Your Compliance and Governance With Policy-Based CI/CD

2
#GitLabCommit
Philippe Lafoucrière
Nico Meisenzahl
Senior Cloud & DevOps Consultant
white duck
@nico-meisenzahl
@nmeisenzahl
Distinguished Security Engineer
GitLab
@plafoucriere
@plafoucriere

4
#GitLabCommit
Agenda
● Why do we need compliance and governance in CI/CD?
● What is Open Policy Agent and how does it work?
● How to get started – some examples

5
#GitLabCommit
Why do we need compliance
and governance in CI/CD?

6
#GitLabCommit
What is Compliance?
“Adherence to standards, regulations, and other requirements”
(wikipedia)

7
#GitLabCommit
Types of Software compliance
● Statutory/Regulatory compliance: comply with
relevant laws, policies, and regulations.
● Standards: adhere to established and standard
requirements
● Contractual obligations: Vendor agreements,
customers contracts, ...
● Corporate: Set of rules and policies defined by the
company to comply with the needs of HR, Security,
Communication, ...

8
#GitLabCommit
Compliance frameworks
Regulatory Compliance
Frameworks are mandatory for
some industries.
Source: GitLab current Security Certifications and Attestations

9
#GitLabCommit
The way to Compliance
You can do all of these without
Compliance, but doing
Compliance without them will
turn out to be extremely hard.
They are intimately tied together.
Automation
Testing
Quality
Compliance

10
#GitLabCommit
Compliance and Governance in CI/CD?
- Define the “how” around the “what” of the pipelines
- Security and Compliance gates
- Ensure the requirements are always met, during all
the lifecycle of the project
- Iteration is key (start small!)
- OPA to the rescue

11
#GitLabCommit
What is Open Policy Agent
and how does it work?

12
#GitLabCommit
Open Policy Agent (OPA)
“policy-based control for cloud native environments”
● general-purpose policy engine across your stack
● graduated CNCF project introduced by styra
● declarative policy language
● decoupled the application logic from policy decisions
○ REST API with sidecar or daemon
○ golang library
○ Wasm module
● provides APIs for easy management

14
#GitLabCommit
Ecosystem
● API and service authorization with Envoy, Kong, Traefik and others
● authorization policies for SQL, Kafka and others
● container network authorization with Istio and Linkerd
● test policies for Terraform infrastructure changes
● policies for SSH and sudo
● policy and Governance for Kubernetes
● and many more
○ https://www.openpolicyagent.org/docs/latest/ecosystem

17
#GitLabCommit
Rego
● “ray-go”
● declarative Policy Language
○ ”is Nico allowed to POST a payload to /api”
● rules commonly return true/false
○ but may return any
● 140+ build-in functions
○ date/time, string, ...
○ Regex
○ JWT validation
○ ...

19
#GitLabCommit
How to get started?
● OPA playground
○ https://play.openpolicyagent.org
● docs
○ https://www.openpolicyagent.org/docs
● OPA CLI
○ opa run
○ opa test
○ opa eval

20
#GitLabCommit
How to get started – some
examples

21
#GitLabCommit
Demo: Policy-Based CI/CD with OPA
● Infrastructure-As-Code change validation (Terraform)
○ https://gitlab.com/nico-meisenzahl/terraform-opa-policy-demo
● GitLab project validation
○ https://gitlab.com/gitlab-com/gl-security/engineering-and-rese
arch/inventory-example/-/merge_requests/7

22
#GitLabCommit
Further examples
● Kubernetes manifest validation
● Allow/Deny Lists for library dependencies
● Docker Authorization
● Envoy Authorization
● And more

23
#GitLabCommit
Philippe Lafoucrière
Nico Meisenzahl
Senior Cloud & DevOps Consultant
white duck
@nico-meisenzahl
@nmeisenzahl
Distinguished Security Engineer
GitLab
@plafoucriere
@plafoucriere

What's hot

GitOps w/argocd

Jean-Philippe Bélanger

Watch the recording here: https://youtu.be/0KmqEp4VxSQ Welcome Helm users! CNCF Flux has a best-in-class way to use Helm according to GitOps principles. For you, that means improved security, reliability, and velocity - no more being on the pager on the weekends or having painful troubleshooting or rollback when things go wrong. Built on Kubernetes controller-runtime, Flux’s Helm Controller is an example of a mature software agent that uses Helm’s SDK to full effect. Flux’s biggest addition to Helm is a structured declaration layer for your releases that automatically gets reconciled to your cluster based on your configured rules: ⭐️ The Helm client commands let you imperatively do things ⭐️ Flux Helm Custom Resources let you declare what you want the Helm SDK to do automatically During this session, Scott Rigby, Developer Experience Engineer at Weaveworks and Flux & Helm Maintainer, will take you on a tour of Flux’s Helm Controller, share the additional benefits Flux adds to Helm and then walk through a live demo of how to manage helm releases using Flux. If you want to follow along with Scott’s demo, here are a couple of resources to help you prepare ahead of time: 📄 Flux for Helm Users Docs: https://fluxcd.io/docs/use-cases/helm/ 📄 Flux Guide: Manage Helm Releases: https://fluxcd.io/docs/guides/helmreleases/ Speaker Bio: Scott is a Brooklyn based interdisciplinary artist and Developer Advocate at Weaveworks. He co-founded the Basekamp art and research group in 1998 and the massively collaborative Plausible Artworlds international network. In technology he enjoys helping develop open source software that anyone can use, most recently projects in the cloud native landscape including co-maintaining Helm and Flux. In daily decisions, large or small, he tries to help make the world a better place for everyone.

GitOps for Helm Users by Scott Rigby

Weaveworks

Terraform 101

Haggai Philip Zagury

Platform Engineering

Opsta

Kubernetes GitOps featuring GitHub, Kustomize and ArgoCD

Sunnyvale

Artifactory Essentials Workshop on August 27, 2020 by JFrog

Cloud Study Network

GitOps - Operation By Pull Request

Kasper Nissen

Writing the Container Network Interface(CNI) plugin in golang

HungWei Chiu

Finesta ci 360 project year 1 cm strategy presentation

Courtney Schultz

GitOps is the best modern practice for CD with Kubernetes

Volodymyr Shynkar

For this info-packed and hands-on workshop we cover: 📍 Introduction to Kubernetes & GitOps talk: We cover the most popular path that has brought success to many users already - GitOps as a natural evolution of Kubernetes. We'll give an overview of how you can benefit from Kubernetes and GitOps: greater security, reliability, velocity and more. Importantly, we cover definitions and principles standardized by the CNCF's OpenGitOps group and what it means for you. 📍 Get Started with GitOps: You'll have GitOps up and running in about 30 mins using our free and open source tools! We'll give a brief vision of where you want to be with those security, reliability, and velocity benefits, and then we'll support you while go through the getting started steps. During the workshop, you'll also experience in action and see demos for: - an opinionated repo structure to minimize decision fatigue - disaster recovery using GitOps - Helm charts example - Multi-cluster example - all with free and open source tools mostly in the CNCF (eg. Flux and Helm). If you have questions before or after the workshop, talk to us at #weave-gitops http://bit.ly/WeaveGitOpsSlack (If you need to invite yourself to the Slack, visit https://slack.weave.works/)

Intro to Kubernetes & GitOps Workshop

Weaveworks

Although not an entirely new concept, Platform Engineering and Internal Developer Platforms (IDPs) are all the rage due to their potential to increase development velocity and deployment frequency while boosting reliability and security. Join Joe Dahlquist, VP of PMM and Mohamed Ahmed, VP of Developer Platforms at Weaveworks to learn the 6 tell-tale signs your company should implement a platform engineering approach. The webinar draws on hundreds of conversations with SRE’s, developers, and platform engineering teams to help you better understand what works, what doesn’t and what might be missing from your strategy. Attendees can apply these learnings to their first (or next) developer platform regardless of your build vs. buy journey. You will learn: * The difference between Internal Developer Platforms and Platform Engineering * Why platform engineering now? * How Dev and Ops benefit from an IDP * 6 tell-tale signs to start platform engineering * Drafting your platform engineering strategy - where to begin and what to avoid

Six Signs You Need Platform Engineering

Weaveworks

Termo de Abertura e Declaração de Escopo – Conteudo e Diferenças

Ricardo Viana Vargas

GitOps 101 Presentation.pdf

ssuser31375f

Presented at Kubernetes and Cloud Native meetup in Toronto on December 4, 2019 See https://www.youtube.com/watch?v=YmIAatr3Who for a video recording of a similar talk. Are you looking to get more flexibility out of your CICD platform? Interested how GitOps fits into the mix? Learn how Argo CD, Workflows, and Events can be combined to craft custom CICD flows. All while staying Kubernetes native, enabling you to leverage existing observability tooling.

A GitOps Kubernetes Native CICD Solution with Argo Events, Workflows, and CD

Julian Mazzitelli

DevOps topologies

Sushma

Kubermatic CNCF Webinar - start.kubermatic.pdf

LibbySchulze

Engineering tomorrow’s products means keeping ahead and staying relevant in a constantly and rapidly changing environment. A core characteristic of regulated environments is the necessity to comply with formal standards, regulations, directives and guidance. Organizations must demonstrate that their system meets its intended purpose and has no unintended consequences that might cause harm. They must also develop the objective evidence required to prove that the system conforms to regulatory standards. The Scaled Agile Framework (SAFe®) addresses the conceptual and process incompatibilities between systems and software. By selecting the right ‘hooks’ in the Scaled Agile Framework, you can achieve high maturity levels for various reference models (Automotive Spice, CMMI, etc.). In this webinar, we will highlight how to ensure compliance when implementing SAFe in regulated industries and present a recent case study in the Automotive industry. In this webinar, we will: · Explore how compliance can be achieved, maintained and proven to regulators. · Introduce the concepts and practices of Applied SAFe. · Share a case study for Automotive SPICE 3.0 If you wish to combine agility and efficiency together with compliance to regulatory requirements (both specific reference models, such as SPICE 3.0, as well as your own organization’s reference models), this webinar is well worth your time.

Scaling Agile in Regulated Environments: Addressing the Challenges of Complia...

Cprime

GitOps with Gitkube

Tirumarai Selvan

Cilium is open source software for providing and transparently securing network connectivity and load balancing between application workloads such as application containers or processes. Cilium operates at Layer 3/4 to provide traditional networking and security services as well as Layer 7 to protect and secure use of modern application protocols such as HTTP, gRPC and Kafka. The foundation of Cilium is the new Linux kernel technology BPF which supports the dynamic insertion of BPF bytecode into the Linux kernel at various integration points. This presentation reveals the secrets of Kubernetes networking and gives you a deep dive into Cilium and why it is awesome!

Kubernetes Networking with Cilium - Deep Dive

Michal Rostecki

What's hot (20)

GitOps w/argocd

GitOps for Helm Users by Scott Rigby

Terraform 101

Platform Engineering

Kubernetes GitOps featuring GitHub, Kustomize and ArgoCD

Artifactory Essentials Workshop on August 27, 2020 by JFrog

GitOps - Operation By Pull Request

Writing the Container Network Interface(CNI) plugin in golang

Finesta ci 360 project year 1 cm strategy presentation

GitOps is the best modern practice for CD with Kubernetes

Intro to Kubernetes & GitOps Workshop

Six Signs You Need Platform Engineering

Termo de Abertura e Declaração de Escopo – Conteudo e Diferenças

GitOps 101 Presentation.pdf

A GitOps Kubernetes Native CICD Solution with Argo Events, Workflows, and CD

DevOps topologies

Kubermatic CNCF Webinar - start.kubermatic.pdf

Scaling Agile in Regulated Environments: Addressing the Challenges of Complia...

GitOps with Gitkube

Kubernetes Networking with Cilium - Deep Dive

Similar to GitLab Commit: Enhance your Compliance with Policy-Based CI/CD

Travelio Tech Talks 2022 presentation The recommended workflow for implementing GitOps with Kubernetes manifests is known as trunk-based development. This method defines one branch as the "trunk" and carries out development on each environment in a different short-lived branch. When development is complete for that environment, the developer creates a pull request for the branch to the trunk. Developers can also create a fork to work on an environment, and then create a branch to merge the fork into the trunk. Once the proper approvals are done, the pull request (or the branch from the fork) gets merged into the trunk. The branch for that feature is deleted, keeping your branches to a minimum. Trunk-based development trades branches for directories. You can think of the trunk as a "main" or primary branch. production and prod are popular names for the trunk branch. Trunk-based development came about to enable continuous integration and continuous delivery by supplying a development model focused on the fast delivery of changes to applications. But this model also works for GitOps repositories because it keeps things simple and more in tune with how Kustomize and Helm work. When you record deltas between environments, you can clearly see what changes will be merged into the trunk. You won’t have to cherry-pick nearly as often, and you’ll have the confidence that what is in your Git repository is what is actually going into your environment. This is what you want in a GitOps workflow.

Understanding the GitOps Workflow and CICD Pipeline - What It Is, Why It Matt...

Gibran Badrulzaman

More and more businesses are requiring developers to own end to end delivery, including operational ownership. Weaveworks will share with you what GitOps means, and how easy it is to create cloud native applications, CICD pipelines, integrate operations and more, using GitOps. Inherited from best practices going back 10-15 years, cloud native is making these practices more relevant today. At Weaveworks, they implement these principles in their product, Weave Cloud. This not only helps customers ship apps faster, it also helps them run their own cloud native stack. This presentation will show how Weaveworks does this, identify best practices and tools, and showcase some of Weaveworks’ use cases. For the video of this presentation at Cloud Native London visit: https://skillsmatter.com/skillscasts/10506-keynote-by-alexis-richardson To learn more about Weaveworks: www.weave.works

Cloud Native Apps with GitOps

Weaveworks

GitOps è un nuovo metodo di CD che utilizza Git come unica fonte di verità per le applicazioni e per l'infrastruttura (declarative infrastructure / infrastructure as code), fornendo sia il controllo delle revisioni che il controllo delle modifiche. In questo talk vedremo i concetti alla base di CI/CD, ovvero Continuous Integration e Continuous Deployment (o anche Continuous Delivery), pratiche nello sviluppo software che permettono ai team di creare dei progetti collaborativi in modo rapido, efficiente e idealmente con meno errori. Infine vedremo come implementare un flusso di lavoro GitOps usando Github actions e ArgoCD.

GitOps: Git come unica fonte di verità per applicazioni e infrastruttura

sparkfabrik

You may not think of "GitOps" and "service mesh" together – but maybe you should! These two wildly different technologies are each enormously capable independently, and combined they deliver far more than the sum of their parts: a single Git commit can control workflows customized for your exact situation by taking advantage of the service mesh's ability to measure and manipulate traffic anywhere in your application's call graph, and you can rest easy knowing that Git is preserving the complete configuration for your entire application every step of the way. See how these technologies can work together to tackle complex problems in cloud-native applications. What you’ll get out of this: * Understand what GitOps and service meshes can - and can't - do for you. * Understand basic operations with GitOps and Linkerd. * Understand the basics of continuous deployment with Weave GitOps and Linkerd.

Intro to GitOps with Weave GitOps, Flagger and Linkerd

Weaveworks

gitopsthekubernetesway-201026090439.pdf

saraichiba2

GitOps è un nuovo metodo di CD che utilizza Git come unica fonte di verità per le applicazioni e per l'infrastruttura (declarative infrastructure/infrastructure as code), fornendo sia il controllo delle revisioni che il controllo delle modifiche. In questo talk vedremo come implementare workflow di CI/CD Gitops basati su Kubernetes, dalla teoria alla pratica passando in rassegna i principali strumenti oggi a disposizione come ArgoCD, Flux (aka Gitops engine) e JenkinsX

Gitops: the kubernetes way

sparkfabrik

OPENING KEYNOTE: The Cloud Native Computing Foundation (CNCF) is an open source software foundation dedicated to making cloud native computing universal and sustainable. With over 300 members including the world’s largest public cloud and enterprise software companies, Alexis Richardson, CEO of Weaveworks and chair of the CNCF Technical Oversight Committee will walk you through some success stories, and why cloud native is the way forward. You’ll learn why Kubernetes and other CNCF projects have some of the fastest adoption rates in the history of open source, and how this is only the beginning. Alexis will then show how you can increase speed and reliability in your development workflows even further by using the GitOps model, which has been developed at Weaveworks. You’ll learn about the core concepts of GitOps, including customer success stories, and how you can benefit from using this model.

Cloud Native Transformation (Alexis Richardson) - Continuous Lifecycle 2018 ...

Weaveworks

Slides from OpenSource101.com Talk (https://opensource101.com/sessions/wtf-is-gitops-why-should-you-care/) If you’re interested in learning more about Cloud Native Computing or are already in the Kubernetes community you may have heard the term GitOps. It’s become a bit of a buzzword, but it’s so much more! The benefits of GitOps are real – they bring you security, reliability, velocity and more! And the project that started it all was Flux – a CNCF Incubating project developed and later donated by Weaveworks (the GitOps company who coined the term). Pinky will share from personal experience why GitOps has been an essential part of achieving a best-in-class delivery and platform team. Pinky will give a brief overview of definitions, CNCF-based principles, and Flux’s capabilities: multi-tenancy, multi-cluster, (multi-everything!), for apps and infra, and more. Pinky will cover a little of Flux’s microservices architecture and how the various components deliver this robust, secure, and trusted open source solution. Through the components of the Flux project, users today are enjoying compatibility with Helm, Jenkins, Terraform, Prometheus, and more as well as with cloud providers such as AWS, Azure, Google Cloud, and more. Join us for this informative session and get all of your GitOps questions answered by an end user in the community! Speaker: Priyanka (aka “Pinky”) is a Developer Experience Engineer at Weaveworks. She has worked on a multitude of topics including front end development, UI automation for testing and API development. Previously she was a software developer at State Farm where she was on the delivery engineering team working on GitOps enablement. She was instrumental in the multi-tenancy migration to utilize Flux for an internal Kubernetes offering. Outside of work, Priyanka enjoys hanging out with her husband and two rescue dogs as well as traveling around the globe.

WTF is GitOps and Why You Should Care?

Weaveworks

Presented at Open Source 101 2022 Presented by Priyanka Ravi, Weaveworks Abstract: If you’re interested in learning more about Cloud Native Computing or are already in the Kubernetes community you may have heard the term GitOps. It’s become a bit of a buzzword, but it’s so much more! The benefits of GitOps are real - they bring you security, reliability, velocity and more! And the project that started it all was Flux - a CNCF Incubating project developed and later donated by Weaveworks (the GitOps company who coined the term). Pinky will share from personal experience why GitOps has been an essential part of achieving a best-in-class delivery and platform team. Pinky will give a brief overview of definitions, CNCF-based principles, and Flux's capabilities: multi-tenancy, multi-cluster, (multi-everything!), for apps and infra, and more. Pinky will cover a little of Flux's microservices architecture and how the various components deliver this robust, secure, and trusted open source solution. Through the components of the Flux project, users today are enjoying compatibility with Helm, Jenkins, Terraform, Prometheus, and more as well as with cloud providers such as AWS, Azure, Google Cloud, and more. Join us for this informative session and get all of your GitOps questions answered by an end user in the community!

WTF is GitOps & Why Should You Care?

All Things Open

Hyperledger fabric 3

Arvind Sridharan

Today’s modern enterprises are spoilt for choice with technology options, services and approaches. But in order to improve organizational productivity and development velocity, considering how developer experience plays a key role in these decisions will be a huge driver of their success. DevEx is becoming increasingly critical for organizations because developers are important for building digital products and services. Organizations require developers to spend more time coding and less time working on infrastructure. Improving developer toolchains is essential for increasing productivity. But where does security sit in all of this? James Governor, Analyst and Co-Founder of RedMonk and Steve George, COO at Weaveworks (the pioneers for GitOps deployments and infrastructure management) discuss the importance of DX and security in successful organizations today. They focus on how GitOps is enabling DevOps automation and allowing traditional CICD practices to shift further left.

DX, Guardrails, Golden Paths & Policy in Kubernetes

Weaveworks

DSO-LG 2021 Reboot: Policy As Code (Anders Eknert)

Michael Man

Deploy 22 microservices from scratch in 30 mins with GitOps

Opsta

Modern day deployments can often resemble the chaos of navigating the high seas with poor visibility and the dangers of unexpected events. Dev and test environments, running test data sets and feature flags in the public cloud, and production being served from a self-managed site that securely hosts client data can all be a challenge without full observability and control. In this webinar, we show how you can reliably expand your Kubernetes footprint with Weave GitOps. Confidently observe and control your fleets, all from a single pane of glass across any environment. Join this webinar to learn how to: Control the health and propagation of customized clusters Easily assign and secure clusters across multiple teams for multiple purposes Observe all actions across all environments all from within Git Understand managing all deployments across your cluster and fleets

Observe and command your fleets across any kubernetes with weave git ops

Weaveworks

Today it’s all about delivering velocity without compromising on quality, yet it’s becoming increasingly difficult for organisations to keep up with the challenges of current release management and traditional operations. The demand for developers to own the end-to-end delivery, including operational ownership, is increasing. A “you build it, you own it” development process requires tools that developers know and understand. So I’d like to introduce “GitOps”- an agile software lifecycle for modern applications. In this session, I will discuss these industry challenges, including current CICD trends and how they’re converging with operations and monitoring. I’ll also illustrate the GitOps model, identify best practices and tools to use, and explain how you can benefit from adopting this methodology inherited from best practices going back 10-15 years.

Continuous Lifecycle London 2018 Event Keynote

Weaveworks

Cloud native policy enforcement with Open Policy Agent

LibbySchulze

PGConf.ASIA 2019 Bali - Patroni on GitLab.com - Jose Cores Finnoto

Equnix Business Solutions

Primeros pasos del Software Libre en infraestructura civil Civil Infrastructu...

Agustin Benito Bethencourt

[APIdays Singapore 2019] Managing the API lifecycle with Open Source Technolo...

WSO2

View this video on Youtube here: https://youtu.be/tK4S8y3j5TA In this info-packed and hands-on workshop we covered:  Introduction to Kubernetes & GitOps talk: We covered the most popular path that has brought success to many users already - GitOps as a natural evolution of Kubernetes. We'll give an overview of how you can benefit from Kubernetes and GitOps: greater security, reliability, velocity and more. Importantly, we cover definitions and principles standardized by the CNCF's OpenGitOps group and what it means for you.  Get Started with GitOps: You'll have GitOps up and running in about 30 mins using our free and open source tools! We'll give a brief vision of where you want to be with those security, reliability, and velocity benefits, and then we'll support you while go through the getting started steps. During the workshop, you'll also experience in action and see demos for: - an opinionated repo structure to minimize decision fatigue - disaster recovery using GitOps - Helm charts example - Multi-cluster example - all with free and open source tools mostly in the CNCF (eg. Flux and Helm). If you have questions before or after the workshop, talk to us at #weave-gitops http://bit.ly/WeaveGitOpsSlack (If you need to invite yourself to the Slack, visit https://slack.weave.works/)

Free GitOps Workshop (with Intro to Kubernetes & GitOps)

Weaveworks

Similar to GitLab Commit: Enhance your Compliance with Policy-Based CI/CD (20)

Understanding the GitOps Workflow and CICD Pipeline - What It Is, Why It Matt...

Cloud Native Apps with GitOps

GitOps: Git come unica fonte di verità per applicazioni e infrastruttura

Intro to GitOps with Weave GitOps, Flagger and Linkerd

gitopsthekubernetesway-201026090439.pdf

Gitops: the kubernetes way

Cloud Native Transformation (Alexis Richardson) - Continuous Lifecycle 2018 ...

WTF is GitOps and Why You Should Care?

WTF is GitOps & Why Should You Care?

Hyperledger fabric 3

DX, Guardrails, Golden Paths & Policy in Kubernetes

DSO-LG 2021 Reboot: Policy As Code (Anders Eknert)

Deploy 22 microservices from scratch in 30 mins with GitOps

Observe and command your fleets across any kubernetes with weave git ops

Continuous Lifecycle London 2018 Event Keynote

Cloud native policy enforcement with Open Policy Agent

PGConf.ASIA 2019 Bali - Patroni on GitLab.com - Jose Cores Finnoto

Primeros pasos del Software Libre en infraestructura civil Civil Infrastructu...

[APIdays Singapore 2019] Managing the API lifecycle with Open Source Technolo...

Free GitOps Workshop (with Intro to Kubernetes & GitOps)

More from Nico Meisenzahl

Cloud-native technologies have revolutionized the way we build and deploy applications, enabling greater scalability, flexibility, and reliability. In this talk, Nico will explore the concept of sustainability in the context of cloud-native workloads and discuss the benefits of building sustainable applications. Nico will cover best practices for designing and implementing sustainable cloud-native workloads, as well as share real-world examples. This talk will guide you through the technical details of sustainable cloud-native workloads and provide actionable steps for everyone interested in building sustainable applications in the cloud.

Cloud-Native & Sustainability: How and Why to Build Sustainable Workloads

Nico Meisenzahl

Nico will show how to prevent your Kubernetes cluster from being hijacked by introducing you to best practices as well as useful open-source projects based on real-world examples. You’ll learn everything you need to know to build and run secure Kubernetes clusters including: - basics like shift left and container image security - ensure supply chain security - implement Kubernetes policies - introduce Kubernetes network security - rely on Container Runtime Security - many more… Don't miss this session to learn everything you need to know to securely run your Kubernetes-based workloads.

Container Day Security: How to Prevent Your Kubernetes Cluster From Being Hacked

Nico Meisenzahl

Festive Tech Calendar: Festive time with AKS networking

Nico Meisenzahl

ContainerConf 2022: Hijack Kubernetes

Nico Meisenzahl

ContainerConf 2022: Kubernetes is awesome - but...

Nico Meisenzahl

KCD Munich 2022: How to Prevent Your Kubernetes Cluster From Being Hacked

Nico Meisenzahl

KCD Munich 2022: Hijack a Kubernetes Cluster - a Walkthrough

Nico Meisenzahl

… you should also know when not to use it. This is what Philip and Nico will talk about in this session. They will share all the things they have learned and seen over the past years. Philip and Nico share real-world examples of what they've seen in projects and tell you what went wrong and what could have been done better. And why Kubernetes has been the wrong choice for some of them. Applications and use-cases that do not fit Kubernetes are just one example we will talk about. Join this talk to learn how to take full advantage of Kubernetes and learn where it fits to run your workload successfully. That said: We love Kubernetes!

Cloud Love Conference: Kubernetes is awesome, but...

Nico Meisenzahl

How to Prevent Your Kubernetes Cluster From Being Hacked

Nico Meisenzahl

Nico will show how to hijack a Kubernetes cluster based on common attack vectors. You'll also learn why it's important to implement zero-trust to prevent data leaks and malicious workloads from being executed on a hijacked cluster. Furthermore, he will show you how to protect your cluster from being taken over by sharing useful insights, configurations, and toolsets. This talk is not intended to be an in-depth security talk, but to provide you with best practices and also make you aware of certain attack vectors and how to prevent them.

Container Days: Hijack a Kubernetes Cluster - a Walkthrough

Nico Meisenzahl

Hijack a Kubernetes Cluster - a Walkthrough

Nico Meisenzahl

You are already running Kubernetes-based workloads on Azure Kubernetes Service and want to get more out of it? This is your session! In this talk, Nico will show you all the nice features you get with AKS besides just Kubernetes. Learn all the details about the available add-ons, integrations, and toolsets to integrate and secure your Kubernetes-based applications. Furthermore, Nico will give a preview of potential new features from the AKS roadmap.

Azure Zürich User Group: Azure Kubernetes Service – more than just a managed ...

Nico Meisenzahl

Hijack a Kubernetes Cluster - a Walkthrough

Nico Meisenzahl

azdevcom - Hijack a Kubernetes Cluster

Nico Meisenzahl

Whether you want to get started with Governance or improve your current process, this talk will show you how to improve your compliance by implementing policy-based CI/CD (Continuous Integration / Continuous Delivery) with Open Policy Agent. Nico will tell you all the details about Open Policy Agent and how you can easily integrate it into your existing CI/CD pipelines. Join this session to learn all the details on how to stay compliant with project dependencies or control your Infrastructure and Kubernetes deployment pipelines.

Continuous Lifecycle: Enhance Your Compliance and Governance With Policy-Base...

Nico Meisenzahl

Continuous Lifecycle: Hijack Kubernetes

Nico Meisenzahl

Hijack a Kubernetes Cluster - a Walkthrough

Nico Meisenzahl

Infrastructure-as-code is key to keeping up with our rapidly changing world. In this talk, you will learn everything you need to get started with Terraform on Azure. Nico will show you all the fundamentals and best practices you need to know to use Terraform on Azure. Furthermore, you will learn how to scaffold a production-ready and secure Terraform project that you can use as a blueprint for your environments. Join Nico and walk away with all the details you need to use Terraform in production!

Azure Meetup Hamburg: Production-Ready Terraform Deployments on Azure

Nico Meisenzahl

Microsoft DevOps Forum 2021 – DevOps & Security

Nico Meisenzahl

In this session, Nico will talk about Helm and Operators as well as the battle between them. If you ever ask yourself one of the following questions, this talk is the right one for you: "Do I have to decide?" "Do I need to learn both?" "What are the best tools for my use-case?" In short: There is no battle. Both tools have different scopes. Nico will talk about the pros and cons, and what the projects themselves focus on. Join his talk to learn more!

DevOpsCon Berlin: Helm vs Operators – Do I Need to Decide?

Nico Meisenzahl

More from Nico Meisenzahl (20)

Cloud-Native & Sustainability: How and Why to Build Sustainable Workloads

Container Day Security: How to Prevent Your Kubernetes Cluster From Being Hacked

Festive Tech Calendar: Festive time with AKS networking

ContainerConf 2022: Hijack Kubernetes

ContainerConf 2022: Kubernetes is awesome - but...

KCD Munich 2022: How to Prevent Your Kubernetes Cluster From Being Hacked

KCD Munich 2022: Hijack a Kubernetes Cluster - a Walkthrough

Cloud Love Conference: Kubernetes is awesome, but...

How to Prevent Your Kubernetes Cluster From Being Hacked

Container Days: Hijack a Kubernetes Cluster - a Walkthrough

Hijack a Kubernetes Cluster - a Walkthrough

Azure Zürich User Group: Azure Kubernetes Service – more than just a managed ...

Hijack a Kubernetes Cluster - a Walkthrough

azdevcom - Hijack a Kubernetes Cluster

Continuous Lifecycle: Enhance Your Compliance and Governance With Policy-Base...

Continuous Lifecycle: Hijack Kubernetes

Hijack a Kubernetes Cluster - a Walkthrough

Azure Meetup Hamburg: Production-Ready Terraform Deployments on Azure

Microsoft DevOps Forum 2021 – DevOps & Security

DevOpsCon Berlin: Helm vs Operators – Do I Need to Decide?

Recently uploaded

This presentations targets students or working professionals. You may know Google for search, YouTube, Android, Chrome, and Gmail, but did you know Google has many developer tools, platforms & APIs? This comprehensive yet still high-level overview outlines the most impactful tools for where to run your code, store & analyze your data. It will also inspire you as to what's possible. This talk is 50 minutes in length.

Powerful Google developer tools for immediate impact! (2023-24 C)

wesley chun

Imagine a world where information flows as swiftly as thought itself, making decision-making as fluid as the data driving it. Every moment is critical, and the right tools can significantly boost your organization’s performance. The power of real-time data automation through FME can turn this vision into reality. Aimed at professionals eager to leverage real-time data for enhanced decision-making and efficiency, this webinar will cover the essentials of real-time data and its significance. We’ll explore: FME’s role in real-time event processing, from data intake and analysis to transformation and reporting An overview of leveraging streams vs. automations FME’s impact across various industries highlighted by real-life case studies Live demonstrations on setting up FME workflows for real-time data Practical advice on getting started, best practices, and tips for effective implementation Join us to enhance your skills in real-time data automation with FME, and take your operational capabilities to the next level.

From Event to Action: Accelerate Your Decision Making with Real-Time Automation

Safe Software

MySQL Webinar, presented on the 25th of April, 2024. Summary: MySQL solutions enable the deployment of diverse Database Architectures tailored to specific needs, including High Availability, Disaster Recovery, and Read Scale-Out. With MySQL Shell's AdminAPI, administrators can seamlessly set up, manage, and monitor these solutions, ensuring efficiency and ease of use in their administration. MySQL Router, on the other hand, provides transparent routing from the application traffic to the backend servers in the architectures, requiring minimal configuration. Completely built in-house and supported by Oracle, these solutions have been adopted by enterprises of all sizes for their business-critical applications. In this presentation, we'll delve into various database architecture solutions to help you choose the right one based on your business requirements. Focusing on technical details and the latest features to maximize the potential of these solutions.

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Miguel Araújo

Strategies for Landing an Oracle DBA Job as a Fresher

Remote DBA Services

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

The Digital Insurer

With more memory available, system performance of three Dell devices increased, which can translate to a better user experience Conclusion When your system has plenty of RAM to meet your needs, you can efficiently access the applications and data you need to finish projects and to-do lists without sacrificing time and focus. Our test results show that with more memory available, three Dell PCs delivered better performance and took less time to complete the Procyon Office Productivity benchmark. These advantages translate to users being able to complete workflows more quickly and multitask more easily. Whether you need the mobility of the Latitude 5440, the creative capabilities of the Precision 3470, or the high performance of the OptiPlex Tower Plus 7010, configuring your system with more RAM can help keep processes running smoothly, enabling you to do more without compromising performance.

Boost PC performance: How more available memory can improve productivity

Principled Technologies

GenAI Risks & Security Meetup 01052024.pdf

lior mazor

How to Troubleshoot Apps for the Modern Connected Worker

ThousandEyes

MINDCTI Revenue Release Quarter One 2024

MIND CTI

2024: Domino Containers - The Next Step. News from the Domino Container commu...

Martijn de Jong

💉💊+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHABI}}+971581248768 +971581248768 Mtp-Kit (500MG) Prices » Dubai [(+971581248768**)] Abortion Pills For Sale In Dubai, UAE, Mifepristone and Misoprostol Tablets Available In Dubai, UAE CONTACT DR.Maya Whatsapp +971581248768 We Have Abortion Pills / Cytotec Tablets /Mifegest Kit Available in Dubai, Sharjah, Abudhabi, Ajman, Alain, Fujairah, Ras Al Khaimah, Umm Al Quwain, UAE, Buy cytotec in Dubai +971581248768''''Abortion Pills near me DUBAI | ABU DHABI|UAE. Price of Misoprostol, Cytotec” +971581248768' Dr.DEEM ''BUY ABORTION PILLS MIFEGEST KIT, MISOPROTONE, CYTOTEC PILLS IN DUBAI, ABU DHABI,UAE'' Contact me now via What's App…… abortion Pills Cytotec also available Oman Qatar Doha Saudi Arabia Bahrain Above all, Cytotec Abortion Pills are Available In Dubai / UAE, you will be very happy to do abortion in Dubai we are providing cytotec 200mg abortion pill in Dubai, UAE. Medication abortion offers an alternative to Surgical Abortion for women in the early weeks of pregnancy. We only offer abortion pills from 1 week-6 Months. We then advise you to use surgery if its beyond 6 months. Our Abu Dhabi, Ajman, Al Ain, Dubai, Fujairah, Ras Al Khaimah (RAK), Sharjah, Umm Al Quwain (UAQ) United Arab Emirates Abortion Clinic provides the safest and most advanced techniques for providing non-surgical, medical and surgical abortion methods for early through late second trimester, including the Abortion By Pill Procedure (RU 486, Mifeprex, Mifepristone, early options French Abortion Pill), Tamoxifen, Methotrexate and Cytotec (Misoprostol). The Abu Dhabi, United Arab Emirates Abortion Clinic performs Same Day Abortion Procedure using medications that are taken on the first day of the office visit and will cause the abortion to occur generally within 4 to 6 hours (as early as 30 minutes) for patients who are 3 to 12 weeks pregnant. When Mifepristone and Misoprostol are used, 50% of patients complete in 4 to 6 hours; 75% to 80% in 12 hours; and 90% in 24 hours. We use a regimen that allows for completion without the need for surgery 99% of the time. All advanced second trimester and late term pregnancies at our Tampa clinic (17 to 24 weeks or greater) can be completed within 24 hours or less 99% of the time without the need surgery. The procedure is completed with minimal to no complications. Our Women's Health Center located in Abu Dhabi, United Arab Emirates, uses the latest medications for medical abortions (RU-486, Mifeprex, Mifegyne, Mifepristone, early options French abortion pill), Methotrexate and Cytotec (Misoprostol). The safety standards of our Abu Dhabi, United Arab Emirates Abortion Doctors remain unparalleled. They consistently maintain the lowest complication rates throughout the nation. Our Physicians and staff are always available to answer questions and care for women in one of the most difficult times in their lives. The decision to have an abortion at the Abortion Cl

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@

A Principled Technologies deployment guide Conclusion Deploying VMware Cloud Foundation 5.1 on next gen Dell PowerEdge servers brings together critical virtualization capabilities and high-performing hardware infrastructure. Relying on our hands-on experience, this deployment guide offers a comprehensive roadmap that can guide your organization through the seamless integration of advanced VMware cloud solutions with the performance and reliability of Dell PowerEdge servers. In addition to the deployment efficiency, the Cloud Foundation 5.1 and PowerEdge solution delivered strong performance while running a MySQL database workload. By leveraging VMware Cloud Foundation 5.1 and PowerEdge servers, you could help your organization embrace cloud computing with confidence, potentially unlocking a new level of agility, scalability, and efficiency in your data center operations.

Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...

Principled Technologies

The Good, the Bad and the Governed - Why is governance a dirty word? David O'Neill, Chief Operating Officer - APIContext Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

apidays

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Juan lago vázquez

Artificial Intelligence Chap.5 : Uncertainty

Khushali Kathiriya

Axa Assurance Maroc - Insurer Innovation Award 2024

The Digital Insurer

AWS Community Day CPH - Three problems of Terraform

Andrey Devyatkin

Data Cloud, More than a CDP by Matt Robison

Anna Loughnan Colquhoun

The value of a flexible API Management solution for Open Banking Steve Melan, Manager for IT Innovation and Architecture - State's and Saving's Bank of Luxembourg Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The value of a flexible API Management solution for O...

apidays

This presentation explores the impact of HTML injection attacks on web applications, detailing how attackers exploit vulnerabilities to inject malicious code into web pages. Learn about the potential consequences of such attacks and discover effective mitigation strategies to protect your web applications from HTML injection vulnerabilities. for more information visit https://bostoninstituteofanalytics.org/category/cyber-security-ethical-hacking/

HTML Injection Attacks: Impact and Mitigation Strategies

Boston Institute of Analytics

Recently uploaded (20)

Powerful Google developer tools for immediate impact! (2023-24 C)

From Event to Action: Accelerate Your Decision Making with Real-Time Automation

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Strategies for Landing an Oracle DBA Job as a Fresher

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

Boost PC performance: How more available memory can improve productivity

GenAI Risks & Security Meetup 01052024.pdf

How to Troubleshoot Apps for the Modern Connected Worker

MINDCTI Revenue Release Quarter One 2024

2024: Domino Containers - The Next Step. News from the Domino Container commu...

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Artificial Intelligence Chap.5 : Uncertainty

Axa Assurance Maroc - Insurer Innovation Award 2024

AWS Community Day CPH - Three problems of Terraform

Data Cloud, More than a CDP by Matt Robison

Apidays New York 2024 - The value of a flexible API Management solution for O...

HTML Injection Attacks: Impact and Mitigation Strategies

GitLab Commit: Enhance your Compliance with Policy-Based CI/CD

1. 1 #GitLabCommit Enhance Your Compliance and Governance With Policy-Based CI/CD

2. 2 #GitLabCommit Philippe Lafoucrière Nico Meisenzahl Senior Cloud & DevOps Consultant white duck @nico-meisenzahl @nmeisenzahl Distinguished Security Engineer GitLab @plafoucriere @plafoucriere

3. 3 #GitLabCommit Agenda

4. 4 #GitLabCommit Agenda ● Why do we need compliance and governance in CI/CD? ● What is Open Policy Agent and how does it work? ● How to get started – some examples

5. 5 #GitLabCommit Why do we need compliance and governance in CI/CD?

6. 6 #GitLabCommit What is Compliance? “Adherence to standards, regulations, and other requirements” (wikipedia)

7. 7 #GitLabCommit Types of Software compliance ● Statutory/Regulatory compliance: comply with relevant laws, policies, and regulations. ● Standards: adhere to established and standard requirements ● Contractual obligations: Vendor agreements, customers contracts, ... ● Corporate: Set of rules and policies defined by the company to comply with the needs of HR, Security, Communication, ...

8. 8 #GitLabCommit Compliance frameworks Regulatory Compliance Frameworks are mandatory for some industries. Source: GitLab current Security Certifications and Attestations

9. 9 #GitLabCommit The way to Compliance You can do all of these without Compliance, but doing Compliance without them will turn out to be extremely hard. They are intimately tied together. Automation Testing Quality Compliance

10. 10 #GitLabCommit Compliance and Governance in CI/CD? - Define the “how” around the “what” of the pipelines - Security and Compliance gates - Ensure the requirements are always met, during all the lifecycle of the project - Iteration is key (start small!) - OPA to the rescue

11. 11 #GitLabCommit What is Open Policy Agent and how does it work?

12. 12 #GitLabCommit Open Policy Agent (OPA) “policy-based control for cloud native environments” ● general-purpose policy engine across your stack ● graduated CNCF project introduced by styra ● declarative policy language ● decoupled the application logic from policy decisions ○ REST API with sidecar or daemon ○ golang library ○ Wasm module ● provides APIs for easy management

13. 13 #GitLabCommit

14. 14 #GitLabCommit Ecosystem ● API and service authorization with Envoy, Kong, Traefik and others ● authorization policies for SQL, Kafka and others ● container network authorization with Istio and Linkerd ● test policies for Terraform infrastructure changes ● policies for SSH and sudo ● policy and Governance for Kubernetes ● and many more ○ https://www.openpolicyagent.org/docs/latest/ecosystem

15. 15 #GitLabCommit How OPA works

16. 16 #GitLabCommit How OPA works

17. 17 #GitLabCommit Rego ● “ray-go” ● declarative Policy Language ○ ”is Nico allowed to POST a payload to /api” ● rules commonly return true/false ○ but may return any ● 140+ build-in functions ○ date/time, string, ... ○ Regex ○ JWT validation ○ ...

18. 18 #GitLabCommit How OPA works

19. 19 #GitLabCommit How to get started? ● OPA playground ○ https://play.openpolicyagent.org ● docs ○ https://www.openpolicyagent.org/docs ● OPA CLI ○ opa run ○ opa test ○ opa eval

20. 20 #GitLabCommit How to get started – some examples

21. 21 #GitLabCommit Demo: Policy-Based CI/CD with OPA ● Infrastructure-As-Code change validation (Terraform) ○ https://gitlab.com/nico-meisenzahl/terraform-opa-policy-demo ● GitLab project validation ○ https://gitlab.com/gitlab-com/gl-security/engineering-and-rese arch/inventory-example/-/merge_requests/7

22. 22 #GitLabCommit Further examples ● Kubernetes manifest validation ● Allow/Deny Lists for library dependencies ● Docker Authorization ● Envoy Authorization ● And more

23. 23 #GitLabCommit Philippe Lafoucrière Nico Meisenzahl Senior Cloud & DevOps Consultant white duck @nico-meisenzahl @nmeisenzahl Distinguished Security Engineer GitLab @plafoucriere @plafoucriere

24. 24 #GitLabCommit Thank You!

GitLab Commit: Enhance your Compliance with Policy-Based CI/CD

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to GitLab Commit: Enhance your Compliance with Policy-Based CI/CD

Similar to GitLab Commit: Enhance your Compliance with Policy-Based CI/CD (20)

More from Nico Meisenzahl

More from Nico Meisenzahl (20)

Recently uploaded

Recently uploaded (20)

GitLab Commit: Enhance your Compliance with Policy-Based CI/CD