Flux’s Security & Scalability with OCI & Helm Slides.pdf

1
November 29, 2022
Flux’s Security & Scalability
with OCI & Helm
Kingdon Barrett
OSS Engineer, Weaveworks
Vanessa Abankwah
DX Community Manager, Weaveworks

2
Weaveworks is founded on open source
● Flux & Flagger (CNCF): GitOps and Progressive Delivery for k8s
● EKSctl: Create an Amazon EKS cluster with one command
● (and many many more projects!)
And now … Weave GitOps......Built on Flux!
weave.works

3
Speakers Help/Support
Kingdon Barrett
OSS Engineer
Vanessa Abankwah
DX Community
Manager ,Weaveworks
Duration
30-40 Minutes
Browser
Safari copy/paste
shortcuts may not work
Using Zoom
Questions?
• Use chat (button: top
left corner of screen)
• Escape to exit full
screen
• “To Everyone” or “To
all panelists and
attendees”
Support:
https://support.zoom.us/hc/
en-us/articles/206175806-T
op-Questions
Troubleshooting
Use chat
If the issue is not easily resolved,
we ask that you follow along as
we demo the sample app.
Flux’s Security & Scalability with OCI & Helm

4
HashiCorp User Group Luxembourg (virtual) Nov 30
WOUG: Implementing Flux for Scale with Soft Multi-tenancy (Dec 13)
Upcoming Events

5
5
● Operating model for cloud native applications such as Kubernetes
● Utilizes a version controlled system (Commonly Git) as the “single
source of truth”
● Enables continuous delivery through automated deployment,
monitoring, and management by a version controlled system
● Managing your infrastructure and applications declaratively
Recap: What is GitOps

6
6
● 2 wks ago: (https://youtu.be/Bmh7kKYLIhY) Flux with “OCI Bootstrap”
● OCIRepository “standing in” for GitRepository as root Source Of Truth
○ “Bootstrap Lite”
● Non-standard conﬁg
○ We started to get ideas about where OCI can be used
○ Primitives: use them how you want, these are only examples
● (Podinfo app still managed via Git)
○ stand in for “upstreams we can’t control”
● Today is “Part 2” of the series
Recap: Flux Security & Scalability (VSCode + OCI + Cosign)

7
7
Still GitOps?
OCI + Flux == GitOps
● Git is still the source of truth
● Before:
○ Git => Flux
● After:
○ Git => OCI registry => Flux

8
8
Still GitOps?
OCI + Flux == GitOps
● Git is still the source of truth
● Before:
○ Git => Flux
● After:
○ Git => OCI registry => Flux
○ New opportunities for validation, etc.
○ (We added a CI Step!)

9
Source: GitOps Working Group
https://opengitops.dev/

11
11
Security & Scalability
● Pulling an OCI image is much less resource-intensive compared
to a full or shallow Git clone
● Highly available registries are on every cloud provider
● Flux leverages Kubernetes workload identity and IAM when
pulling OCI artifacts from managed registries
○ => No more key management
○ => No more SSH keys to generate
○ => No more proprietary API usage for token generation

12
12
Recap: Security & Scalability
● Last time: Image verification with cosign
○ “Two types” of images
■ Application runtime (not verified)
■ Manifests (YAML) - and how to publish as OCI, sign, etc.
● This time: …

13
13
Recap: Security & Scalability
● Last time: Image verification with cosign
○ “Two types” of images
■ Application runtime (not verified)
■ Manifests (YAML) - and how to publish as OCI, sign, etc.
● Today: let’s add
○ Helm Charts, and Cosign verification on HelmReleases
○ Keyless Cosign Signatures (and keyed)
● Bonus:
○ App runtime image verification with Kyverno

14
14
● Software supply chain attacks
● OCI Artifact authenticity
● Sigstore cosign
○ Sponsored by Open Source Security Foundation (OpenSSF)
○ OpenID Connect, Root CA and Public Ledger
○ Keys: text-based, cloud KMS, Kubernetes Secret
● Container registry must support signed images
○ GitHub oﬀers a simple way to get started with OCI and cosign
Recap: Features of veriﬁcation with cosign

15
15
● What does it mean?
○ Overlapping protections
○ Risk assessment
○ Multiple mitigations
● Swiss-Cheese Strategy for Security
○ When there is a hole in one layer…
○ …the other layers enhance the probability of blocking attacks
Defense in Depth

16
16
● What does it mean for us?
○ Traditional approaches still apply:
■ Use a protected main branch, and CI checks
■ Use immutable images (req. support from Container Registry)
○ New approaches we can add:
■ Signatures and veriﬁcation
■ Verify:
● YAML manifests (declarative representation of prod/app)
● App Runtime Images
Defense in Depth

17
17
● Helm
● Flux’s Helm Controller & Source Controller
● Sigstore cosign
● Git repository (GitHub)
● CI workﬂows (GitHub Actions)
● Container registry (GHCR)
Agenda: Tools we are using

18
18
● Helm
○ It’s ubiquitous
○ If you are using Kubernetes and you are not Google-scale
■ You basically can’t avoid Helm (everybody has helm charts)
■ Lots of nice features including lifecycle hooks
■ (Don’t over-analyze it)
○ Software + conﬁg distro commonly done with Helm charts
■ But it has some limitations

19
19
● Flux’s Helm Controller & Source Controller
○ Allows Helm to be used declaratively
○ Remediation and CRD upgrades
■ Features that aren’t natively in Helm
○ Helm + GitOps => (Flux implements this)

20
20
● Sigstore cosign
○ Popular new tool for veriﬁcation of signatures
○ Enables traditional “keyed” signatures or
■ Keyless - OIDC-based workﬂow
○ OCI signatures
○ Flexible attestations

21
21
● Sigstore cosign
Q: How many people are signing releases now?

22
22
● Sigstore cosign
● What does keyless veriﬁcation get us?

23
23
● Sigstore cosign
● What does keyless veriﬁcation get us?
○ (If we don’t sign releases now, could it get any worse?)

24
24
● Git repository (GitHub)
○ (Also an OIDC provider)
○ Place to store and version code

25
25
● CI workﬂows (GitHub Actions)
○ Place for CI actions to run
○ (environment with ephemeral GITHUB_TOKEN)

26
26
● Container registry (GHCR)
○ Place for CI actions to store the results
○ (Signatures go in here, as OCI artifacts as well)
■ sha256-abcd1234ef98765.sig
○ Images have a “digest” which hashes their content
○ Cosign attestations can make+certify assertions (“CI Passed”)
○ “Packages” hold the manifests or app runtime images
■ Serve them up as an OCI Repository

28
28
● Demo Example Docs
○ https://github.com/kingdonb/ﬂux-oci-demo-nov-29
○ (The repo we worked in today, with “solutions”
Text in README shows what we did)
Links

29
29
● Podinfo
○ https://github.com/stefanprodan/podinfo
○ Keyless:
■ https://github.com/stefanprodan/podinfo/blob/master/.github/
workﬂows/release.yml#L90-L97
○ Keyed:
■ https://github.com/stefanprodan/podinfo/blob/master/.github/
workﬂows/release.yml#L118-L125
Links

30
30
● Flux Blog & Docs
○ https://fluxcd.io/blog/2022/10/prove-the-authenticity-of-oci-artifacts/
○ https://fluxcd.io/blog/2022/11/verify-the-integrity-of-the-helm-charts-stored-as-
oci-artifacts-before-reconciling-them-with-flux/
○ https://fluxcd.io/blog/2022/08/manage-kyverno-policies-as-ocirepositories/
○ https://fluxcd.io/flux/cheatsheets/oci-artifacts/#signing-and-verification
● Security
○ https://fluxcd.io/flux/security/contextual-authorization/
○ https://fluxcd.io/flux/security/secrets-management/
Links

31
31
● Kyverno
○ https://kyverno.io/docs/writing-policies/verify-images/#verifying-image-attestations
○ https://kyverno.io/policies/flux/generate-flux-multi-tenant-resources/generate-flux-
multi-tenant-resources/ <- Flux Multi-Tenancy Resource
● Kyverno uses Flux and Cosign:
● https://github.com/kyverno/kyverno/blob/main/.github/workflows/relea
se.yaml#L155-L172
Links

32
32
● (Who else uses Cosign today in their release process?)
● Prometheus Community does now:
○ https://github.com/prometheus-community/helm-charts/tree/main/
charts/kube-prometheus-stack
○ https://github.com/orgs/prometheus-community/packages?repo_
name=helm-charts
● Flux Monitoring
■ https://ﬂuxcd.io/ﬂux/guides/monitoring/
Links

33
33
● Cert-Manager does now:
○ https://cert-manager.io/docs/installation/code-signing/#container-images-
-cosign
Links

34
34
● Harbor curiously does not:
○ However, Harbor users do already enjoy Cosign veriﬁcation now:
○ https://goharbor.io/blog/cosign-2.5.0/
● You can see attestations and verify the signatures in Harbor UI
Links

35
35
● Is coming!
● You can help by…
Adoption

36
36
● Is coming!
● You can help by…
○ Trying this workﬂow out and reporting any issues you may have
○ Joining the community
● Flux Dev Meetings
● Flux Bug Scrub
○ https://ﬂuxcd.io/#calendar
● (We’d love to have you join!)
Adoption

37
37
GitOps Tools for Flux Visual Studio Code Extension
● An extension to enhance the developer experience
● An intuitive way to manage, troubleshoot and operate your
Kubernetes environment following the GitOps operating model
● Accelerate your development lifecycle and simplify your continuous
delivery pipelines
● GitOps Tools Visual Studio Code on GitHub:
https://github.com/weaveworks/vscode-gitops-tools
● GitOps Tools for Flux in Visual Studio Marketplace:
https://marketplace.visualstudio.com/items?itemName=Weavework
s.vscode-gitops-tools

38
38
Weave GitOps
● Adds a web UI that surfaces key information to help application
operators easily discover and resolve issues
● An intuitive interface that provides a guided experience to build
understanding and simplify getting started for new users; they can
easily discover the relationship between Flux objects and navigate to
deeper levels of information as required
● GitOps Tools Visual Studio Code on GitHub:
https://github.com/weaveworks/weave-gitops
● Weave GitOps Documentation:
https://docs.gitops.weave.works/docs/intro/

39
● Join us on Flux discussions if you have more questions:
https://github.com/fluxcd/flux2/discussions
● Flux Community:
https://github.com/fluxcd/community/blob/main/community-roles.md
● Join the GitOps Community Group:
https://www.meetup.com/GitOps-Community/
● Join the GitOps Community LinkedIn Group:
https://www.linkedin.com/groups/13914610/
● VS Code Extension: https://code.visualstudio.com/
Next Steps

Conﬁdential do not distribute
4
0
weave.works
Thank you

Flux’s Security & Scalability with OCI & Helm Slides.pdf

Recommended

More Related Content

Similar to Flux’s Security & Scalability with OCI & Helm Slides.pdf (20)

More from Weaveworks (20)

Recently uploaded (20)

Flux’s Security & Scalability with OCI & Helm Slides.pdf