Overview.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "aa0a293f",
   "metadata": {},
   "source": [
    "**This notebook covered by the following [license](License.ipynb)  This note must not be removed**"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2fd74af7-9a3e-444a-8a43-20ed85fdb28e",
   "metadata": {},
   "source": [
    "# Pause bis 15:30h"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ea15dd25",
   "metadata": {
    "tags": []
   },
   "source": [
    "\n",
    "# Kubernetes Security\n",
    "\n",
    "## Day 1: Introduction\n",
    "\n",
    "- repetiton of the basics\n",
    "- what is running in my cluster?\n",
    "- the Linux heritage: Linux Namespaces, Capabilities, SecComp, Selinux and Apparmor \n",
    "- containers and virtualization\n",
    "- container runtimes: beyond Docker\n",
    "- pods, daemonsets, statefulsets and other workloads\n",
    "- architectural aspects\n",
    "- the most common errors\n",
    "- container patterns, designing containers with security in mind\n",
    "- secure architecture: does an application need privileged\n",
    "- databases in Kubernetes\n",
    "- access to the Host Filesystem\n",
    "- standards (German BSI, Nist, CIS)\n",
    "- container images\n",
    "- SecDevOps in secure environments\n",
    "- filtering\n",
    "\n",
    "## Day 2: networks\n",
    "\n",
    "- services\n",
    "- ingress as an additional network layer\n",
    "- transport layer security and secrets\n",
    "- NetworkPolicies\n",
    "- distributed firewalls\n",
    "- when do you need service meshs?\n",
    "\n",
    "## Day 3: Hardening Kubernetes\n",
    "\n",
    "- PodSecurityPolicies\n",
    "- Admission Controller, Open Policy Agent\n",
    "- Users, Roles und RBAC (Role Based Access Control)\n",
    "- Audit Logs\n",
    "- What is allowed to a Pod?\n",
    "- distributions\n",
    "- cloud vendors\n",
    "- On Premises\n",
    "- criteria for selecting vendors"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "97e7cb35",
   "metadata": {
    "tags": []
   },
   "source": [
    "## Introduction\n",
    "\n",
    "- [Basics](KubernetesBasics.ipynb)\n",
    "- [What goes on in my Cluster?](ClusterOverview.ipynb)\n",
    "- Linux Heritage\n",
    "   - [Linux Namespaces](Linux%20Namespaces.ipynb)\n",
    "   - [SeLinux](https://platform9.com/blog/selinux-kubernetes-rbac-and-shipping-security-policies-for-on-prem-applications/)\n",
    "   - [AppArmor](https://kubernetes.io/docs/tutorials/clusters/apparmor/)\n",
    "   - [seccomp](https://kubernetes.io/docs/tutorials/clusters/seccomp/)\n",
    "     - [gvisor](https://gvisor.dev/)\n",
    "     - [Kubernetes Runtime Class](https://kubernetes.io/docs/concepts/containers/runtime-class/)\n",
    "   - [Linux Capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html), [Outlook to PodSecurityPolicies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)\n",
    "- [Container Runtimes](https://kubernetes.io/docs/setup/production-environment/container-runtimes/)\n",
    "  - [Open Container Initiative](https://opencontainers.org/) \n",
    "- Signatures\n",
    "   - [Signing with Skopeo](https://github.com/containers/skopeo)\n",
    "     - [IBM](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontent)\n",
    "     - [Skopeo and OpenShift](https://www.openshift.com/blog/signing-and-verifying-container-images)\n",
    "     - [Verifying](https://developers.redhat.com/blog/2019/10/29/verifying-signatures-of-red-hat-container-images/)\n",
    "- Registry [Harbor](https://goharbor.io/)\n",
    "- Pods, Daemonsets, StatefulSets and other [Workloads](https://kubernetes.io/docs/concepts/workloads/controllers/)\n",
    "- Secure Containers\n",
    "   - [Snyk Node.js](https://snyk.io/blog/hacking-docker-containers-by-exploiting-base-image-vulnerabilities/)\n",
    "   - [Google best practices for building containers](https://cloud.google.com/solutions/best-practices-for-building-containers)\n",
    "   - [Minimal go container from scratch](https://github.com/endocode/minimal-go-container-from-scratch)\n",
    "   - [Google Distroless](https://github.com/GoogleContainerTools/distroless)\n",
    "   - [Alpine](https://www.alpinelinux.org/), [Ariadne Conill's Blog](https://ariadne.space/) \n",
    "   - [Unprivileged NGinx](Unprivileged.ipynb)\n",
    "   - [Impftermine App](https://github.com/kiebitz-oss/apps)\n",
    "- [Access to the host file system](Kube-Scan-Cloudbomb.ipynb)\n",
    "- [Secure Architecture](https://www.heise.de/hintergrund/Kubernetes-Security-Teil-3-Im-Spannungsfeld-von-Komplexitaet-und-Sicherheit-4862263.html?seite=all)\n",
    "-  Standards\n",
    "  - [BSI - Baustein Container](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-GS-Kompendium_Einzel_PDFs_2022/07_SYS_IT_Systeme/SYS_1_6_Containerisierung_Edition_2022.pdf?__blob=publicationFile&v=3#download=1)\n",
    "  - [BSI - Kubernetes](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-GS-Kompendium_Einzel_PDFs_2022/06_APP_Anwendungen/APP_4_4_Kubernetes_Edition_2022.pdf?__blob=publicationFile&v=3)\n",
    "  - [BSI - Bausteine (Drafts) - Benutzerdefinierter Baustein Container unter openshift](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-Grundschutz-Modernisierung/Benutzerdefinierte_BS/openshift.pdf)\n",
    "    - [OpenShift Installation](https://docs.openshift.com/container-platform/4.6/installing/installing_bare_metal/installing-bare-metal.html)\n",
    "    - [Code Ready Containers](https://github.com/code-ready/crc)\n",
    "    - [Heise Artikel über Kubernetes Grundschutz](https://www.heise.de/hintergrund/IT-Grundschutz-BSI-Anforderungen-fuer-Container-und-Kubernetes-6200393.html) Vorsicht, manchmal sehr ungenau\n",
    "  - [CIS - Docker Benchmarks](https://www.cisecurity.org/benchmark/docker/)\n",
    "  - [CIS - Kubernetes](https://www.cisecurity.org/?s=kubernetes)\n",
    "  - [kube-bench und kubescape](kube-bench.ipynb)\n",
    "  - [Awesome K8S Security](https://github.com/magnologan/awesome-k8s-security) from [magnologan](https://twitter.com/magnologan)\n",
    "  - [Ian Coldwater](https://twitter.com/IanColdwater)\n",
    "  - [NIST Application Container Security Guide](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-190.pdf) \n",
    "  - DoD US Verteidigungsministerium\n",
    "    - [DoD Container Hardening Process Guide](https://dl.dod.cyber.mil/wp-content/uploads/devsecops/pdf/Final_DevSecOps_Enterprise_Container_Hardening_Guide_1.1.pdf)\n",
    "    - [DoD Enterprise DevSecOps Reference Design](https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf)\n",
    "    - [DoD Enterprise DevSecOps Reference Design: CNCF Kubernetes ](https://dodcio.defense.gov/Portals/0/Documents/Library/DevSecOpsReferenceDesign.pdf)\n",
    "  - [NSA Hardening Guidance](https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/1/CTR_KUBERNETESHARDENINGGUIDANCE.PDF)\n",
    "    - [Kubernetes.io: Closer LOok on the NSA Kubernetes Hardening Guide](https://kubernetes.io/blog/2021/10/05/nsa-cisa-kubernetes-hardening-guidance/)\n",
    "    - [Aquasecurity: A Closer Look Into the NSA Kubernetes Hardening Guide](https://blog.aquasec.com/nsa-kubernetes-hardening-guide)\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "3959f762",
   "metadata": {},
   "source": [
    "# Networks\n",
    "\n",
    "- Ingress seems to be broken [Ingress Recap](Ingress.ipynb)\n",
    "  - Kong to the rescue\n",
    "      - [Kong Start](IngressKongStart.ipynb)\n",
    "      - [Kong Example](IngressKong.ipynb)\n",
    "  - [cert-manager](https://github.com/jetstack/cert-manager)\n",
    "    - [ACME](https://de.wikipedia.org/wiki/Automatic_Certificate_Management_Environment)\n",
    "      - [Boulder](https://github.com/letsencrypt/boulder)\n",
    "      - [Smallstep](https://github.com/smallstep)\n",
    "      - [Digicert](https://docs.digicert.com/certificate-tools/Certificate-lifecycle-automation-index/automation-user-guide/install-automation-agent-webserver/)\n",
    "    - [Example Helm Template](https://github.com/impfen/kubernetes/blob/main/charts/kiebitz/templates/issuer.yaml)\n",
    "  - [see Google cloud-proxy](https://github.com/GoogleCloudPlatform/cloudsql-proxy)\n",
    "  - [mkcert](https://github.com/FiloSottile/mkcert)\n",
    "- Istio\n",
    "  - Service Mesh\n",
    "  - [The service mesh manifesto](https://buoyant.io/service-mesh-manifesto/)\n",
    "  - [Distributed Firewall](https://www1.cs.columbia.edu/~smb/papers/ccs-df.pdf)\n",
    "  - [NIST Zero Trust](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf)\n",
    "  - [US Federal Zero Trust Strategy](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf)\n",
    "  - [Installation](Istio1.8.2.ipynb)\n",
    "  - [Traffic Management](Istio-Traffic-Mgmt.ipynb)\n",
    "  - [Hack](IstioHack.ipynb)\n",
    "  - Fix it\n",
    "    - [A Hacker’s Guide to Kubernetes Networking](https://thenewstack.io/hackers-guide-kubernetes-networking/)\n",
    "    - [Kubernetes Networking](https://kubernetes.io/docs/concepts/cluster-administration/networking/)\n",
    "    - CNI [Network Plugins](https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/)\n",
    "    - [Istio CNI](https://istio.io/latest/docs/setup/additional-setup/cni/)\n",
    "    - [Istio Platforms](https://istio.io/latest/docs/concepts/what-is-istio/#platform-support)\n",
    "  - Other Meshes\n",
    "    - [Service Mesh](https://servicemesh.es/)\n",
    "- [NetworkPolicies](NetworkPolicy.ipynb)\n",
    "  - Calico\n",
    "  - Traffic Control\n",
    "  - Testing with Netcat\n",
    "  - [Multi Tenancy](https://blog.jessfraz.com/post/hard-multi-tenancy-in-kubernetes/)\n",
    "- Misc\n",
    "  - Maglev \n",
    "    - [GitHub](https://github.com/kkdai/maglev)\n",
    "    - [Google Research](https://research.google/pubs/pub44824/)\n",
    "  - [Wireguard Wormhole](https://goteleport.com/blog/announcing-wormhole/)\n",
    "  - [CNCF Landscape Networking](https://landscape.cncf.io/card-mode?category=cloud-native-network&grouping=category)\n",
    "  - [Machine Config Operator](https://github.com/openshift/machine-config-operator)\n",
    "  - [Multus](https://github.com/k8snetworkplumbingwg/multus-cni)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "bc5acd4f",
   "metadata": {},
   "source": [
    "## Kubernetes Hardening\n",
    "\n",
    "- Resilience Concepts\n",
    "  - [Google SRE](https://sre.google/books/)\n",
    "  - High Availibity\n",
    "  - Highest Availibility\n",
    "    - [BSI Standortwahl](hhttps://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/RZ-Sicherheit/Standort-Kriterien_Rechenzentren.html)\n",
    "    - [Kommentar der f-i-ts: Georedundanz](https://www.finsurance-it-services.de/blog/bsi-anforderungen-die-georedundanz)\n",
    "  - Design for Resilience\n",
    "    - Racks, Zones, Regions\n",
    "    - Resilience Testing\n",
    "      - [Chaos Engineering](https://en.wikipedia.org/wiki/Chaos_engineering)\n",
    "      - [The Netflix Symian Army](https://netflixtechblog.com/the-netflix-simian-army-16e57fbab116)\n",
    "      - [Blast Radius: AWS](https://aws.amazon.com/de/getting-started/fundamentals-core-concepts/)\n",
    "    -[Eschborner Landstraße 100](https://www.google.de/maps/place/Eschborner+Landstra%C3%9Fe+100,+60489+Frankfurt+am+Main/@50.1295737,8.5978761,521m/data=!3m1!1e3!4m5!3m4!1s0x47bd0996b4099c65:0x3114c7b98478ce03!8m2!3d50.1281919!4d8.6014355)  \n",
    "- [12factor](https://12factor.net/)\n",
    "- Databases\n",
    "  - Concepts\n",
    "    - Migration vs Clustering\n",
    "    - Load considerations\n",
    "      - High Availibility\n",
    "      - Node Restore under load\n",
    "    - Level of Done\n",
    "    - Infrastructure Nodes\n",
    "  - [Postgres Operator by Zalando](Postgres%20Zalando.ipynb), at [Operator Hub](https://operatorhub.io/operator/postgres-operator)\n",
    "  - [Vitesse](https://vitess.io/)\n",
    "  - [Bloomberg Solr](https://2019.berlinbuzzwords.de/19/session/running-solr-within-kubernetes-scale.html)\n",
    "  - [Snapshots](https://kubernetes.io/docs/concepts/storage/volume-snapshots/)\n",
    "  - [Encrypted Volumes](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/)\n",
    "- [Audit Logs](AuditLogs.ipynb)\n",
    "  - [FluentD](https://docs.fluentd.org/v/0.12/) \n",
    "- [Service Account Token](ServiceAccountToken.ipynb)\n",
    "- [OpenShift Examples](OpenShift/Overview.ipynb)\n",
    "- [Further Hardening](https://github.com/thomasfricke/container-hardening)\n",
    "- [Nico Meisenzahl escalation into Azure](https://github.com/nmeisenzahl/hijack-kubernetes/blob/main/docs/hands-on.md)\n",
    "- [Unprivileged $\\neq$ Hardened](Unprivileged.ipynb)\n",
    "- [PodSecurityPolicies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)\n",
    "  - [Basics](PodSecurityPolicyBasic.ipynb)\n",
    "  - [Permissive](PodSecurityPolicyPermissive.ipynb)\n",
    "  - [Strict](PodSecurityPolicyStrict.ipynb)\n",
    "- [Accounts and Permissions](AccountWithRBAC.ipynb)  \n",
    "- [Heise Artikel](https://www.heise.de/hintergrund/Kubernetes-Security-Teil-3-Im-Spannungsfeld-von-Komplexitaet-und-Sicherheit-4862263.html?seite=all)\n",
    "- OAuth2\n",
    "- [OpenPolicyAgent](OpenPolicyAgent.ipynb)\n",
    "  - [Rego Examples](https://gist.github.com/garethr/ea41afb1b6562cdb2b1555719f51f90e)\n",
    "  \n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a0f85516",
   "metadata": {},
   "source": [
    "# Breaking news - latest\n",
    "\n",
    "- [CVE-2021-25742 Ingress Nginx Lua Snippets](https://github.com/kubernetes/ingress-nginx/issues/7837)\n",
    "- [Impftermine - Kiebitz](https://github.com/kiebitz-oss/kubernetes)\n",
    "- [Cilium Beta](https://cilium.io/blog/2021/12/01/cilium-service-mesh-beta)\n",
    "- [StackRox](https://www.stackrox.com/), [aquired by Redh Hat](https://www.redhat.com/en/blog/red-hat-closes-acquisition-stackrox)\n",
    "- [Cosign](https://github.com/sigstore/cosign)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "bb379724",
   "metadata": {},
   "source": [
    "# Sources\n",
    "\n",
    "- [Talk ContainerConf](https://drive.google.com/file/d/15EHHoFQWa4m_GfIAYqTvYmXWU3Kg2Ig6/view)\n",
    "- [Securing a Cluster](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/)\n",
    "- [Concepts Security](https://kubernetes.io/docs/concepts/security/), what?\n",
    "- [The Definitive\n",
    "Guide to Securing\n",
    "Kubernetes\n",
    "Liz Rice, Brendan Burns: The Definitive\n",
    "Guide to Securing\n",
    "Kubernetes](https://cdn2.hubspot.net/hubfs/1665891/Assets/The%20Definitive%20Guide%20to%20Securing%20Kubernetes.pdf), advertising\n",
    "- [Liz Rice & Michael Hausenblas: Kubernetes Security](https://cdn2.hubspot.net/hubfs/1665891/Assets/Kubernetes%20Security%20-%20Operating%20Kubernetes%20Clusters%20and%20Applications%20Safely.pdf) better, but still too basic"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "9508d1f9",
   "metadata": {},
   "source": [
    "# High Availability\n",
    "\n",
    "## Höchstverfügbarkeit \n",
    "[Georedundanz](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Sicherheitsberatung/Standort-Kriterien_RZ/Standort-Kriterien_Rechenzentren.pdf)\n",
    "\n",
    "## Resilience\n",
    "### Chaos Engineering\n",
    "### "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "id": "2deb0761",
   "metadata": {},
   "outputs": [],
   "source": [
    "rm -f my-kubeconfig my-namespace-rbac.dot my-namespace-rbac.png minikube.dot minikube.png notebooks.tgz\n",
    "(cd .. ; tar cfz  /tmp/notebooks.tgz  --no-recursion  notebooks/*.* )"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "id": "0cb9925a",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "notebooks/AccountWithRBAC.ipynb\n",
      "notebooks/AuditLogs.ipynb\n",
      "notebooks/ClusterOverview.ipynb\n",
      "notebooks/ContainerdCloudbomb.ipynb\n",
      "notebooks/CrioBomb.ipynb\n",
      "notebooks/Helm.ipynb\n",
      "notebooks/Ingress.ipynb\n",
      "notebooks/IngressStart.ipynb\n",
      "notebooks/Istio-Traffic-Mgmt.ipynb\n",
      "notebooks/Istio1.8.2.ipynb\n",
      "notebooks/IstioHack.ipynb\n",
      "notebooks/Kube-Scan-Cloudbomb.ipynb\n",
      "notebooks/KubernetesBasics.ipynb\n",
      "notebooks/Linux Namespaces.ipynb\n",
      "notebooks/NetworkPolicy.ipynb\n",
      "notebooks/OpenPolicyAgent.ipynb\n",
      "notebooks/Overview.ipynb\n",
      "notebooks/PodSecurityPolicyBasic.ipynb\n",
      "notebooks/PodSecurityPolicyPermissive.ipynb\n",
      "notebooks/PodSecurityPolicyStrict.ipynb\n",
      "notebooks/Postgres Zalando.ipynb\n",
      "notebooks/ServiceAccountToken.ipynb\n",
      "notebooks/Unprivileged.ipynb\n",
      "notebooks/audit-policy.yaml\n",
      "notebooks/docker-hypervisor.png\n",
      "notebooks/istio-1.8.2/\n",
      "notebooks/kube-bench.ipynb\n"
     ]
    }
   ],
   "source": [
    "mv  /tmp/notebooks.tgz .\n",
    "tar tzf notebooks.tgz"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b06c007f",
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "27fab98c",
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "markdown",
   "id": "7b3500c4",
   "metadata": {},
   "source": [
    "# Break until 15:00"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e9fdfde2",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Bash",
   "language": "bash",
   "name": "bash"
  },
  "language_info": {
   "codemirror_mode": "shell",
   "file_extension": ".sh",
   "mimetype": "text/x-sh",
   "name": "bash"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}