Build and secure containers to support your CI/CD pipeline - Xebia Knowledge Exchange 2019-01-22

Today CI/CD servers support containers. However, in some restricted environments, people are not willing to shift the responsibility to create the containers to the development teams. Based on a recent assignment at a customer, it shows a way to allow teams to create their own build & deploy containers and at the same time maintain a level of security, paramount for a financial organisation.

Transcript

1. Build and secure containers to support your CI/CD pipeline
2. Hello! I am João Rosa I am Software Consultant, focused on Quality. You can find me at @joaoasrosa 2
3. Horror story What we found at a customer 1.
4. The most important systems in your organisation are: the payroll system and the CI/CD server. 4
5. Problems found with CI/CD server Lifecycle management There is not a lifecycle management on the tool. It has Critical CVE’s. Misconfiguration The server holds multiple services. Also, the configuration of the services is not secure. Agents drift The build and deploy agents are in a drift state. Plus, old frameworks are installed. 5
6. LEAD TIME For new capabilities. Such as a new version of a framework, or new tool features. 6
7. A way out What we proposed to the customer 2.
8. SaaS Move from the on-premises solution, to a SaaS solution. It will mitigate some of the risks. Proposed solution Shift responsibilities From manage tooling, to enable development teams to deliver value. 8
9. Use containers to build and deploy ▪ Today, mature solutions offer containers as compute unit ▪ Isolated by default (between jobs) ▪ Granular capabilities ▪ Allow teams to create the container images 9
10. With great power, comes great responsibility! Ben Parker 10
11. How about security? Teams are creating their own containers! 11 Photo by Alistair MacRobert on Unsplash
12. Back to basics… on software development code test deploy 12
13. A (possible) solution Implementation details 3.
14. What test means for containers in a financial institution? We can understand it as testing the capabilities and security. Other definitions? 14 Photo by Saffu on Unsplash
15. What does that means? ▪ Test the dependencies ▪ Scan the dependencies 15
16. Test Test the container image, to assert the dependencies are installed according to the expectations. What does that mean? Scan Scan the container image, discovering if there are problems with any of the dependencies. Bonus, is it possible to monitor it? 16
17. Implementation ▪ The container image definition is a Dockerfile ▪ Testing using Google’s Container Structure Tests ▪ Scanning and monitoring using Snyk However there are other tools! :) 17
18. DEMO TIME 18
19. Container Structure Tests ▪ Command tests ▪ File Existence tests ▪ File Content tests ▪ Metadata tests ▪ License tests * 19 * (licenses allowed by Google)
20. Snyk ▪ Scan dependencies ▪ Monitoring snapshots of the dependencies 20
21. Thanks! Any questions? You can find me at ▪ @joaoasrosa ▪ jrosa@xebia.com 21
22. Credits Special thanks to all the people who made and released these awesome resources for free: ▪ Presentation template by SlidesCarnival ▪ Photographs by Unsplash 22