oSC24 - NeuVector Integration into AWS CodePipeline CI and CD workflow

Slide 1

Slide 1 text

Dominik Wombacher [email protected] wombelix on libera.chat wombelix @wombelix:matrix.org NeuVector CI/CD Workflow with AWS CodePipeline Sr. Partner Solutions Architect, AWS @[email protected]

Slide 2

Slide 2 text

That’s me • Passionate Engineer • Open source contributor • bugfixes / features • packager • maintainer • Dog person & Dad Linus loves Geeko

Slide 3

Slide 3 text

NeuVector Introduction

Slide 4

Slide 4 text

NeuVector The Full Life-Cycle Container Security Platform

Slide 5

Slide 5 text

Challenges

Slide 6

Slide 6 text

NeuVector Features • Vulnerability Scanning

Slide 7

Slide 7 text

NeuVector Features • Vulnerability Scanning • Admission Control • Violation Protection • Threat Detection • DLP and WAF Sensors • Run-time Security • Compliance & Auditing • Endpoint/Host Security • Multi-Cluster Management • Container Quarantine • REST API, Syslog, Webhooks • Package capture • Authentication (LDAP, SAML, OIDC)

Slide 8

Slide 8 text

Risks to mitigate

Slide 9

Slide 9 text

Classic CI/CD Workflow Image source: https://docs.aws.amazon.com

Slide 10

Slide 10 text

Vulnerability scanning Image source: https://open-docs.neuvector.com

Slide 11

Slide 11 text

Run-time security Network Process File Access

Slide 12

Slide 12 text

NeuVector CI/CD Workflow Image source: https://docs.aws.amazon.com

Slide 13

Slide 13 text

Architecture

Slide 14

Slide 14 text

NeuVector Components • Controller • Enforcer • Manager • Scanner • Updater

Slide 15

Slide 15 text

NeuVector Architecture Image source: https://open-docs.neuvector.com Admin

Slide 16

Slide 16 text

NeuVector on Amazon EKS

Slide 17

Slide 17 text

CI/CD Workflow

Slide 18

Slide 18 text

Walkthrough

Slide 19

Slide 19 text

No content

Slide 20

Slide 20 text

No content

Slide 21

Slide 21 text

No content

Slide 22

Slide 22 text

No content

Slide 23

Slide 23 text

No content

Slide 24

Slide 24 text

No content

Slide 25

Slide 25 text

No content

Slide 26

Slide 26 text

No content

Slide 27

Slide 27 text

No content

Slide 28

Slide 28 text

No content

Slide 29

Slide 29 text

No content

Slide 30

Slide 30 text

No content

Slide 31

Slide 31 text

No content

Slide 32

Slide 32 text

No content

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

No content

Slide 35

Slide 35 text

Sample code

Slide 36

Slide 36 text

Sample code

Slide 37

Slide 37 text

buildspec.yaml

Slide 38

Slide 38 text

scan.sh

Slide 39

Slide 39 text

Sample code https://github.com/aws-samples/neuvector-vulnerability-scan-in-aws-codebuild

Slide 40

Slide 40 text

Happy End? Not yet … The Digest/RepoDigest problem

Slide 41

Slide 41 text

Digest/RepoDigest problem docker build > NeuVector Scan > Submit report: CodeBuild log: ERRO|SCN|main.main: Failed to sumit scan result - error=Submit scan result failed with status code 400 NeuVector log: DEBU|CTL|rest.handlerScanRepositorySubmit: - URL=/v1/scan/result/repository ERRO|CTL|rest.handlerScanRepositorySubmit: Missing image metadate in the request DEBU|CTL|rest.writer.WriteHeader: 400 - Method=POST URL=/v1/scan/result/repository

Slide 42

Slide 42 text

Digest/RepoDigest problem controller/rest/repository.go#L263 // Sanity check if result.ImageID == "" || result.Digest == "" || result.Repository == "" || result.Tag == "" { log.Error("Missing image metadate in the request") restRespErrorMessage(w, http.StatusBadRequest, api.RESTErrInvalidRequest, "Missing image metadate in the request") return }

Slide 43

Slide 43 text

Digest/RepoDigest problem docker build -t localhost:5000/testcontainer . docker inspect localhost:5000/testcontainer "Id": "sha256:a88710f44133fef9e94f7c10cd[...]", "RepoTags": [ "localhost:5000/testcontainer:latest" ], "RepoDigests": [],

Slide 44

Slide 44 text

Digest/RepoDigest problem docker build -t localhost:5000/testcontainer . docker inspect localhost:5000/testcontainer docker push localhost:5000/testcontainer "Id": "sha256:a88710f44133fef9e94f7c10cd[...]", "RepoTags": [ "localhost:5000/testcontainer:latest" ], "RepoDigests": [ "localhost:5000/testcontainer@sha256:021[...]" ],

Slide 45

Slide 45 text

Digest/RepoDigest workaround Start local registry > docker build > docker push to local registry > NeuVector Scan > Submit report

Slide 46

Slide 46 text

Digest/RepoDigest Bug https://github.com/neuvector/neuvector/issues/1423

Slide 47

Slide 47 text

Learn more

Slide 48

Slide 48 text

Virtual Workshop Secure Your CI/CD Pipeline with NeuVector by SUSE on AWS • Delivered by AWS and SUSE • Hands-on focused • ~3 hour duration • AWS Account provided • Free of charge, seats limited