oSC24 - NeuVector Integration into AWS CodePipeline CI and CD workflow

NeuVector is a open source container security platform. Key strengths are vulnerability and runtime scanning. I demonstrate in this talk how you ensure that only container images without a detected vulnerability move to the next stage in your Pipeline. How you define the baseline of allowed activities of your application. And how you can block the deployment into production if an unexpected behavior at runtime was detected in your testing stage. I'll use AWS CodePipeline, AWS CodeDeploy and AWS CloudFormation. The procedure is applicable to other toolset and Hybrid environments as well.

Transcript

1. Dominik Wombacher dominik@wombacher.cc wombelix on libera.chat wombelix @wombelix:matrix.org NeuVector CI/CD Workflow with AWS CodePipeline Sr. Partner Solutions Architect, AWS @wombelix@fosstodon.org
2. That’s me • Passionate Engineer • Open source contributor • bugfixes / features • packager • maintainer • Dog person & Dad Linus loves Geeko
3. NeuVector Introduction
4. NeuVector The Full Life-Cycle Container Security Platform
5. Challenges
6. NeuVector Features • Vulnerability Scanning
7. NeuVector Features • Vulnerability Scanning • Admission Control • Violation Protection • Threat Detection • DLP and WAF Sensors • Run-time Security • Compliance & Auditing • Endpoint/Host Security • Multi-Cluster Management • Container Quarantine • REST API, Syslog, Webhooks • Package capture • Authentication (LDAP, SAML, OIDC)
8. Risks to mitigate
9. Classic CI/CD Workflow Image source: https://docs.aws.amazon.com
10. Vulnerability scanning Image source: https://open-docs.neuvector.com
11. Run-time security Network Process File Access
12. NeuVector CI/CD Workflow Image source: https://docs.aws.amazon.com
13. Architecture
14. NeuVector Components • Controller • Enforcer • Manager • Scanner • Updater
15. NeuVector Architecture Image source: https://open-docs.neuvector.com Admin
16. NeuVector on Amazon EKS
17. CI/CD Workflow
18. Walkthrough
35. Sample code
36. Sample code
37. buildspec.yaml
38. scan.sh
39. Sample code https://github.com/aws-samples/neuvector-vulnerability-scan-in-aws-codebuild
40. Happy End? Not yet … The Digest/RepoDigest problem
41. Digest/RepoDigest problem docker build > NeuVector Scan > Submit report: CodeBuild log: ERRO|SCN|main.main: Failed to sumit scan result - error=Submit scan result failed with status code 400 NeuVector log: DEBU|CTL|rest.handlerScanRepositorySubmit: - URL=/v1/scan/result/repository ERRO|CTL|rest.handlerScanRepositorySubmit: Missing image metadate in the request DEBU|CTL|rest.writer.WriteHeader: 400 - Method=POST URL=/v1/scan/result/repository
42. Digest/RepoDigest problem controller/rest/repository.go#L263 // Sanity check if result.ImageID == "" || result.Digest == "" || result.Repository == "" || result.Tag == "" { log.Error("Missing image metadate in the request") restRespErrorMessage(w, http.StatusBadRequest, api.RESTErrInvalidRequest, "Missing image metadate in the request") return }
43. Digest/RepoDigest problem docker build -t localhost:5000/testcontainer . docker inspect localhost:5000/testcontainer "Id": "sha256:a88710f44133fef9e94f7c10cd[...]", "RepoTags": [ "localhost:5000/testcontainer:latest" ], "RepoDigests": [],
44. Digest/RepoDigest problem docker build -t localhost:5000/testcontainer . docker inspect localhost:5000/testcontainer docker push localhost:5000/testcontainer "Id": "sha256:a88710f44133fef9e94f7c10cd[...]", "RepoTags": [ "localhost:5000/testcontainer:latest" ], "RepoDigests": [ "localhost:5000/testcontainer@sha256:021[...]" ],
45. Digest/RepoDigest workaround Start local registry > docker build > docker push to local registry > NeuVector Scan > Submit report
46. Digest/RepoDigest Bug https://github.com/neuvector/neuvector/issues/1423
47. Learn more
48. Virtual Workshop Secure Your CI/CD Pipeline with NeuVector by SUSE on AWS • Delivered by AWS and SUSE • Hands-on focused • ~3 hour duration • AWS Account provided • Free of charge, seats limited
49. Workshop session #1 • July 17th 2024 at 7:30 AM PT / 10:30 AM ET
50. Workshop session #2 • July 30th 2024 at 10:00 AM CEST
51. Thank you! Feedback? Questions? https://pulse.aws/survey/O0RAERVC