Skip the anxiety attack when building secure containerized apps
- 1. Think 2018 / © 2018 IBM Corporation Skip the Anxiety Attack when Building Secure Containerized Apps — Lewis Evans Senior Software Engineer, IBM Container Service Development
- 2. Contents 2Think 2018 / © 2018 IBM Corporation • What is all of this new technology? Ø containers, microservices, orchestration • I’m scared to run in the cloud • How can IBM help me?
- 3. Definitions
- 4. A standard way to package an application and all its dependencies so that it can be moved between environments and run without changes. Containers work by isolating the differences between applications inside the container so that everything outside the container can be standardized. Containers
- 5. IBM Cloud Container Service | IBM Confidential | ©2017 IBM Corporation Container Use Cases Create new cloud-native apps Streamline development with built-in microservices, runtimes, containers and Kubernetes orchestration plus integrated management. Modernize your heritage apps on cloud Move your apps as-is to the cloud or re- factor an app and use it in new development and application workload models. Open your data center to work with cloud services Protect and leverage your in-house data and pull in external
- 6. Allows users to define how to coordinate the containers in the cloud when the multi-container packaged application is deployed. • Scheduling • Cluster management • Service discovery • Provisioning • Monitoring • Configuration management Container Orchestration
- 7. An engineering approach focused on decomposing an application into single-function modules with well defined interfaces which are independently deployed and operated by a small team who owns the entire lifecycle of the service. Microservices accelerate delivery by minimizing communication and coordination between people while reducing the scope and risk of change. Microservices
- 8. Problem
- 9. “Over 30% of Official Images in DockerHub Contain High Priority Security Vulnerabilities” Banyan Ops report Source: http://bit.ly/2eknhJs “80% of attacks leverage known vulnerabilities and configuration management setting weaknesses” US State Department report Source: http://bit.ly/2esbkke The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users. Source: http://heartbleed.com The consequences of an attacker successfully exploiting this vulnerability on a Web server are serious in nature. For example attackers may have the ability to dump password files or download malware on to infected computers. Once inside the victim’s firewall, the attackers could then compromise and infect other computers on the network. Source: http://symc.ly/2e1blNM IBM Cloud Container Service | ©2018 IBM Corporation
- 10. Sometimes things don’t go as planned…
- 11. Many possibilities for failure • Failures WILL happen • Their root causes can be complex and affect different number of users • Reduce the likelihood of correlated failures • Recover quickly • Proactive detection of problems before they happen Datacenter Server Rack Server Virtual Server Code Request
- 12. Being competitive requires: – Rapid delivery – Leveraging public cloud – Simple, rapid scaling
- 13. Container and microservice considerations: - Monitoring - Logging - Security - Application versioning - Root cause analysis - Persistent storage - Docker engine management - Kubernetes version
- 15. A managed Kubernetes service providing an intuitive user experience with on-going cluster management. Built-in security and isolation to enable rapid delivery of apps, while leveraging IBM Cloud Services including Weather data, IoT, Analytics, or AI capabilities with Watson. Available in six IBM regions WW, including 19 datacenters. Kubernetes Certified Service Provider Kubernetes Technology Partner Kubernetes Service Providers IBM Cloud Container Service | ©2018 IBM Corporation
- 17. Intelligent Scheduling Self-healing Horizontal scaling Service discovery & load balancing Automated rollouts and rollbacks Secret and configuration management IBM Cloud Container Service | ©2018 IBM Corporation
- 18. API UI CLI Kubernetes Master Worker Node 1 Worker Node 2 Worker Node 3 Worker Node n Registry • Etcd • API Server • Controller Manager Server • Scheduler Server Kubernetes Architecture
- 20. Simplified cluster management Extend with IBM Cloud & Watson Container security & isolation Automated toolchains Native open-source experience Integrated operational tools IBM Cloud Container Service | ©2018 IBM Corporation
- 21. • Intuitive graphical user experience • CLI and API alternatives • Fully managed master nodes • User controlled worker node management Simplified Cluster Management IBM Cloud Container Service | ©2018 IBM Corporation
- 22. • Provides Docker image and running container scanning to detect vulnerabilities and configuration weaknesses with Vulnerability Advisor • Image security enforcement • Store your images securely in your hosted private registry • Docker image signing • Automatic encryption of secrets and volumes • Isolated networking and storage Container Security & Isolation IBM Cloud Container Service | ©2018 IBM Corporation
- 23. Design Your Own Cluster • Tunable capacity • Select between shared and dedicated compute • Edge nodes • Configurable networking and storage • Integrated VPN IBM Cloud Container Service | ©2018 IBM Corporation
- 24. Extend IBM Cloud Services • Enhance your application with Watson, IoT, Analytics and Data Services • Persistent Volumes using IBM Cloud storage • IP and application Load Balancing • Integrated with IBM Cloud access management IBM Cloud Container Service | ©2018 IBM Corporation
- 25. Native Kubernetes Experience • Seamless experience moving from local development to IBM Bluemix • 100% Kubernetes API and tools • Supports Kubernetes dashboard • Leverage Docker images IBM Cloud Container Service | ©2018 IBM Corporation
- 26. Integrated Operational Tools • Built-in log and metrics collection with IBM Bluemix log and metrics services • Use with IBM DevOps tools such as Delivery Pipeline • Supports popular add-ons including Prometheus, Weave, sysdig, fluentd and others IBM Cloud Container Service | ©2018 IBM Corporation
- 27. Hardware level trust in the cloud?
- 28. Introducing: IBM Cloud Container Service with Trusted Compute 28Think 2018 / DOC ID / Month XX, 2018 / © 2018 IBM Corporation Image Area Tamper-proof assurance with a chain of trust, rooted in hardware Audit the trusted status of Bare-metal Kubernetes worker nodes for compliance needs Uniquely secure: Containers protection from the hardware up, available only from IBM
- 29. How IBM delivers IBM Cloud Container Service with Trusted Compute Tamper-proof integrity assurance with a chain of trust rooted in hardware with Intel® Trusted Execution Technology (Intel® TXT) • Hardware Root of Trust with Intel® TXT • Chain of Trust & Attestation with Intel Cloud Integrity Technology (Intel ® CIT) • Transparent visibility of Integrity assurance to Kubernetes orchestration • Container Integrity with Docker Trust • Audit Logging and Continuous Monitoring 29
- 30. Skip the Anxiety Attack When Building Secure Containerized Apps
- 31. Skip the Anxiety Attack When Building Secure Containerized Apps • Integrated security insights with Vulnerability Advisor • Control access to cluster and containerized apps • Network isolation • Physical server isolation in the cloud • Easy development with portable Docker containers • Fast and scalable deployments with Kubernetes • Create HA clusters and apps • Operations support with native tools and 3rd party tools • Modernize your apps using 170+ services from IBM Cloud catalog, including Watson, Weather, IoT, or Data
- 32. What do our users say? “easy setup compared to the other cloud services like AWS, Google cloud and Azure.” “The biggest factor is that the cluster is managed. The cluster management of kubernetes is a component with a lot of learning cost high recognition.” “Voice Gateway + Watson is used to validate call center solutions” “high speed” “simple to use” “Its right on the mark in terms of control and also you have a free option. I am experimenting with blockchain using CS” “We believe that it is attractive that you can leave the infrastructure management part of the kubernetes cluster, verify the safety of containers, and the part of cooperation with bluemix team.”
- 33. Thank you 33Think 2018 / © 2018 IBM Corporation Lewis Evans Senior Software Engineer, IBM Cloud Container Service Development — Lewis.evans@uk.ibm.com Learn more: ibm.biz/ibm-k8s