Download to read offline
Uploaded byWeaveworks
Robust Network Security and Observability with GitOps and Cilium
The document discusses a webinar featuring experts from Weaveworks and Isovalent, focusing on robust network security and observability through GitOps and Cilium. It emphasizes the importance of GitOps for Kubernetes users and highlights various services and tools offered by Weaveworks, including continuous application delivery and advanced security measures. Additionally, it introduces Cilium as a powerful networking solution utilizing eBPF for enhanced security and visibility in cloud-native environments.
Robust Network Security and Observability with GitOps and Cilium
- 1. 1 Confidential do notdistribute Robust Network Security and Observability with GitOps and Cilium In partnership with:
- 2. 2 2 Webinar Platform -FAQs Using Zoom • You are in listen only mode • This webinar is being recorded • Q&A session will follow the presentation, please use the Q&A panel to submit questions • Hit escape to exit full screen • Slides and recording will be shared after the webinar Technical Issues - please visit Zoom Help https://support.zoom.us/hc/en-us/articles/206175806-Top-Questions
- 3. 3 3 Lutz Lange Solutions Architect,Weaveworks Lutz is a Solution Architect at Weaveworks. He lives in Berlin and has a long history in the Container, Kubernetes and Cloud Native space. He was one of the 1st attendees in Google's Kubernetes Training program back when Kubernetes was in its infancy. He has also worked at Red Hat, Instana, Pivotal and VMware and thinks that GitOps is something every serious user of Kubernetes needs. Speaker introduction Raphaël Pinson Solutions Architect, Isovalent Raphaël is a Solutions Architect with Cloud Native networking and security specialists Isovalent, creators of the Cilium eBPF-based networking project. He works on Cilium, Hubble & Tetragon and the future of Cloud-Native networking & security using eBPF. An early adopter of the DevOps principle, he has been a practitioner of Configuration Management and Agile principles in Operations for many years, with a special involvement in the Puppet and Terraform communities over the years.
- 4. 4 Weaveworks is backedby solid investors Weaveworks is a key partner with all the major infrastructure and Kubernetes vendors Weaveworks: the GitOps company Weaveworks is deeply committed to the Open Source Community
- 5. 5 Confidential do notdistribute 5 Battle Tested Weaveworks Approach Process Technical support Customer Reliability Engineering (CRE) ● Weaveworks approved expertise in Gitops, kubernetes & cloud native ● “Virtual” SRE ● Traditionally embeds in customers team ● Long term technical resourcing (6 month or 12 Months) Weave GitOps Services Weave GitOps Enterprise ● Curated platform- Clusters on-demand & Application Deployment ● Run Anywhere on any K8 platform ● Integrated security & Policy & Governance ● 24/7 Support Consulting, Professional Services, Training ● Workshops ○ Design, build, operate and Optimize ● POC Delivery ● Training ○ Skills Development ● Time and materials ○ Day Rate CAPABILITIES Reconciliation loop Monitor specific events in Git – repos, branches and/or folders Simple profile bootstrap Setup, provision and operate a custom, production-ready cluster Application management UI immediately detect drift between states as well as cluster health problems. Cluster fleet management Reuse cluster templates easily from git Team Management & Governance Segment responsibilities and enforce change control policies Advanced Security RBAC, Single Sign On (SSO)
- 6. 6 Confidential do notdistribute 6 Continuous Application Delivery - use GitOps to deploy and operate applications. Automation increases deployment velocity and developer productivity. Weave GitOps - Use Cases Kubernetes Everywhere - in the cloud or the datacenter Kubernetes is a universal platform that’s easy to manage with GitOps. DevOps Automation - Lifecycle management of the entire platform. All clusters and services, using automation and policy. 1 4 2 5 3 6 Self-Service Platforms - a complete platform giving developers autonomy while ensuring consistency and manageability. Trusted Delivery - shift policy and security left - governance, risk, and compliance are non-negotiable. Progressive Delivery - deploy services across many environments and regions reliably using GitOps
- 7. 7 Confidential do notdistribute 7 Weave GitOps Experience DEVELOPER EXPERIENCE • Continuous Delivery, observability, and monitoring • Consistent developer workflows across multiple deployments • Team workspaces for multi-tenanted usage OPERATOR EXPERIENCE • Extend Kubernetes to managed platform using GitOps model • An Open Source Kubernetes platform for on-premise deployment • Additive to manage Kubernetes (e.g., EKS, AKS or GKE) • Upgrades to new versions • Extensible controls to implement security and policy controls
- 8. 8 Confidential do notdistribute 8 Test IDE Build GitOps – An Operating Model for Cloud Native Unifying Deployment, Monitoring and Management. Git as the single source of truth of a system’s desired state ALL intended operations are committed by pull request ALL diffs between intended and observed state with automatic convergence ALL changes are observable, verifiable and auditable Kubernetes GitOps Continuous Integration GIT “Immutability Firewall” Deployment (clusters, apps) Monitoring Logging (Observability) Management (operations)
- 9. 9 App Team workspaces App Management Cluster App Leaf Cluster ProfilePolicy Management Management UI Weave GitOps Enterprise Kubernetes Cluster Management UI Management UI Multi Cluster Installer (CAPI) Weave GitOps Enterprise Kubernetes Weave GitOps Enterprise
- 10.
- 11. ● Open SourceProjects ● Company behind Cilium ● Provides Cilium Enterprise
- 12. What is Cilium? Atthe foundation of Cilium is the new Linux kernel technology eBPF, which enables the dynamic insertion of powerful security, visibility, and networking control logic within Linux itself. Besides providing traditional network level security, the flexibility of BPF enables security on API and process level to secure communication within a container or pod. Read More ● Networking & Load-Balancing ○ CNI, Kubernetes Services, Multi-cluster, VM Gateway ● Network Security ○ Network Policy, Identity-based, Encryption ● Observability ○ Metrics, Flow Visibility, Service Dependency
- 14. Makes the Linuxkernel programmable in a secure and efficient way. “What JavaScript is to the browser, eBPF is to the Linux Kernel”
- 16.
- 17.
- 18. Flow Visibility $ kubectlget pods NAME READY STATUS RESTARTS AGE tiefighter 1/1 Running 0 2m34s xwing 1/1 Running 0 2m34s deathstar-5b7489bc84-crlxh 1/1 Running 0 2m34s deathstar-5b7489bc84-j7qwq 1/1 Running 0 2m34s $ hubble observe --follow -l class=xwing # DNS lookup to coredns default/xwing:41391 (ID:16092) -> kube-system/coredns-66bff467f8-28dgp:53 (ID:453) to-proxy FORWARDED (UDP) kube-system/coredns-66bff467f8-28dgp:53 (ID:453) -> default/xwing:41391 (ID:16092) to-endpoint FORWARDED (UDP) # ... # Successful HTTPS request to www.disney.com default/xwing:37836 (ID:16092) -> www.disney.com:443 (world) to-stack FORWARDED (TCP Flags: SYN) www.disney.com:443 (world) -> default/xwing:37836 (ID:16092) to-endpoint FORWARDED (TCP Flags: SYN, ACK) www.disney.com:443 (world) -> default/xwing:37836 (ID:16092) to-endpoint FORWARDED (TCP Flags: ACK, FIN) default/xwing:37836 (ID:16092) -> www.disney.com:443 (world) to-stack FORWARDED (TCP Flags: RST) # ... # Blocked HTTP request to deathstar backend default/xwing:49610 (ID:16092) -> default/deathstar:80 (ID:16081) Policy denied DROPPED (TCP Flags: SYN) Flow Metadata ‒ Ethernet headers ‒ IP & ICMP headers ‒ UDP/TCP ports, TCP flags ‒ HTTP, DNS, Kafka, ... Kubernetes ‒ Pod names and labels ‒ Service names ‒ Worker node names DNS (if available) ‒ FQDN for source and destination Cilium ‒ Security identities and endpoints ‒ Drop reasons ‒ Policy verdict matches
- 19.
- 20.
- 21.
- 22. Zero Trust SecurityDemo namespace=raphink-0
- 23. OSS Community eBPF-based Networking, Observability,Security cilium.io cilium.slack.com Regular news Learn more about Cilium! Base technology The revolution in the Linux kernel, safely and efficiently extending the capabilities of the kernel. ebpf.io What is eBPF? - ebook For the Enterprise Hardened, enterprise-grade eBPF-powered networking, observability, and security. isovalent.com/product isovalent.com/labs
- 24. 24 Confidential do notdistribute 2 4 Questions? Please use the Q&A window to submit your questions.
- 25. 25 Whitepaper: Shifting SecurityLeft with GitOps and Trusted Delivery https://bit.ly/3MvzXgQ Learn more about Weave GitOps www.weave.works/enterprise Request a personal demo www.weave.works/contact Thank You
- 26. 26 Confidential do notdistribute 2 6 Thank you https://weave.works