Is it Observable

Episode : OPAGatekeeper

This repository contains the files utilized during the tutorial presented in the dedicated IsItObservable episode explaining how to create Security Policies using OPA Gatekeeper.

this tutorial will also utilize the OpenTelemetry Operator with:

• the OpenTelemetry Demo
• the hipster-shop
• istio All the observability data generated by the environment would be sent to Dynatrace.

Prerequisite

The following tools need to be install on your machine :

• jq
• kubectl
• git
• gcloud ( if you are using GKE)
• Helm

1.Create a Google Cloud Platform Project

PROJECT_ID="<your-project-id>"
gcloud services enable container.googleapis.com --project ${PROJECT_ID}
gcloud services enable monitoring.googleapis.com \
cloudtrace.googleapis.com \
clouddebugger.googleapis.com \
cloudprofiler.googleapis.com \
--project ${PROJECT_ID}

2.Create a GKE cluster

ZONE=europe-west3-a
NAME=isitobservable-gatekeeper
gcloud container clusters create ${NAME} --zone=${ZONE} --machine-type=e2-standard-4 --num-nodes=2

Getting started

Dynatrace Tenant

1. Dynatrace Tenant - start a trial

If you don't have any Dynatrace tenant , then I suggest to create a trial using the following link : Dynatrace Trial Once you have your Tenant save the Dynatrace tenant url in the variable DT_TENANT_URL (for example : https://dedededfrf.live.dynatrace.com)

DT_TENANT_URL=<YOUR TENANT Host>

2. Create the Dynatrace API Tokens

The dynatrace operator will require to have several tokens:

• Token to deploy and configure the various components
• Token to ingest metrics and Traces

Operator Token

One for the operator having the following scope:

• Create ActiveGate tokens
• Read entities
• Read Settings
• Write Settings
• Access problem and event feed, metrics and topology
• Read configuration
• Write configuration
• Paas integration - installer downloader

Save the value of the token . We will use it later to store in a k8S secret

API_TOKEN=<YOUR TOKEN VALUE>

Ingest data token

Create a Dynatrace token with the following scope:

• Ingest metrics (metrics.ingest)
• Ingest logs (logs.ingest)
• Ingest events (events.ingest)
• Ingest OpenTelemetry
• Read metrics

Save the value of the token . We will use it later to store in a k8S secret

DATA_INGEST_TOKEN=<YOUR TOKEN VALUE>

Istio

1. Download Istioctl

curl -L https://istio.io/downloadIstio | sh -

This command download the latest version of istio compatible with our operating system. 2. Add istioctl to you PATH

cd istio-1.22.0

this directory contains samples with addons . We will refer to it later.

export PATH=$PWD/bin:$PATH

4.Clone Github repo

git clone https://github.com/isitobservable/OPA_Gatekeeper
cd OPA_Gatekeeper

5. Deploy most of the components for The collector

The application will deploy the entire environment:

chmod 777 deployment.sh
./deployment.sh  --clustername "${NAME}" --dturl "${DT_TENANT_URL}" --dtingesttoken "${DATA_INGEST_TOKEN}" --dtoperatortoken "${API_TOKEN}" 

6. Deploy OPA Policies

1. Create a namespace for vulnerable workload

kubectl create ns goat-app 
kubectl label ns goat-app type=app

2. Deploy the General Constraints

kubectl apply -k opa_gatekeeper/general

3. Deploy pod security policies

kubectl apply -k opa gatekeeper/podsecurity

4. Deploy unsafe workload

kubectl apply -f k8sGoat/hunger_check.yaml
kubectl apply -f k8sGoat/health_check.yaml -n goat-app
kubectl apply -f k8sGoat/internal_proxy.yaml -n goat-app
kubectl apply -f k8sGoat/kube_bench_node.yaml -n goat-app
kubectl apply -f k8sGoat/kube_bench_security.yaml -n goat-app
kubectl apply -f k8sGoat/system-monitor.yaml -n goat-app

5. Observe the OPA GateKeeper Audit

The OpenTelemetry Collectors are configured to collect the logs and traces from OPA Gatekeeper. Let's deploy the dashboard located : dynatrace/Gatekeeper.json

This dashboard will keep track on the behavior of OPA Gatekeeper and the various violation.

6. Delete unsafe workload

kubectl delete -f k8sGoat/hunger_check.yaml
kubectl delete -f k8sGoat/health_check.yaml -n goat-app
kubectl delete -f k8sGoat/internal_proxy.yaml -n goat-app
kubectl delete -f k8sGoat/kube_bench_node.yaml -n goat-app
kubectl delete -f k8sGoat/kube_bench_security.yaml -n goat-app
kubectl delete -f k8sGoat/system-monitor.yaml -n goat-app