QUENTIN PETRAROIA: Hello. My name is
Quentin Petraroia,
and today we're going to be talking about
secure deployments on AKS.
Microsoft Defender for Cloud is a tool for
security posture management and threat protection.
This tool has many plans,
and one of them is for containers.
This is called Microsoft Defender for Containers,
and it is the Cloud native solution
for container security.
Defender for Containers will help you enable
Azure Policies to secure your cluster.
You can apply and enforce built-in security policies on
your cluster using the policies that
Defender recommends.
Azure Policy helps to enforce
organizational standards and to
assess compliance at scale.
In this demo, we're going to be enabling in
Azure Policy through Microsoft Defender for Containers.
We're then going to check that
that policy is correctly set
up and we're going to test
that policy with GitHub actions.
One deployment will pass and one deployment will fail.
Now let's get into the demo.
Starting off in our AKS cluster,
the first thing that we have to do is make sure
that Microsoft Defender for Cloud is turned on.
We can go to Microsoft Defender
and click the Getting Started tab.
Once on the Getting Started tab,
we can click our subscription
and make sure that's turned on.
As you can see here,
I already have it turned on for containers.
If you didn't have it turned on at this point,
all you have to do is toggle the
switch and click "Save".
Now we can double check that is turned on by going
to the Security tab in our AKS cluster.
As you can see here,
it says on in bold font.
Now we can go to the recommendation tab
and look at vulnerabilities that we should fix.
We're going to first sort
the resource type by Kubernetes Service.
This allows us to just quickly glance at
exactly Kubernetes focused areas of improvement.
We click Kubernetes service and let's see what pops up.
As you can see, remediate vulnerabilities
is at the top of the list,
and one that stands out to us is
container images should be deployed
from trusted registries only.
The first thing you can do here
is deny at the subscription level.
If you click that denial option,
you can pick the subscription
that you would wish to deny on.
We already have that set up with
our compute PM subscription.
Now let's actually just create the policy definition.
What we're going to do is we're going to make sure
that our policy follows a certain standard.
This is that if anything
outside of our specific registry
that we want, it will be denied.
We're setting that up right now,
I'm going to make sure that we set the scope properly.
We're going to pick our subscription and then
we're going to pick our resource group.
Just like that, we now have a policy set up.
Now it takes around 30 minutes to set in,
so let's give it some time and we'll come back soon.
Now that the 30 minutes have passed,
we can go and double check to
see if that policy is actually set up.
By going to our AKS cluster and clicking the Policy tab,
we can quickly go to Azure Policy
and check our policies that are active.
Once here, we scroll down and we can see
right here that that was the policy that we created.
Before we start deploying workloads,
we can just double check to see if everything's correct.
As you can see that assignment is there,
and if we go into it, we should see
that regex command that we put in.
Overall, everything looks really good,
so now let's start testing
and deploying workloads to our cluster.
Now let's kick off our workloads.
We have a test repo here,
and if we go to the GitHub action section,
we have two actions setup.
One is deploying an nginx container that uses
an ACR and another is deploying
an nginx container that's using an MCR.
If you remember, our policy states that anything that's
not using our specified ACR will be denied.
Let's test this action right now,
the one using the MCR and let's see what happens.
It looks like the building the place has kicked off.
Let's watch all the steps
happen live and see where exactly this error occurs.
It looks like the red x has popped up,
we can check out what the error is.
As you can see, it looks
like the error is the rollout status error.
We can then go to the AKS cluster
and see exactly what happened.
It looks like there's an error
with their nginx container.
We can go into the container and
see exactly what the problem is.
By going to the replica sets,
we can then go into events and see what the error is.
It looks like the request was denied.
If we scroll down,
we should be able to get a bit more information.
If you look here, we can see
that the request was denied and that
the container image that uses
the MCR has not been allowed,
so it looks like our policy worked.
The next thing we can do is test it with the ACR.
Let's just clean up these resources
and try that other GitHub action.
Now we can go back to our repo,
back to the action section,
and try the ACR action.
Now, this should work.
Because again, if you remember, we stated
that in our regex for our policy that
anything with our ACR
will be valid and will be able to be deployed.
Let's kick off this action and see what happens.
The action has now been kicked off,
we can sit back and wait for
the nginx container to be deployed
on to our AKS cluster.
We now have the green checkmark, so it should be good.
If we go back to our AKS cluster
and go to the workload section,
we should see our nginx container.
Now we can just double check our events and
our logs to make sure
that everything is deployed properly.
As you can see, everything looks like it's running.
If we go to events,
we can see that we have the scaled up
replica set, so everything looks good.
If we go to services,
we can see that our services is up as well.
We can go back into our container and go to
the replica sets and check out the events as
well just to see
a bigger picture of exactly what happened.
As you can see, everything was
successful and our policy works.
In summary, what we did in this demo
was enable Microsoft Defender for Containers.
We created an Azure Policy
that allowed us to only use images from
a trusted source and then we
tested that policy with GitHub actions.
If you would like to learn more about
Microsoft Defender for Containers,
Azure Policy, and GitHub actions,
please feel free to check out the links below.
Thank you for watching this demo.