Andrew Martin, Control Plane | KubeCon + CloudNativeCon NA 2022

This is texturing TV. I said we would be back. Welcome back to kubecon.

I miss my cue here. So it's late in the day where I'll having fun. Welcome back to kubecon 2022 here in Detroit Motor City Detroit City.

We're having a great time talking about security kubernetes Cloud native all kinds of good stuff the great pleasure being joined by Andrew Martin welcome. We had a chance to meet earlier today. That was fantastic and I knew about your book and said, hey, we'll need to come over and let's chat about the book.

There you go. Get the money shot in here get the book. So first of all, tell us about yourself and tell us about control playing your company.

Thank you very much for having me here. My name is Andy. I found the control playing five years ago focus on cloud native security.

We've been working with regulated Industries critical National infrastructure in the UK and we still Cloud native is the future. Of course, Michael Carlson of Linux deployment models the clarity configuration. But the security properties of kubernetes took a while to materialize it was the right decision because of course the project gained huge adoption and we see prevalent usage throughout the world.

But specifically within highly regulated organizations that declarative model lends itself. So well to static testing before deployments. That we could see where the curve was going, and I've been working with Docker and containerization since about 2013.

As a result of having the privilege of shipping systems at that kind of time and having experience of working within regulated Industries. We started to control plane to provide cloud-native consultancy and audits for regulated Industries governments Healthcare financial services, and we're very proud to have just opened up in North America just last week and we look forward to going into australasia and opening up next week now business is good if you're opening office, that's a good sign, right? You know, what's what's interesting?

I'm curious your thoughts on this with kind of declarative environments things that were, you know, pulling out of repository for configuring code and environments. I would I would guess now you're in London a good reason because it's a good, you know world financial center, right? Let's talk about regulated industry.

Does it help does that help with your governance and compliance and audit? Or it might help but it's it's kind of overtaken by other complexities. In terms of our geographic location, it's really useful because there are certain.

Gravity Wells for people who are interested in kind of things pandemic has changed that to a large extent but we have Canary Wharf which is our financial center or secretary. We also have the city of London and we have a preponderance of people who are very interested in solving these problems in and around those areas. So it is useful.

I'm very lucky to have colleagues who have worked or to facing in the UK as well. The fact that we have our own specific brand of some of those regulations make things a little bit difficult at times but in general We can say there is a standardized way to secure a kubernetes system with highly classified or sensitive data in and there are specific deployment topologies for the Shades of Gray in the middle. So it's super useful to have colleagues and collaborators in that space.

It's also an interesting secondary concern that it is a bubble to a large extent as you say, it's Financial Center the same with New York the same with California, San Francisco. And so a lot of organizations are still looking to keep up or to open up Cloud native or even to start with their Cloud Journey. so it is useful to catch myself and just remind myself that actually We are at the epicenter of something or one of the epicenters and that still making security usable.

But other organizations is a core part of the journey and the vision of the organization interesting. But what do you I'm very fascinated because I've had a foot in the security camp and the foot in the software and Cloud camp and they're they're different mental models Lanes of thinking. What do you think the greatest misconception for the security population is about kubernetes and how you secure it.

What what do they need to know that they probably don't know just because they're not living in kubernetes day today. the greatest misconception is is a container a security boundary and we have a whole range of answers here ultimately. The the view from one of the core teams inside Google in the security team.

GK a few years ago was printing these leaky container stickers for the sad face containers and other security boundary. This is because they're running on a shared kernel and if there is a vulnerability in the colonel because the security features like namespaces and see groups and capabilities the way that lsms again are Colonel bound and not namespace. Means that if somebody can escape from a container of viral kernel exploits and we saw this with 30 pipe recently.

One of my colleagues actually developed a proof of Concepts and the talk that I did at kubecon Valencia includes a demo of rooting cubelet node from within a container. So because of that shared kernel we get the benefit of very fast startup times. We're just starting a process on a running kernel.

We don't have to emulate the BIOS. We don't have to do this physical device emulation. But we make a compromise in terms of I've been packing but also our security.

We can then take that to the opposite extreme and say well a virtual machine has Hardware extensions. It does interrupt interception rewriting in some cases and so is a stronger security boundary. Well, yes, that's true.

But there have always been hypervisor escapes for everything and we look at the TM food cup. We look at pone to own. We see people get paid for these bug bounces work.

It's wonderful that this is how we developed as an industry. So this intermediate space where we now see micro VMS like firecracker, which is actually a qmu based actual VM or gvisor, which is a full golang based reimplementation of the Linux kernel occupies this kind of Middle Ground. We can also run cat containers I suppose which is a virtual machine with a container runtime inside.

There is a space for any sort of. Requirement on that Spectrum kubernetes will support running them all. And then the difficult to becomes our standard Cloud misconfiguration.

We're less likely to see a cve Hopping a shell or routing a box then we offer somebody to make a fundamental configuration mistake. They're just opens the open stores. I was just going to ask about that because with all those variations they all have their own make sure you do the following things.

Right so you don't have a problem and you know still today configuration mistakes are if not the top one of the top three, you know, you look at Oasis top 10 or whatever. It's always configuration. She's up there.

So it seems like those those options make it not more complex itself and thus open to more issues. Absolutely true. 0.

But actually projects like frisker the secure software Factory reference architecture integrates queue. There are reference examples and I'm very excited about the potential for audit and policy as code extending out across the entire human Essence configuration space. Excellent.

Tell us before we finish up just about the book. Why why did you write the book what what craziness prompted you write a book because I know this a lot of work. It's a it's a labor of love to tell us about it.

Absolutely. So well, first of all, I have to thank my dear co-author friends Mr. Michael Hassan glass who helped to guide me through the process.

This was first work of this side that I've ordered. He is a political author and therefore was able to give you some guidance including the question. Do you really want to do this?

Yeah. Sure. Yeah, I was counseled by various parties to not take my my headspace with this but it's a labor of love as to say something that I've always wanted to achieve personally and something that I was so flattered to be given first refusal on so being given the offer knowing that I have a lot to say and I've really love writing flamboyant nonsensical terms of phrase of one of my favorite things.

So the Delight of being able to combine a good excuse for a CEO get his hands on the keyboard. I also wrote a course for the Sands Institute last year before in fact, so entangling all those different threads. Building out proof of Concepts going back through all the CVS raised against the project over the years and demonstrating.

The reason they were problematic because history repeats itself, and actually we can learn so much from going back to that problem set. and then Building the whole thing. And again you see here.

Threats driven analysis and defense so threat model for each individual chapter. Goes through the reasonably exhaustive. I mean scoped so it's not be let's say a space shuttle system, but a recently exhaustive threat model to try and cover all the eventualities that somebody finds deploying kubernetes and then respond to them individually demonstrating the actual provenance and mechanism of attack.

And then once we understand it's very sun to style once we understand the offensive adversarial mindset how to defend so yes tremendous fun. I had the opportunity to write another book shortly afterwards and wisely myself. Okay free to reach or refresh but you know to just introducing threat modeling to software Engineers that concept alone is useful because you applied here but also other domains, do you have a favorite play?

I mean you can get this so of course through the O'Reilly subscription. You have a place you like to have people buy the book your favorite outlet and all honesty. I think someone's local bookstore.

Should they be stocking this kind of esoteric work? io. We sponsor the first half of the PDF.

So people don't have to rekey the examples. Actually, we have purchased and handed out so many of these. we're very lucky that O'Reilly supporters in shipping them to conferences and I really take a lot of pleasure in writing a personal dedication in each one understanding how somebody feels about kubernetes where it sits and there's Journey especially at security conferences because many people are Just beginning this summer Nursery in many cases or their development team of shipped Cuban letters and they're now trying to backfill their knowledge So, yeah, thank you for asking.

Very good you bet. Well Andy, thank you very much for stopping by bringing the book. I think you said that's your last it is the last one.

So you're hanging on to it. I'm sure it was in high demands. com is that we are a DOT IO that AIO I have 50/50 chance.

Yeah, so that I check them out. Thanks again for joining. Hey, we'll be right back.

We've got some more great guests that we went to introduce you to just like Andy be sure and check out control plane and hacking kubernetes. We'll see you in a few.