March 2020 Summaries

The blog post explores the complexities of achieving PCI compliance in containerized environments, particularly within Kubernetes, given the unique challenges of container sprawl, lifespan, and open-source packaging. As hackers become more adept at exploiting vulnerabilities, PCI DSS compliance is crucial to mitigate risks associated with credit card data theft, with non-compliance potentially costing businesses millions. Traditional compliance tools are often inadequate for container environments due to their inability to assess container behavior and lack of cloud context. Sysdig Secure offers a solution by providing tailored PCI scanning policies, network topology maps, asset inventory management, access control, and continuous audits to ensure compliance without hindering cloud adoption. The platform aims to streamline the compliance process across all stages of container and Kubernetes lifecycles, allowing businesses to manage security risks effectively and expedite application delivery.

Prometheus, a widely-used monitoring tool in Kubernetes environments, faces several challenges when scaled for production needs, including lack of global visibility, complex configuration management, and horizontal scaling limitations. As organizations grow and the number of services increases, Prometheus struggles with memory issues due to the growing number of time series, and its inability to scale horizontally becomes evident. Workarounds like sharding and long-term storage solutions such as Cortex, Thanos, and M3 exist but come with their own complexities and high operational costs. Sysdig aims to address these scaling challenges by evolving its platform to be fully compatible with Prometheus, offering a scalable and secure solution that retains data for longer periods, thereby allowing developers to focus on innovation rather than maintaining complex monitoring infrastructures.

PromCat, short for Prometheus Catalog, is a curated resource catalog designed to enhance enterprise-class Prometheus monitoring by offering vetted, documented, and supported integrations for Kubernetes platforms and cloud-native services. As the Prometheus ecosystem has grown rapidly, the abundance of resources has made it challenging for companies to identify production-ready tools amidst untested options. PromCat aims to address these challenges by providing a reliable repository of Prometheus integrations, including exporters, dashboards, and alerts, tailored for enterprise environments. It supports both Grafana and Sysdig dashboards, ensures compatibility with existing Prometheus tools, and commits to contributing improvements back to the open-source community. PromCat launches with resources for Kubernetes, Istio, and AWS services, with plans to expand based on customer feedback and needs, while offering Sysdig's cloud-scale Prometheus monitoring features.

Sysdig has announced a new cloud-scale monitoring offering that is fully compatible with Prometheus, addressing the scalability and workflow issues commonly faced by organizations using Prometheus monitoring. This enhancement allows customers to maintain their existing Prometheus standards while benefiting from improved scalability, data retention, and troubleshooting capabilities. The release includes full support for Prometheus features such as PromQL, integration with third-party tools like Grafana, and an embedded Prometheus server in Sysdig's agent for streamlined metric collection. Additionally, Sysdig introduced PromCat.io, a curated catalog of Prometheus monitoring integrations that simplifies the selection, configuration, and maintenance of exporters. This development aims to provide organizations with a robust monitoring solution that includes enterprise-grade access controls, security features, and support for long-term data retention, making it easier to manage and analyze cloud-native environments.

Kubernetes 1.18 introduces a range of new features and enhancements, emphasizing improved functionality and support for Windows nodes. Key updates include the OIDC discovery for the API server, enabling service account tokens as a general authentication mechanism, and significant advancements for Windows support, such as the implementation of RuntimeClass and CRI-ContainerD on Windows nodes. The release also marks the graduation of several features to stable status, such as the CertificateSigningRequest API, and improvements in debugging capabilities with the introduction of the kubectl debug command. Additionally, this version enhances network performance with the EndpointSlice API and NodeLocal DNSCache, while also offering storage improvements like immutable Secrets and ConfigMaps. These updates reflect Kubernetes' commitment to community needs, scalability, and security, with a focus on facilitating better integration and performance across diverse environments.

Sysdig has partnered with VMware to enhance security for cloud-native environments through the integration of Sysdig Secure with VMware Tanzu Service Mesh, leveraging VMware NSX. This collaboration aims to provide organizations with improved security, compliance, and operational controls across multi-cloud and Kubernetes environments. Sysdig Secure offers threat detection, incident response, and forensics capabilities, while Tanzu Service Mesh facilitates secure communication and visibility at the API level for microservices. This integration allows users to apply operational controls, monitor security events, and address incidents in real-time, thereby improving security intelligence and enabling better policy decisions. The combined solution empowers developers, infrastructure, and security teams to collaborate effectively, ensuring secure and efficient operations across complex, multi-cluster environments.

The blog post highlights the enhanced functionality of the Sysdig Terraform Provider, which facilitates the integration of security as code within GitOps workflows. It illustrates how organizations can define alerts, rules, and policies as Terraform resources, using a scenario involving a security engineer named Néstor to emphasize the importance of managing infrastructure configurations through GitOps principles. By utilizing the Sysdig Terraform Provider, users can automate and streamline security operations, reducing the risk of misconfigurations and enabling quick identification and resolution of potential vulnerabilities. The text provides detailed instructions on setting up the provider, creating security rules and policies for container infrastructures, and establishing notification channels for monitoring security events through email and Slack. The post concludes by encouraging the use of Sysdig's open-source Terraform provider to enhance cloud security and invites contributions to its ecosystem.

GitOps, a methodology for managing Kubernetes clusters and application delivery through infrastructure as code principles, utilizes Git as a central repository for storing the infrastructure and application declarations, ensuring an audit trail for changes. K8s-security-configwatch, an open-source tool from Sysdig, enhances GitOps by automatically reviewing Kubernetes configuration changes for security vulnerabilities, integrating with GitHub Actions to trigger workflows that alert security engineers if potential risks are detected. This tool tracks various security attributes such as SecurityContext and PodSecurityContext objects, providing feedback on changes that could either open security gaps or cause application failures. By automating configuration audits, k8s-security-configwatch helps prevent security breaches and maintains the integrity of Kubernetes deployments.