August 2020 Summaries

Bottlerocket is a purpose-built operating system from AWS designed specifically for hosting Linux containers, aimed at enhancing security and management in containerized environments. It reduces complexity and security risks by including only essential software, thus optimizing resource usage and simplifying OS updates, particularly when used with Amazon EKS. Bottlerocket features image-based updates for consistency, API-driven configuration, and the exclusion of SSH to enhance security by making it harder for attackers to access the system. Sysdig supports Bottlerocket by ensuring its security and monitoring tools are compatible, leveraging the Sysdig agent to provide comprehensive visibility and protection through runtime security and performance monitoring. This integration allows users to confidently detect vulnerabilities, monitor infrastructure, and scale Prometheus monitoring across Kubernetes clusters, thereby improving operational efficiency and security.

Organizations increasingly adopt Prometheus for monitoring container and microservice environments, particularly as they shift from monolithic architectures to cloud-native ones, but face scalability challenges as their infrastructure grows. The complexity of monitoring in such dynamic environments is heightened by the ephemeral nature of containers and the numerous metrics that need to be tracked across distributed systems. Prometheus, an open-source tool supported by a broad community, offers a solution with its ability to collect and make sense of metrics in these environments but can hit limitations as the environment expands. Challenges include managing multiple Prometheus servers and federating data, which can complicate troubleshooting and data integration. To address these issues, companies might consider using tools like Cortex or Thanos for centralized data querying, though these require significant resources. When transitioning to a commercial solution, it's crucial to maintain compatibility with existing Prometheus tools and features, such as PromQL and Grafana, while ensuring robust access controls and troubleshooting capabilities. Meeting these criteria can help organizations integrate a commercial solution seamlessly into their existing Prometheus setups, preserving the benefits developers appreciate while solving scalability issues.

The blog post by Jorge Salamero Sanz provides a guide on how to monitor the Harbor container registry using Prometheus metrics. Harbor, an open-source container registry developed by VMware and now under the CNCF umbrella, offers features like RBAC, replication, and image scanning, making it a suitable choice for self-hosted environments. However, self-hosting requires maintaining the service's availability, health, and resource usage. Since Harbor doesn't natively expose Prometheus metrics, Max Cai developed a Prometheus exporter that queries the Harbor API to generate useful metrics, simplifying the integration process for users deploying in Kubernetes. The blog details the configuration of this exporter and suggests using Sysdig's out-of-the-box Harbor dashboard or other tools like Grafana to monitor various metrics, including Harbor health, storage usage, projects, quotas, and replication status. The post highlights the importance of monitoring these metrics to ensure the smooth operation of Harbor registries and suggests leveraging Sysdig's Secure DevOps Platform for enhanced container and Kubernetes environment monitoring.

Kubernetes 1.19 introduces several significant updates aimed at enhancing usability, security, and feature stability, along with extending the support window from nine to 12 months, which eases the upgrade process for users. This release includes 34 enhancements, with 10 new features, eight graduating to stable, two management changes, and 14 existing features receiving updates. Notable improvements include the introduction of generic ephemeral inline volumes, a structured logging system, and a new protocol for steady feature development. The update also emphasizes the transition from beta to stable for features like Ingress and CertificateSigningRequest API, while enhancements such as the warning mechanism for deprecated APIs and the kubeadm customization with patches streamline administration and configuration efforts. The version also advances the migration from in-tree storage plugins to CSI drivers, like those for Azure and vSphere, to enhance modularity and extensibility.

Sysdig's 2020 Container Security Snapshot underscores the critical need for embedding security into DevOps processes as container and Kubernetes adoption grows. The report reveals insights from over 100,000 scanned images, showing that Alpine is the most commonly used base image, despite the existence of unusually large Alpine-based images which pose security risks. The average Docker image contains about 9.5 layers, and using open source third-party libraries, particularly npm, is widespread, despite the high risk of vulnerabilities, with 53% of non-OS packages having severe vulnerabilities. Additionally, 58% of images run as root, highlighting risky configurations that require continuous monitoring. Sysdig emphasizes the importance of scanning for vulnerabilities early in the CI/CD pipeline and maintaining a secure DevOps workflow to ensure robust application security across the container lifecycle.

The blog post explores the integration of automated registry scanning into container workflows using Harbor and Sysdig, emphasizing the importance of shifting security to the earliest stages of the development process to improve security impact and reduce "time to fix" vulnerabilities. Harbor, an open-source container registry project hosted by CNCF, offers features like integration with third-party scanning backends, enhancing the user experience by presenting scanning results directly in the Harbor UI. The article outlines how Sysdig Secure's pluggable scanning capabilities can be integrated with Harbor to automate image scanning, especially for third-party images that may bypass CI/CD pipelines, by using an adapter that allows communication between Harbor and Sysdig Secure for vulnerability reporting. It details the setup process, including the use of Kubernetes and Helm Charts, and presents two scanning operation modes: backend and inline scanning, each with its own pros and cons. The post concludes by highlighting the benefits of this integration as part of a secure container lifecycle and encourages users to implement these practices to establish a more robust security pipeline.

Brian Brazil's blog post discusses the role of exporters in monitoring third-party applications with Prometheus, particularly when these applications do not natively expose metrics in Prometheus format. It outlines the process of finding and evaluating appropriate exporters, recommending resources such as the Prometheus website, third-party listings, and general search engines to locate suitable options. The post emphasizes the importance of well-maintained exporters and highlights the use of labels to organize and manage metric data effectively across various environments and infrastructures. It also provides a practical example using HAProxy and node exporters, illustrating how labels can be applied to streamline queries and manage deployments more efficiently. The post concludes by noting the scalability benefits of using Sysdig for Prometheus monitoring, allowing for extensive metric tracking and long-term data retention.