Alcide Runtime Security | Embedded Firewall Policies

In this tutorial we will learn about Alcide Embedded Firewall Policies.
Alcide Embedded Firewall Policies basically enable developers & devops to capture their microservice know-how into a set of firewall rules that creates a whitelisted perimeter at the Pod level.

The policy embedding, comes in the shape and form of annotating Pod Specification within a deployed resource.
So whether this a plain Kubernetes YAML resource, a helm chart, we can capture security policy as code.

Alcide Runtime (ART)

Alcide Embedded Policies are created by developers/devops either in Git or as part of an automation pipeline to control the "Allowed" network traffic for the application/micro-service.

By using Alcide Embedded Policies, new applications are immediately granted with the required access to operate, and only what's required.

For this tutorial you will need a Kubernetes cluster with enough permissions to deploy resources into it.

Install and Set Up kubectl.
Install Minikube, or any working Kubernetes Cluster
Alcide Cloud Account

Alcide Code-to-production security

In order to implement Alcide Runtime Security features, we will need to onboard your Kubernetes cluster into your Alcide Cloud Account

Login to your account: https://yourcompany.cloud.alcide.io
On the left hand side menu, click on Create Data Center/Cluster
Follow the steps in the UI wizard.

At this point you should be able to see your cluster, worker nodes, and workloads, in the Infrastructure View and the application components in your Application View

Alcide Code-to-production security

Policy Structure

Let's begin with few Alcide Embedded Policy examples:

policy.v1.alcide.io/outbound.ip.1: tcp://1.1.1.1/?ports=80
policy.v1.alcide.io/inbound.ip.2: tcp://any/?ports=any
policy.v1.alcide.io/outbound.dns.1: tcp://amazon.com/?ports=80
policy.v1.alcide.io/outbound.dns.2: https://*.amazon.com
policy.v1.alcide.io/outbound.service.1: tcp://my-service/?ports=80
policy.v1.alcide.io/inbound.service.2: tcp://my-service/?ports=80
policy.v1.alcide.io/outbound.endpoint.1: tcp://my-workload/?ports=80
policy.v1.alcide.io/inbound.endpoint.2: https://my-namespace.my-workload
policy.v1.alcide.io/outbound.namespace.1: tcp://my-namespace/?ports=80
policy.v1.alcide.io/inbound.namespace.2: tcp://my-namespace/?ports=any

For more details and examples go to Alcide Documentation

Create the frontend, backend, and client apps:

kubectl create namespace alcide-demo
kubectl create -f https://raw.githubusercontent.com/alcideio/codelab.github.io/master/codelabs/runtime-codelab-03/star_demo.yaml

Go to your account at Alcide Cloud Console, and navigate to the Application view,
In the upper left side you could see a DropDown menu for filltering clusters and namespaces, default is "All Clusters"
Oppen the DropDown menu and under your cluster name sellect alcide-demo to filter by this namespace.
You should see now the 3 new services we just created, each service has full communication access to his neighbors (indicated by the arrows).

Alcide Star Demo

We are going to switch Alcide's Agent running mode - enforcement mode.

kubectl set env daemonsets/agent-nodelet -n alcide ALCIDE_WORKLOAD_ENFORCE_MODE=inline && kubectl rollout status -n alcide daemonset/agent-nodelet --watch && while [[ ! $(kubectl -n alcide exec -it $(kubectl get pods -n alcide -l app=agent-nodelet -o custom-columns=:metadata.name --no-headers) -- alcide_agent dp wl ls | grep $(kubectl get pods -n alcide-demo -l app=client -o custom-columns=:metadata.name --no-headers)) ]]; do echo "please wait for Alcide agent to be reaady..."; sleep 20; done; echo "Ready! :)"

Now let's create the same workload but this time with Alcide Embedded Firewall Policies:

kubectl create -f https://raw.githubusercontent.com/alcideio/codelab.github.io/master/codelabs/runtime-codelab-03/star_demo_with_embedded_policies.yaml

Go to your account at Alcide Cloud Console, and navigate to the Application view,
In the upper left side you could see a DropDown menu for filltering clusters and namespaces, default is "All Clusters"
Oppen the DropDown menu and under your cluster name sellect alcide-demo to filter by this namespace.
You should see now the 3 new services we just created but this time each service can communicate only with allowed neighbors.

Alcide Star Demo

Reset the environment

Delete the alcide-demo Deployment from the previous step and re-deploy it.

kubectl delete -f https://raw.githubusercontent.com/alcideio/codelab.github.io/master/codelabs/runtime-codelab-03/star_demo_with_embedded_policies.yaml
kubectl delete -f https://raw.githubusercontent.com/alcideio/codelab.github.io/master/codelabs/runtime-codelab-03/star_demo.yaml
kubectl delete namespace alcide-demo

In this codelab we covered:

Alcide Embedded Policy syntax
Implemented Alcide Embedded Policy

Alcide Code-to-production security