SlideShare a Scribd company logo
CCICI
Cloud Interoperability 1.0 Testbed
Security Access Implementation & References
A presentation by
Krishna Kumar & Chengappa Munjandira
May 2021
Cloud Interoperability & Portability
Report 1.0 based
TestBed Setup
If you likes to be part of this open source project, join here
1) https://www.linkedin.com/groups/8247749/
2) https://ccici.in/
Cloud InterOp TestBed Architecture Framework
Cloud Provider Resources
(Compute, Network, Storage, etc.)
Infrastructure as Code
(Tosca, Terraform, Docker, Openstack, etc.)
Application / Services
(k8s, Compose, Vault, Consul, ServiceBrokers, etc.)
Data Access Layer
(CSI, SODA, VirtualDB, VirtualFS, etc.)
Security
&
Compliance
Monitoring
&
Logging
App/Service
Management
Data
Management
Network
Management
Standards
for
India
Cloud
End Users (ISP, SMBs, Startups, Incubators, Government Agencies, Universities)
vendor
Neutral
Authentication Flow - service to service across clouds
Cloud1
Service1
Cloud2
Service2
Zero trust network
1
2
The Operations flow legends:
1. Service1 initiate Service2/Cloud2
2. Cloud1 request OAuth Token from
Cloud2 (See the format of request)
3. Cloud2 process Token for specific
service with access and token
expiration
4. Cloud2 send Token back to Cloud1
5. Service1 call Service2 with access
token
6. Service1 consume Service2 action
(e.g: storage.objectread)
7. Service2 ACK/ERROR on call and
log the entries in Cloud2 logs
8. Service1 stop the service2 call as
needed by the operation
9. Cloud2 access Token expire
10. Service1 continue further operation
UR1. IUR
Token Request Format
1. Provider URI
2. Service Account
3. Account Key
4. Action*
5. Token expiration
InterOp Format
*Action Format
● compute.*
● network.*
● storage.*
● operations.*
3
4
5 6
7
8

Recommended for you

An intro to Kubernetes operators
An intro to Kubernetes operatorsAn intro to Kubernetes operators
An intro to Kubernetes operators

An Operator is an application that encodes the domain knowledge of the application and extends the Kubernetes API through custom resources. They enable users to create, configure, and manage their applications. Operators have been around for a while now, and that has allowed for patterns and best practices to be developed. In this talk, Lili will explain what operators are in the context of Kubernetes and present the different tools out there to create and maintain operators over time. She will end by demoing the building of an operator from scratch, and also using the helper tools available out there.

kubernetesoperatorsmicroservices
Kubernetes Helm: Why It Matters
Kubernetes Helm: Why It MattersKubernetes Helm: Why It Matters
Kubernetes Helm: Why It Matters

Kubernetes Helm makes application deployment easy, standardized and reusable. Use of Kubernetes Helm leads to better developer productivity, reduced Kubernetes deployment complexity and enhanced enterprise production readiness. Enterprises using Kubernetes Helm can speed up the adoption of cloud native applications. These applications can be sourced from open-source community provided repositories, or from an organization’s internal repository of customized application blueprints. Developers can use Kubernetes Helm as a vehicle for packaging their applications and sharing them with the Kubernetes community. Kubernetes Helm also allows software vendors to offer their containerized applications at “the push of a button.” Through a single command or a few mouse clicks, users can install Kubernetes apps for dev-test or production environments.

platform9kuberneteskubernetes helm
Operator SDK for K8s using Go
Operator SDK for K8s using GoOperator SDK for K8s using Go
Operator SDK for K8s using Go

Sebastien Thomas, System Architect at Coyote Amerique, gave a presentation on operator frameworks. His talk covered how Operator SDK can be used to create Kubernetes Operators with Go.

kubernetesoperator sdkkubernetes operator
Multi cloud Authentication & Authorization for Service provisioning
User /
Agent
Cloud 1:
Id Provider
Cloud 1:
Service Consumer
Zero Trust Tunnel
Cloud 2:
Id Provider 2
Cloud 2:
Service Provider
Connect to Cloud
Authentication : Access Token
Request Service Roll
Request Service mapping
Authorization Bearer Token
Authorized: Access Grants
Broker
Agent
Broker
Agent
Discovery
Selection
Monitoring
JWT:
valid?
expired?
Cloud Actor
Access
flow
1
Access flow 1
Cloud Auditor
Service
Templates
Service
provisioning
workflow
Authentication & Authorization OPTIONS:
The following will be in place:
1. Single Sign-On & Cloud Federated Identity prefered by the Organization, like Microsoft AD.
2. Multi-Factor Authentication with app/otp generated approval to avoid phishing attacks:
3. Legacy system IAM using solutions Security Assertion Markup Language (SAML) 2.0 Identity Provider (IdP)
4. Third party Identity service Identity-Management-as-a-Service (IDaaS) like OKTA
5. If you want to allow anonymous users access (quite common for eCommerce applications) to any part of our
application then you need to determine if you will be redirecting right away or prompting your users to redirect only
when required.
6. Auth0 Universal Login - the so-called Bring Your Own Identity scenarios provided via Social Login.
a. OpenID Connect & OAuth2.0
OAuth 2.0 is a framework that controls authorization, is a authorization protocol(OAuth only authorizes devices, API, servers with
access tokens rather than credentials and it works over HTTPS.); OpenID Connect and SAML are both industry standards for
federated authentication; OpenID Connect uses OAuth2.0 & JWT - mainly in websites and mobile (allows for ‘Federated
Authentication’); SAML - OAuth with XML format - mainly in enterprise user login in multiple apps. SAML is used for both
authentication & authorization between two parties;
https://medium.com/@jad.karaki/identity-management-saml-vs-oauth2-vs-openid-connect-c9a06548b4c5
CCICI CIP 1.0 Testbed - Security access implementation and reference - v1.0
Standards/Benchmark Applicable
1. CIS benchmark - (e.g: kubernetes, cloud service providers, etc.)
2. Payment Card Industry Data Security Standard 3.2.1 (PCI-DSS v3.2.1)
3. OWASP Top Ten (OWASP - A1:A10)
4. National Institute of Standards and Technology 800-53 (NIST 800-53)
5. International Organization for Standardization ISO 27001/17/18
6. FIPS 140-2 standards
7. Cloud Security Alliances (CSA)
8. Cloud Computing Compliance Criteria Catalogue (CS:2020)
9. SOC for service Organizations - (AICPA SOC)
10. Refer:
a. AWS Compliance Programs - https://aws.amazon.com/compliance/programs/
b. Azure Compliance Offerings - https://docs.microsoft.com/en-us/azure/compliance/
c. Google Cloud Compliance Resource - https://cloud.google.com/security/compliance

Recommended for you

Kubernetes Cluster API - managing the infrastructure of multi clusters (k8s ...
Kubernetes Cluster API - managing the infrastructure of  multi clusters (k8s ...Kubernetes Cluster API - managing the infrastructure of  multi clusters (k8s ...
Kubernetes Cluster API - managing the infrastructure of multi clusters (k8s ...

Thanks to tools like kubeadm, Terraform or Ansible setting up a Kubernetes cluster on a dedicated environment is getting reachable, but what’s about setting up a bunch of cluster in multiple clouds in automatic way? This is still a challenge. Also if you want to do same in your own datacenter. In this talk we will take a look to the approach to orchestrate and manage a whole set of k8s cluster by the Cluster API project of kubernetes (a subproject of sig-cluster-lifecycle). The main idea behind it is to use the Kubernetes API itself to manage multiple clusters with there master and worker nodes in same way you would manage your PODs - define the needed resources and the responsible controller will take care for providing it. After an overview about the concepts of cluster API, I will show what’s needed to implement a cluster API conform machine class/deployment. There I will see that adding your own provider isn’t that hard as you may aspect. At the end of the day it just requires a simple interface to implement. The corresponding kubermatic controllers we implemented at Loodse are available as open source, so its possible to play around with it. A live demo will show how easy it is to spin up and maintain multiple Kubernetes cluster at different public and on-premise cloud providers over one managing cluster. A final wrap up will summarize the current state of the Cluster API project and the advantages of managing clusters as cattles instead of pets.

#kubernetes#clusterapi#kubermatic
Helm - Package Manager for Kubernetes
Helm - Package Manager for KubernetesHelm - Package Manager for Kubernetes
Helm - Package Manager for Kubernetes

Helm is a package manager for Kubernetes. It helps streamline installing and managing applications. This session covers prerequisites for Helm, which include a basic understanding of containers and Kubernetes along with its architecture. It also covers the limitations that come with running deployments using the kubectl binary, Helm's architecture, templating with it and finally ends on a note highlighting the difference between versions 2 and 3.

helmkubernetescontainer
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...

** Kubernetes Certification Training: https://www.edureka.co/kubernetes-certification ** This Edureka tutorial on "Kubernetes Architecture" will give you an introduction to popular DevOps tool - Kubernetes, and will deep dive into Kubernetes Architecture and its working. The following topics are covered in this training session: 1. What is Kubernetes 2. Features of Kubernetes 3. Kubernetes Architecture and Its Components 4. Components of Master Node and Worker Node 5. ETCD 6. Network Setup Requirements ​DevOps Tutorial Blog Series: https://goo.gl/P0zAfF

devopskubernetesdevops edureka
Open solutions available for Cloud Interop
1. Crossplane - Manage any infrastructure your applications need directly from Kubernetes - https://crossplane.io/
2. Liqo - project that dynamically creates a big cluster - https://github.com/liqotech/liqo
3. Kubefed - coordinate the configuration of multiple Kubernetes clusters from a single set of APIs in a hosting cluster -
https://github.com/kubernetes-sigs/kubefed
4. Konveyor - help modernize/migrate applications - forklift(to KubeVirt), pelorus, windup - https://konveyor.io/
5. KubeVirt - virtuaization APIs for k8s - https://kubevirt.io/
6. oVirt - Virtualization with kvm hypervisor - https://www.ovirt.org/
7. Thanos - Prometheus at scale - https://thanos.io/
8. Open Data Initiative - a platform for a single, comprehensive view of your data -
https://www.microsoft.com/en-us/open-data-initiative
9. OAM model - runtime-agnostic specification that defines cloud native apps - https://oam.dev/
10. CloudARK - framework to offer platform services as-Code - https://cloudark.io/
11. KubePlus - CRD for CRDs for platform services - https://github.com/cloud-ark/kubeplus
12. Cloud Custodian - Cloud Security, Governance, and Management - https://cloudcustodian.io/
13. Edge - Akri, OpenYurt, OpenNESS, k3s, kubeedge
14. Storage - Ceph, EdgeFS, Rook, ChubaoFS, Longhorn, OpenEBS
15. Runtime - CRI-O, CSI, CNI
16. CNCF Projects - https://www.cncf.io/ & case studies https://www.cncf.io/case-studies/
17. Apache project list - https://www.apache.org/
TOP Announcements from Major Cloud Vendors in last 1+yrs:
● AWS re:invent
○ - https://aws.amazon.com/blogs/aws/aws-reinvent-announcements-2020/
● MicroSoft Build -
○ https://www.cloudwithchris.com/blog/build-2021-summary/
○ https://www.cnbc.com/2020/05/22/microsoft-build-2020-recap-windows-azure-and-teams-tools.html
● Google Cloud Next -
○ https://www.cnet.com/news/google-io-2021-every-announcement-developers-conference/
○ https://cloud.google.com/blog/topics/google-cloud-next/complete-list-of-announcements-from-google-cloud-next20-onair
● IBM Think -
○ https://www.ibm.com/cloud/blog/ibm-think-2021-key-announcements
○ https://www.eweek.com/innovation/ibm-think-2020-digital-building-reliability-resiliency-in-uncertain-times
● Oracle World -
○ https://www.forbes.com/sites/oracle/2019/09/25/larry-ellison-at-oracle-openworld-5-highlights-from-oracles-leader/?sh=22
1998582670
● VMWorld -
○ https://www.vmware.com/company/news/updates/2020/vmworld-2020-news-announcement-summary.html
● Alibaba Apsara -
○ https://www.cloudmanagementinsider.com/alibaba-cloud-enters-next-phase-with-cloud-2-0-new-cloud-os-first-cloud-comp
uter/
Look for latest on interoperability / Hybrid cloud solutions...
BACKUP
OAuth2 Flow Diagram Get Access Token flow has 5
steps (as shown in the diagram):
1. Pre-register Client (App)
with OAuth Server to get
Client ID/Client Secret
2. OAuth Server
authenticates user when
she clicks on the App’s
social login button, which
is tagged with Client ID
3. OAuth Server solicits user
permission to allow the
App to perform something
on her behalf
4. OAuth Server sends secret
Code to App
5. App acquires Key/Access
Token from OAuth Server
by presenting secret Code
and Client Secret
https://blog.oauth.io/introduction-oauth
2-flow-diagrams/

Recommended for you

Kubernetes Architecture
 Kubernetes Architecture Kubernetes Architecture
Kubernetes Architecture

In this session, we will discuss the architecture of a Kubernetes cluster. we will go through all the master and worker components of a kubernetes cluster. We will also discuss the basic terminology of Kubernetes cluster such as Pods, Deployments, Service etc. We will also cover networking inside Kuberneets. In the end, we will discuss options available for the setup of a Kubernetes cluster.

kubernetesconatinerizationcontainer- orchestration
Building Cloud-Native Applications with Kubernetes, Helm and Kubeless
Building Cloud-Native Applications with Kubernetes, Helm and KubelessBuilding Cloud-Native Applications with Kubernetes, Helm and Kubeless
Building Cloud-Native Applications with Kubernetes, Helm and Kubeless

This document discusses building cloud-native applications with Kubernetes, Helm, and Kubeless. It introduces cloud-native concepts like containers and microservices. It then explains how Kubernetes provides container orchestration and Helm provides application packaging. Finally, it discusses how Kubeless enables serverless functionality on Kubernetes.

cloud computingkuberneteskubeless
Kubernetes ClusterAPI
Kubernetes ClusterAPIKubernetes ClusterAPI
Kubernetes ClusterAPI

The document discusses Cluster API, an open source project that provides a Kubernetes cluster management API for provisioning and managing Kubernetes clusters across multiple cloud providers and on-premises. It introduces key Cluster API concepts like Machines, MachineClasses, and MachineSets that allow users to declaratively manage Kubernetes node lifecycles and scaling. The document also advertises an early bird discount code for an upcoming conference.

dockerinfrastructurekubernetes
BANZAI CLOUD - Zero Touch Authentication Flow This is how the whole flow looks:
1. The user uses the Backyards CLI to perform a
Backyards command.
2. The Backyards CLI creates a proxy endpoint to reach
the Backyards service (we call it the “Server” from
here on in), on a local port.
3. The Backyards CLI uses client-go to create an HTTP
Transport that will automatically authenticate
against the auth provider and will add a valid Bearer
token to every request, except when Client
Certificates are being used. In the event that Client
Certificates are being used, the CLI will simply add
the Client Certificates to the login request’s body.
4. The Backyards CLI calls the login API on the Server.
5. The Server verifies Bearer Tokens using the
TokenReview API (or the Server verifies Client
Certificates through a separate client)
6. The Server also uses the SubjectAccessReview API to
get information about the user’s capabilities.
7. The Server issues a JWT, encoding all the user’s
groups and capabilities with a longer expiration (10h),
and wraps it in an encrypted JWE with a shorter
expiration (5s).
8. The Backyards CLI receives the tokens, and can
cache and work with the JWT for as long as it’s valid.
9. If the user calls the dashboard command, then the
Backyards CLI has to use the encrypted JWE to open
the browser tab.
https://banzaicloud.com/blog/zero-touch-authentica
tion-on-kubernetes/
K8s Authentication
https://www.cncf.io/blog/2020/07/31/kubernetes-rbac-101-authentication/
K8s trust boundaries
https://www.marcolancini.it/2020/blog-kubernetes-threat-modelling/
Kubernetes Data Flow
https://www.marcolancini.it/2020/blog-kubernetes-threat-modelling/

Recommended for you

Test your Kubernetes operator with Operator Lifecycle Management
Test your Kubernetes operator with Operator Lifecycle ManagementTest your Kubernetes operator with Operator Lifecycle Management
Test your Kubernetes operator with Operator Lifecycle Management

Operator pattern is pioneered by CoreOS, and it is embraced by the Kubernetes community. The Operator framework from CoreOS/Red Hat is also getting adoption. Operator Lifecycle Management (OLM) is part of the Operator framework. This talk walks you through testing Kubernetes operator with Operator Lifecycle Management (OLM).

kubernetesopenshiftoperator
Aura Framework Overview
Aura Framework OverviewAura Framework Overview
Aura Framework Overview

The document provides an overview of the Aura framework: - Aura is Salesforce's framework for building UI components that are reusable, high performing, and support events. It allows for faster development through out-of-box components. - Components are the building blocks of Aura apps and can encapsulate HTML, CSS, JavaScript and other code. They represent reusable sections of the UI. - Aura uses an event-driven programming model where components can fire and handle events to respond to user interactions.

aurasalesforce.comlightning
Kubernetes: The Next Research Platform
Kubernetes: The Next Research PlatformKubernetes: The Next Research Platform
Kubernetes: The Next Research Platform

Kubernetes has become the defacto standard as a platform for container orchestration. Its ease of extending and many integrations has paved the way for a wide variety of data science and research tooling to be built on top of it. From all encompassing tools like Kubeflow that make it easy for researchers to build end-to-end Machine Learning pipelines to specific orchestration of analytics engines such as Spark; Kubernetes has made the deployment and management of these things easy. This presentation will showcase some of the larger research tools in the ecosystem and go into how Kubernetes has enabled this easy form of application management.

kubernetescontainershpc
K8s Authenticating
https://v1-18.docs.kubernetes.io/docs/reference/access-authn-authz/authentication/
https://kubernetes.io/docs/reference/access-authn-authz/authentication/
OPA
https://kubernetes.io/blog/2019/08/06/opa-gatekeeper-policy-and-governance-for-kubernetes/
K8s Multi Cloud
https://www.alibabacloud.com/blog/a-multi-cloud-and-multi-cluster-architecture-with-kubernetes_595541
K8s in EKS - AWS
https://aws.amazon.com/blogs/containers/kubernetes-rbac-and-iam-integration-in-amazon-eks-using-a-java-based-kuberne
tes-operator/

Recommended for you

Kubernetes design principles, patterns and ecosystem
Kubernetes design principles, patterns and ecosystemKubernetes design principles, patterns and ecosystem
Kubernetes design principles, patterns and ecosystem

Kubernetes began as Google's internal container orchestration system called Borg and was open sourced as Kubernetes in 2014. It uses a declarative model where users describe their application components and infrastructure as code to manage the desired state. Key principles include being extensible through custom resources and controllers, meeting users where they are through integration with applications, and decoupling applications from infrastructure. Common extension points allow customizing authorization, scheduling, resources, and controllers. Operators help manage custom applications and Prometheus is a widely used monitoring operator. Best practices for day 2 operations focus on cluster design, application patterns, and security. A rich ecosystem of tools has grown around Kubernetes.

kubernetesgoogle
Developingapiplug insforcs-151112204727-lva1-app6891
Developingapiplug insforcs-151112204727-lva1-app6891Developingapiplug insforcs-151112204727-lva1-app6891
Developingapiplug insforcs-151112204727-lva1-app6891

This document provides instructions for developing an API plug-in for CloudStack version 4.5 using SolidFire as an example. It outlines the steps to create a new Maven project called "abc123" by copying the existing "solidfire" project template. It describes updating files and dependencies to reference the new "abc123" project instead of "solidfire". The document then explains how to create the key classes needed to implement the plug-in, map it to API commands, and deploy the final JAR file. The goal is to extend CloudStack's API with new commands that can invoke functionality from a third-party product via the plug-in.

next-generation data center
Ofir Makmal - Intro To Kubernetes Operators - Google Cloud Summit 2018 Tel Aviv
Ofir Makmal - Intro To Kubernetes Operators - Google Cloud Summit 2018 Tel AvivOfir Makmal - Intro To Kubernetes Operators - Google Cloud Summit 2018 Tel Aviv
Ofir Makmal - Intro To Kubernetes Operators - Google Cloud Summit 2018 Tel Aviv

This document introduces Kubernetes operators and discusses how they can automate operations for stateful applications running on Kubernetes clusters. It explains that operators use custom resource definitions (CRDs) and custom controllers to make stateful applications declarative and enable automating tasks like backups, upgrades, and data redistribution. The operator pattern works by having a controller watch for the desired state defined by CRDs and take actions to maintain that state. The document demonstrates how operators can add new functionality to Kubernetes clusters and operate as "SRE as a service." It also introduces the Operator Framework for easily building new operators with the Operator SDK.

kubernetesoperatorsstateful apps
K8s in AKS - Azure
https://docs.microsoft.com/en-us/azure/aks/concepts-identity
K8s in GKE - Google Cloud
https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
Thanks…….

More Related Content

What's hot

Helm - Application deployment management for Kubernetes
Helm - Application deployment management for KubernetesHelm - Application deployment management for Kubernetes
Helm - Application deployment management for Kubernetes
Alexei Ledenev
 
Optimizing Kubernetes deployments with Helm
Optimizing Kubernetes deployments with HelmOptimizing Kubernetes deployments with Helm
Optimizing Kubernetes deployments with Helm
erwindeg
 
Continuous Delivery for Kubernetes Apps with Helm and ChartMuseum
Continuous Delivery for Kubernetes Apps with Helm and ChartMuseumContinuous Delivery for Kubernetes Apps with Helm and ChartMuseum
Continuous Delivery for Kubernetes Apps with Helm and ChartMuseum
Codefresh
 
An intro to Kubernetes operators
An intro to Kubernetes operatorsAn intro to Kubernetes operators
An intro to Kubernetes operators
J On The Beach
 
Kubernetes Helm: Why It Matters
Kubernetes Helm: Why It MattersKubernetes Helm: Why It Matters
Kubernetes Helm: Why It Matters
Platform9
 
Operator SDK for K8s using Go
Operator SDK for K8s using GoOperator SDK for K8s using Go
Operator SDK for K8s using Go
CloudOps2005
 
Kubernetes Cluster API - managing the infrastructure of multi clusters (k8s ...
Kubernetes Cluster API - managing the infrastructure of  multi clusters (k8s ...Kubernetes Cluster API - managing the infrastructure of  multi clusters (k8s ...
Kubernetes Cluster API - managing the infrastructure of multi clusters (k8s ...
Tobias Schneck
 
Helm - Package Manager for Kubernetes
Helm - Package Manager for KubernetesHelm - Package Manager for Kubernetes
Helm - Package Manager for Kubernetes
Knoldus Inc.
 
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
Edureka!
 
Kubernetes Architecture
 Kubernetes Architecture Kubernetes Architecture
Kubernetes Architecture
Knoldus Inc.
 
Building Cloud-Native Applications with Kubernetes, Helm and Kubeless
Building Cloud-Native Applications with Kubernetes, Helm and KubelessBuilding Cloud-Native Applications with Kubernetes, Helm and Kubeless
Building Cloud-Native Applications with Kubernetes, Helm and Kubeless
Bitnami
 
Kubernetes ClusterAPI
Kubernetes ClusterAPIKubernetes ClusterAPI
Kubernetes ClusterAPI
loodse
 
Test your Kubernetes operator with Operator Lifecycle Management
Test your Kubernetes operator with Operator Lifecycle ManagementTest your Kubernetes operator with Operator Lifecycle Management
Test your Kubernetes operator with Operator Lifecycle Management
Baiju Muthukadan
 
Aura Framework Overview
Aura Framework OverviewAura Framework Overview
Aura Framework Overview
rajdeep
 
Kubernetes: The Next Research Platform
Kubernetes: The Next Research PlatformKubernetes: The Next Research Platform
Kubernetes: The Next Research Platform
Bob Killen
 
Kubernetes design principles, patterns and ecosystem
Kubernetes design principles, patterns and ecosystemKubernetes design principles, patterns and ecosystem
Kubernetes design principles, patterns and ecosystem
Sreenivas Makam
 
Developingapiplug insforcs-151112204727-lva1-app6891
Developingapiplug insforcs-151112204727-lva1-app6891Developingapiplug insforcs-151112204727-lva1-app6891
Developingapiplug insforcs-151112204727-lva1-app6891
NetApp
 
Ofir Makmal - Intro To Kubernetes Operators - Google Cloud Summit 2018 Tel Aviv
Ofir Makmal - Intro To Kubernetes Operators - Google Cloud Summit 2018 Tel AvivOfir Makmal - Intro To Kubernetes Operators - Google Cloud Summit 2018 Tel Aviv
Ofir Makmal - Intro To Kubernetes Operators - Google Cloud Summit 2018 Tel Aviv
Ofir Makmal
 
Kubernetes Deployment Tutorial | Kubernetes Tutorial For Beginners | Kubernet...
Kubernetes Deployment Tutorial | Kubernetes Tutorial For Beginners | Kubernet...Kubernetes Deployment Tutorial | Kubernetes Tutorial For Beginners | Kubernet...
Kubernetes Deployment Tutorial | Kubernetes Tutorial For Beginners | Kubernet...
Edureka!
 
Kubernetes - A Rising Hero
Kubernetes - A Rising HeroKubernetes - A Rising Hero
Kubernetes - A Rising Hero
Huynh Thai Bao
 

What's hot (20)

Helm - Application deployment management for Kubernetes
Helm - Application deployment management for KubernetesHelm - Application deployment management for Kubernetes
Helm - Application deployment management for Kubernetes
 
Optimizing Kubernetes deployments with Helm
Optimizing Kubernetes deployments with HelmOptimizing Kubernetes deployments with Helm
Optimizing Kubernetes deployments with Helm
 
Continuous Delivery for Kubernetes Apps with Helm and ChartMuseum
Continuous Delivery for Kubernetes Apps with Helm and ChartMuseumContinuous Delivery for Kubernetes Apps with Helm and ChartMuseum
Continuous Delivery for Kubernetes Apps with Helm and ChartMuseum
 
An intro to Kubernetes operators
An intro to Kubernetes operatorsAn intro to Kubernetes operators
An intro to Kubernetes operators
 
Kubernetes Helm: Why It Matters
Kubernetes Helm: Why It MattersKubernetes Helm: Why It Matters
Kubernetes Helm: Why It Matters
 
Operator SDK for K8s using Go
Operator SDK for K8s using GoOperator SDK for K8s using Go
Operator SDK for K8s using Go
 
Kubernetes Cluster API - managing the infrastructure of multi clusters (k8s ...
Kubernetes Cluster API - managing the infrastructure of  multi clusters (k8s ...Kubernetes Cluster API - managing the infrastructure of  multi clusters (k8s ...
Kubernetes Cluster API - managing the infrastructure of multi clusters (k8s ...
 
Helm - Package Manager for Kubernetes
Helm - Package Manager for KubernetesHelm - Package Manager for Kubernetes
Helm - Package Manager for Kubernetes
 
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
 
Kubernetes Architecture
 Kubernetes Architecture Kubernetes Architecture
Kubernetes Architecture
 
Building Cloud-Native Applications with Kubernetes, Helm and Kubeless
Building Cloud-Native Applications with Kubernetes, Helm and KubelessBuilding Cloud-Native Applications with Kubernetes, Helm and Kubeless
Building Cloud-Native Applications with Kubernetes, Helm and Kubeless
 
Kubernetes ClusterAPI
Kubernetes ClusterAPIKubernetes ClusterAPI
Kubernetes ClusterAPI
 
Test your Kubernetes operator with Operator Lifecycle Management
Test your Kubernetes operator with Operator Lifecycle ManagementTest your Kubernetes operator with Operator Lifecycle Management
Test your Kubernetes operator with Operator Lifecycle Management
 
Aura Framework Overview
Aura Framework OverviewAura Framework Overview
Aura Framework Overview
 
Kubernetes: The Next Research Platform
Kubernetes: The Next Research PlatformKubernetes: The Next Research Platform
Kubernetes: The Next Research Platform
 
Kubernetes design principles, patterns and ecosystem
Kubernetes design principles, patterns and ecosystemKubernetes design principles, patterns and ecosystem
Kubernetes design principles, patterns and ecosystem
 
Developingapiplug insforcs-151112204727-lva1-app6891
Developingapiplug insforcs-151112204727-lva1-app6891Developingapiplug insforcs-151112204727-lva1-app6891
Developingapiplug insforcs-151112204727-lva1-app6891
 
Ofir Makmal - Intro To Kubernetes Operators - Google Cloud Summit 2018 Tel Aviv
Ofir Makmal - Intro To Kubernetes Operators - Google Cloud Summit 2018 Tel AvivOfir Makmal - Intro To Kubernetes Operators - Google Cloud Summit 2018 Tel Aviv
Ofir Makmal - Intro To Kubernetes Operators - Google Cloud Summit 2018 Tel Aviv
 
Kubernetes Deployment Tutorial | Kubernetes Tutorial For Beginners | Kubernet...
Kubernetes Deployment Tutorial | Kubernetes Tutorial For Beginners | Kubernet...Kubernetes Deployment Tutorial | Kubernetes Tutorial For Beginners | Kubernet...
Kubernetes Deployment Tutorial | Kubernetes Tutorial For Beginners | Kubernet...
 
Kubernetes - A Rising Hero
Kubernetes - A Rising HeroKubernetes - A Rising Hero
Kubernetes - A Rising Hero
 

Similar to CCICI CIP 1.0 Testbed - Security access implementation and reference - v1.0

MuleSoft Integration with AWS Cognito Client Credentials and Mule JWT Validat...
MuleSoft Integration with AWS Cognito Client Credentials and Mule JWT Validat...MuleSoft Integration with AWS Cognito Client Credentials and Mule JWT Validat...
MuleSoft Integration with AWS Cognito Client Credentials and Mule JWT Validat...
Manish Kumar Yadav
 
citus™ iot ecosystem
citus™ iot ecosystemcitus™ iot ecosystem
citus™ iot ecosystem
DUONG Dinh Cuong
 
MNAssociationEnterpriseArchitectsCloudFoundryJuly2017
MNAssociationEnterpriseArchitectsCloudFoundryJuly2017MNAssociationEnterpriseArchitectsCloudFoundryJuly2017
MNAssociationEnterpriseArchitectsCloudFoundryJuly2017
Andrew Ripka
 
Community call: Develop multi tenant apps with the Microsoft identity platform
Community call: Develop multi tenant apps with the Microsoft identity platformCommunity call: Develop multi tenant apps with the Microsoft identity platform
Community call: Develop multi tenant apps with the Microsoft identity platform
Microsoft 365 Developer
 
Spring boot microservice metrics monitoring
Spring boot   microservice metrics monitoringSpring boot   microservice metrics monitoring
Spring boot microservice metrics monitoring
Oracle Korea
 
Spring Boot - Microservice Metrics Monitoring
Spring Boot - Microservice Metrics MonitoringSpring Boot - Microservice Metrics Monitoring
Spring Boot - Microservice Metrics Monitoring
DonghuKIM2
 
Leveraging New Features in CA Single-Sign on to Enable Web Services, Social S...
Leveraging New Features in CA Single-Sign on to Enable Web Services, Social S...Leveraging New Features in CA Single-Sign on to Enable Web Services, Social S...
Leveraging New Features in CA Single-Sign on to Enable Web Services, Social S...
CA Technologies
 
CI and CD with Spinnaker
CI and CD with SpinnakerCI and CD with Spinnaker
CI and CD with Spinnaker
VMware Tanzu
 
IBM Hybrid Cloud Integration UCC Talk, 21st November 2018
IBM Hybrid Cloud Integration UCC Talk, 21st November 2018IBM Hybrid Cloud Integration UCC Talk, 21st November 2018
IBM Hybrid Cloud Integration UCC Talk, 21st November 2018
Michael O'Sullivan
 
Microservices
MicroservicesMicroservices
Microservices
Ramesh (@Mavuluri)
 
Azure from scratch part 2 By Girish Kalamati
Azure from scratch part 2 By Girish KalamatiAzure from scratch part 2 By Girish Kalamati
Azure from scratch part 2 By Girish Kalamati
Girish Kalamati
 
CTU June 2011 - Windows Azure App Fabric
CTU June 2011 - Windows Azure App FabricCTU June 2011 - Windows Azure App Fabric
CTU June 2011 - Windows Azure App Fabric
Spiffy
 
InfoTRAMS - Czy platforma Microsoft Azure jest biznoseow bezpieczna?
InfoTRAMS - Czy platforma Microsoft Azure jest biznoseow bezpieczna?InfoTRAMS - Czy platforma Microsoft Azure jest biznoseow bezpieczna?
InfoTRAMS - Czy platforma Microsoft Azure jest biznoseow bezpieczna?
Tobias Koprowski
 
EduID Mobile App - Use-Cases, Concepts and Implementation
EduID Mobile App - Use-Cases, Concepts and ImplementationEduID Mobile App - Use-Cases, Concepts and Implementation
EduID Mobile App - Use-Cases, Concepts and Implementation
Christian Glahn
 
Api management update for optus
Api management update for optusApi management update for optus
Api management update for optus
sflynn073
 
Private Apps in the Public Cloud - DevConTLV March 2016
Private Apps in the Public Cloud - DevConTLV March 2016Private Apps in the Public Cloud - DevConTLV March 2016
Private Apps in the Public Cloud - DevConTLV March 2016
Issac Goldstand
 
Asp interview Question and Answer
Asp interview Question and Answer Asp interview Question and Answer
Asp interview Question and Answer
home
 
Microservices with asp dot net core, a next gen technology
Microservices with asp dot net core, a next gen technologyMicroservices with asp dot net core, a next gen technology
Microservices with asp dot net core, a next gen technology
Evincedev
 
Cloud foundry integration-with-openstack-and-docker-bangalorecf-meetup
Cloud foundry integration-with-openstack-and-docker-bangalorecf-meetupCloud foundry integration-with-openstack-and-docker-bangalorecf-meetup
Cloud foundry integration-with-openstack-and-docker-bangalorecf-meetup
Krishna-Kumar
 
Bye bye Identity Server
Bye bye Identity ServerBye bye Identity Server
Bye bye Identity Server
Sergio Navarro Pino
 

Similar to CCICI CIP 1.0 Testbed - Security access implementation and reference - v1.0 (20)

MuleSoft Integration with AWS Cognito Client Credentials and Mule JWT Validat...
MuleSoft Integration with AWS Cognito Client Credentials and Mule JWT Validat...MuleSoft Integration with AWS Cognito Client Credentials and Mule JWT Validat...
MuleSoft Integration with AWS Cognito Client Credentials and Mule JWT Validat...
 
citus™ iot ecosystem
citus™ iot ecosystemcitus™ iot ecosystem
citus™ iot ecosystem
 
MNAssociationEnterpriseArchitectsCloudFoundryJuly2017
MNAssociationEnterpriseArchitectsCloudFoundryJuly2017MNAssociationEnterpriseArchitectsCloudFoundryJuly2017
MNAssociationEnterpriseArchitectsCloudFoundryJuly2017
 
Community call: Develop multi tenant apps with the Microsoft identity platform
Community call: Develop multi tenant apps with the Microsoft identity platformCommunity call: Develop multi tenant apps with the Microsoft identity platform
Community call: Develop multi tenant apps with the Microsoft identity platform
 
Spring boot microservice metrics monitoring
Spring boot   microservice metrics monitoringSpring boot   microservice metrics monitoring
Spring boot microservice metrics monitoring
 
Spring Boot - Microservice Metrics Monitoring
Spring Boot - Microservice Metrics MonitoringSpring Boot - Microservice Metrics Monitoring
Spring Boot - Microservice Metrics Monitoring
 
Leveraging New Features in CA Single-Sign on to Enable Web Services, Social S...
Leveraging New Features in CA Single-Sign on to Enable Web Services, Social S...Leveraging New Features in CA Single-Sign on to Enable Web Services, Social S...
Leveraging New Features in CA Single-Sign on to Enable Web Services, Social S...
 
CI and CD with Spinnaker
CI and CD with SpinnakerCI and CD with Spinnaker
CI and CD with Spinnaker
 
IBM Hybrid Cloud Integration UCC Talk, 21st November 2018
IBM Hybrid Cloud Integration UCC Talk, 21st November 2018IBM Hybrid Cloud Integration UCC Talk, 21st November 2018
IBM Hybrid Cloud Integration UCC Talk, 21st November 2018
 
Microservices
MicroservicesMicroservices
Microservices
 
Azure from scratch part 2 By Girish Kalamati
Azure from scratch part 2 By Girish KalamatiAzure from scratch part 2 By Girish Kalamati
Azure from scratch part 2 By Girish Kalamati
 
CTU June 2011 - Windows Azure App Fabric
CTU June 2011 - Windows Azure App FabricCTU June 2011 - Windows Azure App Fabric
CTU June 2011 - Windows Azure App Fabric
 
InfoTRAMS - Czy platforma Microsoft Azure jest biznoseow bezpieczna?
InfoTRAMS - Czy platforma Microsoft Azure jest biznoseow bezpieczna?InfoTRAMS - Czy platforma Microsoft Azure jest biznoseow bezpieczna?
InfoTRAMS - Czy platforma Microsoft Azure jest biznoseow bezpieczna?
 
EduID Mobile App - Use-Cases, Concepts and Implementation
EduID Mobile App - Use-Cases, Concepts and ImplementationEduID Mobile App - Use-Cases, Concepts and Implementation
EduID Mobile App - Use-Cases, Concepts and Implementation
 
Api management update for optus
Api management update for optusApi management update for optus
Api management update for optus
 
Private Apps in the Public Cloud - DevConTLV March 2016
Private Apps in the Public Cloud - DevConTLV March 2016Private Apps in the Public Cloud - DevConTLV March 2016
Private Apps in the Public Cloud - DevConTLV March 2016
 
Asp interview Question and Answer
Asp interview Question and Answer Asp interview Question and Answer
Asp interview Question and Answer
 
Microservices with asp dot net core, a next gen technology
Microservices with asp dot net core, a next gen technologyMicroservices with asp dot net core, a next gen technology
Microservices with asp dot net core, a next gen technology
 
Cloud foundry integration-with-openstack-and-docker-bangalorecf-meetup
Cloud foundry integration-with-openstack-and-docker-bangalorecf-meetupCloud foundry integration-with-openstack-and-docker-bangalorecf-meetup
Cloud foundry integration-with-openstack-and-docker-bangalorecf-meetup
 
Bye bye Identity Server
Bye bye Identity ServerBye bye Identity Server
Bye bye Identity Server
 

More from Krishna-Kumar

SODA Ambassadors & Community Ecosystem
SODA Ambassadors & Community EcosystemSODA Ambassadors & Community Ecosystem
SODA Ambassadors & Community Ecosystem
Krishna-Kumar
 
Open Source Building Career and Competency
Open Source Building Career and CompetencyOpen Source Building Career and Competency
Open Source Building Career and Competency
Krishna-Kumar
 
Google Anthos - Azure Stack - AWS Outposts :Comparison
Google Anthos - Azure Stack - AWS Outposts :ComparisonGoogle Anthos - Azure Stack - AWS Outposts :Comparison
Google Anthos - Azure Stack - AWS Outposts :Comparison
Krishna-Kumar
 
Cloud Native Use Cases / Case Studies - KubeCon 2019 San Diego - RECAP
Cloud Native Use Cases / Case Studies - KubeCon 2019 San Diego - RECAPCloud Native Use Cases / Case Studies - KubeCon 2019 San Diego - RECAP
Cloud Native Use Cases / Case Studies - KubeCon 2019 San Diego - RECAP
Krishna-Kumar
 
Cloud interoperability and open standards for digital india open infrasummit
Cloud interoperability and open standards for digital india open infrasummitCloud interoperability and open standards for digital india open infrasummit
Cloud interoperability and open standards for digital india open infrasummit
Krishna-Kumar
 
Google Cloud Container Security Quick Overview
Google Cloud Container Security Quick OverviewGoogle Cloud Container Security Quick Overview
Google Cloud Container Security Quick Overview
Krishna-Kumar
 
KubeCon + CloudNativeCon Barcelona and Shanghai 2019 - Highlights
KubeCon + CloudNativeCon Barcelona and Shanghai 2019 - HighlightsKubeCon + CloudNativeCon Barcelona and Shanghai 2019 - Highlights
KubeCon + CloudNativeCon Barcelona and Shanghai 2019 - Highlights
Krishna-Kumar
 
Introduction to ieee standards development - Bangalore Section
Introduction to ieee standards development - Bangalore SectionIntroduction to ieee standards development - Bangalore Section
Introduction to ieee standards development - Bangalore Section
Krishna-Kumar
 
IEEE Standards Association - Introduction
IEEE Standards Association - IntroductionIEEE Standards Association - Introduction
IEEE Standards Association - Introduction
Krishna-Kumar
 
IoTShow.in Bangalore 2019 - a Recap on 'IoT and Edge' Talk.
IoTShow.in Bangalore 2019 - a Recap on 'IoT and Edge' Talk.IoTShow.in Bangalore 2019 - a Recap on 'IoT and Edge' Talk.
IoTShow.in Bangalore 2019 - a Recap on 'IoT and Edge' Talk.
Krishna-Kumar
 
Open Source Edge Computing Platforms - Overview
Open Source Edge Computing Platforms - OverviewOpen Source Edge Computing Platforms - Overview
Open Source Edge Computing Platforms - Overview
Krishna-Kumar
 
cncf overview and building edge computing using kubernetes
cncf overview and building edge computing using kubernetescncf overview and building edge computing using kubernetes
cncf overview and building edge computing using kubernetes
Krishna-Kumar
 
Evolution of containers to kubernetes
Evolution of containers to kubernetesEvolution of containers to kubernetes
Evolution of containers to kubernetes
Krishna-Kumar
 
My Ladakh Marathon Run 2018
My Ladakh Marathon Run 2018My Ladakh Marathon Run 2018
My Ladakh Marathon Run 2018
Krishna-Kumar
 
Containers and workload security an overview
Containers and workload security an overview Containers and workload security an overview
Containers and workload security an overview
Krishna-Kumar
 
Now yoga - a study on where why what how
Now yoga  - a study on where why what howNow yoga  - a study on where why what how
Now yoga - a study on where why what how
Krishna-Kumar
 
CNCF Introduction - Feb 2018
CNCF Introduction - Feb 2018CNCF Introduction - Feb 2018
CNCF Introduction - Feb 2018
Krishna-Kumar
 
KubeCon USA 2017 brief Overview - from Kubernetes meetup Bangalore
KubeCon USA 2017 brief Overview - from Kubernetes meetup BangaloreKubeCon USA 2017 brief Overview - from Kubernetes meetup Bangalore
KubeCon USA 2017 brief Overview - from Kubernetes meetup Bangalore
Krishna-Kumar
 
Yoga for confused IT engineer
Yoga for confused IT engineerYoga for confused IT engineer
Yoga for confused IT engineer
Krishna-Kumar
 
Why kubernetes for Serverless (FaaS)
Why kubernetes for Serverless (FaaS)Why kubernetes for Serverless (FaaS)
Why kubernetes for Serverless (FaaS)
Krishna-Kumar
 

More from Krishna-Kumar (20)

SODA Ambassadors & Community Ecosystem
SODA Ambassadors & Community EcosystemSODA Ambassadors & Community Ecosystem
SODA Ambassadors & Community Ecosystem
 
Open Source Building Career and Competency
Open Source Building Career and CompetencyOpen Source Building Career and Competency
Open Source Building Career and Competency
 
Google Anthos - Azure Stack - AWS Outposts :Comparison
Google Anthos - Azure Stack - AWS Outposts :ComparisonGoogle Anthos - Azure Stack - AWS Outposts :Comparison
Google Anthos - Azure Stack - AWS Outposts :Comparison
 
Cloud Native Use Cases / Case Studies - KubeCon 2019 San Diego - RECAP
Cloud Native Use Cases / Case Studies - KubeCon 2019 San Diego - RECAPCloud Native Use Cases / Case Studies - KubeCon 2019 San Diego - RECAP
Cloud Native Use Cases / Case Studies - KubeCon 2019 San Diego - RECAP
 
Cloud interoperability and open standards for digital india open infrasummit
Cloud interoperability and open standards for digital india open infrasummitCloud interoperability and open standards for digital india open infrasummit
Cloud interoperability and open standards for digital india open infrasummit
 
Google Cloud Container Security Quick Overview
Google Cloud Container Security Quick OverviewGoogle Cloud Container Security Quick Overview
Google Cloud Container Security Quick Overview
 
KubeCon + CloudNativeCon Barcelona and Shanghai 2019 - Highlights
KubeCon + CloudNativeCon Barcelona and Shanghai 2019 - HighlightsKubeCon + CloudNativeCon Barcelona and Shanghai 2019 - Highlights
KubeCon + CloudNativeCon Barcelona and Shanghai 2019 - Highlights
 
Introduction to ieee standards development - Bangalore Section
Introduction to ieee standards development - Bangalore SectionIntroduction to ieee standards development - Bangalore Section
Introduction to ieee standards development - Bangalore Section
 
IEEE Standards Association - Introduction
IEEE Standards Association - IntroductionIEEE Standards Association - Introduction
IEEE Standards Association - Introduction
 
IoTShow.in Bangalore 2019 - a Recap on 'IoT and Edge' Talk.
IoTShow.in Bangalore 2019 - a Recap on 'IoT and Edge' Talk.IoTShow.in Bangalore 2019 - a Recap on 'IoT and Edge' Talk.
IoTShow.in Bangalore 2019 - a Recap on 'IoT and Edge' Talk.
 
Open Source Edge Computing Platforms - Overview
Open Source Edge Computing Platforms - OverviewOpen Source Edge Computing Platforms - Overview
Open Source Edge Computing Platforms - Overview
 
cncf overview and building edge computing using kubernetes
cncf overview and building edge computing using kubernetescncf overview and building edge computing using kubernetes
cncf overview and building edge computing using kubernetes
 
Evolution of containers to kubernetes
Evolution of containers to kubernetesEvolution of containers to kubernetes
Evolution of containers to kubernetes
 
My Ladakh Marathon Run 2018
My Ladakh Marathon Run 2018My Ladakh Marathon Run 2018
My Ladakh Marathon Run 2018
 
Containers and workload security an overview
Containers and workload security an overview Containers and workload security an overview
Containers and workload security an overview
 
Now yoga - a study on where why what how
Now yoga  - a study on where why what howNow yoga  - a study on where why what how
Now yoga - a study on where why what how
 
CNCF Introduction - Feb 2018
CNCF Introduction - Feb 2018CNCF Introduction - Feb 2018
CNCF Introduction - Feb 2018
 
KubeCon USA 2017 brief Overview - from Kubernetes meetup Bangalore
KubeCon USA 2017 brief Overview - from Kubernetes meetup BangaloreKubeCon USA 2017 brief Overview - from Kubernetes meetup Bangalore
KubeCon USA 2017 brief Overview - from Kubernetes meetup Bangalore
 
Yoga for confused IT engineer
Yoga for confused IT engineerYoga for confused IT engineer
Yoga for confused IT engineer
 
Why kubernetes for Serverless (FaaS)
Why kubernetes for Serverless (FaaS)Why kubernetes for Serverless (FaaS)
Why kubernetes for Serverless (FaaS)
 

Recently uploaded

NBFC Software: Optimize Your Non-Banking Financial Company
NBFC Software: Optimize Your Non-Banking Financial CompanyNBFC Software: Optimize Your Non-Banking Financial Company
NBFC Software: Optimize Your Non-Banking Financial Company
NBFC Softwares
 
A Comparative Analysis of Functional and Non-Functional Testing.pdf
A Comparative Analysis of Functional and Non-Functional Testing.pdfA Comparative Analysis of Functional and Non-Functional Testing.pdf
A Comparative Analysis of Functional and Non-Functional Testing.pdf
kalichargn70th171
 
dachnug51 - Whats new in domino 14 .pdf
dachnug51 - Whats new in domino 14  .pdfdachnug51 - Whats new in domino 14  .pdf
dachnug51 - Whats new in domino 14 .pdf
DNUG e.V.
 
Attendance Tracking From Paper To Digital
Attendance Tracking From Paper To DigitalAttendance Tracking From Paper To Digital
Attendance Tracking From Paper To Digital
Task Tracker
 
CViewSurvey Digitech Pvt Ltd that works on a proven C.A.A.G. model.
CViewSurvey Digitech Pvt Ltd that  works on a proven C.A.A.G. model.CViewSurvey Digitech Pvt Ltd that  works on a proven C.A.A.G. model.
CViewSurvey Digitech Pvt Ltd that works on a proven C.A.A.G. model.
bhatinidhi2001
 
Splunk_Remote_Work_Insights_Overview.pptx
Splunk_Remote_Work_Insights_Overview.pptxSplunk_Remote_Work_Insights_Overview.pptx
Splunk_Remote_Work_Insights_Overview.pptx
sudsdeep
 
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
ThousandEyes
 
Shivam Pandit working on Php Web Developer.
Shivam Pandit working on Php Web Developer.Shivam Pandit working on Php Web Developer.
Shivam Pandit working on Php Web Developer.
shivamt017
 
Leading Project Management Tool Taskruop.pptx
Leading Project Management Tool Taskruop.pptxLeading Project Management Tool Taskruop.pptx
Leading Project Management Tool Taskruop.pptx
taskroupseo
 
Intro to Amazon Web Services (AWS) and Gen AI
Intro to Amazon Web Services (AWS) and Gen AIIntro to Amazon Web Services (AWS) and Gen AI
Intro to Amazon Web Services (AWS) and Gen AI
Ortus Solutions, Corp
 
Software development... for all? (keynote at ICSOFT'2024)
Software development... for all? (keynote at ICSOFT'2024)Software development... for all? (keynote at ICSOFT'2024)
Software development... for all? (keynote at ICSOFT'2024)
miso_uam
 
Independence Day Hasn’t Always Been a U.S. Holiday.pdf
Independence Day Hasn’t Always Been a U.S. Holiday.pdfIndependence Day Hasn’t Always Been a U.S. Holiday.pdf
Independence Day Hasn’t Always Been a U.S. Holiday.pdf
Livetecs LLC
 
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...
karim wahed
 
Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...
Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...
Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...
Medical / Health Care (+971588192166) Mifepristone and Misoprostol tablets 200mg
 
Break data silos with real-time connectivity using Confluent Cloud Connectors
Break data silos with real-time connectivity using Confluent Cloud ConnectorsBreak data silos with real-time connectivity using Confluent Cloud Connectors
Break data silos with real-time connectivity using Confluent Cloud Connectors
confluent
 
Folding Cheat Sheet #7 - seventh in a series
Folding Cheat Sheet #7 - seventh in a seriesFolding Cheat Sheet #7 - seventh in a series
Folding Cheat Sheet #7 - seventh in a series
Philip Schwarz
 
WhatsApp Tracker - Tracking WhatsApp to Boost Online Safety.pdf
WhatsApp Tracker -  Tracking WhatsApp to Boost Online Safety.pdfWhatsApp Tracker -  Tracking WhatsApp to Boost Online Safety.pdf
WhatsApp Tracker - Tracking WhatsApp to Boost Online Safety.pdf
onemonitarsoftware
 
introduction of Ansys software and basic and advance knowledge of modelling s...
introduction of Ansys software and basic and advance knowledge of modelling s...introduction of Ansys software and basic and advance knowledge of modelling s...
introduction of Ansys software and basic and advance knowledge of modelling s...
sachin chaurasia
 
ANSYS Mechanical APDL Introductory Tutorials.pdf
ANSYS Mechanical APDL Introductory Tutorials.pdfANSYS Mechanical APDL Introductory Tutorials.pdf
ANSYS Mechanical APDL Introductory Tutorials.pdf
sachin chaurasia
 
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdf
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdfAWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdf
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdf
karim wahed
 

Recently uploaded (20)

NBFC Software: Optimize Your Non-Banking Financial Company
NBFC Software: Optimize Your Non-Banking Financial CompanyNBFC Software: Optimize Your Non-Banking Financial Company
NBFC Software: Optimize Your Non-Banking Financial Company
 
A Comparative Analysis of Functional and Non-Functional Testing.pdf
A Comparative Analysis of Functional and Non-Functional Testing.pdfA Comparative Analysis of Functional and Non-Functional Testing.pdf
A Comparative Analysis of Functional and Non-Functional Testing.pdf
 
dachnug51 - Whats new in domino 14 .pdf
dachnug51 - Whats new in domino 14  .pdfdachnug51 - Whats new in domino 14  .pdf
dachnug51 - Whats new in domino 14 .pdf
 
Attendance Tracking From Paper To Digital
Attendance Tracking From Paper To DigitalAttendance Tracking From Paper To Digital
Attendance Tracking From Paper To Digital
 
CViewSurvey Digitech Pvt Ltd that works on a proven C.A.A.G. model.
CViewSurvey Digitech Pvt Ltd that  works on a proven C.A.A.G. model.CViewSurvey Digitech Pvt Ltd that  works on a proven C.A.A.G. model.
CViewSurvey Digitech Pvt Ltd that works on a proven C.A.A.G. model.
 
Splunk_Remote_Work_Insights_Overview.pptx
Splunk_Remote_Work_Insights_Overview.pptxSplunk_Remote_Work_Insights_Overview.pptx
Splunk_Remote_Work_Insights_Overview.pptx
 
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
 
Shivam Pandit working on Php Web Developer.
Shivam Pandit working on Php Web Developer.Shivam Pandit working on Php Web Developer.
Shivam Pandit working on Php Web Developer.
 
Leading Project Management Tool Taskruop.pptx
Leading Project Management Tool Taskruop.pptxLeading Project Management Tool Taskruop.pptx
Leading Project Management Tool Taskruop.pptx
 
Intro to Amazon Web Services (AWS) and Gen AI
Intro to Amazon Web Services (AWS) and Gen AIIntro to Amazon Web Services (AWS) and Gen AI
Intro to Amazon Web Services (AWS) and Gen AI
 
Software development... for all? (keynote at ICSOFT'2024)
Software development... for all? (keynote at ICSOFT'2024)Software development... for all? (keynote at ICSOFT'2024)
Software development... for all? (keynote at ICSOFT'2024)
 
Independence Day Hasn’t Always Been a U.S. Holiday.pdf
Independence Day Hasn’t Always Been a U.S. Holiday.pdfIndependence Day Hasn’t Always Been a U.S. Holiday.pdf
Independence Day Hasn’t Always Been a U.S. Holiday.pdf
 
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) Course Introducti...
 
Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...
Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...
Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...
 
Break data silos with real-time connectivity using Confluent Cloud Connectors
Break data silos with real-time connectivity using Confluent Cloud ConnectorsBreak data silos with real-time connectivity using Confluent Cloud Connectors
Break data silos with real-time connectivity using Confluent Cloud Connectors
 
Folding Cheat Sheet #7 - seventh in a series
Folding Cheat Sheet #7 - seventh in a seriesFolding Cheat Sheet #7 - seventh in a series
Folding Cheat Sheet #7 - seventh in a series
 
WhatsApp Tracker - Tracking WhatsApp to Boost Online Safety.pdf
WhatsApp Tracker -  Tracking WhatsApp to Boost Online Safety.pdfWhatsApp Tracker -  Tracking WhatsApp to Boost Online Safety.pdf
WhatsApp Tracker - Tracking WhatsApp to Boost Online Safety.pdf
 
introduction of Ansys software and basic and advance knowledge of modelling s...
introduction of Ansys software and basic and advance knowledge of modelling s...introduction of Ansys software and basic and advance knowledge of modelling s...
introduction of Ansys software and basic and advance knowledge of modelling s...
 
ANSYS Mechanical APDL Introductory Tutorials.pdf
ANSYS Mechanical APDL Introductory Tutorials.pdfANSYS Mechanical APDL Introductory Tutorials.pdf
ANSYS Mechanical APDL Introductory Tutorials.pdf
 
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdf
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdfAWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdf
AWS Cloud Practitioner Essentials (Second Edition) (Arabic) AWS Security .pdf
 

CCICI CIP 1.0 Testbed - Security access implementation and reference - v1.0

  • 1. CCICI Cloud Interoperability 1.0 Testbed Security Access Implementation & References A presentation by Krishna Kumar & Chengappa Munjandira May 2021
  • 2. Cloud Interoperability & Portability Report 1.0 based TestBed Setup If you likes to be part of this open source project, join here 1) https://www.linkedin.com/groups/8247749/ 2) https://ccici.in/
  • 3. Cloud InterOp TestBed Architecture Framework Cloud Provider Resources (Compute, Network, Storage, etc.) Infrastructure as Code (Tosca, Terraform, Docker, Openstack, etc.) Application / Services (k8s, Compose, Vault, Consul, ServiceBrokers, etc.) Data Access Layer (CSI, SODA, VirtualDB, VirtualFS, etc.) Security & Compliance Monitoring & Logging App/Service Management Data Management Network Management Standards for India Cloud End Users (ISP, SMBs, Startups, Incubators, Government Agencies, Universities) vendor Neutral
  • 4. Authentication Flow - service to service across clouds Cloud1 Service1 Cloud2 Service2 Zero trust network 1 2 The Operations flow legends: 1. Service1 initiate Service2/Cloud2 2. Cloud1 request OAuth Token from Cloud2 (See the format of request) 3. Cloud2 process Token for specific service with access and token expiration 4. Cloud2 send Token back to Cloud1 5. Service1 call Service2 with access token 6. Service1 consume Service2 action (e.g: storage.objectread) 7. Service2 ACK/ERROR on call and log the entries in Cloud2 logs 8. Service1 stop the service2 call as needed by the operation 9. Cloud2 access Token expire 10. Service1 continue further operation UR1. IUR Token Request Format 1. Provider URI 2. Service Account 3. Account Key 4. Action* 5. Token expiration InterOp Format *Action Format ● compute.* ● network.* ● storage.* ● operations.* 3 4 5 6 7 8
  • 5. Multi cloud Authentication & Authorization for Service provisioning User / Agent Cloud 1: Id Provider Cloud 1: Service Consumer Zero Trust Tunnel Cloud 2: Id Provider 2 Cloud 2: Service Provider Connect to Cloud Authentication : Access Token Request Service Roll Request Service mapping Authorization Bearer Token Authorized: Access Grants Broker Agent Broker Agent Discovery Selection Monitoring JWT: valid? expired? Cloud Actor Access flow 1 Access flow 1 Cloud Auditor Service Templates Service provisioning workflow
  • 6. Authentication & Authorization OPTIONS: The following will be in place: 1. Single Sign-On & Cloud Federated Identity prefered by the Organization, like Microsoft AD. 2. Multi-Factor Authentication with app/otp generated approval to avoid phishing attacks: 3. Legacy system IAM using solutions Security Assertion Markup Language (SAML) 2.0 Identity Provider (IdP) 4. Third party Identity service Identity-Management-as-a-Service (IDaaS) like OKTA 5. If you want to allow anonymous users access (quite common for eCommerce applications) to any part of our application then you need to determine if you will be redirecting right away or prompting your users to redirect only when required. 6. Auth0 Universal Login - the so-called Bring Your Own Identity scenarios provided via Social Login. a. OpenID Connect & OAuth2.0 OAuth 2.0 is a framework that controls authorization, is a authorization protocol(OAuth only authorizes devices, API, servers with access tokens rather than credentials and it works over HTTPS.); OpenID Connect and SAML are both industry standards for federated authentication; OpenID Connect uses OAuth2.0 & JWT - mainly in websites and mobile (allows for ‘Federated Authentication’); SAML - OAuth with XML format - mainly in enterprise user login in multiple apps. SAML is used for both authentication & authorization between two parties; https://medium.com/@jad.karaki/identity-management-saml-vs-oauth2-vs-openid-connect-c9a06548b4c5
  • 8. Standards/Benchmark Applicable 1. CIS benchmark - (e.g: kubernetes, cloud service providers, etc.) 2. Payment Card Industry Data Security Standard 3.2.1 (PCI-DSS v3.2.1) 3. OWASP Top Ten (OWASP - A1:A10) 4. National Institute of Standards and Technology 800-53 (NIST 800-53) 5. International Organization for Standardization ISO 27001/17/18 6. FIPS 140-2 standards 7. Cloud Security Alliances (CSA) 8. Cloud Computing Compliance Criteria Catalogue (CS:2020) 9. SOC for service Organizations - (AICPA SOC) 10. Refer: a. AWS Compliance Programs - https://aws.amazon.com/compliance/programs/ b. Azure Compliance Offerings - https://docs.microsoft.com/en-us/azure/compliance/ c. Google Cloud Compliance Resource - https://cloud.google.com/security/compliance
  • 9. Open solutions available for Cloud Interop 1. Crossplane - Manage any infrastructure your applications need directly from Kubernetes - https://crossplane.io/ 2. Liqo - project that dynamically creates a big cluster - https://github.com/liqotech/liqo 3. Kubefed - coordinate the configuration of multiple Kubernetes clusters from a single set of APIs in a hosting cluster - https://github.com/kubernetes-sigs/kubefed 4. Konveyor - help modernize/migrate applications - forklift(to KubeVirt), pelorus, windup - https://konveyor.io/ 5. KubeVirt - virtuaization APIs for k8s - https://kubevirt.io/ 6. oVirt - Virtualization with kvm hypervisor - https://www.ovirt.org/ 7. Thanos - Prometheus at scale - https://thanos.io/ 8. Open Data Initiative - a platform for a single, comprehensive view of your data - https://www.microsoft.com/en-us/open-data-initiative 9. OAM model - runtime-agnostic specification that defines cloud native apps - https://oam.dev/ 10. CloudARK - framework to offer platform services as-Code - https://cloudark.io/ 11. KubePlus - CRD for CRDs for platform services - https://github.com/cloud-ark/kubeplus 12. Cloud Custodian - Cloud Security, Governance, and Management - https://cloudcustodian.io/ 13. Edge - Akri, OpenYurt, OpenNESS, k3s, kubeedge 14. Storage - Ceph, EdgeFS, Rook, ChubaoFS, Longhorn, OpenEBS 15. Runtime - CRI-O, CSI, CNI 16. CNCF Projects - https://www.cncf.io/ & case studies https://www.cncf.io/case-studies/ 17. Apache project list - https://www.apache.org/
  • 10. TOP Announcements from Major Cloud Vendors in last 1+yrs: ● AWS re:invent ○ - https://aws.amazon.com/blogs/aws/aws-reinvent-announcements-2020/ ● MicroSoft Build - ○ https://www.cloudwithchris.com/blog/build-2021-summary/ ○ https://www.cnbc.com/2020/05/22/microsoft-build-2020-recap-windows-azure-and-teams-tools.html ● Google Cloud Next - ○ https://www.cnet.com/news/google-io-2021-every-announcement-developers-conference/ ○ https://cloud.google.com/blog/topics/google-cloud-next/complete-list-of-announcements-from-google-cloud-next20-onair ● IBM Think - ○ https://www.ibm.com/cloud/blog/ibm-think-2021-key-announcements ○ https://www.eweek.com/innovation/ibm-think-2020-digital-building-reliability-resiliency-in-uncertain-times ● Oracle World - ○ https://www.forbes.com/sites/oracle/2019/09/25/larry-ellison-at-oracle-openworld-5-highlights-from-oracles-leader/?sh=22 1998582670 ● VMWorld - ○ https://www.vmware.com/company/news/updates/2020/vmworld-2020-news-announcement-summary.html ● Alibaba Apsara - ○ https://www.cloudmanagementinsider.com/alibaba-cloud-enters-next-phase-with-cloud-2-0-new-cloud-os-first-cloud-comp uter/ Look for latest on interoperability / Hybrid cloud solutions...
  • 12. OAuth2 Flow Diagram Get Access Token flow has 5 steps (as shown in the diagram): 1. Pre-register Client (App) with OAuth Server to get Client ID/Client Secret 2. OAuth Server authenticates user when she clicks on the App’s social login button, which is tagged with Client ID 3. OAuth Server solicits user permission to allow the App to perform something on her behalf 4. OAuth Server sends secret Code to App 5. App acquires Key/Access Token from OAuth Server by presenting secret Code and Client Secret https://blog.oauth.io/introduction-oauth 2-flow-diagrams/
  • 13. BANZAI CLOUD - Zero Touch Authentication Flow This is how the whole flow looks: 1. The user uses the Backyards CLI to perform a Backyards command. 2. The Backyards CLI creates a proxy endpoint to reach the Backyards service (we call it the “Server” from here on in), on a local port. 3. The Backyards CLI uses client-go to create an HTTP Transport that will automatically authenticate against the auth provider and will add a valid Bearer token to every request, except when Client Certificates are being used. In the event that Client Certificates are being used, the CLI will simply add the Client Certificates to the login request’s body. 4. The Backyards CLI calls the login API on the Server. 5. The Server verifies Bearer Tokens using the TokenReview API (or the Server verifies Client Certificates through a separate client) 6. The Server also uses the SubjectAccessReview API to get information about the user’s capabilities. 7. The Server issues a JWT, encoding all the user’s groups and capabilities with a longer expiration (10h), and wraps it in an encrypted JWE with a shorter expiration (5s). 8. The Backyards CLI receives the tokens, and can cache and work with the JWT for as long as it’s valid. 9. If the user calls the dashboard command, then the Backyards CLI has to use the encrypted JWE to open the browser tab. https://banzaicloud.com/blog/zero-touch-authentica tion-on-kubernetes/
  • 20. K8s in EKS - AWS https://aws.amazon.com/blogs/containers/kubernetes-rbac-and-iam-integration-in-amazon-eks-using-a-java-based-kuberne tes-operator/
  • 21. K8s in AKS - Azure https://docs.microsoft.com/en-us/azure/aks/concepts-identity
  • 22. K8s in GKE - Google Cloud https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity