1) The document discusses a 3 step process for securing Helm charts: define security requirements, use policy as code to encode the requirements, and implement guardrails like scans to ensure the requirements are met. 2) It provides examples of writing Rego policy that checks for secrets in environment variables, privilege escalation settings, and running as root. 3) Tools like Terrascan can scan Helm charts and infrastructure as code for policy violations and be integrated into CI/CD pipelines to prevent insecure configurations from being deployed.

1. Policy as code: What Helm
Developers Need to Know About
Security
1
Cesar Rodriguez
Head of Developer Advocacy

2. 2
CNCF Survey 2020 / Photo by CHUTTERSNAP on Unsplash
92%
organizations
using containers
in production
83%
organizations
using
Kubernetes in
production

3. Cloud Breaches
3
200
cloud breaches in
the last 24 months
30B+
records exposed due to
cloud infrastructure
misconfigurations

4. 4
➜ ~

5. 5
➜ ~ brew install mysql

6. 6
➜ ~ brew install mysql
➜ ~ docker run --name cesar-mysql -e
MYSQL_ROOT_PASSWORD=super-secret-password -d mysql:latest

7. 7
➜ ~ brew install mysql
➜ ~ docker run --name cesar-mysql -e
MYSQL_ROOT_PASSWORD=super-secret-password -d mysql:latest
➜ ~ helm install mysql bitnami/mysql

8. How do I secure Helm?

9. Cesar Rodriguez
Developer Advocate
Cloud Security Architect
OSS Contributor
cesar@accurics.com

10. #3
Implement
Guardrails
#1 Define
Requirements
#2 Use Policy
as Code
3 Steps for Using Helm Securely

11. Photo by Rafael Garcin on Unsplash
Step #1: Define
Requirements

12. Photo by Rafael Garcin on Unsplash
Security
Functionality
Usability

13. Frameworks, Compliance, & Benchmarks

14. Security Risk Categories
14
Data
Protection
Enforcing encryption helps
protect data traversing
network boundaries and
at-rest
Access
Management
Access to cloud resources
should be controlled
enforcing least privilege
and avoid accidental public
exposure
Network
Security
Security controls should be
applied at the network
layer to prevent
unintended exposure
Visibility
Ensuring logging and
monitoring of cloud
systems is enabled and
accessible by security team

15. Example - Wordpress Architecture
15

16. Example Architecture Security Requirements
16

17. Example - Wordpress Architecture Policies
17
1. Secrets in environment vars
(CIS k8s benchmark 5.4.1)

18. Example - Wordpress Architecture Policies
18
1. Secrets in environment vars
(CIS k8s benchmark 5.4.1)
2. Containers running as root
(CIS k8s benchmark 5.2.6)

19. Example - Wordpress Architecture Policies
19
1. Secrets in environment vars
(CIS k8s benchmark 5.4.1)
2. Containers running as root
(CIS k8s benchmark 5.2.6)
3. Privilege escalation setting
(CIS k8s benchmark 5.2.5)

20. Step #2: Use Policy as Code

21. Photo by Scott Graham on Unsplash
What is Policy as Code?

22. PaC Benefits
22
1. Low friction
2. Secure by default
3. Increased Security Visibility

23. 23
openpolicyagent.org

24. Rego #1: Avoid Secrets in Env Variables
24
containerUsesSecretsInEnvironmentVar[api.id] {
api = input.kubernetes_deployment[_]
spec = api.config.spec.template.spec
containers = spec.containers[_]
envVars := containers.env[_]
envVars.valueFrom.secretKeyRef
}
1
2
3
4
5
6
7

25. Rego #1: Avoid Secrets in Env Variables
25
containerUsesSecretsInEnvironmentVar[api.id]{
api = input.kubernetes_deployment[_]
spec = api.config.spec.template.spec
containers = spec.containers[_]
envVars := containers.env[_]
envVars.valueFrom.secretKeyRef
}
1
2
3
4
5
6
7
apiVersion: v1
kind: Deployment
metadata:
name: secret-env-pod
spec:
containers:
- name: mycontainer
image: redis
env:
- name: SECRET_USERNAME
valueFrom:
secretKeyRef:
name: mysecret
key: username
- name: SECRET_PASSWORD
valueFrom:
secretKeyRef:
name: mysecret
key: password
restartPolicy: Never
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

26. Rego #2: Privilege Escalation
26
privilegeEscalationCheck
[pod.id] {
pod := object.get(input, "kubernetes_deployment", "undefined")[_]
secContext := pod.config.spec.template.spec.securityContext
podSecurityCheck(secContext)
}
podSecurityCheck(secContext) {
secContext.allowPrivilegeEscalation == "true"
}
podSecurityCheck(secContext) {
object.get(secContext, "allowPrivilegeEscalation", "undefined") == "undefined"
}
1
2
3
4
5
6
7
8
9
10
11

27. Rego #2: Privilege Escalation
27
privilegeEscalationCheck[pod.id] {
pod := object.get(input, "kubernetes_deployment", "undefined")[_]
secContext := pod.config.spec.template.spec.securityContext
podSecurityCheck(secContext)
}
podSecurityCheck(secContext) {
secContext.allowPrivilegeEscalation == "true"
}
podSecurityCheck(secContext) {
object.get(secContext, "allowPrivilegeEscalation", "undefined") == "undefined"
}
1
2
3
4
5
6
7
8
9
10
11

28. Rego #2: Privilege Escalation
28
privilegeEscalationCheck[pod.id] {
pod := object.get(input, "kubernetes_deployment", "undefined")[_]
secContext := pod.config.spec.template.spec.securityContext
podSecurityCheck(secContext)
}
podSecurityCheck(secContext) {
secContext.allowPrivilegeEscalation == "true"
}
podSecurityCheck(secContext) {
object.get(secContext, "allowPrivilegeEscalation", "undefined")== "undefined"
}
1
2
3
4
5
6
7
8
9
10
11

29. Rego #2: Privilege Escalation
29
podSecurityCheck(secContext) {
secContext.allowPrivilegeEscalation == "true"
}
podSecurityCheck(secContext) {
object.get(secContext,
"allowPrivilegeEscalation", "undefined") ==
"undefined"
}
securityContext:
runAsUser: 1000
runAsGroup: 3000
fsGroup: 2000
allowPrivilegeEscalation: true
1
2
3
4
5
8
9
10
11
12
13
14
15

30. Rego #3 Running as Root
30
runAsNonRootCheck(secContext) {
secContext.runAsNonRoot == "false"
}
runAsNonRootCheck(secContext) {
object.get(secContext, "runAsNonRoot", "undefined") == "undefined"
}
runAsUserCheck(secContext) {
secContext.runAsUser == "0"
}
runAsUserCheck(secContext) {
object.get(secContext, "runAsUser", "undefined") == "undefined"
}
10
11
12
13
14
15
16
17
18
19
20
21

31. Rego #3 Running as Root
31
10
11
12
13
14
15
16
17
18
19
20
21
runAsNonRootCheck(secContext) {
secContext.runAsNonRoot == "false"
}
runAsNonRootCheck(secContext) {
object.get(secContext, "runAsNonRoot", "undefined") == "undefined"
}
runAsUserCheck(secContext) {
secContext.runAsUser == "0"
}
runAsUserCheck(secContext) {
object.get(secContext, "runAsUser", "undefined") == "undefined"
}

32. Rego #3 Running as Root
32
runAsNonRootCheck(secContext) {
secContext.runAsNonRoot == "false"
}
runAsNonRootCheck(secContext) {
object.get(secContext,
"runAsNonRoot", "undefined") ==
"undefined"
}
runAsUserCheck(secContext) {
secContext.runAsUser == "0"
}
runAsUserCheck(secContext) {
object.get(secContext, "runAsUser",
"undefined") == "undefined"
}
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
securityContext:
runAsNonRoot: false
runAsGroup: 3000
fsGroup: 2000
securityContext:
runAsUser: 0
runAsGroup: 3000
fsGroup: 2000
1
2
3
4
1
2
3
4

33. Step #3: Implement Guardrails

34. Photo by Aditya Rathod on Unsplash
What are security guardrails?

35. 35
github.com/accurics/terrascan

36. 36
➜ ~ terrascan scan -p policies -i helm
Violation Details -
Description: Container uses secrets in environment variables
File : wordpress/templates/deployment.yaml
Line : 1
Severity : HIGH
-----------------------------------------------------------------------
Description: Containers Should Not Run with AllowPrivilegeEscalation
File : wordpress/templates/deployment.yaml
Line : 1
Severity : HIGH
-----------------------------------------------------------------------
Description: Minimize Admission of Root Containers
File : wordpress/templates/deployment.yaml
Line : 1
Severity : HIGH

37. 37
➜ ~ terrascan scan -p policies -i helm -r git -u
git@github.com:helm/charts.git//stable//wordpress
Violation Details -
Description: Container uses secrets in environment variables
File : wordpress/templates/deployment.yaml
Line : 1
Severity : HIGH
-----------------------------------------------------------------------
Description: Containers Should Not Run with AllowPrivilegeEscalation
File : wordpress/templates/deployment.yaml
Line : 1
Severity : HIGH
-----------------------------------------------------------------------

38. 38
➜ ~ alias no_terrascan_highs='terrascan scan -p policies -i helm -o json | ((
$(jq ".results.scan_summary.high") == 0 ))'
➜ ~ no_terrascan_highs && helm install wordpress .

39. CI/CD
39
Build
Continuous Integration
Deploy
Continuous Deployment
Develop
Continuous Code
Posture Management
Run
Continuous Cloud
Posture Management
RUNTIME
DEVELOPMENT
Cloud
Infrastructure as Code Secure Code
Management
CI/CD Cloud Service Provider

40. 40
Admission Controller

41. Demo

42. #3
Implement
Guardrails
#2 Use Policy
as Code
3 Steps for Using Helm Securely
#1 Define
Requirements

43. 43
Thank You
accurics.com/blog