Jan 05, 2023

Alex Hisaka

D2iQ

Simplifying Kubernetes DevSecOps Through Platform Engineering

8 min read

The D2iQ Kubernetes Platform (DKP) is designed to be secure by default. Built-in security can alleviate the burden on IT teams to have its members acquire security expertise and continually apply security measures to software and platform development.

To learn how your business can fail-proof its infrastructure with military-grade security, speak with the experts at D2iQ.

DevSecOps–short for development, security, and operations–is a trending practice that introduces security testing, triage, and risk mitigation as early as possible in the software development lifecycle, rather than bolting on security in the final stages.

DevSecOps requires a shift (also known as “shift-left”) in culture, process, and tools across development, security, and operations teams to make security a shared responsibility. From testing for security vulnerabilities to building business-driven security services, everyone is accountable for building security into the DevOps continuous integration and continuous delivery (CI/CD) workflow.

By ensuring security is an integral part of the entire development lifecycle, DevOps teams can deliver secure applications with speed and quality and prevent time-intensive and costly fixes post-production.

As the trend towards platform engineering displaces DevOps, deploying a fully automated and integrated Kubernetes stack that is secure by default is a way to ease the burden of DevSecOps.

Just as platform engineering eases the burden of DevOps by providing an Internal Development Environment (IDE) that serves as a “golden path” for developers, an IDE can simplify the practice of DevSecOps.

How Did DevSecOps Emerge?

In the past, security considerations and practices were often introduced at the end of the development cycle by a separate security team and tested by a separate (QA) team. This was manageable when software updates were released every few months or even years. However, the rise of cloud, containers, and microservices drove the need to accelerate the development and delivery of software releases.

As software developers adopted agile and devops practices, aiming to reduce software development cycles to weeks or even days, the traditional approach to bolting on security no longer sufficed. Because of this, DevSecOps was introduced into the DevOps framework to make security a shared responsibility. Today, continuous testing and integration, which includes security scanning into pipelines is becoming the norm.

How Does DevSecOps Work?

DevSecOps principles mirror those of traditional DevOps where multiple teams work together to enable secure continuous software delivery. DevSecOps best practices should ensure that security is integrated at each stage of the development lifecycle. And the process repeats as new features are developed and bugs are fixed. A typical DevSecOps workflow includes the following steps:

IT security integrates and begins threat modeling during the initial concept of the system.
A developer writes code within a version control management system.
The changes are committed within the version control management system.
Another developer retrieves the code from the versional control management system and conducts either static analysis (SA), dynamic analysis (DA), or software composition analysis (SCA) to evaluate security, the runtime environment, license compliance, open-source projects and packages, and code quality.
The application is deployed and security configurations are applied to the system.
A sandbox is created to conduct a series of tests, including security integration tests, back-end, UI, and API
Once the application passes the tests, it’s deployed to a production environment.
The production environment is continuously monitored to identify any security vulnerabilities in the system.

What Are the Benefits of DevSecOps?

Improve overall security

The most important and obvious benefit of DevSecOps is that you improve your overall security posture. Identifying security flaws earlier in your pipeline means it is significantly easier to fix them before they reach production. And because continuous monitoring is in place, it enhances your threat detection capabilities, making your secure product easier to sell.

Faster delivery

With DevSecOps, there is no need to wait until the end of the development cycle to bolt on security to an application. When security is integrated throughout the development lifecycle, it accelerates the speed of product delivery.

Reduce costs

By discovering security vulnerabilities before they reach production, you can significantly lower the costs incurred to fix them.

Ensure compliance

Another benefit of DevSecOps is that it ensures compliance with industry-standard regulations, such as the General Data Protection Regulation (GDPR). DevSecOps provides teams with a holistic overview of these measures for easier compliance.

Establishes collaborative culture

Integrating security practices into DevOps enhances the value of DevOps and improves the overall security posture as a culture of shared responsibility. When everyone is involved in the process, it increases their awareness of security fundamentals and best practices and provides a sense of ownership in the results.

How Does D2iQ Make DevSecOps Easier?

In today’s complex development environment, DevOps is giving way to platform engineering. In essence, DKP provides the Internal Development Platform (IDP) that is the key to successful platform engineering. Building an IDP can be tricky, which is why DKP offers organizations an easier path through an easy-to-deploy Kubernetes IDP that is production-ready out of the box.

A fully automated, integrated, secure, and tested Kubernetes stack like DKP provides a production-ready platform that eases development and management through a centralized management plane, built-in GitOps, and Cluster API (CAPI) for declarative programming.

By focusing on security as a critical platform requirement, D2iQ is able to build military-grade security into DKP that meets all NSA/CISA Kubernetes hardening guidelines. An air-gapped security environment can be deployed in minutes.

Secure By Default

DKP’s security posture can be broken down into four concepts:

Security Traffic Flows

External cluster traffic
Internal cluster traffic

Access and Identity Management

Authentication integration
Authorization implementation
Secret management

Logging, Monitoring, and Compliance

Logging architecture
Monitoring architecture
Compliance as a code

Operating and Maintaining the Cluster

Configuration management
Image management
Migration and deployment management
Contingency planning

Trusted Solutions and Benefits

Enterprise Scale Tests

DKP goes through a rigorous testing and review process where its scanned against Center for Internet Security (CIS) benchmarks, common vulnerabilities, and exposures (CVEs), and then deployed and soaked for up to 10,000 hours with mixed workload testing.

Release Cycle

D2iQ relies on upstream Kubernetes, which currently maintains community support for up to N-2 versions. This time period tends to amount to nine months of upstream support for any given minor version of Kubernetes, or a new minor release of Kubernetes every three months.

Upstream Base Technology Leadership

D2iQ can, and has, submitted enhancements and fixes for the underlying components included in DKP. This work has included triage, root cause analysis, and fixes for upstream open-source projects. Our engineering teams are actively contributing to a wide range of these projects, from a code and technical leadership perspective. To name a few, those efforts include Kubernetes itself, Kubefed, Kubecost, Cluster API, and many more.

Supply Chain Management

As cyberattacks continue to escalate, there has been increased focus on ensuring a reliable and transparent supply chain, especially for open-source software. At D2iQ, we provide an opinionated Kubernetes distribution while remaining transparent about each piece of code integrated into our platform.

Kubernetes Security Vulnerabilities

D2iQ is a part of the Kubernetes embargo community, meaning we are given early builds of Kubernetes under confidentiality to test and package in advance of the official release. This status gives us the opportunity to give you critical CVE patches very quickly, usually the day they are announced.

DKP Security Vulnerabilities

Ensuring security to the best of our abilities underlies everything we do. D2iQ will perform both OSS licensing and container image security scanning for releases. Image vulnerability scanning is performed on a continuous basis as part of D2iQ’s standard CI/CD process.

Air-Gapped Deployments

DKP is infrastructure agnostic and has a proven track record of running in a variety of environments, including those that are fully air-gapped from the Internet.

FIPS Compliant

Many government agencies in the United States require Federal Information Processing Standards (FIPS) compliance or validation for deployed software. D2iQ works with a number of government agencies and has a history of delivering FIPS-compliant platforms as part of these partnerships. In addition, DKP is FIPS 140-2 certified, which is the more stringent of the standards. With FIPS 140-2 validation, U.S. public sector organizations can have peace of mind that their DKP products and workloads have been certified secure by an independent laboratory in compliance with government standards.

To learn how your business can fail-proof its infrastructure with military-grade security, speak with the experts at D2iQ.

< Previous

Next >