Project Lightning Talk: Blocking Vulnerable Workloads Out (And Catching What Got I... Alessio Greggi

In this talk, Alessio introduces Cube Warden, a universal policy engine that enables users to write custom policies in various programming languages, including Go, Rust, and TypeScript. He explains how policies can be compiled into OCI artifacts using WebAssembly, making them easy to deploy across different registries. The speaker discusses the integration of an SBOM scanner, a new component of Cube Warden that scans for vulnerabilities in container images, leveraging Trivy for vulnerability reporting. He details the image CV policy that enforces a maximum number of vulnerabilities allowed in images before they can be applied to a cluster, emphasizing the importance of context-aware policies that utilize information from the SBOM scanner's reports. The session concludes with a demonstration of how these policies can be configured and deployed effectively.

Welcome everyone. My name is Alessio and today I'm going to show you nice integration that we made using a new policy for Cube Warden to block workloads that have a specified number of CV that we want to block. So let's start by introducing what Cube Warden is. So it's a universal policy engine. Um Its particularity is that you can write your own policies you using your favorite

language since Cube Warden provides the SDK for several languages. You can use for example go or rust, typescript and so on and so forth. And the nice thing is that you can basically compile the policies with your favorite language into an OCI artifact thanks to Wasm. So you basically have this single binary and you can push this on your favorite registry. So that you can eat available

for the policy that you that you need. The other component which is a part of this integration is a SBOM scanner. So SBOM scanner is a a new component of the Cube Warden project and it's basically an SBOM centric security scanner. We are actually using Trivy under the hood but we plan to extend the support for other scanners so that the vulnerability report will be enriched by

all of them. In general you can basically configure a registry so that SBOM scanner will point to that registry and scan for the images inside the registry. Of course you can use some filters to avoid scanning the whole registry if you don't need the entire posture but in general it works with a this CRD which is the registry one and it basically produce as a result vulnerability

report of all the images that have been scanned on the registry. So you can see all the vulnerabilities that are affecting your images inside the registry that you configured. Now the integration is about this new policy combining Cube Warden and SBOM scanner. So their their potential all together. And the policy is the image CV policy. it basically enforce maximum number of vulnerabilities inside an image before to

get applied on your cluster. So if you want to avoid having like vulnerable CVs inside your cluster you can basically avoid it when you are applying the the resource. So the policy is a context aware policy as I said so it needs information coming from from from SBOM scanner which is the vulnerability report CRD. let's see how can you apply this. to apply the the policy you

you need a cluster administration policy. you can see the pointer. Okay. So you basically recall the policy using the module attribute. So since it's stored into a registry as an OCI artifact. And then you basically tell Cube Warden to use it in protect mode. So that will take action and avoid applying the resource so that you are applying. You have to specify the context of the the

policy. So in this case as I said you need a vulnerability report CRD produced by SBOM scanner. And in the end you can configure the policy specifying the behavior that you want to apply to to the policy. So in this case for example we assign the ignore missing vulnerability report. So in case the vulnerability report is not present on the cluster you can decide to apply the

workload in any case but I mean this depends on you. But more in general the max severity is the field that allows you to specify how many vulnerabilities depending on critical, high, you want to have in in the image when you apply it. So in this case we want zero vulnerabilities, zero critical vulnerabilities. that's how it work. So SBOM scanner scan for the registries, produce the vulnerability

report here and when you apply the resource the deployment Cube Warden check for the image CV policy, check that exist and then apply depending on the number of vulnerabilities. And that's all. Thanks. Awesome. Thank you very much. >> [applause]