documentation VS conftest

Both Kata Containers and UTM support virtio-fs, so this is not strictly true. The former can be used as a stand-in replacement for the runtime used by docker desktop[1]. With the latter, one could use a UTM-backed guest as a docker runtime in macOS[2] or run docker directly on the guest[3].

[1] https://github.com/kata-containers/documentation/blob/master...

[2] https://www.codeluge.com/post/setting-up-docker-on-macos-m1-...

[3] https://www.lifeintech.com/2021/11/03/docker-performance-on-...

For services with increased security requirements, it is recommended to use a low-level run-time with a high degree of isolation (gVisior, Kata-runtime)

On the official Kata repo, I found a tutorial only for manually deployed Kubernetes on GCE.

This is new and may not be used much, but it is possible to use part of Kata with part of Firecracker. https://github.com/kata-containers/documentation/wiki/Initia...

If it's using firecracker, it's probably using KVM virtualization while ensuring that the memory the VM consumes is not pinned... that is, that the VM can be swapped out of memory. For reference, firecracker was created by AWS to run and secure AWS Lambda. The hypervisor is written in rust and uses seccomp to eliminate unnecessary system calls. They open sourced it a few years back.

What you gain is a stronger security boundary. Just FYI, since 2019, you can also do this in Kubernetes using Kata containers which will happily shim firecracker. The setup is not simple though.

https://github.com/kata-containers/documentation/wiki/Initia...

Overall, fly.io building infrastructure on this pattern is fantastic and making it accessible is fantastic. Looking forward to seeing how this continues to evolve and am happy to see more infra build on top of firecracker. Very exciting!

I wrote following conftest.dev (OPA), sample policy

name: tf-plan-apply on: pull_request: branches: [ main ] env: TF_VERSION: 1.0.0 CONFTEST_VERSION: 0.28.3 WORKING_DIR: ./ jobs: terraform: name: aws-eureka-pairs-etc-s3 runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v2 - name: Install conftest run: | wget -O - 'https://github.com/open-policy-agent/conftest/releases/download/v${{ env.CONFTEST_VERSION }}/conftest_${{ env.CONFTEST_VERSION }}_Linux_x86_64.tar.gz' | tar zxvf - ./conftest --version //❶ - name: Setup Terraform uses: hashicorp/setup-terraform@v1 with: terraform_wrapper: false //❷ terraform_version: ${{ env.TF_VERSION }} cli_config_credentials_token: ${{ secrets.YOUR_CRED_NAME}} - name: Terraform Init ${{ env.WORKING_DIR }} working-directory: ${{ env.WORKING_DIR }} run: terraform init - name: Terraform Plan ${{ env.WORKING_DIR }} if: github.event_name == 'pull_request' env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} working-directory: ${{ env.WORKING_DIR }} id: plan run: terraform plan -out=tfplan -no-color -lock=false -parallelism=50 - name: Convert terraform plan result to json formmat if: github.event_name == 'pull_request' id: convert working-directory: ${{ env.WORKING_DIR }} run: terraform show -json tfplan > tfplan.json - name: conftest test if: github.event_name == 'pull_request' id: conftest run: ./conftest test --no-color ${{ env.WORKING_DIR }}/tfplan.json //❸

Workload configuration should be audited regularly (Kics, Kubeaudit, Kubescape, Conftest, Kubesec, Checkov)

Insert Conftest! As they state in their GitHub description, Conftest tests against structured configuration data using the Open Policy Agent Rego query language. In the case of Terraform, this means we're actually running unit tests against sample JSON and actual tests against the Terraform state JSON.

While Rego is the policy language we use to assemble our policies, we still need something to run those policies with. If you have a cluster and you want to actively evaluate policies, you can end up running an instance of Open Policy Agent and it's associated tooling. However in our case, we just want to check things at runtime (or just on some recurring basis such as when changes get checked in or a pull request is submitted). In the latter instance, we are able to use another tool from the Open Policy Agent project called ConfTest. What ConfTest allows us to do is to specify a file or directory of files that we want to inspect along with the set of policies we want to inspect them with. It then takes all of that and dumps out the associated outputs from those policies and tell us the results (i.e. the messages, how many policies were checked and the results of those policies). This tool is much better suited for our use case, so this is what we will proceed with. To grab the latest version of ConfTest, you can grab the latest release from here.

OR HOW TO RUN https://github.com/open-policy-agent/conftest AS CI/CD in Circle CI to apply policies?

If you like terraform-compliance, Conftest might also be worth having a look. It has its own DSL to write policies, and allows you to test multiple frameworks. We found this blog post from Lennard Eijsackers very informative, and would thus rather recommend you to check it out.

Can Gatekeeper and Conftest single-source the same set of rules? I'm looking at https://github.com/open-policy-agent/conftest/issues/54#issuecomment-528988831 and not seeing how.