🛡️ Secure Container Pipeline Workshop

https://powoftech.github.io/secure-container-pipeline-workshop/

A comprehensive hands-on workshop for building secure container pipelines with vulnerability scanning, policy enforcement, and runtime threat detection on AWS.

🎯 Overview

This workshop teaches you how to implement a complete secure container supply chain using modern DevSecOps practices. You'll learn to secure every stage of the container lifecycle - from build to runtime - using industry-standard tools and AWS services.

What You'll Build

• 🏗️ Secure CI/CD Pipeline with automated vulnerability scanning
• 🔒 Policy Enforcement using Kyverno admission controllers
• 👀 Runtime Threat Detection with Falco monitoring
• 📦 Container Registry Security with Amazon ECR enhanced scanning
• ☸️ Kubernetes Security Policies preventing misconfigurations

Learning Objectives

By completing this workshop, you will:

• ✅ Understand container security risks and mitigation strategies
• ✅ Implement automated vulnerability scanning in CI/CD pipelines
• ✅ Configure policy-as-code for Kubernetes admission control
• ✅ Deploy runtime security monitoring and threat detection
• ✅ Apply security best practices for containerized applications
• ✅ Create secure, scalable deployment workflows

---

🏗️ Architecture

Core Components

• Application: Simple Node.js web server demonstrating secure containerization practices
• ECR + Inspector: Automated vulnerability scanning and registry security
• Kyverno: Policy engine for Kubernetes admission control and governance
• Falco: Runtime security monitoring and threat detection
• GitHub Actions: Secure CI/CD pipeline with automated security gates

---

📋 Prerequisites

Required Tools & Accounts

• AWS Account with appropriate permissions for ECR, EKS, and EC2
• kubectl (version 1.27+) - Installation Guide
• AWS CLI (version 2.x) - Installation Guide
• Docker - Installation Guide
• GitHub Account for CI/CD workflow
• Node.js (version 16+) for local development

AWS Permissions Required

Your AWS account/IAM user needs permissions for:

• Amazon ECR (create repositories, push/pull images)
• Amazon EKS (create/manage clusters)
• Amazon EC2 (for EKS worker nodes)
• Amazon IAM (for service accounts and roles)
• Amazon Inspector (for enhanced container scanning)

Knowledge Prerequisites

• Basic understanding of containers and Docker
• Familiarity with Kubernetes concepts
• AWS services fundamentals
• Git and GitHub workflow

---

🚀 Quick Start

1. Clone the Repository

git clone https://github.com/your-username/secure-container-pipeline-workshop.git
cd secure-container-pipeline-workshop

2. Test the Application Locally

# Navigate to the app directory
cd app

# Run the application
node app.js

# Test in another terminal
curl http://localhost:8080
# Expected output: Hello, FCJ-ers!

3. Build and Test the Container

# Build the Docker image
docker build -t secure-app:latest .

# Run the container
docker run -p 8080:8080 secure-app:latest

# Test the containerized app
curl http://localhost:8080

4. Workshop Environment Setup

Follow the detailed workshop modules below to set up your complete secure container pipeline environment.

---

📚 Workshop Modules

This workshop is structured in progressive modules that build upon each other:

Module 1: 🏗️ Foundation Setup

Duration: 30-45 minutes

• Set up Amazon ECR repository
• Provision Amazon EKS cluster
• Configure enhanced vulnerability scanning
• Set up local development environment

Files involved:

• k8s/cluster.yaml - EKS cluster configuration

Module 2: 🔄 Secure CI/CD Pipeline

Duration: 45-60 minutes

• Create secure GitHub Actions workflow
• Implement automated vulnerability scanning
• Configure image signing and attestation
• Set up promotion gates and deployment automation

Files involved:

• .github/workflows/ci.yaml - CI/CD pipeline (to be created)
• app/Dockerfile - Secure container configuration

Module 3: 🛡️ Policy Enforcement with Kyverno

Duration: 60-75 minutes

• Install and configure Kyverno
• Implement admission control policies
• Test policy enforcement scenarios
• Create custom security policies

Files involved:

• k8s/policy-disallow-latest-tag.yaml - Prevent latest tag usage
• k8s/policy-require-non-root.yaml - Enforce non-root containers
• k8s/test-*.yaml - Policy validation tests

Module 4: 👁️ Runtime Security with Falco

Duration: 45-60 minutes

• Deploy Falco for runtime monitoring
• Configure security rules and alerts
• Test threat detection scenarios
• Set up log aggregation and alerting

Module 5: 🚀 Application Deployment

Duration: 30-45 minutes

• Deploy the secure application
• Validate all security controls
• Test end-to-end security pipeline
• Monitor and troubleshoot

Files involved:

• k8s/deployment.yaml - Application deployment
• k8s/service.yaml - Service configuration

Module 6: 🔍 Monitoring & Observability

Duration: 30 minutes

• Set up comprehensive logging
• Configure security dashboards
• Implement alerting strategies
• Review audit trails

---

🔒 Security Features

Container Security

• Multi-stage builds with minimal attack surface
• Non-root user execution for reduced privilege
• Distroless/slim base images to minimize vulnerabilities
• Immutable image tags for consistent deployments

Registry Security

• Automated vulnerability scanning with Amazon Inspector
• Enhanced scanning results with CVE details
• Image lifecycle policies for artifact management
• Registry access controls with IAM integration

Admission Control Policies

• Block latest tags - Prevent mutable image references
• Require non-root - Enforce security contexts
• Resource limits - Prevent resource exhaustion
• Security contexts - Enforce pod security standards

Runtime Security

• System call monitoring with Falco
• Kubernetes audit logging for cluster events
• Anomaly detection for suspicious activities
• Real-time alerting for security incidents

---

🛠️ Project Structure

.
├── app/                          # Application source code
│   ├── app.js                   # Node.js application
│   └── Dockerfile               # Secure multi-stage Dockerfile
├── k8s/                         # Kubernetes manifests and policies
│   ├── cluster.yaml             # EKS cluster configuration
│   ├── deployment.yaml          # Application deployment
│   ├── service.yaml             # Service configuration
│   ├── policy-disallow-latest-tag.yaml  # Kyverno policy
│   ├── policy-require-non-root.yaml     # Kyverno policy
│   └── test-*.yaml              # Policy validation manifests
├── .github/workflows/          # CI/CD pipeline (to be created)
├── LICENSE                     # MIT License
└── README.md                   # This file

---

🚦 Getting Started Guide

Step 1: Environment Setup

1. Configure AWS CLI

   aws configure
   # Enter your AWS Access Key ID, Secret Access Key, region, and output format

2. Verify Prerequisites

   # Check versions
   docker --version
   kubectl version --client
   aws --version
   node --version

Step 2: Deploy Infrastructure

1. Create ECR Repository

   aws ecr create-repository --repository-name secure-container-workshop

2. Set up EKS Cluster

   # Use eksctl or Terraform - detailed instructions in Module 1
   eksctl create cluster --config-file=k8s/cluster.yaml

Step 3: Build and Push Image

1. Build Application Image

   cd app
   docker build -t secure-app:v1.0.0 .

2. Push to ECR

   # Get ECR login token
   aws ecr get-login-password --region <your-region> | docker login --username AWS --password-stdin <account-id>.dkr.ecr.<region>.amazonaws.com
   
   # Tag and push
   docker tag secure-app:v1.0.0 <account-id>.dkr.ecr.<region>.amazonaws.com/secure-container-workshop:v1.0.0
   docker push <account-id>.dkr.ecr.<region>.amazonaws.com/secure-container-workshop:v1.0.0

Step 4: Install Security Tools

1. Install Kyverno

   kubectl create -f https://github.com/kyverno/kyverno/releases/latest/download/install.yaml

2. Apply Security Policies

   kubectl apply -f k8s/policy-disallow-latest-tag.yaml
   kubectl apply -f k8s/policy-require-non-root.yaml

3. Install Falco

   helm repo add falcosecurity https://falcosecurity.github.io/charts
   helm repo update
   helm install falco falcosecurity/falco

Step 5: Deploy Application

kubectl apply -f k8s/deployment.yaml
kubectl apply -f k8s/service.yaml

---

🧪 Testing & Validation

Policy Testing

Test your Kyverno policies with the provided test manifests:

# This should be REJECTED (uses latest tag)
kubectl apply -f k8s/test-root-pod.yaml

# This should be ACCEPTED (non-root user)
kubectl apply -f k8s/test-non-root-pod-level.yaml

# This should be ACCEPTED (non-root container level)
kubectl apply -f k8s/test-non-root-container-level.yaml

Vulnerability Scanning

Check ECR scan results:

aws ecr describe-image-scan-findings --repository-name secure-container-workshop --image-id imageTag=v1.0.0

Runtime Security Testing

Simulate security events to test Falco:

# Access the application pod
kubectl exec -it <pod-name> -- /bin/sh

# Trigger Falco alerts (inside the pod)
touch /tmp/suspicious-file
curl http://suspicious-domain.com

---

🔍 Troubleshooting

Common Issues

ECR Authentication Errors

# Re-authenticate to ECR
aws ecr get-login-password --region <region> | docker login --username AWS --password-stdin <account-id>.dkr.ecr.<region>.amazonaws.com

Kyverno Policy Not Enforcing

# Check policy status
kubectl get cpol
kubectl describe cpol disallow-latest-tag

# Verify Kyverno is running
kubectl get pods -n kyverno

EKS Cluster Access Issues

# Update kubeconfig
aws eks update-kubeconfig --region <region> --name <cluster-name>

# Verify connection
kubectl get nodes

Debug Commands

# Check application logs
kubectl logs -f deployment/secure-app

# Check Kyverno logs
kubectl logs -n kyverno deployment/kyverno-admission-controller

# Check Falco logs
kubectl logs daemonset/falco

---

📖 Additional Resources

Documentation

• Amazon ECR User Guide
• Amazon EKS User Guide
• Kyverno Documentation
• Falco Documentation

Security Best Practices

• NIST Container Security Guide
• CIS Kubernetes Benchmark
• OWASP Container Security Top 10

AWS Security Resources

• AWS Container Security Best Practices
• Amazon EKS Security Best Practices

---

🤝 Contributing

We welcome contributions to improve this workshop! Please:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/improvement)
3. Commit your changes (git commit -am 'Add improvement')
4. Push to the branch (git push origin feature/improvement)
5. Open a Pull Request

Areas for Contribution

• Additional security policies
• More comprehensive test scenarios
• Integration with other security tools
• Documentation improvements
• Performance optimizations

---

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

---

🙋 Support

Workshop Support

• Review the detailed project proposal for comprehensive technical details
• Check the troubleshooting section above
• Open an issue for bugs or questions

Learning Path

1. Complete all workshop modules in order
2. Practice with your own applications
3. Extend with additional security tools
4. Share your experience with the community

---

Happy Learning! 🎓 Build secure, deploy confidently! 🚀

---