DevSecOps: Running a React Single Page App with minimal privilege in Kubernetes

 Dockerfile

FROM node:16-alpine3.11 as build

WORKDIR /app

ENV PATH /app/node_modules/.bin:$PATH

COPY Moneta.Frontend.Web/package.json ./

COPY Moneta.Frontend.Web/package-lock.json ./

RUN npm install --silent

COPY Moneta.Frontend.Web/ ./

RUN yarn build

FROM nginx:latest

COPY --from=build /app/build /usr/share/nginx/html

COPY Moneta.Frontend.Web/nginx/default.conf /etc/nginx/conf.d/default.conf

COPY Moneta.Frontend.Web/nginx/nginx.conf /etc/nginx/nginx.conf

RUN chown -R nobody:nogroup /usr/share/nginx/html && chmod -R 755 /usr/share/nginx/html && \

        chown -R nobody:nogroup /var/cache/nginx && \

        chown -R nobody:nogroup /var/log/nginx && \

        chown -R nobody:nogroup /etc/nginx/conf.d

RUN touch /var/run/nginx.pid && \

        chown -R nobody:nogroup /var/run/nginx.pid

EXPOSE 8080

CMD ["nginx", "-g", "daemon off;"]

nginx/default.conf

server {

  listen 8080;

  location / {

    root   /usr/share/nginx/html;

    index  index.html index.htm;

    try_files $uri $uri/ /index.html;

  }

  error_page   500 502 503 504  /50x.html;

  location = /50x.html {

    root   /usr/share/nginx/html;

  }

}

nginx/nginx.conf

worker_processes  1;

           

error_log  /var/log/nginx/error.log warn;

pid        /var/run/nginx.pid;

events {

    worker_connections  1024;

}

http {

    include       /etc/nginx/mime.types;

    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '

                      '$status $body_bytes_sent "$http_referer" '

                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;

    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;

}

k8s deployment

podSecurityContext: 

  runAsUser: 65534  #nobody

  fsGroup: 65534    #nogroup

securityContext: 

  capabilities:

    drop:

    - ALL

    add: 

    - "NET_ADMIN"

  readOnlyRootFilesystem: false

  runAsNonRoot: true

  runAsUser: 65534 # run as the nobody user

Fix Warning ResponseCookies - The cookie '.AspNetCore.OpenIdConnect.Nonce.xyz' has set 'SameSite=None' and must also set 'Secure'

            
In Startup.cs add the following snippet in Configure

 public void Configure(IApplicationBuilder app, IWebHostEnvironment env)

        {

            //...

            app.UseCookiePolicy(new CookiePolicyOptions

            {

                Secure = CookieSecurePolicy.Always,

                MinimumSameSitePolicy = SameSiteMode.None

            });

            //...

        }

DevSecOps: Runing ASP .NET Core Applications with minimal privileges in Kubernetes

 

Configure podSecurityContext

Configure the pod to run as nobody/nogroup user as follows:

podSecurityContext: 

  runAsUser: 65534

  fsGroup: 65534

Configure SecurityContext

Configure security context to run with minimal possible privileges:

securityContext: 

  capabilities:

    drop:

    - ALL

    add: 

    - "NET_ADMIN"

  readOnlyRootFilesystem: false

  runAsNonRoot: true

  runAsUser: 65534 # run as the nobody/nogroup user

Run on non standard port

Since we do not have permission to run ports lower tan 1024 (normally assigned by adding capability NET_BIND_SERVICE but this requires root privileges) we have to configure ASP .Net Core to listen to a port above 1024.

env:

- name: ASPNETCORE_URLS

    value: http://+:8080

Zero trust architecture with Istio

Disabling access to services outside the mesh

The following command will restrict all outbound traffic to services defined in the service registry as well as those defined through ServiceEntries:

istioctl install --set meshConfig.outboundTrafficPolicy.mode=REGISTRY_ONLY. 

Enabling access to an URL outside the mesh

apiVersion: networking.istio.io/v1beta1

kind: ServiceEntry

metadata:

  name: moneta-egress

spec:

  hosts:

  - '*.microsoft.com'

  - '*.microsoftonline.com'

  - '*.windows.net'

  location: MESH_EXTERNAL

  ports:

  - name: https

    number: 443

    protocol: HTTPS

  resolution: NONE

Set up the namespace to be secure by default

Enable mTLS in strict mode for a specific namespace

apiVersion: "security.istio.io/v1beta1"

kind: "PeerAuthentication"

metadata:

  name: "default"

spec:

  mtls:

    mode: STRICT

Apply ALLOW NOTHING policy

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-nothing
spec:
  {}

Creating allow rules for the different components

Create allow rule for the frontend

apiVersion: security.istio.io/v1beta1

kind: AuthorizationPolicy

metadata:

  name: frontend

spec:

  selector:

    matchLabels:

      app.kubernetes.io/name: {{ include "web.name" . }}

  action: ALLOW

  rules:

   - {}

Create allow rule for accounts service

apiVersion: security.istio.io/v1beta1

kind: AuthorizationPolicy

metadata:

  name: {{ include "accounts.name" . }}

spec:

  selector:

    matchLabels:

      app.kubernetes.io/name: {{ include "accounts.name" . }}

  action: ALLOW

  rules:

  - from:

    - source:

        principals: ["cluster.local/ns/moneta/sa/frontend-web"]

    to:

    - operation:

        paths: ["/accounts/*"]

check policies applied 

istioctl x authz check $(kubectl get pods -l app=mssql -n moneta -o jsonpath="{.items[0].metadata.name}").moneta

Cloud-native Architecture

Definition:
Cloud native technologies empower organizations to build and run scalable applications in modern, dynamic environments such as public, private, and hybrid clouds. Containers, service meshes, microservices, immutable infrastructure, and declarative APIs exemplify this approach.

These techniques enable loosely coupled systems that are resilient, manageable, and observable. Combined with robust automation, they allow engineers to make high-impact changes frequently and predictably with minimal toil.

The Cloud Native Computing Foundation seeks to drive adoption of this paradigm by fostering and sustaining an ecosystem of open source, vendor-neutral projects. We democratize state-of-the-art patterns to make these innovations accessible for everyone.

ref: https://github.com/cncf/foundation/blob/master/charter.md

Traits of a cloud-native architecture:

• Self-healing
• cost efficient
• easy to update 

Principles

1. Design for automation
2. Favor stateless over statefull applications
3. Favor Managed Services
4. Practice defense in depth
5. Evolutionary Architecture

ref: https://cloud.google.com/blog/products/application-development/5-principles-for-cloud-native-architecture-what-it-is-and-how-to-master-it