Thursday, April 22, 2021

Fix Warning ResponseCookies - The cookie '.AspNetCore.OpenIdConnect.Nonce.xyz' has set 'SameSite=None' and must also set 'Secure'

            
In Startup.cs add the following snippet in Configure

 public void Configure(IApplicationBuilder appIWebHostEnvironment env)
        {
            //...

            app.UseCookiePolicy(new CookiePolicyOptions
            {
                Secure = CookieSecurePolicy.Always,
                MinimumSameSitePolicy = SameSiteMode.None
            });

            //...
        }

Saturday, April 17, 2021

DevSecOps: Runing ASP .NET Core Applications with minimal privileges in Kubernetes

 


Configure podSecurityContext

Configure the pod to run as nobody/nogroup user as follows:

podSecurityContext
  runAsUser65534
  fsGroup65534



Configure SecurityContext

Configure security context to run with minimal possible privileges:

securityContext
  capabilities:
    drop:
    - ALL
    add
    - "NET_ADMIN"
  readOnlyRootFilesystemfalse
  runAsNonRootfalse
  runAsUser65534 # run as the nobody/nogroup user



Run on non standard port

Since we do not have permission to run ports lower tan 1024 (normally assigned by adding capability NET_BIND_SERVICE but this requires root privileges) we have to configure ASP .Net Core to listen to a port above 1024.

env:
nameASPNETCORE_URLS
    valuehttp://+:8080



Tuesday, April 13, 2021

Zero trust architecture with Istio

Disabling access to services outside the mesh

The following command will restrict all outbound traffic to services defined in the service registry as well as those defined through ServiceEntries:

istioctl install --set meshConfig.outboundTrafficPolicy.mode=REGISTRY_ONLY. 

Enabling access to an URL outside the mesh

apiVersionnetworking.istio.io/v1beta1
kindServiceEntry
metadata:
  namemoneta-egress
spec:
  hosts:
  - '*.microsoft.com'
  - '*.microsoftonline.com'
  - '*.windows.net'
  locationMESH_EXTERNAL
  ports:
  - namehttps
    number443
    protocolHTTPS
  resolutionNONE

Set up the namespace to be secure by default

Enable mTLS in strict mode for a specific namespace

apiVersion"security.istio.io/v1beta1"
kind"PeerAuthentication"
metadata:
  name"default"
spec:
  mtls:
    modeSTRICT


Apply ALLOW NOTHING policy

apiVersionsecurity.istio.io/v1beta1
kindAuthorizationPolicy
metadata:
  nameallow-nothing
spec:
  {}

Creating allow rules for the different components

Create allow rule for the frontend

apiVersionsecurity.istio.io/v1beta1
kindAuthorizationPolicy
metadata:
  namefrontend
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ include "web.name" . }}
  actionALLOW
  rules:
   - {}

Create allow rule for accounts service

apiVersionsecurity.istio.io/v1beta1
kindAuthorizationPolicy
metadata:
  name: {{ include "accounts.name" . }}
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ include "accounts.name" . }}
  actionALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/moneta/sa/frontend-web"]
    to:
    - operation:
        paths: ["/accounts/*"]

check policies applied 

istioctl x authz check $(kubectl get pods -l app=mssql -n moneta -o jsonpath="{.items[0].metadata.name}").moneta