DevSecOps Notes

 Fluentbit - is log and metrics processor tool. General-Purpose Log Processor.  - It can also gather metrics (CPU, Memory, Storage) - Can be setup on     - Server     - Virtual Machine     - Embedded Device     - Container     - Pods - challenges of Logging in Kubernetes     -  different log format     - additional logging context     - collect -> process  -> store     - resource requirement     -  - 

 OAuth - Authorization between services  OAuth  The valet key example Access delegation The OAuth flow OAuth Access Token - Contains user-allowed permissions - Trustable (cannot be tampered) JWT (JAWT) - secure comunication RFC 7519 Authorization strategies - session token - reference token - JSON web token - value token HTTP - statless ( have to have all information for the connection) Session ID + Cookies -> most popular mechanism for authorization Sticky session for load balancer solution JSON Web Tokens (JWT) How does JWT looks like?

a) Overview b)  Readme Govermance   documentation c)  what should within the documentation Scope - what project consist and not consist of  Mission  Values and principles

1. Network architecture   Distribution layer - which is sometimes referred to as the aggregation layer , provides route filtering and interVLAN routing . Management ACLs and IPS filtering are typically implemented at the distribution layer. The distribution layer serves as an aggregation point of access layer network links. Because the distribution layer is the intermediary between the access layer and the core layer , the distribution layer is the ideal place to enforce security policies and to perform and to perform tasks that involve packet manipulation, such as routing. Summarization and next-hop redundancy are also performed in the distribution. 2-tier architecture Collapsed Core Layer 3-tier architecture Cisco three-tier network design model Core Layer - The core layer typically provides the fastest switching path in the network. As the network backbone, the core layer is primarily associated with low latency and high reliability. 2.  Power over Ethernet (PoE) Cisco C...

  1. Overview Access private resources user needs: - vpn/ssh credentials - ip/subnet - DB credentials Access private resources challenges - offboarding / onboarding users - key rotation  - unstatic ip address - expose credentials Zero trust security model Dynamic, ephemeral enviorments single sing on with idp  role base access control with policy  logical service Boundary features:  - offboarding / onboarding users - it is enough to remove them from idp - high level policies - user do not get asses to private network - credential do not have to be given to user. Gateway fatched them from vault if gateway can comunicate with vault, or vault is used.  User -(connection)->  Worker -> target endpoint Worker -> Controllers User -()-> Controllers -> DB Controls Workers CLI UX Desktop App  Terraform Provider Dynamic Host Set     - AWs     - Consul     - k8s 2. 

 1. Overview - Waypoint - a project that unifies workflows fr build, deploy, and release platforms. Developers: - write code - test application - build - deploy - release - operate - measure source code + manifestation  => platform (Waypoint) waypoint up Deployment - gitops system - chatbot system - cli waypoint logs waypoint exec waypon 2. 

 1) Resource Groups - Resource Groups are collection of resources that share one or more tags - Resource Groups appears in the Global Console Header and Under Systems Manager - Helps you organize and consolidate information based on your project and the resources that you use. Resource Groups details about a group of resources based on     * Metrics     * Alarms     * Configuration Settings 2) Tags - Tags are words or phrases that act as metadata for organizing your AWS resources 3) 4) 5) 6) 7) 8)

1) Elastic Compute Cloud (EC2) - Cloud Computing Service. Choose your OS, Storage , Memory, Network Throughput . Launch and SSH into your server within minutes .  - Elastic compute Cloud (EC2) is a highly configurable server . - EC2 is resizable compute capacity . It takes minutes to launch new instances. - Anything and everything on AWS uses EC2 Instance underneath. - Choose your OS via Amazon Machine Image (AMI)     * RedHat     * Ubuntu     * Windows     * Amazon Linux     * Suse - Choose you Instance Type      * t2.nano - $0.0065/hour ($4.75/month), 1vCPU 0.5GB Mem     * c4.8xlarge - $1.591/hour ($1161.43/month), 36vCPU, 60GB Mem , 10 Gigabit performance - Add Storage (EBS, EFS) - SSD, HDD, Virtual Magnetic Tape, Multiple Volumes - Configure your Instance - Security Groups, Key Pairs, UserData, IAM Roles, Placement Group - a) EC2 - Instance Types and Usage - General Purpose      * ...

 1. AWS OpsWorks - configuration management service that provides fully-managed instances for Chef and Puppet - What is Configuration Management? The act of maintaining a specific software configuration and the ability to remotely make configuration changes to servers in way that they can be monitored , audited and automated. - What is Software Provisioning ? The act of configuration software packages on servers. Setting up all the software and configuration requirements to run a web-application. - What is Application Deployment ?  The act of deploying new versions of web-application or rollback to a previous web-application version. -What software does Configuration Managment, Software Provisioning, Application Deployment     *  Chef     *  Puppet     *  Ansible      *  Saltstack - AWS OpsWorks provides managed instances for the automation platforms Chef and Puppet -OpsWorks lets you use Chef and Puppet to aut...

1) Service Catalog - AWS Service Catalog enables organization to create and manage catalogs of products that are approved for use on AWS to achieve consistent governance and meet compliance requierments. - The AWS Service Catalog is an alternative to granting direct access to AWS resources via the AWS Console     * Standarization     * Self-service discovery and launch     * Fine-grain access control     * Extensibility and version control Anatomy of Service Control a)  Service Catalog - Users -  Administrative User  (Manages the catalog)     * Manage a catalog of products , organizing them into portfolios and granting access to the end users.      *An administrator technical responsibilities include:         ** Preparing CloudFormation templates         ** Configuring constraints         ** Managing IAM roles assigned to...