May is Identity and Access month in the Red Hat’s monthly Security series! Beginning in March 2021, the Red Hat Security Ecosystem team has provided an introduction to a DevOps Security topic in a regular fashion to help you learn how Red Hat weaves together DevOps and security to help master the force called DevSecOps. We explain how to assemble Red Hat products and our security ecosystem partners to aid in your journey to deploying a comprehensive DevSecOps solution.
Identity and Access defined
Typically when identity and access is mentioned in a Kubernetes context, it’s IAM, or Identity and access management. These security methods control access to on-premises and cloud assets, applications, and data based on user or application identity and administratively defined policies. They are found in every stage of the DevOps lifecycle and can help protect against unauthorized system access and lateral movement. Taking a look at the different methods in Identity and Access, the following become a distinct, but related list:
-
Authentication is verifying the identity of users, services and applications.
-
Authorization is granting the authenticated users to specific resources or functions. In Kubernetes context, this is commonly referred to as role-based access controls (RBACs), which grant collections of users access to resources or functions based on their job responsibilities, simplify administration and onboarding, and reduce privilege creep.
-
Secure identity storage, such as secrets vaults and hardware security modules (HSMs), which manage and safeguard security credentials, keys, certificates, and secrets while at rest and in transit. HSMs are typically a physical device which securely stores digital keys through encryption to protect sensitive data. Secrets Vaults are typically a software solution that securely stores and manages any type of secret, like tokens, passwords, certificates, and encryption keys.
-
Provenance, which in the context of containers, is the ability to verify the identity or authenticity of code or an image typically through some type of digital signature or attestation record.
Identity and Access integrated in DevSecOps
As seen in the DevSecOps framework below, Identity and Access is represented in each integration point in the life cycle. This makes sense as identity needs to be managed properly in each step of the way in DevOps.
![2021-6-8-Devops identity and access framework 2021-6-8-Devops identity and access framework](/rhdc/managed-files/styles/wysiwyg_full_width/private/image1_78_0.png.webp?itok=cvuzJ18s)
Integration Point |
Description |
IDE |
Centrally provide IDE access to developers and ensure they only have access to development projects they are authorized to work on. Red Hat CodeReady Workspaces uses RH-SSO to create, import, manage, delete, and authenticate users. It can use third-party identity management systems, like a secrets vault, to create and authenticate users. |
Source Code Management |
You want to ensure the right people have access to the right source code repositories and only allow commit permissions to code contributors. In Red Hat OpenShift, Identity Providers like GitHub and GitLab can be configured to access the SCM. Secrets Vaults extend this capability by centrally managing SCM access tokens or secrets. |
Build Automation |
Developers don’t need edit access to the build system as builds should run automatically on a scheduled basis or per commits. With OpenShift Pipelines being part of Red Hat OpenShift, the default RBAC capabilities can be leveraged to allow specific permissions to the pipeline projects. Base images can be checked during the builds to ensure they come from trusted repositories and their checksums match with the distributor. |
Binary Repository |
Authentication and Authorization is a key consideration for Binary Repositories ability to stage or cache 3rd party dependencies from external sources to prevent users from using untrusted code in their applications. |
Container Registry |
Follow a zero trust methodology to harden your container registry access as it is a critical part of the DevSecOps development cycle. With Red Hat Quay, you can remove anonymous access, integrate with an Identity Provider, and create Robot Accounts which allow specific fine grained permissions to specific repositories. |
Container Orchestration |
In addition to user authentication and authorization to deploy and test container images, pod permissions are an important consideration in this step, especially if pods need to reference images across projects, from secured or private registries. Using image pull secrets with a centralized secrets vault is a best practice. |
Cluster |
Red Hat OpenShift Container Platform provides foundational Identity & Access features by integrating with Identity Providers, multi-tenancy with Project namespaces, and RBAC turned on by default. In addition to cluster user access, secrets vaults provide essential functions for running applications, such as on-demand access to passwords for application services like databases. An HSM can be used to protect and store cryptographic keys with industry standard, tamper-resistant hardware so that applications can access sensitive data without getting direct access to the encryption keys. |
Enhance and Extend Identity and Access with Red Hat Partners
Combining Red Hat OpenShift Container Platform identity and access features with Red Hat’s certified Ecosystem Security Partners provides holistic enterprise-ready DevSecOps. If you are looking to enhance and extend Red Hat’s security capabilities in Identity & Access, take a look at the following Red Hat Partners:
-
Cyberark’s certified software and webinar.
-
Thales’ Red Hat solution brief and webinar.
For more information, visit "Modernize and secure applications with DevSecOps," or talk to us at Enhance container security and adopt DevSecOps.
About the author
Dave Meurer currently serves as a Principal Solution Architect on the Red Hat Global Partner Security ISV team, where he owns technical relationships and evangelism with security independent software vendor partners of Red Hat. Before joining Red Hat, he spent nine years in the Application Security industry with Synopsys and Black Duck, where he served in similar roles as the director of technical alliances and sales engineering.
Meurer also worked for Skyway Software, HSN.com, and Accenture in various management and application development roles. When he’s not thinking about Kubernetes, security, and partners, he enjoys being the VP Sales of North Central Tampa for his wife (the CEO) and 5 kids (Inside Sales).
More like this
Browse by channel
Automation
The latest on IT automation for tech, teams, and environments
Artificial intelligence
Updates on the platforms that free customers to run AI workloads anywhere
Open hybrid cloud
Explore how we build a more flexible future with hybrid cloud
Security
The latest on how we reduce risks across environments and technologies
Edge computing
Updates on the platforms that simplify operations at the edge
Infrastructure
The latest on the world’s leading enterprise Linux platform
Applications
Inside our solutions to the toughest application challenges
Original shows
Entertaining stories from the makers and leaders in enterprise tech
Products
- Red Hat Enterprise Linux
- Red Hat OpenShift
- Red Hat Ansible Automation Platform
- Cloud services
- See all products
Tools
- Training and certification
- My account
- Customer support
- Developer resources
- Find a partner
- Red Hat Ecosystem Catalog
- Red Hat value calculator
- Documentation
Try, buy, & sell
Communicate
About Red Hat
We’re the world’s leading provider of enterprise open source solutions—including Linux, cloud, container, and Kubernetes. We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.
Select a language
Red Hat legal and privacy links
- About Red Hat
- Jobs
- Events
- Locations
- Contact Red Hat
- Red Hat Blog
- Diversity, equity, and inclusion
- Cool Stuff Store
- Red Hat Summit