Secure approval chain for runtime protection
A secure approval chain for runtime protection is disclosed. As an application or pod is developed in a pipeline, an approval engine ensures that the pod is approved by all approvers. The approval engine generates a deployment token that is added to the configuration data of the pod and that can be used at deployment to perform various security operations including pod verification, runtime environment control and enforcement, and pod or application verification.
1. A method, comprising:
generating, by an approval engine, a security tuple for a pod that is passing through a pipeline, wherein the security tuple includes first fields that uniquely identify the pod;
generating a hash of the security tuple;
generating, by the approval engine, a deployment token that includes the hash of the security tuple and second fields;
cryptographically signing, by all of the approvers, the deployment token, wherein each of the approvers uses a private key to cryptographically sign the deployment token, wherein the approval engine is aware of all of the multiple approvers, requires all of the approvers to cryptographically sign the deployment token, and prevents any of the approvers from being bypassed;
adding, by the approval engine, the cryptographically signed deployment token to configuration data of the pod; and
executing a webhook when the pod is deployed to a runtime environment, wherein the webhook validates signatures of the approvers.
2. The method of claim 1 , further comprising cryptographically signing the deployment token with multiple private keys associated with corresponding to multiple approvers.
3. The method of claim 1 , further comprising the webhook generating a hash from the first fields and comparing the generated hash with the hash of the security tuple included in the deployment token, wherein the pod is rejected when the hashes do not match.
4. The method of claim 3 , further comprising validating conditions for the runtime environment, the conditions including a target platform identifier and target platform configurations.
5. The method of claim 4 , further comprising adding decryption data to the configuration information of the pod when the webhook validates the pod.
6. The method of claim 5 , further comprising node verification by providing the pod with decryption keys when the pod is valid and ensuring that only authorized pods operate in the runtime environment.
7. The method of claim 1 , further comprising verifying, all of the signatures using public keys of the approvers.
8. The method of claim 1 , further comprising deploying the pod to an approved runtime environment.
9. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
generating, by an approval engine, a security tuple for a pod that is passing through a pipeline, wherein the security tuple includes first fields that uniquely identify the pod;
generating a hash of the security tuple;
generating, by the approval engine, a deployment token that includes the hash of the security tuple and second fields;
cryptographically signing, by all of the approvers, the deployment token, wherein each of the approvers uses a private key to cryptographically sign the deployment token, wherein the approval engine is aware of all of the multiple approvers, requires all of the approvers to cryptographically sign the deployment token, and prevents any of the approvers from being bypassed;
adding, by the approval engine, the cryptographically signed deployment token to configuration data of the pod; and
executing a webhook when the pod is deployed to a runtime environment, wherein the webhook validates signatures of the approvers.
10. The non-transitory storage medium of claim 9 , further comprising cryptographically signing the deployment token with multiple private keys associated with corresponding to multiple approvers.
11. The non-transitory storage medium of claim 9 , further comprising the webhook generating a hash from the first fields and comparing the generated hash with the hash of the security tuple included in the deployment token, wherein the pod is rejected when the hashes do not match.
12. The non-transitory storage medium of claim 11 , further comprising validating conditions for the runtime environment, the conditions including a target platform identifier and target platform configurations.
13. The non-transitory storage medium of claim 12 , further comprising adding decryption data to the configuration information of the pod when the webhook validates the pod.
14. The non-transitory storage medium of claim 13 , further comprising node verification by providing the pod with decryption keys when the pod is valid and ensuring that only authorized pods operate in the runtime environment.
15. The non-transitory storage medium of claim 9 , further comprising verifying, all of the signatures using public keys of the approvers.
16. The non-transitory storage medium of claim 9 , further comprising deploying the pod to an approved runtime environment.