Streamline Open-Source Security Compliance On Kubernetes With Tanzu Application Catalog

Additionally, there are myriad benchmarks for container security that teams can follow to reduce the attack surface of applications. However, none of these benchmarks are typically applied to pre-built images from public container registries. This means that applications must be “rebased” onto the organization’s hardened OS container, and continuous integration (CI) infrastructure must be deployed and configured to maintain it over time. The result is that teams spend an inordinate amount of time packaging and customizing generic open-source components to meet their company policies—time that would be better spent on building and shipping applications.

Tanzu Application Catalog builds your catalog of containers on top of your hardened base OS container for you, and automatically updates the containers whenever the OS is updated.

Put Bitnami’s automated packaging pipeline to work for you

We learned early on that the Bitnami system’s flexibility with packaging software for multiple Linux distributions would be of value to customers. One of our first beta testers and earliest customers was struggling to get the Harbor registry working on their hardened CentOS 7 base container, to which they had adapted security benchmarks originally designed for virtual machines. The thought of maintaining all of Harbor’s multiple containers, which were originally developed on PhotonOS, over the long term as updates to both the application and underlying dependencies evolved, was discouraging.

Enter Tanzu Application Catalog: the customer set up a DMZ with their base operating system container in storage where the Tanzu Application Catalog automated pipeline could securely access it and periodically check for updates. Harbor was then packaged on this base container, and it has been maintained for the customer (along with a catalog of over 40 runtimes, databases, and other components) ever since.

In the span of a couple of days, Tanzu Application Catalog solved a problem for this customer that, by their own estimate, would have taken multiple sysadmins and developers weeks of effort. Tanzu Application Catalog’s continuous stream of application and dependency updates made their security posture stronger than ever, even as it reduced costs.

No custom base image? No problem!

What if you don’t have your own base operating system image, but recognize the need to standardize on one? Not to worry. VMware maintains a variety of container images hardened using best practices and continuously monitored for security patches from the upstream distro. This removes the burden on teams to become experts in Linux packaging, allowing developers and operators to focus on more valuable work.

This feature has been particularly valuable to our federal government customers, who require that their base OS containers be Federal Information Processing Standards (FIPS) certified. With Tanzu Application Catalog, these customers and others, such as government contractors, quickly gain access to an entire library of open-source software, maintained up-to-date on a FIPS-compliant operating system, so that developers can self-serve containers and Helm charts without violating security policy.

A continuous stream of software updates, with total transparency and auditability

One of the most important container security practices is to keep software up-to-date. This includes the latest security patches to applications or runtimes, dependencies, and operating system components.

Keeping all those things maintained for open-source software often requires setting up costly CI infrastructure that does nothing to enhance the capabilities of whatever software is being maintained. To reduce these costs, there is constant pressure to utilize containers packaged by external parties. However, an organization is hard pressed to find a third party they can truly trust not to make mistakes in packaging their containers.

Tanzu Application Catalog takes a unique approach to solving this problem: the Bitnami automated pipeline gets the software in every container directly from the upstream source and updates it for you over time. Each container and Helm chart comes with metadata that provides a complete accounting of every binary, library, and system package contained within: what version and patch level, where it was downloaded from, what open-source license it is subject to; all signed and verifiable through the Tanzu Application Catalog UI or through our newly released CLI (in beta).