Achieving DevSecOps Outcomes with Tanzu Advanced Speakers: David Zendzian, Global Field CISCO, VMware Tanzu James Urquhart, Strategic Executive Advisor, VMware Tanzu Mike Koleno, Chief Architect, AHEAD

1. Confidential │ ©2020 VMware, Inc.
Achieving
DevSecOps
Outcomes with Tanzu
Advanced
David M. Zendzian (dmz)
Global Field CISO, VMware Tanzu
James Urquhart
Strategic Executive Advisor
VMware Tanzu
Mike Koleno
Chief Architect
AHEAD

2. Confidential │ ©2020 VMware, Inc. 2
Build or Acquire Software and the Hardware Required to Run It
The Traditional Role of IT
Applications
Infrastructure

3. Confidential │ ©2020 VMware, Inc. 3
Deliver better software to production, faster
Structured Around Critical Capabilities
Applications
Infrastructure
DEVELOPER EXPERIENCE
OPERATOR EXPERIENCE
Code and containerize
custom applications
Reduce risk with curated
build packs and services
Automate deployment of
apps into production
Enable developer self-
service with K8s across
clouds, clusters and teams
Apply enterprise
observability to drive
decisions and reduce risk
Ensure secure and reliable
communication between
services
Multi-cloud

4. Confidential │ ©2020 VMware, Inc. 4
Deliver better software to production faster with less risk
Modern Application Demands Change The Conversation
Applications
Infrastructure
LOW TOIL, LOW RISK PATH TO PRODUCTION
LOW TOIL, LOW RISK SERVICE DELIVERY
Multi-cloud

5. Confidential │ ©2020 VMware, Inc.
Themes in App Modernization
Embracing Cloud-
Native Architecture
Enterprise
Integration Redux
From Batch To
Event-Driven
1 2 3
View From

6. Confidential │ ©2020 VMware, Inc.
Creation (coding, sourcing, unit testing, dev local workspace)
Build/Verify (CI, build, integration testing, registry, security scanning, etc)
Deploy/Operate (CD, configuration, automation, load/stress testing)
Connect (Networking, load balancing, ingress/egress, etc.)
Observe (K8S, compute, network, storage, self-service)
Five areas of focus for DevSecOps

7. Confidential │ ©2020 VMware, Inc. 7
DevSecOps Capabilities – Build, Run, Manage
The Right Tools, The Right Parts
Modern
businesses
operate in a
regulated world; it
is only when
internal policy,
governance and
audit teams
partner with
developers that
they can fully meet
these regulations.

8. Confidential │ ©2020 VMware, Inc. 8
DevSecOps Capabilities – Create
The Right Tools, The Right Parts
Developers should
focus on building
great software, not
achieving basic
security for well-
known
architectures.

9. Confidential │ ©2020 VMware, Inc. 9
Development
environment
• Tools
• Databases
• Services
• Kubernetes
CODE
DevSecOps Flow – Create
Version
Control Includes:
• Developer’s local development environment
• IDEs and editors
• Debugging tools
• Docker/containerd
• Application Stack
• Frameworks
• Libraries
• Middleware/Runtime
• Required shared services
• Databases and file stores
• Message/event queues
• Cloud services
• Version Control
• Balanced team – includes security / risk
• Before building – architecture requirements
• Data Classification / Auth / Secrets / ConfigMgmt
/ Circuitbreakers / Logging / Input-Output
Validation / BoM / Risk Assessment / Incident
Response
• Framework guardrails for ATO
• Code signing

10. Confidential │ ©2020 VMware, Inc.
Run
Enterprise Apps Are The Lifeblood of Organizations Today
Build
Any Cloud
Any Platform
Any Application Stack
Innovate
APP
View From

11. Confidential │ ©2020 VMware, Inc.
The Four Principles of GitOps
Source: GitOps Working Group
Declarative
The entire system is
described declaratively
Versioned
The canonical desired
system state is
versioned in Git
Automation
Approved changes can
be automatically applied
to the system
Self-Healing
Software agents ensure
correctness and alert on
divergence
View From

12. Confidential │ ©2020 VMware, Inc. 12
DevSecOps Capabilities – Build/Verify
The Right Tools, The Right Parts
Bulding, testing,
and packaging
distributed
applications
requires a
trusted supply-
chain,
verification of
build integrity,
and ensuring the
immutability of
delivered
containers.

13. Confidential │ ©2020 VMware, Inc. 13
Automated container
packaging
• Validated
• Reproducible builds
• Security and patching
CI
Container image registry
• Secure artifacts with policies and
role-based access
• Image scanning and
signing
DevSecOps Flow – Build/Verify
Version
Control Includes:
• Cloud Native Build Packs
• Curated/Validated
• CVE and Bug Mitigations
• Upstream
• Automated Builds
• “Sec” in DevSecOps
• Lots of tooling
• Code validation / OSL /
BoM / SAST / DAST / …
• Image Signing
• Always latest image
• Code / RootFS / Runtime
• Building for container no dev
workstation
• Vuln Scanning
• Inventory

14. Confidential │ ©2020 VMware, Inc.
DEV STAGE PROD
How Can The Tanzu Build Service Help?
DEV STAGE PROD
View From

15. Confidential │ ©2020 VMware, Inc.
Tanzu Harbor
Auditing: All the operations to the repositories are tracked. View From

16. Confidential │ ©2020 VMware, Inc.
Tanzu Harbor
Security Support: Integration with enterprise LDAP/AD systems for user
authentication & management
View From

17. Confidential │ ©2020 VMware, Inc.
Tanzu Harbor
Vulnerability Scanning: Harbor uses Clair to scan images regularly and warn
users of vulnerabilities.
View From

18. Confidential │ ©2020 VMware, Inc. 18
DevSecOps Capabilities – Deploy/Operate
The Right Tools, The Right Parts
Running custom
software securely
is not the act of a
single
organization or a
single toolset.
Intrinsic security
is only achieved
by an intentional
coordination of
security concerns,
both between
dependencies and
up and down the
stack.

19. Confidential │ ©2020 VMware, Inc.
Tanzu App Catalog
Operator Confidence: Gain the confidence that your open-source containers
conform to your security requirements, are built on your OS of choice, and are
automatically updated
View From

20. Confidential │ ©2020 VMware, Inc. 20
Container image registry
• Secure artifacts with policies and
role-based access
• Image scanning and
signing
CD
CUSTOMER
Validated catalog of
runtimes and images
• Curated, secure, validated
OSS images
DevSecOps Flow – Deploy/Operate
Open source aligned
Kubernetes
• Certified, conformant Kubernetes
runtime
• Cluster-API-driven lifecycle
management
Centralized management for
multiple clusters across
clouds
• Policy management, enforcement
• Identity and access management
• Backup and restore
• Up to date source for
dependencies automatically
updated
• Smoke testing for all critical
platforms
• Configuration hardening
• AV / Malware scanning
• Vulnerability Scanning
• BoM – Libraries / versions / OSL
• Signed
• Trusted starting point for images
and applications

21. Confidential │ ©2020 VMware, Inc. 21
DevSecOps Capabilities – Connect/Observe
The Right Tools, The Right Parts
Managing (and
securing) a
complex systems
portfolio requires
being able to see
the system and
both its intended
and emergent
behaviors.

22. Confidential │ ©2020 VMware, Inc. 22
CUSTOMER
DevSecOps Flow – Connect
Open source aligned
Kubernetes
• Certified, conformant Kubernetes
runtime
• Cluster-API-driven lifecycle
management
Centralized management for
multiple clusters across
clouds
• Policy management, enforcement
• Identity and access management
• Backup and restore
Connect and protect
applications
• Encrypted traffic,
security policies,
firewall
• Kubernetes
• Compliant – No lock-in / fastest response to upstream patches
and updates
• OPA / Gatekeeper policies
• Network Policies
• NSX/AVI/CNI integrations – extensive multi-layer segmentation
options across multiple public and private clouds
• Centralized Mission Control Vision
• Extensive role based access
• CLI for all functionality – api-first development
• Cluster Groups
• Policies – Cluster / Network / Image / CIS / STIG
• Any Kubernetes
• FedRamp High in process right now
• Service Mesh
• TLS Everywhere
• mTLS client authentication
• “zero-trust” application networks (when used with network
policies)

23. Confidential │ ©2020 VMware, Inc.
Tanzu Mission Control
Centralized management of policy and security for all clusters across all teams
View From

24. Confidential │ ©2020 VMware, Inc. 24
CUSTOMER
DevSecOps Flow – Observe
Open source aligned
Kubernetes
• Certified, conformant Kubernetes
runtime
• Cluster-API-driven lifecycle
management
Centralized management for
multiple clusters across
clouds
• Policy management, enforcement
• Identity and access management
• Backup and restore
Observability
• Visibility across
applications, clusters based
on open standards
Connect and protect
applications
• Encrypted traffic,
security policies,
firewall
• Observability Vision
• Millions of events per second
• View of all clusters and applications
• If architecture side prepared for observability
• Forensic information
• Abnormal performance
• Unusual resource consumption
• …

25. Confidential │ ©2020 VMware, Inc.
Tanzu Observability
Application
Performance:
View distributed
application maps
with pre-built
dashboards, and
query/filter traces
and metrics at
scale
View From

26. Confidential │ ©2020 VMware, Inc. 26
Container image registry
• Secure artifacts with policies and
role-based access
• Image scanning and
signing
Observability
• Visibility across
applications, clusters based
on open standards
Connect and protect
applications
• Encrypted traffic,
security policies,
firewall
CD
Development
environment
• Tools
• Databases
• Services
• Kubernetes
CODE
CUSTOMER
Automated container
packaging
• Validated
• Reproducible builds
• Security and patching
CI
Open source aligned
Kubernetes
• Certified, conformant Kubernetes
runtime
• Cluster-API-driven lifecycle
management
Centralized management for
multiple clusters across
clouds
• Policy management, enforcement
• Identity and access management
• Backup and restore
Validated catalog of
runtimes and images
• Curated, secure, validated
OSS images
DevSecOps Flow
Version
Control

27. Confidential │ ©2020 VMware, Inc. 27
VMware Tanzu Advanced Benefits
New K8s, same UI
Adopt Kubernetes with no additional
code or training required
Multi-cloud simplified
Operate VMs and containers side-by-
side with a global control plane
Platform Development
Drive cloud native architecture
Consistent policy
Access, back up, controls etc. across
all clusters for DevSecOps
Cloud native constructs
Drive adoption of microservices,
containers, and data models
App Navigator
Drive cloud native patterns
Intrinsic security for apps
App security part of software
development lifecycle
Accelerate developer velocity
Enable self-service and automate
the path to production
Application
Modernization
Catalyst for customer outcomes
OPS: Embrace move to containers and K8s
Simplify operation across multi-cloud
SEC: Secure containers and open source
Reduce risk across app portfolio
DEV: Deliver apps and updates faster
Re-platform or re-factor app-by-app
Architect: Enable agile business through software
Eliminate friction of Dev, Sec, and Ops