Deploy Applications with Confidence and Control with VMware Application Catalog™ and Sealed Secrets

Raquel Campuzano and Juan Ariza co-wrote this blog post

As more organizations adopt Kubernetes as the preferred infrastructure for running their IT resources, enterprise SRE teams tend to adopt a GitOps mindset.  

The GitOps approach consists of embracing different practices that manage infrastructure configuration as a code. This means that Git becomes the single source of truth and as such, all operations are tracked via commits and pull requests. Thus, every action performed on the infrastructure will leave a trace and can be reverted if needed.  

This practice brings a lot of benefits to IT admins, since automation and ease of managing Kubernetes configurations are extremely important to them. 

Despite this, there’s a high probability of discovering security risks when managing access to the applications running in a Kubernetes cluster. This is where Sealed Secrets comes in. Sealed Secrets is a  Kubernetes controller and a tool for one-way encrypted Secrets.  

Why should every cluster controller use Sealed Secrets to protect their deployments?  

When cluster operators and administrators follow the GitOps approach, they usually find that they can manage all Kubernetes configurations through Git except secrets. Sealed Secrets solves this problem by encrypting the secret into a new Kubernetes object called “SealedSecret” which is safe to store even in public repositories.  

Sealed Secrets is a popular Open-Source project led by Bitnami that helps Kubernetes operators and administrators keep their deployments safe and under control. Sealed Secrets can only be decrypted by those who have access to the sealing private key — usually the cluster administrator — ensuring that nobody else, even the original author, is able to obtain the secret given in a Sealed Secret manifest file. 

Sealed Secrets is now available as a Helm chart in VMware Application Catalog! VMware Application Catalog is a customizable selection of trusted, pre-packaged open-source application components that are continuously maintained and verifiably tested for use in enterprise production environments – the ideal option to procure secure application building blocks.  

Depending on your requirements, you can either navigate to the ongoing Open-Source project located in the Bitnami GitHub repository and download the tool and test it out, or if your organization requires a more stable, secure, and compliant image, you can deploy Sealed Secrets on your cluster through VMware Application Catalog.  

Deploy Sealed Secrets on Kubernetes through VMware Application Catalog

The following steps describe how to navigate to VMware Application Catalog — formerly known as Tanzu Application Catalog — and deploy Sealed Secrets in your cluster. 

Once you have it installed, you will be able to deploy any application — this blog post uses MariaDB as an example, but you can pick another solution existing in your catalog — and encrypt its secrets using a Sealed Secret.   

This post assumes that you already have: 

• Sealed Secrets and MariaDB added to your VMware Application Catalog 
• Kubeseal was previously installed on your computer. 

Navigate to app-catalog.vmware.com and sign in with your VMware account to your catalog. 

In the “My Applications” section, search for Sealed Secrets Helm chart and click “Details”. 

On the next screen, you will find the instructions for deploying the chart on your cluster. Make sure that your cluster is up and running by executing kubectl cluster-info. Then, run the commands you will find under the “Consume your Helm Chart” section.  

Once you have installed the Sealed Secrets chart, it is time to use it to encrypt the required secrets to manage the MariaDB credentials. Fortunately, the MariaDB Helm chart supports retrieving the credentials from an existing secret. 

To use that feature, you must make sure that you know which is the expected format for the MariaDB secret. You can obtain that information by checking in the MariaDB chart’s README file the “common parameters” section as shown below: 

Based on this information, you can use kubeseal to create a Sealed Secret with encrypted credentials for MariaDB by executing the command below: 

kubectl create secret generic mariadb-secret --dry-run=client \ 

  --from-literal=mariadb-root-password=ROOT_PASSWORD \ 

  --from-literal=mariadb-replication-password=REPLICATION_PASSWORD \ 

  --from-literal=mariadb-password=SOME_PASSWORD \ 

  -o yaml | kubeseal --controller-name=CONTROLLER_NAME \ 

  --controller-name=CONTROLLER_NAMESPACE \ 

  --format yaml > mariadb-sealedsecret.yaml 

Note: Remember to replace the ROOT_PASSWORD, REPLICATION_PASSWORD, and SOME_PASSWORD placeholders with the passwords you want to use to configure MariaDB. Also, replace the CONTROLLER_NAME and CONTROLLER_NAMESPACE with the name and namespace of your Sealed Secrets controller, respectively. This information is displayed in the NOTES when installing the Sealed Secret chart. 

The command above creates a new yaml file named mariadb-sealedsecret.yaml which contains the encrypted MariaDB credentials. That file should look like it is shown below: 

At this point, you can safely add this file to your Git repository. Once you have a Sealed Secret manifest, you can deploy it in your Kubernetes cluster running the command below: 

kubectl create -f mariadb-sealedsecret.yaml 

Use the following command to double-check that the Sealed Secret — and the associated secret — was successfully created: 

kubectl get sealedsecret mariadb-secret 

kubectl get secret mariadb-secret  

Now, you can deploy the MariaDB Helm chart retrieving the credentials from the existing “mariadb-secret” secret.  

To do so, back to the VMware Application Catalog and search for the MariaDB details page. Then, execute the command you will find in the “Consume your Helm Chart” by appending the following flag: 

--set auth.existingSecret=mariadb-secret 

Once the chart is installed, you can start to operate your MariaDB database as described in its installation notes. 

The last step is to obtain the chart installation values and save them in a file using the command below: 

helm get values MARIADB_RELEASE > mariadb-values.yaml 

Note: Remember to replace the MARIADB_RELEASE placeholder with the name you used for your MariaDB release. 

You can now add this mariadb-values.yaml to your Git repository.  

By committing both this and the mariadb-sealedsecret.yaml file in your repository you can record the status of your infrastructure in a reproducible manner – allowing you to again embrace the GitOps mindset.  Thanks to Sealed Secrets, now you can also publish your changes in any public repository without exposing your database credentials. 

Deploy Applications with Confidence and Control 

As shown in this blog post, the combination of Sealed Secrets and VMware Application Catalog allows you to deploy applications in your cluster with complete confidence. Apart from keeping your applications automatically updated and monitored thanks to VMware Application Catalog, now you can rely on the efficiency of Sealed Secrets for keeping your deployments locked and safe against misuse.  

Learn more about VMware Application Catalog by checking its product page on vmware.com. You can also check out technical documentation for VMware Application catalog here. You can also contact the VMware Application Catalog team directly at vac@vmware.com.

If you are interested in contributing to the Sealed Secrets Open Source project, check out the GitHub repository and do not hesitate to send us a pull request. The BItnami engineering team will check it and guide you in the process for a successful merge.     

Supporting Enterprise Architectures with Azure Database Services

Authored by Michael Murphy, Product Marketing Manager

Bitnami supports Microsoft enterprise customers in multi-tier environments in numerous ways, and actively works with the Azure Database Services team to provide enterprise solutions and promote best practices across our portfolio of products and projects. In light of the recent announcement regarding the availability of two new Bitnami packaged solutions pre-configured with Azure Database for MariaDB, I wanted to write this accompanying blog post to provide a bit more detail. Not only about the new offerings, but also about how Bitnami supports Azure Database Services across our product and project portfolio. Here’s how we make it easy for you to add Azure Database Services to your applications and projects.

Open source applications in the Azure Marketplace

As a long time Microsoft partner, Bitnami provides a wide range of pre-packaged, easy to deploy open-source applications and development stacks to the Azure Marketplace. ‘Bitnami Certified’ has become synonymous with ‘trusted, secure, and easy to deploy’. Many of these are multi-tier solutions.

What we just announced extends this support for enterprise architectures. We worked with the Azure Database Services team to further simplify the deployment of two of the most popular and widely deployed applications, WordPress and Drupal. While both of these applications have long been packaged and available from Bitnami in the Azure Marketplace, these new packages offer the applications pre-configured as a multi-tier solution that include Azure Database for MariaDB support.

These packages take the complexity out of configuring what would typically be a sophisticated configuration setup. Deploying one of these applications is now as easy as scrolling through the Azure Marketplace, selecting the offering, and clicking ‘launch’.

Launching one of these application packages lets you leverage the stability and security of Bitnami’s production grade application package while harnessing the power of a fully managed Azure Database, allowing you to scale quickly and reach global distribution without worrying about costly downtime.

Your applications with Stacksmith on Azure and AKS

Stacksmith, from Bitnami, is a product for packaging your own multi-tier applications. Stacksmith lets you enforce best practices during packaging, including your configuration requirements for the use of Azure Database Services, including CosmosDB and Azure Database for MariaDB.

Stacksmith provides reference architectures for Java Tomcat, .NET Core and other Linux applications that include Azure Database Service configuration with an ARM Template out-of-the-box. These architectures are customizable to your requirements, or you can define your own best practices and deployment policies. Stacksmith then codifies them into the packaging process, ensuring that your best practices for using Azure Database Services, including their settings for geo-redundancy, retention policies, tagging and networking configuration are included. Once defined, Stacksmith can apply and maintain these policies and best practices over time across your application portfolio, applying them every time the application is packaged or updated.

Doing so simplifies the process via automation, and enables you to implement and enforce database best practices for your applications. And since Stacksmith includes multi-format support, you can utilize a single packaging process to create artifacts and their database configurations for deployment to Azure and / or AKS / Kubernetes.

Check out the video below for a quick demo: 

Containers / Kubernetes applications on AKS

There are numerous ways Bitnami helps enterprise customers connect database services on AKS. As I mentioned above - Stacksmith can be used to package your applications for multi-tier deployments to your Kubernetes clusters.

You can also use Kubeapps with Open Service Broker for Azure and Stacksmith, in the following way. Kubeapps is an open source project with a web-based graphical user interface that helps you to discover Kubernetes applications and deploy them to your Kubernetes cluster on AKS. Microsoft has partnered with Bitnami to integrate Kubeapps with Open Service Broker for Azure, to allow you to create and present Helm charts that leverage Azure-native PaaS services as part of the architecture. For example, you can deploy your application tier on AKS and an Azure Database Services backend, getting the best of both worlds - a highly scalable application with a highly available database. To maintain your application with this database configuration to ensure it stays up to date and secure over time, you can use Stacksmith. You can read more about Open Service Broker for Azure here.

As you can see, we have been busy supporting our enterprise customers and continue to expand the scope of this support to make it ever easier to set-up and deploy complex environments that leverage first party Azure services.

To learn more, register for the “Create an Application-Centric DevOps Experience with Stacksmith and Azure OSS Database Services” webinar with Andrea Lam, Product Manager of Azure Database for MySQL/MariaDB at Microsoft, on January 29th at 9:00 am PST.

MySQL / MariaDB: Privilege Escalation / Race Condition / Root Privilege Escalation (CVE-2016-6663 and CVE-2016-6664)

Several new security vulnerabilities that affect some versions of MySQL and MariaDB were announced recently:

We want to let you know that all the published Bitnami Stacks that include MySQL or MariaDB as the database server are not affected, since they are using non-affected versions of the component.

CVE-2016-6663

The vulnerability can allow a local system user with access to the affected database in the context of a low-privileged account (CREATE/INSERT/SELECT grants) to escalate their privileges and execute arbitrary code as the database system user.

Successful exploitation would allow an attacker to gain access to all of the databases stored on the affected database server.

Affected versions:

MariaDB 

< 5.5.52

< 10.1.18

        < 10.0.28

MySQL  

<= 5.5.51

<= 5.6.32

<= 5.7.14

More information about this issue can be found at the following link: https://legalhackers.com/advisories/MySQL-Maria-Percona-PrivEscRace-CVE-2016-6663-5616-Exploit.html

CVE-2016-6664

MySQL-based databases including MySQL, MariaDB and Percona are affected by a privilege escalation vulnerability which can let attackers who have gained access to mysql system user to further escalate their privileges to root user allowing them to fully compromise the system.

The vulnerability stems from unsafe file handling of error logs and other files.

Affected versions:

MySQL  

<= 5.5.51

<= 5.6.32

<= 5.7.14

MariaDB

All current

More information about this issue can be found at the following link: https://legalhackers.com/advisories/MySQL-Maria-Percona-RootPrivEsc-CVE-2016-6664-5617-Exploit.html

Are you using an affected version of the server or do you have questions about the security issue? Please post to our community forum and we will be happy to help you.

MONyog Now Available on Bitnami

We’re pleased to welcome MONyog into the Bitnami Library! If you’re a MySQL database administrator looking for an enterprise-grade data monitoring tool that not only offers support for unlimited servers but also top-of-the-line security, test out our newest Application Server app.

MONyog also offers an array of features that ensure you’re getting the most out of your MySQL and MariaDB deployments. From real-time query monitoring analysis to advanced server metrics that alert you to resource shortages, MONyog helps you to tighten security, optimize performance and reduce downtime.

Key features included:

• Real-time query monitoring and log analysis
• Replication and deadlock monitoring
• Proactive alerts via email and SNMP
• Historical/trend analysis of performance data
• Agentless installation
• Supports MySQL servers running on any platform
• Multi-user support with per-server access rules and LDAP integration
• HTTP API for integration with third-party applications

Interested in MONyog? Deploy a one-hour free demo of the Bitnami MONyog Stack! We make it easy to run MONyog in the cloud, virtually, or locally in minutes. Try it out now!

MONyog MySQL Monitor is a product of database management software company Webyog. To learn more about MONyog, please visit the MONyog website and knowledge base.

Bitnami Container Images for Docker - Now in Beta

We’re very happy to announce availability of the first set of Bitnami container images focused on the needs of application developers. We’ve been using containers internally for close to a year and have found them useful, both for local and cloud-based development and testing.

Bitnami container images can help you:

• Reduce the time it takes to setup a developer on a new project
• Reduce friction when sharing environments - experience less “but it worked on my machine?” 
• Mix and match languages for specific projects - with consistency, regardless of the components you select

As with any rapidly evolving technology, we’ve run into a few bumps along the way, but believe that containers offer an interesting way to collaborate on your next software project and that they are complementary to our existing installers, virtual machines, and cloud images.

We’re starting small and initially focused on the needs of Web developers. Today we’re announcing beta Bitnami container images for nginx, php-fpm, mariadb, memcached, node, redis, apache, and ruby.

Our container images have been built around some key ideas we wanted, but found lacking, in other publicly available container images. Bitnami containers for Docker:

• Share a common base OS (initially Ubuntu 14.04) to minimize time-to-get-started
• Are kept up-to-date with consistent version tagging
• Are easy to combine into a multi-tier application because they are consistently documented and take a standardized approach to configuration, bootstrapping, and logging
• Separate data from code to enable upgrading of individual components
• Include run-time notification of new versions

Bitnami container images are available now on the Docker Hub Registry and on GitHub. A walk-through of  how to use these container images to package a real-world application is also available.

We’re very interested in feedback from you on how these container images could be improved. Please open issues with ideas for enhancements or use cases on GitHub. We welcome contributions to the code, so please open a pull request if you have code to share.

Click here to get Bitnami container images for Docker.