diff --git a/README.md b/README.md index 0f562a7..e8e0138 100644 --- a/README.md +++ b/README.md @@ -50,4 +50,3 @@ To ssh into the lab instances, type the following commands. The associated IP ad [6.Use Calico Observability to troubleshoot connectivity issues](https://github.com/tigera-cs/Calico-Security-Observability-Troubleshooting-Training/blob/main/modules/6.Use%20Calico%20Observability%20to%20troubleshoot%20connectivity%20issues/README.md) -[7. Configure Calico Compliance Reporting](https://github.com/tigera-cs/Calico-Security-Observability-Troubleshooting-Training/blob/main/modules/7.%20Configure%20Calico%20Compliance%20Reporting/README.md) diff --git a/modules/6.Use Calico Observability to troubleshoot connectivity issues/README.md b/modules/6.Use Calico Observability to troubleshoot connectivity issues/README.md index 5743800..1fd68b5 100644 --- a/modules/6.Use Calico Observability to troubleshoot connectivity issues/README.md +++ b/modules/6.Use Calico Observability to troubleshoot connectivity issues/README.md @@ -915,4 +915,4 @@ kubectl -n tigera-elasticsearch get secret tigera-secure-es-elastic-user -o go-t 12. After changing the Ingress rule to ***TCP*** in the “cartservice” Security Policy, we are now able to continue with the purcahse. -> ## You have completed `6.Use Calico Observability to troubleshoot connectivity issues` lab. Next lab: [7. Configure Calico Compliance Reporting](https://github.com/tigera-cs/Calico-Security-Observability-Troubleshooting-Training/blob/main/modules/7.%20Configure%20Calico%20Compliance%20Reporting/README.md) +> ## You have completed `6.Use Calico Observability to troubleshoot connectivity issues` lab and the workshop. Well done! diff --git a/modules/7. Configure Calico Compliance Reporting/README.md b/modules/7. Configure Calico Compliance Reporting/README.md deleted file mode 100644 index 156562a..0000000 --- a/modules/7. Configure Calico Compliance Reporting/README.md +++ /dev/null @@ -1,120 +0,0 @@ -# In this lab - -This lab provides the instructions to: - -* [Overview](https://github.com/tigera-cs/Calico-Security-Observability-Troubleshooting-Training/blob/main/modules/7.%20Configure%20Calico%20Compliance%20Reporting/README.md#overview) -* [Configure Compliance Reporting](https://github.com/tigera-cs/Calico-Security-Observability-Troubleshooting-Training/blob/main/modules/7.%20Configure%20Calico%20Compliance%20Reporting/README.md#configure-compliance-reporting) - - - -### Overview - -Kubernetes compliance reporting involves evaluating and documenting how well a Kubernetes cluster adheres to specific compliance standards or regulations. It includes identifying applicable standards, defining policies, assessing cluster configuration, auditing security controls, generating compliance reports, remediating non-compliance, and establishing ongoing monitoring. Compliance reporting ensures that containerized applications are deployed securely and in accordance with industry regulations, reducing the risk of breaches and regulatory violations. Calico compliannce reporting helps us create a number of reports to satisfy the various PCI DSS and SOC 2 reporting requirements. These reports can be customized to report against a certain set of endpoints (for example PCI endpoints). Calico supports the following built-in report types: - -- Inventory -- Network Access -- Policy-Audit -- CIS Benchmark - - - - -#### Documentation - -- https://docs.tigera.io/calico-enterprise/latest/compliance/overview -- https://docs.tigera.io/calico-enterprise/latest/compliance/compliance-reports-cis - - -____________________________________________________________________________________________________________________________________________________________________________________ - - -### Configure Compliance Reporting - -Compliance reports provide the following high-level information: - -- **Protection** - - - Endpoints explicitly protected using ingress or egress policy - - Endpoints with Envoy enabled - -- **Policies and services** - - - Policies and services associated with endpoints - - Policy audit logs - -- **Traffic** - - - Allowed ingress/egress traffic to/from namespaces - - Allowed ingress/egress traffic to/from the internet - - -#### CIS Benchmark Reports - -*CIS Benchmarks are best practices for the secure configuration of a target system.* - [Center for Internet Security](https://www.cisecurity.org/cis-benchmarks/cis-benchmarks-faq) - -Being able to assess your Kubernetes clusters against CIS benchmarks is a standard requirement for a lot of organization’s security and compliance posture. Calico CIS benchmark compliance reports provide this view into your Kubernetes clusters. - -## Example Reports - -### Hourly CIS Benchmark - -

- CIS Benchmark Example -

- - - -```yaml -kubectl apply -f - << EOF -apiVersion: projectcalico.org/v3 -kind: GlobalReport -metadata: - name: hourly-cis-benchmark-report -spec: - reportType: cis-benchmark - schedule: 0 * * * * -EOF -``` - - -### Hourly Report - Full Infrastructure Inventory - -The following report schedules weekly inventory reports for all endpoints. The jobs that create the reports will run on the infrastructure nodes - -

- Full Inventory Example -

- - -```yaml -kubectl apply -f -< - Tenant Network-Access Example -

- - -```yaml -kubectl apply -f - << EOF -apiVersion: projectcalico.org/v3 -kind: GlobalReport -metadata: - name: hourly-network-access-report -spec: - reportType: network-access - schedule: 0 * * * * -EOF -``` diff --git a/modules/7. Configure Calico Compliance Reporting/images/cis-benchmark.png b/modules/7. Configure Calico Compliance Reporting/images/cis-benchmark.png deleted file mode 100644 index 938f7cc..0000000 Binary files a/modules/7. Configure Calico Compliance Reporting/images/cis-benchmark.png and /dev/null differ diff --git a/modules/7. Configure Calico Compliance Reporting/images/flow-logs-kibana.png b/modules/7. Configure Calico Compliance Reporting/images/flow-logs-kibana.png deleted file mode 100644 index f9ff3ce..0000000 Binary files a/modules/7. Configure Calico Compliance Reporting/images/flow-logs-kibana.png and /dev/null differ diff --git a/modules/7. Configure Calico Compliance Reporting/images/flow-visualizer.png b/modules/7. Configure Calico Compliance Reporting/images/flow-visualizer.png deleted file mode 100644 index 62d5558..0000000 Binary files a/modules/7. Configure Calico Compliance Reporting/images/flow-visualizer.png and /dev/null differ diff --git a/modules/7. Configure Calico Compliance Reporting/images/hourly-inventory.png b/modules/7. Configure Calico Compliance Reporting/images/hourly-inventory.png deleted file mode 100644 index 8761823..0000000 Binary files a/modules/7. Configure Calico Compliance Reporting/images/hourly-inventory.png and /dev/null differ diff --git a/modules/7. Configure Calico Compliance Reporting/images/pci-ingress-networkaccess.png b/modules/7. Configure Calico Compliance Reporting/images/pci-ingress-networkaccess.png deleted file mode 100644 index 174a71f..0000000 Binary files a/modules/7. Configure Calico Compliance Reporting/images/pci-ingress-networkaccess.png and /dev/null differ diff --git a/modules/7. Configure Calico Compliance Reporting/images/pci-inventory.png b/modules/7. Configure Calico Compliance Reporting/images/pci-inventory.png deleted file mode 100644 index 57b9ee7..0000000 Binary files a/modules/7. Configure Calico Compliance Reporting/images/pci-inventory.png and /dev/null differ diff --git a/modules/7. Configure Calico Compliance Reporting/images/pci-network-access.png b/modules/7. Configure Calico Compliance Reporting/images/pci-network-access.png deleted file mode 100644 index 43b860d..0000000 Binary files a/modules/7. Configure Calico Compliance Reporting/images/pci-network-access.png and /dev/null differ diff --git a/modules/7. Configure Calico Compliance Reporting/images/service-graph.png b/modules/7. Configure Calico Compliance Reporting/images/service-graph.png deleted file mode 100644 index 4bfa06d..0000000 Binary files a/modules/7. Configure Calico Compliance Reporting/images/service-graph.png and /dev/null differ diff --git a/modules/7. Configure Calico Compliance Reporting/images/tenant-networkaccess.png b/modules/7. Configure Calico Compliance Reporting/images/tenant-networkaccess.png deleted file mode 100644 index 2ca0dc0..0000000 Binary files a/modules/7. Configure Calico Compliance Reporting/images/tenant-networkaccess.png and /dev/null differ diff --git a/modules/7. Configure Calico Compliance Reporting/images/weekly-infrastructure-inventory.png b/modules/7. Configure Calico Compliance Reporting/images/weekly-infrastructure-inventory.png deleted file mode 100644 index 7f0ccef..0000000 Binary files a/modules/7. Configure Calico Compliance Reporting/images/weekly-infrastructure-inventory.png and /dev/null differ